# definitions

definition_id: oval:org.debian:def:83882779625554994041449637320220384137
title: CVE-2022-24836 ruby-nokogiri
description:
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.


definition_id: oval:org.debian:def:150236797805792553635495507788628439886
title: CVE-2022-24999 node-qs
description:
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).


definition_id: oval:org.debian:def:173666628953504075363655888545972461741
title: CVE-2022-2503 linux
description:
Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5


definition_id: oval:org.debian:def:290223158014202902240218607410069832342
title: CVE-2022-2509 gnutls28
description:
A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function.


definition_id: oval:org.debian:def:165485987924395684570719608744619281952
title: CVE-2022-2526 systemd
description:
A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later.


definition_id: oval:org.debian:def:89790291141777450337467233756236754872
title: CVE-2022-25308 fribidi
description:
A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory leak or a denial of service.


definition_id: oval:org.debian:def:233690940215013509628024337072892005320
title: CVE-2022-25309 fribidi
description:
A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and causing a denial of service.


definition_id: oval:org.debian:def:311292846833380387331940265959673751372
title: CVE-2022-25310 fribidi
description:
A segmentation fault (SEGV) flaw was found in the Fribidi package and affects the fribidi_remove_bidi_marks() function of the lib/fribidi.c file. This flaw allows an attacker to pass a specially crafted file to Fribidi, leading to a crash and causing a denial of service.


definition_id: oval:org.debian:def:201285009282100844158114956075679364648
title: CVE-2022-25647 libgoogle-gson-java
description:
The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.


definition_id: oval:org.debian:def:259919902177046491774675860836561329367
title: CVE-2022-25648 ruby-git
description:
The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.


definition_id: oval:org.debian:def:277619267803377757301053504135718394883
title: CVE-2022-25762 tomcat9
description:
If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.


definition_id: oval:org.debian:def:245822847752463668056239755276712382816
title: CVE-2022-25763 trafficserver
description:
Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.


definition_id: oval:org.debian:def:258412922600331049512970499091508594118
title: CVE-2022-25857 snakeyaml
description:
The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.


definition_id: oval:org.debian:def:186901435540367043927228063686908120152
title: CVE-2022-2601 grub2
description:
A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.


definition_id: oval:org.debian:def:217906594938823350672404653334648501054
title: CVE-2022-2625 postgresql-11
description:
A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.


definition_id: oval:org.debian:def:264481056847695068357634022945445800515
title: CVE-2022-26354 qemu
description:
A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results.


definition_id: oval:org.debian:def:222747306360904687606345001583846998393
title: CVE-2022-26365 linux
description:
Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).


definition_id: oval:org.debian:def:121896417931906868476095690787289043855
title: CVE-2022-26373 linux
description:
Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.


definition_id: oval:org.debian:def:295311001750199061767190611939894434419
title: CVE-2022-26377 apache2
description:
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.


definition_id: oval:org.debian:def:224320602570403070807645311187974499492
title: CVE-2022-2639 linux
description:
An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system.


definition_id: oval:org.debian:def:306557257141188997779579458270239070825
title: CVE-2022-26498 asterisk
description:
An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2.


definition_id: oval:org.debian:def:209523590898724554387737145533834958381
title: CVE-2022-26499 asterisk
description:
An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.


definition_id: oval:org.debian:def:89190250053305190049193486822347909477
title: CVE-2022-26505 minidlna
description:
A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to exfiltrate media files.


definition_id: oval:org.debian:def:96845238662332922017492522285593794144
title: CVE-2022-2663 linux
description:
An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured.


definition_id: oval:org.debian:def:184537582737777547462932487866249304770
title: CVE-2022-26651 asterisk
description:
An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. This is fixed in 16.25.2, 18.11.2, and 19.3.2, and 16.8-cert14.


definition_id: oval:org.debian:def:84098400401709172823700398170788191536
title: CVE-2022-26846 spip
description:
SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code.


definition_id: oval:org.debian:def:297917194219436113772203378834139791812
title: CVE-2022-26847 spip
description:
SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects.


definition_id: oval:org.debian:def:10719908929182627755335828432005113491
title: CVE-2022-26874 php-horde-mime-viewer
description:
lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail Edition. This occurs after XSLT rendering.


definition_id: oval:org.debian:def:112397538655253418733295283019579991457
title: CVE-2022-26966 linux
description:
An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device.


definition_id: oval:org.debian:def:37989216663163569823465882822361221598
title: CVE-2022-27114 htmldoc
description:
There is a vulnerability in htmldoc 1.9.16. In image_load_jpeg function image.cxx when it calls malloc,'img->width' and 'img->height' they are large enough to cause an integer overflow. So, the malloc function may return a heap blosmaller than the expected size, and it will cause a buffer overflow/Address boundary error in the jpeg_read_scanlines function.


definition_id: oval:org.debian:def:118966484994239341095682115714212330065
title: CVE-2022-27223 linux
description:
In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by the host for out-of-array access.


definition_id: oval:org.debian:def:197721344082098124579263251810403144220
title: CVE-2022-27337 poppler
description:
A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.


definition_id: oval:org.debian:def:73547345398380930497513122215699821509
title: CVE-2022-27376 mariadb-10.3
description:
MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL statements.


definition_id: oval:org.debian:def:232247754559386763426020006976404279497
title: CVE-2022-27377 mariadb-10.3
description:
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted SQL statements.


definition_id: oval:org.debian:def:60267641438587087655821224877015111581
title: CVE-2022-27378 mariadb-10.3
description:
An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.


definition_id: oval:org.debian:def:329039665708259726810620616718198087595
title: CVE-2022-27379 mariadb-10.3
description:
An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.


definition_id: oval:org.debian:def:286867561525020291427736668183378209354
title: CVE-2022-27380 mariadb-10.3
description:
An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.


definition_id: oval:org.debian:def:134401565565457935980930859911999810661
title: CVE-2022-27381 mariadb-10.3
description:
An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.


definition_id: oval:org.debian:def:232394489782421718937242859318299232989
title: CVE-2022-27383 mariadb-10.3
description:
MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL statements.


definition_id: oval:org.debian:def:318251237750968086880220386399631419699
title: CVE-2022-27384 mariadb-10.3
description:
An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.


definition_id: oval:org.debian:def:307278827891158030319753424331064644030
title: CVE-2022-27386 mariadb-10.3
description:
MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc.


definition_id: oval:org.debian:def:212030422450702404280772160347059599278
title: CVE-2022-27387 mariadb-10.3
description:
MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements.


definition_id: oval:org.debian:def:243697434249414343467215591083937237411
title: CVE-2022-27404 freetype
description:
FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face.


definition_id: oval:org.debian:def:279350390902249074418256081457069725783
title: CVE-2022-27405 freetype
description:
FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.


definition_id: oval:org.debian:def:337661166256923413941510306071492402873
title: CVE-2022-27406 freetype
description:
FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size.


definition_id: oval:org.debian:def:279713912809828997077264075533494209437
title: CVE-2022-27445 mariadb-10.3
description:
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc.


definition_id: oval:org.debian:def:234879928803480225615211151776767830097
title: CVE-2022-27447 mariadb-10.3
description:
MariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary_string::free_buffer() at /sql/sql_string.h.


definition_id: oval:org.debian:def:31349211908211173321715623087570207005
title: CVE-2022-27448 mariadb-10.3
description:
There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc.


definition_id: oval:org.debian:def:335561212851530382751061886946631558180
title: CVE-2022-27449 mariadb-10.3
description:
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148.


definition_id: oval:org.debian:def:99152729792281304130101228173745405132
title: CVE-2022-27452 mariadb-10.3
description:
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc.


definition_id: oval:org.debian:def:109731614281623662844471751988960766024
title: CVE-2022-27456 mariadb-10.3
description:
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc.


definition_id: oval:org.debian:def:133136438052407156912226237955680501428
title: CVE-2022-27458 mariadb-10.3
description:
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Binary_string::free_buffer() at /sql/sql_string.h.


definition_id: oval:org.debian:def:91124532873527644098236606659730796648
title: CVE-2022-27774 curl
description:
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.


definition_id: oval:org.debian:def:119120802702026300376400115631989045986
title: CVE-2022-27776 curl
description:
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.


definition_id: oval:org.debian:def:22799723017009132873770144982228220624
title: CVE-2022-27777 rails
description:
A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.


definition_id: oval:org.debian:def:80509595158270020165428078937909363473
title: CVE-2022-27781 curl
description:
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.


definition_id: oval:org.debian:def:66412494252990775342911827309863462050
title: CVE-2022-27782 curl
description:
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.


definition_id: oval:org.debian:def:8146790338093549729122842523956362103
title: CVE-2022-2787 schroot
description:
Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.


definition_id: oval:org.debian:def:110750645573024734753111166008001710925
title: CVE-2022-2795 bind9
description:
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.


definition_id: oval:org.debian:def:218953775036289345882259826024329740672
title: CVE-2022-28041 libstb
description:
stb_image.h v2.27 was discovered to contain an integer overflow via the function stbi__jpeg_decode_block_prog_dc. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.


definition_id: oval:org.debian:def:250223265349762023704324497262020265128
title: CVE-2022-28042 libstb
description:
stb_image.h v2.27 was discovered to contain an heap-based use-after-free via the function stbi__jpeg_huff_decode.


definition_id: oval:org.debian:def:68094674731402650075676963270257027033
title: CVE-2022-28085 htmldoc
description:
A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function pdf_write_names in ps-pdf.cxx may lead to arbitrary code execution and Denial of Service (DoS).


definition_id: oval:org.debian:def:128767966092450863876604770742133844505
title: CVE-2022-28129 trafficserver
description:
Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.


definition_id: oval:org.debian:def:220609508157629214726591467233527574626
title: CVE-2022-28181 nvidia-graphics-drivers-legacy-390xx
description:
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user on the network can cause an out-of-bounds write through a specially crafted shader, which may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. The scope of the impact may extend to other components.


definition_id: oval:org.debian:def:226521282562537047946020810285304042166
title: CVE-2022-28185 nvidia-graphics-drivers-legacy-390xx
description:
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the ECC layer, where an unprivileged regular user can cause an out-of-bounds write, which may lead to denial of service and data tampering.


definition_id: oval:org.debian:def:108638943544204875317788307690290492947
title: CVE-2022-28201 mediawiki
description:
An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinite recursion, because a bare local interwiki is mishandled for the mainpage message.


definition_id: oval:org.debian:def:212368473675113459272471137271540343207
title: CVE-2022-28202 mediawiki
description:
An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.


definition_id: oval:org.debian:def:174044400148409290311706605820899159234
title: CVE-2022-28203 mediawiki
description:
A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special:NewFiles with actor as a condition can result in a very long running query.


definition_id: oval:org.debian:def:27683596839807361202759161297888081388
title: CVE-2022-28346 python-django
description:
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.


definition_id: oval:org.debian:def:209339080188951706642909576199651395082
title: CVE-2022-28614 apache2
description:
The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.


definition_id: oval:org.debian:def:263097563219464076124539630559709302562
title: CVE-2022-28615 apache2
description:
Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected.


definition_id: oval:org.debian:def:52212373286104208315942248382490840919
title: CVE-2022-2867 tiff
description:
libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with certain parameters) could cause a crash or in some cases, further exploitation.


definition_id: oval:org.debian:def:5560509961616319559003873655788147996
title: CVE-2022-2868 tiff
description:
libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop.


definition_id: oval:org.debian:def:26433779218402832960416638060462653534
title: CVE-2022-2869 tiff
description:
libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw could cause a crash or potentially further exploitation.


definition_id: oval:org.debian:def:300173420333679740245587390617948109046
title: CVE-2022-28959 spip
description:
Multiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below allows attackers to execute arbitrary web scripts or HTML.


definition_id: oval:org.debian:def:225902173680955055567548803044047339281
title: CVE-2022-28960 spip
description:
A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire.


definition_id: oval:org.debian:def:134006810672604326663027716242760637015
title: CVE-2022-28961 spip
description:
Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier_trad and where parameters.


definition_id: oval:org.debian:def:221785077834438035479784202698574758848
title: CVE-2022-2905 linux-5.10
description:
An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data.


definition_id: oval:org.debian:def:323424050051959961066366217937761454961
title: CVE-2022-29078 node-ejs
description:
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).


definition_id: oval:org.debian:def:78352563318787363062869779924160724899
title: CVE-2022-29167 node-hawk
description:
Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.


definition_id: oval:org.debian:def:116467593855582417283121888837113293151
title: CVE-2022-29187 git
description:
Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. The simplest way to avoid being affected by the exploit described in the example is to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a minimum. While a generic workaround is not possible, a system could be hardened from the exploit described in the example by removing any such repository if it exists already and creating one as root to block any future attacks.


definition_id: oval:org.debian:def:102598145090435990658009063617817496241
title: CVE-2022-2928 isc-dhcp
description:
In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dereference() to decrement the refcount field. The function add_option() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort.


definition_id: oval:org.debian:def:331160359073915790285071977339378876303
title: CVE-2022-2929 isc-dhcp
description:
In ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels longer than 63 bytes, could eventually cause the server to run out of memory.


definition_id: oval:org.debian:def:166201251460645888018057585256531836671
title: CVE-2022-29404 apache2
description:
In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.


definition_id: oval:org.debian:def:78628808747138006367127211035148420737
title: CVE-2022-29458 ncurses
description:
ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.


definition_id: oval:org.debian:def:218664346172661394201815208320158349720
title: CVE-2022-29536 epiphany-browser
description:
In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title. The issue occurs because the number of bytes for a UTF-8 ellipsis character is not properly considered.


definition_id: oval:org.debian:def:156892977282185588307529437004679298176
title: CVE-2022-29599 maven-shared-utils
description:
In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.


definition_id: oval:org.debian:def:2730389651046481754839697064669235442
title: CVE-2022-2964 linux
description:
A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.


definition_id: oval:org.debian:def:100202728159464544749616883709435906830
title: CVE-2022-2977 linux
description:
A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-free and create a situation where it may be possible to escalate privileges on the system.


definition_id: oval:org.debian:def:241774982629816207130856745747080662830
title: CVE-2022-2978 linux
description:
A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.


definition_id: oval:org.debian:def:315901909472597588202379073509027624273
title: CVE-2022-29885 tomcat9
description:
The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.


definition_id: oval:org.debian:def:62173907628185610068584681867011619963
title: CVE-2022-29900 linux-5.10
description:
Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.


definition_id: oval:org.debian:def:315661856814457406568850172807179894870
title: CVE-2022-29901 linux
description:
Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.


definition_id: oval:org.debian:def:223059058093976759586561133808117828194
title: CVE-2022-2991 linux
description:
A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged code on the target system to exploit this vulnerability.


definition_id: oval:org.debian:def:156236256397232394154385924972271054490
title: CVE-2022-2996 python-scciclient
description:
A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle (MITM) attacks.


definition_id: oval:org.debian:def:186507196087588933990070559243553132155
title: CVE-2022-29970 ruby-sinatra
description:
Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.


definition_id: oval:org.debian:def:215323067251252370042926381890369849907
title: CVE-2022-30122 ruby-rack
description:
A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.


definition_id: oval:org.debian:def:170306755760023175775623473772063571169
title: CVE-2022-30123 ruby-rack
description:
A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.


definition_id: oval:org.debian:def:148780131702815206077432231935755283941
title: CVE-2022-3028 linux
description:
A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.


definition_id: oval:org.debian:def:233885004503494925378075470724978792483
title: CVE-2022-30287 php-horde-turba
description:
Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.


definition_id: oval:org.debian:def:337520719614787564890099970422214376714
title: CVE-2022-30333 unrar-nonfree
description:
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.


definition_id: oval:org.debian:def:287507559011323446492999495832485168455
title: CVE-2022-30522 apache2
description:
If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.


definition_id: oval:org.debian:def:325569325443500491170997587990486131036
title: CVE-2022-30550 dovecot
description:
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.


definition_id: oval:org.debian:def:262338266309542870739055815404430749003
title: CVE-2022-30556 apache2
description:
Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.


definition_id: oval:org.debian:def:41253357080443829334738552840008939848
title: CVE-2022-3061 linux-5.10
description:
Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by zero error.


definition_id: oval:org.debian:def:263662998276207993818442988059114936907
title: CVE-2022-3100 barbican
description:
A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.


definition_id: oval:org.debian:def:9776704956176696438647649730479732046
title: CVE-2022-31001 sofia-sip
description:
Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause crash. This type of crash may be caused by `#define MATCH(s, m) (strncmp(s, m, n = sizeof(m) - 1) == 0)`, which will make `n` bigger and trigger out-of-bound access when `IS_NON_WS(s[n])`. Version 1.13.8 contains a patch for this issue.


definition_id: oval:org.debian:def:245927839448734163931297230407041264539
title: CVE-2022-31002 sofia-sip
description:
Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause a crash. This type of crash may be caused by a URL ending with `%`. Version 1.13.8 contains a patch for this issue.


definition_id: oval:org.debian:def:198130644437578424001904613166376962245
title: CVE-2022-31003 sofia-sip
description:
Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = record + 2` will access the memory behind `\0` and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue.


definition_id: oval:org.debian:def:80206405728603200484137448713995770849
title: CVE-2022-3107 linux
description:
An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the null pointer dereference.


definition_id: oval:org.debian:def:159040393212424823722532546228811310755
title: CVE-2022-31081 libhttp-daemon-perl
description:
HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling `my $rqst = $conn->get_request()` one could inspect the returned `HTTP::Request` object. Querying the 'Content-Length' (`my $cl = $rqst->header('Content-Length')`) will show any abnormalities that should be dealt with by a `400` response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is `42` or `42, 42, 42`). Anything else MUST be rejected.


definition_id: oval:org.debian:def:32607416678246426356548918259596300977
title: CVE-2022-3111 linux
description:
An issue was discovered in the Linux kernel through 5.16-rc6. free_charger_irq() in drivers/power/supply/wm8350_power.c lacks free of WM8350_IRQ_CHG_FAST_RDY, which is registered in wm8350_init_charger().


definition_id: oval:org.debian:def:140429857319444602050307796669634451044
title: CVE-2022-31129 node-moment
description:
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.


definition_id: oval:org.debian:def:159190715771642336403018970030652666677
title: CVE-2022-31160 jqueryui
description:
jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`.


definition_id: oval:org.debian:def:35267625796903261422048393349471929859
title: CVE-2022-31163 ruby-tzinfo
description:
TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source, time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with `require` on demand. In the affected versions, `TZInfo::Timezone.get` fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be made to load unintended files with `require`, executing them within the Ruby process. Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers. Versions 2.0.0 and later are not vulnerable. Version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of `tzinfo/definition` within a directory in the load path. Applications should ensure that untrusted files are not placed in a directory on the load path. As a workaround, the time zone identifier can be validated before passing to `TZInfo::Timezone.get` by ensuring it matches the regular expression `\A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z`.


definition_id: oval:org.debian:def:253983664721038595180661917674566413307
title: CVE-2022-31197 libpgjava
description:
PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted. User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL against a table name who's column names would contain the malicious SQL and subsequently invoke the `refreshRow()` method on the ResultSet. Note that the application's JDBC user and the schema owner need not be the same. A JDBC application that executes as a privileged user querying database schemas owned by potentially malicious less-privileged users would be vulnerable. In that situation it may be possible for the malicious user to craft a schema that causes the application to execute commands as the privileged user. Patched versions will be released as `42.2.26` and `42.4.1`. Users are advised to upgrade. There are no known workarounds for this issue.


definition_id: oval:org.debian:def:281482108067065900096648989373664223066
title: CVE-2022-31291 dlt-daemon
description:
An issue in dlt_config_file_parser.c of dlt-daemon v2.18.8 allows attackers to cause a double free via crafted TCP packets.


definition_id: oval:org.debian:def:329563310191082748444784453520335460992
title: CVE-2022-31607 nvidia-graphics-drivers-legacy-390xx
description:
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where a local user with basic capabilities can cause improper input validation, which may lead to denial of service, escalation of privileges, data tampering, and limited information disclosure.


definition_id: oval:org.debian:def:192843316104322128907625722381571849541
title: CVE-2022-31608 nvidia-graphics-drivers-legacy-390xx
description:
NVIDIA GPU Display Driver for Linux contains a vulnerability in an optional D-Bus configuration file, where a local user with basic capabilities can impact protected D-Bus endpoints, which may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.


definition_id: oval:org.debian:def:31417198243633448867911643099444831428
title: CVE-2022-31615 nvidia-graphics-drivers-legacy-390xx
description:
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause a null-pointer dereference, which may lead to denial of service.


definition_id: oval:org.debian:def:309487116239539868957891890719083335376
title: CVE-2022-31621 mariadb-10.3
description:
MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occurs (stream_ctxt->dest_file == NULL) while executing the method xbstream_open, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock.


definition_id: oval:org.debian:def:237615505079312371968386723443273033592
title: CVE-2022-31622 mariadb-10.3
description:
MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (pthread_create returns a nonzero value) while executing the method create_worker_threads, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock.


definition_id: oval:org.debian:def:109738445965673707712447349471865473435
title: CVE-2022-31623 mariadb-10.3
description:
MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (i.e., going to the err label) while executing the method create_worker_threads, the held lock thd->ctrl_mutex is not released correctly, which allows local users to trigger a denial of service due to the deadlock.


definition_id: oval:org.debian:def:211553019829249571057107082051399348213
title: CVE-2022-31624 mariadb-10.3
description:
MariaDB Server before 10.7 is vulnerable to Denial of Service. While executing the plugin/server_audit/server_audit.c method log_statement_ex, the held lock lock_bigbuffer is not released correctly, which allows local users to trigger a denial of service due to the deadlock.


definition_id: oval:org.debian:def:265848562298247078971967840250668800604
title: CVE-2022-31625 php7.3
description:
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.


definition_id: oval:org.debian:def:181905037181767374774732885358488755290
title: CVE-2022-31626 php7.3
description:
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability.


definition_id: oval:org.debian:def:66876120940556774121712448695852343905
title: CVE-2022-31628 php7.3
description:
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.


definition_id: oval:org.debian:def:19795533518405231196600605170157702318
title: CVE-2022-31629 php7.3
description:
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.


definition_id: oval:org.debian:def:248979553419581015164220395245935972009
title: CVE-2022-31676 open-vm-tools
description:
VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine.


definition_id: oval:org.debian:def:277437554694584411764032020529518599912
title: CVE-2022-3169 linux-5.10
description:
A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting in a PCIe link disconnect.


definition_id: oval:org.debian:def:143119984179942544681290532241583786254
title: CVE-2022-3176 linux-5.10
description:
There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659


definition_id: oval:org.debian:def:251218200383992895601696158468025078784
title: CVE-2022-31780 trafficserver
description:
Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.


definition_id: oval:org.debian:def:284948156697087973737178081708101408480
title: CVE-2022-31813 apache2
description:
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.


definition_id: oval:org.debian:def:240073902520227959584113095428118932708
title: CVE-2022-3202 linux
description:
A NULL pointer dereference flaw in diFree in fs/jfs/inode.c in Journaled File System (JFS)in the Linux kernel. This could allow a local attacker to crash the system or leak kernel internal information.


definition_id: oval:org.debian:def:195402742566229217615976344694652132393
title: CVE-2022-32083 mariadb-10.3
description:
MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker.


definition_id: oval:org.debian:def:307836338276047274081239579552734733454
title: CVE-2022-32085 mariadb-10.3
description:
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor.


definition_id: oval:org.debian:def:287979640803205579973680546182816578470
title: CVE-2022-32087 mariadb-10.3
description:
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args.


definition_id: oval:org.debian:def:139845255527980361706810938923980594062
title: CVE-2022-32088 mariadb-10.3
description:
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort.


definition_id: oval:org.debian:def:315869154854308320474004091358231054029
title: CVE-2022-32091 mariadb-10.3
description:
MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc.


definition_id: oval:org.debian:def:294844824397246561177192401313550660956
title: CVE-2022-32166 openvswitch
description:
In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an unmapped region of memory. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.


definition_id: oval:org.debian:def:45053661512576139066752592257805672679
title: CVE-2022-32206 curl
description:
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.


definition_id: oval:org.debian:def:110696805572332135393501358917586110877
title: CVE-2022-32208 curl
description:
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.


definition_id: oval:org.debian:def:258251065074761558230521690513226899227
title: CVE-2022-32209 ruby-rails-html-sanitizer
description:
# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both `select` and `style` elements.Code is only impacted if allowed tags are being overridden. This may be done via application configuration:```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = ["select", "style"]```see https://guides.rubyonrails.org/configuring.html#configuring-action-viewOr it may be done with a `:tags` option to the Action View helper `sanitize`:```<%= sanitize @comment.body, tags: ["select", "style"] %>```see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeOr it may be done with Rails::Html::SafeListSanitizer directly:```ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]```or```ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["select", "style"])```All users overriding the allowed tags by any of the above mechanisms to include both "select" and "style" should either upgrade or use one of the workarounds immediately.## ReleasesThe FIXED releases are available at the normal locations.## WorkaroundsRemove either `select` or `style` from the overridden allowed tags.## CreditsThis vulnerability was responsibly reported by [windshock](https://hackerone.com/windshock?type=user).


definition_id: oval:org.debian:def:141580678669599552995600210452592191691
title: CVE-2022-32212 nodejs
description:
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.16.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.


definition_id: oval:org.debian:def:339133428554175781969293325891038963335
title: CVE-2022-32221 curl
description:
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.


definition_id: oval:org.debian:def:298619958606845900688692469109558360567
title: CVE-2022-32292 connman
description:
In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to exploit a heap-based buffer overflow in received_data to execute code.


definition_id: oval:org.debian:def:283703163618956875915393859097715408671
title: CVE-2022-32293 connman
description:
In ConnMan through 1.41, a man-in-the-middle attack against a WISPR HTTP query could be used to trigger a use-after-free in WISPR handling, leading to crashes or code execution.


definition_id: oval:org.debian:def:306597939296738416710296023679019696593
title: CVE-2022-32308 ublock-origin
description:
Cross Site Scripting (XSS) vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofed 'MessageSender.url' to the browser renderer process.


definition_id: oval:org.debian:def:248195741397827589013397312313625282326
title: CVE-2022-3239 linux
description:
A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.


definition_id: oval:org.debian:def:325356600586390127429435493022174940513
title: CVE-2022-3266 firefox-esr
description:
An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.


definition_id: oval:org.debian:def:2784583199445686348753104829456702166
title: CVE-2022-32792 webkit2gtk
description:
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:258438989026738280264796815779566946696
title: CVE-2022-32816 webkit2gtk
description:
The issue was addressed with improved UI handling. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. Visiting a website that frames malicious content may lead to UI spoofing.


definition_id: oval:org.debian:def:221204554573061638442249967841335738920
title: CVE-2022-32886 webkit2gtk
description:
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:52112991296804504197528532937598727434
title: CVE-2022-32888 webkit2gtk
description:
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, watchOS 9, macOS Monterey 12.6, tvOS 16. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:313267377549966015303670701166140205389
title: CVE-2022-32893 webkit2gtk
description:
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.


definition_id: oval:org.debian:def:173070172572301714177003667774363360415
title: CVE-2022-32923 webkit2gtk
description:
A correctness issue in the JIT was addressed with improved checks. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Processing maliciously crafted web content may disclose internal states of the app.


definition_id: oval:org.debian:def:149649498567550203424094218660461580273
title: CVE-2022-32981 linux
description:
An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers.


definition_id: oval:org.debian:def:225215111358973422634590352953119290731
title: CVE-2022-3303 linux-5.10
description:
A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition


definition_id: oval:org.debian:def:334841835379318004673903674500163914626
title: CVE-2022-33744 linux
description:
Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the related lock held, resulting in a small race window, which can be used by unprivileged guests via PV devices to cause inconsistencies of the rbtree. These inconsistencies can lead to Denial of Service (DoS) of dom0, e.g. by causing crashes or the inability to perform further mappings of other guests' memory pages.


definition_id: oval:org.debian:def:24652410102964830771595595239990485900
title: CVE-2022-34169 bcel
description:
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.


definition_id: oval:org.debian:def:313851497195983495090404951955864219768
title: CVE-2022-34265 python-django
description:
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.


definition_id: oval:org.debian:def:24515860267003527815261386554798869758
title: CVE-2022-3435 linux-5.10
description:
A vulnerability classified as problematic has been found in Linux Kernel. This affects the function fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-210357 was assigned to this vulnerability.


definition_id: oval:org.debian:def:65252972404403597823668598307524597879
title: CVE-2022-3437 heimdal
description:
A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.


definition_id: oval:org.debian:def:111328958183318836732392769859766989192
title: CVE-2022-34526 tiff
description:
A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the "tiffsplit" or "tiffcrop" utilities.


definition_id: oval:org.debian:def:150544777845389453517524349446780433281
title: CVE-2022-34665 nvidia-graphics-drivers-legacy-390xx
description:
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause a null-pointer dereference, which may lead to denial of service.


definition_id: oval:org.debian:def:109298600229730677640363740690828240385
title: CVE-2022-34911 mediawiki
description:
An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is not escaped: SpecialCreateAccount::successfulAction() calls ::showSuccessPage() with a message as second parameter, and OutputPage::setPageTitle() uses text().


definition_id: oval:org.debian:def:252102229797900444237816129472440302127
title: CVE-2022-34912 mediawiki
description:
An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title without escaping. Hence, in a non-default configuration where a username contains HTML entities, it won't be escaped.


definition_id: oval:org.debian:def:183418219881046542170217454394231190500
title: CVE-2022-3515 libksba
description:
A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.


definition_id: oval:org.debian:def:119485068869848045942294682663408969238
title: CVE-2022-3517 node-minimatch
description:
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.


definition_id: oval:org.debian:def:40982667723112177174231390453497331722
title: CVE-2022-3521 linux
description:
A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211018 is the identifier assigned to this vulnerability.


definition_id: oval:org.debian:def:147550637627433309102295499954868553594
title: CVE-2022-3524 linux
description:
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211021 was assigned to this vulnerability.


definition_id: oval:org.debian:def:329223223021266709190177144396925607716
title: CVE-2022-35252 curl
description:
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.


definition_id: oval:org.debian:def:183976300247634402008434645563935315814
title: CVE-2022-35409 mbedtls
description:
An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information disclosure based on error responses. Affected configurations have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the configuration: 258 bytes if using mbedtls_ssl_cookie_check, and possibly up to 571 bytes with a custom cookie check function.


definition_id: oval:org.debian:def:113011832757078266235098404393808377424
title: CVE-2022-35414 qemu
description:
** DISPUTED ** softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time."


definition_id: oval:org.debian:def:311580526469442236653658568828358979303
title: CVE-2022-3550 xorg-server
description:
A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211051.


definition_id: oval:org.debian:def:18408290893738620823437199306161721167
title: CVE-2022-3551 xorg-server
description:
A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the file xkb/xkb.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211052.


definition_id: oval:org.debian:def:277351356994183218821683181522120678917
title: CVE-2022-3564 linux
description:
A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211087.


definition_id: oval:org.debian:def:166783882835968360304907611251827182624
title: CVE-2022-3565 linux
description:
A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211088.


definition_id: oval:org.debian:def:191431375729498259987410368536090366376
title: CVE-2022-3570 tiff
description:
Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact


definition_id: oval:org.debian:def:160887052820708403615653287657923403397
title: CVE-2022-3586 linux
description:
A flaw was found in the Linux kernel’s networking code. A use-after-free was found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a denial of service.


definition_id: oval:org.debian:def:150883567303130130858228322724037993079
title: CVE-2022-3594 linux
description:
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211363.


definition_id: oval:org.debian:def:102297130019184687595041974592526392549
title: CVE-2022-3597 tiff
description:
LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.


definition_id: oval:org.debian:def:76474278949291107093283441252850970809
title: CVE-2022-3598 tiff
description:
LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit cfbb883b.


definition_id: oval:org.debian:def:251086751294616056362897798491723116670
title: CVE-2022-3599 tiff
description:
LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125.


definition_id: oval:org.debian:def:322943456011866445242176708899961592750
title: CVE-2022-3621 linux
description:
A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_bmap_lookup_at_level of the file fs/nilfs2/inode.c of the component nilfs2. The manipulation leads to null pointer dereference. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211920.


definition_id: oval:org.debian:def:294734533037635266504106378071538145982
title: CVE-2022-36227 libarchive
description:
In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution."


definition_id: oval:org.debian:def:198446374699209861932127054982748700331
title: CVE-2022-3625 linux-5.10
description:
A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211929 was assigned to this vulnerability.


definition_id: oval:org.debian:def:285502509518241767006487749515026634753
title: CVE-2022-3626 tiff
description:
LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelections, tools/tiffcrop.c:7619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.


definition_id: oval:org.debian:def:152612787004754086229678888745489603849
title: CVE-2022-3627 tiff
description:
LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6860, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.


definition_id: oval:org.debian:def:300801196025396702255914646608799275429
title: CVE-2022-3628 linux
description:
A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges.


definition_id: oval:org.debian:def:100145118562787135904664224280284828985
title: CVE-2022-3629 linux
description:
A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects the function vsock_connect of the file net/vmw_vsock/af_vsock.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211930 is the identifier assigned to this vulnerability.


definition_id: oval:org.debian:def:269131039884918563757607521106189731099
title: CVE-2022-3633 linux-5.10
description:
A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function j1939_session_destroy of the file net/can/j1939/transport.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211932.


definition_id: oval:org.debian:def:92892150693225047643011857988165423804
title: CVE-2022-3635 linux
description:
A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function tst_timer of the file drivers/atm/idt77252.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. VDB-211934 is the identifier assigned to this vulnerability.


definition_id: oval:org.debian:def:308324621425205340189545277774953080302
title: CVE-2022-3640 linux
description:
A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211944.


definition_id: oval:org.debian:def:137135180801646397130926305518010090254
title: CVE-2022-3643 linux
description:
Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior.


definition_id: oval:org.debian:def:178488016193248006239736557855173455712
title: CVE-2022-3646 linux
description:
A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfs_attach_log_writer of the file fs/nilfs2/segment.c of the component BPF. The manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211961 was assigned to this vulnerability.


definition_id: oval:org.debian:def:14491217700981618527624303059139693560
title: CVE-2022-3649 linux
description:
A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_new_inode of the file fs/nilfs2/inode.c of the component BPF. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211992.


definition_id: oval:org.debian:def:304566710457616578246477430340369893352
title: CVE-2022-36879 linux
description:
An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.


definition_id: oval:org.debian:def:220315287982156333167273238840178095960
title: CVE-2022-36946 linux
description:
nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len.


definition_id: oval:org.debian:def:68412483162565251937940583489709956858
title: CVE-2022-37032 frr
description:
An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_parse in bgpd/bgp_packet.c.


definition_id: oval:org.debian:def:279742898726617970702626325842912929794
title: CVE-2022-3705 vim
description:
A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component autocmd Handler. The manipulation leads to use after free. The attack may be launched remotely. Upgrading to version 9.0.0805 is able to address this issue. The name of the patch is d0fab10ed2a86698937e3c3fed2f10bd9bb5e731. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-212324.


definition_id: oval:org.debian:def:289851238444486568990360106669161090182
title: CVE-2022-37155 spip
description:
RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.


definition_id: oval:org.debian:def:118596735315433746990801407057633161948
title: CVE-2022-37434 zlib
description:
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).


definition_id: oval:org.debian:def:232239900854240690435012450843467592055
title: CVE-2022-37452 exim4
description:
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.


definition_id: oval:org.debian:def:34903379018542275981086296046503589805
title: CVE-2022-37454 php7.3
description:
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.


definition_id: oval:org.debian:def:123542197370973191904243252465477820455
title: CVE-2022-37601 node-loader-utils
description:
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.


definition_id: oval:org.debian:def:325919657191301447973468977818150618998
title: CVE-2022-37616 node-xmldom
description:
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."


definition_id: oval:org.debian:def:315019242016718625081565088851863992396
title: CVE-2022-37706 e17
description:
enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.


definition_id: oval:org.debian:def:108978888732474592377595913122410081908
title: CVE-2022-3775 grub2
description:
When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2's heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded.


definition_id: oval:org.debian:def:108911463112870676775140086517229718785
title: CVE-2022-37797 lighttpd
description:
In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.


definition_id: oval:org.debian:def:271553855289950935660735089774042915790
title: CVE-2022-38177 bind9
description:
By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.


definition_id: oval:org.debian:def:336814349430647261089803497037459440543
title: CVE-2022-38178 bind9
description:
By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.


definition_id: oval:org.debian:def:70762940008375438126864265992709914716
title: CVE-2022-38266 leptonlib
description:
An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.


definition_id: oval:org.debian:def:310401185045591192572464025356235129216
title: CVE-2022-38472 firefox-esr
description:
An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.


definition_id: oval:org.debian:def:187615300741353101366943709184530646470
title: CVE-2022-38473 firefox-esr
description:
A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access). This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.


definition_id: oval:org.debian:def:96800902772920315028014755693736762870
title: CVE-2022-38478 firefox-esr
description:
Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR 91.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.


definition_id: oval:org.debian:def:325765024065343210318585244844673644833
title: CVE-2022-38749 snakeyaml
description:
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.


definition_id: oval:org.debian:def:15462751374668725640917511790868859615
title: CVE-2022-38784 poppler
description:
Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2022-38171 in Xpdf.


definition_id: oval:org.debian:def:125676430264793580184318291547196514235
title: CVE-2022-38791 mariadb-10.3
description:
In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a deadlock.


definition_id: oval:org.debian:def:9179038567440343857642603966559440036
title: CVE-2022-38850 mplayer
description:
The MPlayer Project mencoder SVN-r38374-13.0.1 is vulnerable to Divide By Zero via the function config () of llibmpcodecs/vf_scale.c.


definition_id: oval:org.debian:def:25611831637132209671400709127526349620
title: CVE-2022-38851 mplayer
description:
Certain The MPlayer Project products are vulnerable to Out-of-bounds Read via function read_meta_record() of mplayer/libmpdemux/asfheader.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.


definition_id: oval:org.debian:def:206457315109681286951098877247745980377
title: CVE-2022-38855 mplayer
description:
Certain The MPlayer Project products are vulnerable to Buffer Overflow via function gen_sh_video () of mplayer/libmpdemux/demux_mov.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.


definition_id: oval:org.debian:def:120683520082199599288187061597026858125
title: CVE-2022-38858 mplayer
description:
Certain The MPlayer Project products are vulnerable to Buffer Overflow via function mov_build_index() of libmpdemux/demux_mov.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.


definition_id: oval:org.debian:def:307991307895958681407056805699328821051
title: CVE-2022-38860 mplayer
description:
Certain The MPlayer Project products are vulnerable to Divide By Zero via function demux_open_avi() of libmpdemux/demux_avi.c which affects mencoder. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.


definition_id: oval:org.debian:def:163310724172212956081926893814282698465
title: CVE-2022-38861 mplayer
description:
The MPlayer Project mplayer SVN-r38374-13.0.1 is vulnerable to memory corruption via function free_mp_image() of libmpcodecs/mp_image.c.


definition_id: oval:org.debian:def:93633145675249610214580086906428285687
title: CVE-2022-38863 mplayer
description:
Certain The MPlayer Project products are vulnerable to Buffer Overflow via function mp_getbits() of libmpdemux/mpeg_hdr.c which affects mencoder and mplayer. This affects mecoder SVN-r38374-13.0.1 and mplayer SVN-r38374-13.0.1.


definition_id: oval:org.debian:def:83755580872036184457337258091288705580
title: CVE-2022-38864 mplayer
description:
Certain The MPlayer Project products are vulnerable to Buffer Overflow via the function mp_unescape03() of libmpdemux/mpeg_hdr.c. This affects mencoder SVN-r38374-13.0.1 and mplayer SVN-r38374-13.0.1.


definition_id: oval:org.debian:def:71097143035454983504395446384715978475
title: CVE-2022-38865 mplayer
description:
Certain The MPlayer Project products are vulnerable to Divide By Zero via the function demux_avi_read_packet of libmpdemux/demux_avi.c. This affects mplyer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.


definition_id: oval:org.debian:def:200539235466072011015663061101253292617
title: CVE-2022-38866 mplayer
description:
Certain The MPlayer Project products are vulnerable to Buffer Overflow via read_avi_header() of libmpdemux/aviheader.c . This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.


definition_id: oval:org.debian:def:247666107932449252138028718955434219087
title: CVE-2022-39028 inetutils
description:
telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.


definition_id: oval:org.debian:def:266715432588203158869288268866396339548
title: CVE-2022-39176 bluez
description:
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.


definition_id: oval:org.debian:def:233619476751466091982660266708143056952
title: CVE-2022-39177 bluez
description:
BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c.


definition_id: oval:org.debian:def:211751339820906486568344026397870740917
title: CVE-2022-39188 linux
description:
An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs.


definition_id: oval:org.debian:def:167858241389224840442204414821175104840
title: CVE-2022-39190 linux-5.10
description:
An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to an already bound chain.


definition_id: oval:org.debian:def:96126229451068754418902510322319754793
title: CVE-2022-39253 git
description:
Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim's machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.


definition_id: oval:org.debian:def:248053181151551280724419681252586290358
title: CVE-2022-39260 git
description:
Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.


definition_id: oval:org.debian:def:220787875491537180712522018681558112002
title: CVE-2022-39261 twig
description:
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.


definition_id: oval:org.debian:def:129982588526312362580997621420811782614
title: CVE-2022-39286 jupyter-core
description:
Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.


definition_id: oval:org.debian:def:325085752954734303113267288933885358102
title: CVE-2022-39348 twisted
description:
Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.


definition_id: oval:org.debian:def:136107797421627548158209014605440578025
title: CVE-2022-39353 node-xmldom
description:
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.


definition_id: oval:org.debian:def:338667208911604345433113477032058010781
title: CVE-2022-39377 sysstat
description:
sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_structures contains a size_t overflow in sa_common.c. The allocate_structures function insufficiently checks bounds before arithmetic multiplication, allowing for an overflow in the size allocated for the buffer representing system activities. This issue may lead to Remote Code Execution (RCE). This issue has been patched in version 12.7.1.


definition_id: oval:org.debian:def:215556184172740721558884407026510037215
title: CVE-2022-39399 openjdk-11
description:
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).


definition_id: oval:org.debian:def:294679977114334847616737113969985420771
title: CVE-2022-3970 tiff
description:
A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to fix this issue. The identifier VDB-213549 was assigned to this vulnerability.


definition_id: oval:org.debian:def:234587977764855886052954019732388760793
title: CVE-2022-39842 linux
description:
** DISPUTED ** An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copy_from_user(), a heap overflow may occur. NOTE: the original discoverer disputes that the overflow can actually happen.


definition_id: oval:org.debian:def:184936823542744903179032742089105605779
title: CVE-2022-39955 modsecurity-crs
description:
The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indicates multiple character encoding schemes. A vulnerable back-end can potentially be exploited by declaring multiple Content-Type "charset" names and therefore bypassing the configurable CRS Content-Type header "charset" allow list. An encoded payload can bypass CRS detection this way and may then be decoded by the backend. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively.


definition_id: oval:org.debian:def:64934714532537451459632457464661423899
title: CVE-2022-39956 modsecurity-crs
description:
The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and inspected by the web application firewall engine and the rule set. The multipart payload will therefore bypass detection. A vulnerable backend that supports these encoding schemes can potentially be exploited. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised upgrade to 3.2.2 and 3.3.3 respectively. The mitigation against these vulnerabilities depends on the installation of the latest ModSecurity version (v2.9.6 / v3.0.8).


definition_id: oval:org.debian:def:69296118062992817111906988760952181277
title: CVE-2022-39957 modsecurity-crs
description:
The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web application firewall. A restricted resource, access to which would ordinarily be detected, may therefore bypass detection. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively.


definition_id: oval:org.debian:def:131751118799652584009468757502490360236
title: CVE-2022-39958 modsecurity-crs
description:
The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field with a small byte range. A restricted resource, access to which would ordinarily be detected, may be exfiltrated from the backend, despite being protected by a web application firewall that uses CRS. Short subsections of a restricted resource may bypass pattern matching techniques and allow undetected access. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively and to configure a CRS paranoia level of 3 or higher.


definition_id: oval:org.debian:def:54137506487650348224194830149963850781
title: CVE-2022-40023 mako
description:
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.


definition_id: oval:org.debian:def:248601547572125116683058520655001602436
title: CVE-2022-40149 libjettison-java
description:
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.


definition_id: oval:org.debian:def:199739043585263391213591839434911963829
title: CVE-2022-40150 libjettison-java
description:
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.


definition_id: oval:org.debian:def:94920925868218964226133076584121065246
title: CVE-2022-40188 knot-resolver
description:
Knot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU consumption) because of algorithmic complexity. During an attack, an authoritative server must return large NS sets or address sets.


definition_id: oval:org.debian:def:242068686365839057917630821315922837028
title: CVE-2022-40284 ntfs-3g
description:
A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if the ntfs-3g binary is setuid root. A physically proximate attacker can exploit this if NTFS-3G software is configured to execute upon attachment of an external storage device.


definition_id: oval:org.debian:def:264565153729102910716466226506077391082
title: CVE-2022-40303 libxml2
description:
An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.


definition_id: oval:org.debian:def:61027367378352748874044896458302576397
title: CVE-2022-40304 libxml2
description:
An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.


definition_id: oval:org.debian:def:37394642042502642963840464639682008520
title: CVE-2022-40307 linux
description:
An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-after-free.


definition_id: oval:org.debian:def:27934434464886739092496362827306068106
title: CVE-2022-40617 strongswan
description:
strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA) certificate that contains a CRL/OCSP URL that points to a server (under the attacker's control) that doesn't properly respond but (for example) just does nothing after the initial TCP handshake, or sends an excessive amount of application data.


definition_id: oval:org.debian:def:31460713102356547174591720845540657140
title: CVE-2022-40768 linux
description:
drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case.


definition_id: oval:org.debian:def:306968665863340856820717430958092167681
title: CVE-2022-40956 firefox-esr
description:
When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.


definition_id: oval:org.debian:def:287353203412867512952967304713823216093
title: CVE-2022-40957 firefox-esr
description:
Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<br>*This bug only affects Firefox on ARM64 platforms.*. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.


definition_id: oval:org.debian:def:292067203754775437565752676607306024959
title: CVE-2022-40958 firefox-esr
description:
By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fixation and other attacks. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.


definition_id: oval:org.debian:def:84574362145497741561548644373191227910
title: CVE-2022-40959 firefox-esr
description:
During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.


definition_id: oval:org.debian:def:310532486881498911420762968606150803120
title: CVE-2022-40960 firefox-esr
description:
Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.


definition_id: oval:org.debian:def:7907169934052071076099966489610145699
title: CVE-2022-40962 firefox-esr
description:
Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.


definition_id: oval:org.debian:def:128235172964957370049275715223959047187
title: CVE-2022-4121 libetpan
description:
In libetpan a null pointer dereference in mailimap_mailbox_data_status_free in low-level/imap/mailimap_types.c was found that could lead to a remote denial of service or other potential consequences.


definition_id: oval:org.debian:def:101474944569157455580804864860097874848
title: CVE-2022-41222 linux-5.10
description:
mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move.


definition_id: oval:org.debian:def:40738052310755292601048882111763455812
title: CVE-2022-41317 squid
description:
An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.


definition_id: oval:org.debian:def:298877432897813111239328458238910568613
title: CVE-2022-41318 squid
description:
A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a client. This is fixed in 5.7.


definition_id: oval:org.debian:def:244152331337357397329843016049595851220
title: CVE-2022-41325 vlc
description:
An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.


definition_id: oval:org.debian:def:102898334006109184499418252422503279176
title: CVE-2022-4139 linux-5.10
description:
An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system.


definition_id: oval:org.debian:def:103792305662697391832888804548434345080
title: CVE-2022-41404 ini4j
description:
An issue in the fetch() method in the BasicProfile class of org.ini4j before v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.


definition_id: oval:org.debian:def:65408417638795265530432613140366036421
title: CVE-2022-41674 linux-5.10
description:
An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c.


definition_id: oval:org.debian:def:337894185994655015754889053081677490334
title: CVE-2022-41704 batik
description:
A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.


definition_id: oval:org.debian:def:148964986088161740616816469587925661602
title: CVE-2022-41741 nginx
description:
NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.


definition_id: oval:org.debian:def:91220965622487041058152857332453412360
title: CVE-2022-41742 nginx
description:
NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted audio or video file. The issue affects only NGINX products that are built with the module ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.


definition_id: oval:org.debian:def:28455237474284901235998869130313291339
title: CVE-2022-41751 jhead
description:
Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the regeneration -rgt50 option.


definition_id: oval:org.debian:def:289697212404829569012973366790958799524
title: CVE-2022-41765 mediawiki
description:
An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. HTMLUserTextField exposes the existence of hidden users.


definition_id: oval:org.debian:def:102265134156053926752200976814202754432
title: CVE-2022-41767 mediawiki
description:
An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. When changes made by an IP address are reassigned to a user (using reassignEdits.php), the changes will still be attributed to the IP address on Special:Contributions when doing a range lookup.


definition_id: oval:org.debian:def:156565090616751763690510574451281195341
title: CVE-2022-41849 linux
description:
drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufx_ops_open and ufx_usb_disconnect.


definition_id: oval:org.debian:def:218862713486946033613330733691451727953
title: CVE-2022-41850 linux
description:
roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations where a report is received while copying a report->value is in progress.


definition_id: oval:org.debian:def:298244582355594577781023274671676874318
title: CVE-2022-41853 hsqldb
description:
Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.


definition_id: oval:org.debian:def:203256644505312665437180992445684856105
title: CVE-2022-41858 linux
description:
A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information.


definition_id: oval:org.debian:def:334664630380988590532435968274536520774
title: CVE-2022-41881 netty
description:
Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder.


definition_id: oval:org.debian:def:71132934842328659515690038785536405027
title: CVE-2022-41903 git
description:
Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`.


definition_id: oval:org.debian:def:292958957302064118943532361225059029244
title: CVE-2022-41915 netty
description:
Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values.


definition_id: oval:org.debian:def:183456861520452072373235596370966717092
title: CVE-2022-41916 heimdal
description:
Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue.


definition_id: oval:org.debian:def:93331187034318240464699828533500743487
title: CVE-2022-41946 libpgjava
description:
pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `PreparedStatemet.setBytea(int, InputStream)` will create a temporary file if the InputStream is larger than 2k. This will create a temporary file which is readable by other users on Unix like systems, but not MacOS. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. Java 1.7 and higher users: this vulnerability is fixed in 4.5.0. Java 1.6 and lower users: no patch is available. If you are unable to patch, or are stuck running on Java 1.6, specifying the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will mitigate this vulnerability.


definition_id: oval:org.debian:def:128750713377783739062749335604585310548
title: CVE-2022-41966 libxstream-java
description:
XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable.


definition_id: oval:org.debian:def:211690645814314478856305993342168868804
title: CVE-2022-41973 multipath-tools
description:
multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.


definition_id: oval:org.debian:def:131232801246545046566340125971716316788
title: CVE-2022-41974 multipath-tools
description:
multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR.


definition_id: oval:org.debian:def:312669437832274775418192951094301855009
title: CVE-2022-42003 jackson-databind
description:
In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Additional fix version in 2.13.4.1 and 2.12.17.1


definition_id: oval:org.debian:def:7066678119382183807198411904931050928
title: CVE-2022-42004 jackson-databind
description:
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.


definition_id: oval:org.debian:def:117222827252690227934608124505442188165
title: CVE-2022-42010 dbus
description:
An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures.


definition_id: oval:org.debian:def:277435478835441356231311956772237424483
title: CVE-2022-42011 dbus
description:
An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type.


definition_id: oval:org.debian:def:293515886961453607096143403428234983853
title: CVE-2022-42012 dbus
description:
An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format.


definition_id: oval:org.debian:def:75004678699899296784842335300800926093
title: CVE-2022-42328 linux
description:
Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).


definition_id: oval:org.debian:def:152329393367277700173637517349763996366
title: CVE-2022-42703 linux
description:
mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.


definition_id: oval:org.debian:def:83064966547354612304070882037306640291
title: CVE-2022-42719 linux-5.10
description:
A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and potentially execute code.


definition_id: oval:org.debian:def:10446858680817359199394831092097306437
title: CVE-2022-42720 linux-5.10
description:
Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-free conditions to potentially execute code.


definition_id: oval:org.debian:def:295963604698050732877584926602686412173
title: CVE-2022-42721 linux-5.10
description:
A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in turn, potentially execute code.


definition_id: oval:org.debian:def:153334811414802523484474406843812833154
title: CVE-2022-42722 linux-5.10
description:
In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon protection of P2P devices.


definition_id: oval:org.debian:def:4408665936354131089751491367247107186
title: CVE-2022-42799 webkit2gtk
description:
The issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Visiting a malicious website may lead to user interface spoofing.


definition_id: oval:org.debian:def:305709665556036983647630880215461054243
title: CVE-2022-42823 webkit2gtk
description:
A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:161512252280453738810649205651775887651
title: CVE-2022-42824 webkit2gtk
description:
A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Processing maliciously crafted web content may disclose sensitive user information.


definition_id: oval:org.debian:def:183083061056266467629411055780822270667
title: CVE-2022-4283 xorg-server
description:
A vulnerability was found in X.Org. This issue occurs because the XkbCopyNames function leaves a dangling pointer to freed memory, resulting in out-of-bounds memory access on subsequent XkbGetKbdByName requests. This flaw can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.


definition_id: oval:org.debian:def:65576874561673847265826854291721849533
title: CVE-2022-42852 webkit2gtk
description:
The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may result in the disclosure of process memory.


definition_id: oval:org.debian:def:227977146480528008068710527659258453338
title: CVE-2022-42856 webkit2gtk
description:
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..


definition_id: oval:org.debian:def:209770460915223242043956191130223107390
title: CVE-2022-42863 webkit2gtk
description:
A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:248787602321713525284593687815075772204
title: CVE-2022-42867 webkit2gtk
description:
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:91712478152548292836642302308100054322
title: CVE-2022-42890 batik
description:
A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.


definition_id: oval:org.debian:def:8611627503610472741155958392358393611
title: CVE-2022-42895 linux
description:
There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely. We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e https://www.google.com/url


definition_id: oval:org.debian:def:163869145914931632475977196664362283106
title: CVE-2022-42896 linux
description:
There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within proximity of the victim. We recommend upgrading past commit https://www.google.com/url https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4 https://www.google.com/url


definition_id: oval:org.debian:def:73199839516367656911181378386184406900
title: CVE-2022-42898 heimdal
description:
PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."


definition_id: oval:org.debian:def:289639231933661733138374586961353802730
title: CVE-2022-42902 lava
description:
In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server.


definition_id: oval:org.debian:def:102716507389208679046295187241186509672
title: CVE-2022-42906 powerline-gitstatus
description:
powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001.


definition_id: oval:org.debian:def:201318884532522294464500822889563276026
title: CVE-2022-42920 bcel
description:
Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.


definition_id: oval:org.debian:def:254575266828329563772301910492191812305
title: CVE-2022-42927 firefox-esr
description:
A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via <code>performance.getEntries()</code>. This vulnerability affects Thunderbird < 102.4, Firefox ESR < 102.4, and Firefox < 106.


definition_id: oval:org.debian:def:246347297756484105045128605452151918987
title: CVE-2022-42928 firefox-esr
description:
Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 102.4, Firefox ESR < 102.4, and Firefox < 106.


definition_id: oval:org.debian:def:271665175333775342232701258578359784761
title: CVE-2022-42929 firefox-esr
description:
If a website called <code>window.print()</code> in a particular way, it could cause a denial of service of the browser, which may persist beyond browser restart depending on the user's session restore settings. This vulnerability affects Thunderbird < 102.4, Firefox ESR < 102.4, and Firefox < 106.


definition_id: oval:org.debian:def:69897292460210766161490727216626084451
title: CVE-2022-42932 firefox-esr
description:
Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 102.4, Firefox ESR < 102.4, and Firefox < 106.


definition_id: oval:org.debian:def:279384267971883505589306535408943199105
title: CVE-2022-43235 libde265
description:
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_epel_pixels_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.


definition_id: oval:org.debian:def:26899933035836882779978585247652284074
title: CVE-2022-43236 libde265
description:
Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.


definition_id: oval:org.debian:def:7406997668677542226312284427026280144
title: CVE-2022-43237 libde265
description:
Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via void put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.


definition_id: oval:org.debian:def:124182200074593039855917200695818357763
title: CVE-2022-43238 libde265
description:
Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_h_3_v_3_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.


definition_id: oval:org.debian:def:42925172252709801720903938754910486375
title: CVE-2022-43239 libde265
description:
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_chroma<unsigned short> in motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.


definition_id: oval:org.debian:def:290338921082061596377978556765224917181
title: CVE-2022-43240 libde265
description:
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_qpel_h_2_v_1_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.


definition_id: oval:org.debian:def:198211061862625291068825323166100342414
title: CVE-2022-43241 libde265
description:
Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_v_3_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.


definition_id: oval:org.debian:def:219204263687219376755740067585014598166
title: CVE-2022-43242 libde265
description:
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_luma<unsigned char> in motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.


definition_id: oval:org.debian:def:45868571222184271443278008647271194925
title: CVE-2022-43243 libde265
description:
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_weighted_pred_avg_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.


definition_id: oval:org.debian:def:39103509392352819906684061513455698085
title: CVE-2022-43244 libde265
description:
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.


definition_id: oval:org.debian:def:242781096620724766466310262596690324372
title: CVE-2022-43245 libde265
description:
Libde265 v1.0.8 was discovered to contain a segmentation violation via apply_sao_internal<unsigned short> in sao.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.


definition_id: oval:org.debian:def:117545936633299178907634637697023624611
title: CVE-2022-43248 libde265
description:
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_weighted_pred_avg_16_fallback in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.


definition_id: oval:org.debian:def:49169496310562566468083081500118795640
title: CVE-2022-43249 libde265
description:
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.


definition_id: oval:org.debian:def:83222009896692023828447266591593377413
title: CVE-2022-43250 libde265
description:
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_0_0_fallback_16 in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.


definition_id: oval:org.debian:def:191065629057485054782895723192097114934
title: CVE-2022-43252 libde265
description:
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_16_fallback in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.


definition_id: oval:org.debian:def:26460635412598480000146127093638256913
title: CVE-2022-43253 libde265
description:
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_unweighted_pred_16_fallback in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.


definition_id: oval:org.debian:def:319146654671065670188556972773220881700
title: CVE-2022-4345 wireshark
description:
Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file


definition_id: oval:org.debian:def:3993302799227440852057459257952147152
title: CVE-2022-43552 curl
description:
A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path.


definition_id: oval:org.debian:def:282243588415987280200538899187777589495
title: CVE-2022-43680 expat
description:
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.


definition_id: oval:org.debian:def:272955924331869458259557622979729642967
title: CVE-2022-43750 linux
description:
drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory.


definition_id: oval:org.debian:def:274200010889934529709584530747017223108
title: CVE-2022-4378 linux
description:
A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system.


definition_id: oval:org.debian:def:94533967386138169873151198249689434361
title: CVE-2022-44570 ruby-rack
description:
A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.


definition_id: oval:org.debian:def:87084223728568485739976250535675370447
title: CVE-2022-44571 ruby-rack
description:
There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an attacker to craft an input that can cause Content-Disposition header parsing in Rackto take an unexpected amount of time, possibly resulting in a denial ofservice attack vector. This header is used typically used in multipartparsing. Any applications that parse multipart posts using Rack (virtuallyall Rails applications) are impacted.


definition_id: oval:org.debian:def:267638097105102307446954336902022088311
title: CVE-2022-44572 ruby-rack
description:
A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.


definition_id: oval:org.debian:def:250192602550033588898022564550050033275
title: CVE-2022-44638 pixman
description:
In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 due to an integer overflow in pixman_sample_floor_y.


definition_id: oval:org.debian:def:134076060854806164791572993476962682538
title: CVE-2022-44640 heimdal
description:
Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).


definition_id: oval:org.debian:def:47393938876091553187004989088029589303
title: CVE-2022-44641 lava
description:
In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service.


definition_id: oval:org.debian:def:216685731874098430805365017354522677020
title: CVE-2022-44792 net-snmp
description:
handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker (who has write access) to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.


definition_id: oval:org.debian:def:123378976666054015216932113117695879796
title: CVE-2022-44793 net-snmp
description:
handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.


definition_id: oval:org.debian:def:229673019561396843205662919291019296098
title: CVE-2022-45060 varnish
description:
An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.


definition_id: oval:org.debian:def:217227461336877800886308552609241866854
title: CVE-2022-4515 exuberant-ctags
description:
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.


definition_id: oval:org.debian:def:64873765181244066252178437655271808312
title: CVE-2022-45403 firefox-esr
description:
Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have allowed them to determine the presence or length of a media file. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.


definition_id: oval:org.debian:def:43046716337013460500614595993999794808
title: CVE-2022-45404 firefox-esr
description:
Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.


definition_id: oval:org.debian:def:17028093475752868861884244871133512923
title: CVE-2022-45405 firefox-esr
description:
Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.


definition_id: oval:org.debian:def:243470253441009015539279268248296245526
title: CVE-2022-45406 firefox-esr
description:
If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. This could lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.


definition_id: oval:org.debian:def:189016722558922645122033309100607674828
title: CVE-2022-45408 firefox-esr
description:
Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.


definition_id: oval:org.debian:def:308032484203991617844761549631234429738
title: CVE-2022-45409 firefox-esr
description:
The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> may not have been called, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.


definition_id: oval:org.debian:def:188199309702397237838536130680653110920
title: CVE-2022-45410 firefox-esr
description:
When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.


definition_id: oval:org.debian:def:265798426377247060153627553647565564794
title: CVE-2022-45411 firefox-esr
description:
Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookies protected by HTTPOnly). To mitigate this attack, browsers placed limits on <code>fetch()</code> and XMLHttpRequest; however some webservers have implemented non-standard headers such as <code>X-Http-Method-Override</code> that override the HTTP method, and made this attack possible again. Thunderbird has applied the same mitigations to the use of this and similar headers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.


definition_id: oval:org.debian:def:38695565905314835491285342511195199841
title: CVE-2022-45412 firefox-esr
description:
When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer. <br>*This bug only affects Thunderbird on Unix-based operated systems (Android, Linux, MacOS). Windows is unaffected.*. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.


definition_id: oval:org.debian:def:61806917108448593092458176023423270049
title: CVE-2022-45414 thunderbird
description:
If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. This vulnerability affects Thunderbird < 102.5.1.


definition_id: oval:org.debian:def:323851977042606230028937480941622241722
title: CVE-2022-45416 firefox-esr
description:
Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have possibly figured out which keys were being pressed. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.


definition_id: oval:org.debian:def:248641777960959019632508324992177324385
title: CVE-2022-45418 firefox-esr
description:
If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.


definition_id: oval:org.debian:def:184542887556626357518848771354020964909
title: CVE-2022-45420 firefox-esr
description:
Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.


definition_id: oval:org.debian:def:89206181663711550320675738696231697188
title: CVE-2022-45421 firefox-esr
description:
Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.


definition_id: oval:org.debian:def:262443030939476136573176132658467258271
title: CVE-2022-45442 ruby-sinatra
description:
Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.


definition_id: oval:org.debian:def:291237666473943374821172544290387953550
title: CVE-2022-45685 libjettison-java
description:
A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data.


definition_id: oval:org.debian:def:105507327729783339383101892147906773920
title: CVE-2022-45693 libjettison-java
description:
Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.


definition_id: oval:org.debian:def:133219174314042143959023278582882434982
title: CVE-2022-45939 emacs
description:
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input.


definition_id: oval:org.debian:def:7009694427339914219428667857237411330
title: CVE-2022-46169 cacti
description:
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device. The vulnerability resides in the `remote_agent.php` file. This file can be accessed without authentication. This function retrieves the IP address of the client via `get_client_addr` and resolves this IP address to the corresponding hostname via `gethostbyaddr`. After this, it is verified that an entry within the `poller` table exists, where the hostname corresponds to the resolved hostname. If such an entry was found, the function returns `true` and the client is authorized. This authorization can be bypassed due to the implementation of the `get_client_addr` function. The function is defined in the file `lib/functions.php` and checks serval `$_SERVER` variables to determine the IP address of the client. The variables beginning with `HTTP_` can be arbitrarily set by an attacker. Since there is a default entry in the `poller` table with the hostname of the server running Cacti, an attacker can bypass the authentication e.g. by providing the header `Forwarded-For: <TARGETIP>`. This way the function `get_client_addr` returns the IP address of the server running Cacti. The following call to `gethostbyaddr` will resolve this IP address to the hostname of the server, which will pass the `poller` hostname check because of the default entry. After the authorization of the `remote_agent.php` file is bypassed, an attacker can trigger different actions. One of these actions is called `polldata`. The called function `poll_for_data` retrieves a few request parameters and loads the corresponding `poller_item` entries from the database. If the `action` of a `poller_item` equals `POLLER_ACTION_SCRIPT_PHP`, the function `proc_open` is used to execute a PHP script. The attacker-controlled parameter `$poller_id` is retrieved via the function `get_nfilter_request_var`, which allows arbitrary strings. This variable is later inserted into the string passed to `proc_open`, which leads to a command injection vulnerability. By e.g. providing the `poller_id=;id` the `id` command is executed. In order to reach the vulnerable call, the attacker must provide a `host_id` and `local_data_id`, where the `action` of the corresponding `poller_item` is set to `POLLER_ACTION_SCRIPT_PHP`. Both of these ids (`host_id` and `local_data_id`) can easily be bruteforced. The only requirement is that a `poller_item` with an `POLLER_ACTION_SCRIPT_PHP` action exists. This is very likely on a productive instance because this action is added by some predefined templates like `Device - Uptime` or `Device - Polling Time`. This command injection vulnerability allows an unauthenticated user to execute arbitrary commands if a `poller_item` with the `action` type `POLLER_ACTION_SCRIPT_PHP` (`2`) is configured. The authorization bypass should be prevented by not allowing an attacker to make `get_client_addr` (file `lib/functions.php`) return an arbitrary IP address. This could be done by not honoring the `HTTP_...` `$_SERVER` variables. If these should be kept for compatibility reasons it should at least be prevented to fake the IP address of the server running Cacti. This vulnerability has been addressed in both the 1.2.x and 1.3.x release branches with `1.2.23` being the first release containing the patch.


definition_id: oval:org.debian:def:146644760488583703599082429839694466317
title: CVE-2022-46338 g810-led
description:
g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device nodes world-readable and writable, allowing any process on the system to read traffic from keyboards, including sensitive data.


definition_id: oval:org.debian:def:280335048733134715977192288271875616227
title: CVE-2022-46340 xorg-server
description:
A vulnerability was found in X.Org. The issue occurs due to the swap handler for the XTestFakeInput request of the XTest extension, possibly corrupting the stack if GenericEvents with lengths larger than 32 bytes are sent through the XTestFakeInput request. This flaw can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where the client and server use the same byte order.


definition_id: oval:org.debian:def:243360870605580374577711380840218877528
title: CVE-2022-46341 xorg-server
description:
A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.


definition_id: oval:org.debian:def:309195598833267334269509379176537745118
title: CVE-2022-46342 xorg-server
description:
A vulnerability was found in X.Org. This flaw occurs because the handler for the XvdiSelectVideoNotify request may write to memory after it has been freed. This flaw can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.


definition_id: oval:org.debian:def:325341486720244826341063788108741650300
title: CVE-2022-46343 xorg-server
description:
A vulnerability was found in X.Org. This issue occurs because the handler for the ScreenSaverSetAttributes request may write to memory after it has been freed. This flaw can lead to local privileges elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.


definition_id: oval:org.debian:def:217231897398824223194520884003262680629
title: CVE-2022-46344 xorg-server
description:
A vulnerability was found in X.Org. The issue occurs because the handler for the XIChangeProperty request has a length-validation issue, resulting in out-of-bounds memory reads and potential information disclosure. This flaw can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.


definition_id: oval:org.debian:def:333200192406837126980322266109955706756
title: CVE-2022-46391 awstats
description:
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.


definition_id: oval:org.debian:def:86174188461520867766586802603914134817
title: CVE-2022-4662 linux
description:
A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use this flaw to crash the system.


definition_id: oval:org.debian:def:52816013834682559720500540833528491115
title: CVE-2022-46648 ruby-git
description:
ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318.


definition_id: oval:org.debian:def:36566383359078913640711865737256008072
title: CVE-2022-46691 webkit2gtk
description:
A memory consumption issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:220402947450108720092101334411682373451
title: CVE-2022-46692 webkit2gtk
description:
A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may bypass Same Origin Policy.


definition_id: oval:org.debian:def:5008810027063869369947413696245000970
title: CVE-2022-46698 webkit2gtk
description:
A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may disclose sensitive user information.


definition_id: oval:org.debian:def:186354635731708812662728700463519581368
title: CVE-2022-46700 webkit2gtk
description:
A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:225363065971752888352931159889876611098
title: CVE-2022-46871 firefox-esr
description:
An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited. This vulnerability affects Firefox < 108.


definition_id: oval:org.debian:def:37501425860948901479962917713361458086
title: CVE-2022-46872 firefox-esr
description:
An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.<br>*This bug only affects Thunderbird for Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6.


definition_id: oval:org.debian:def:159013769779761224629209000613837227197
title: CVE-2022-46874 firefox-esr
description:
A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.<br/>*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox < 108, Thunderbird < 102.6.1, Thunderbird < 102.6, and Firefox ESR < 102.6.


definition_id: oval:org.debian:def:103035246681197506589844895346475304463
title: CVE-2022-46877 firefox-esr
description:
By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 108.


definition_id: oval:org.debian:def:228858409040701197457587257956526473130
title: CVE-2022-46878 firefox-esr
description:
Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6.


definition_id: oval:org.debian:def:75557615140079343431983085202353579022
title: CVE-2022-46880 firefox-esr
description:
A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 105. This vulnerability affects Firefox ESR < 102.6, Firefox < 105, and Thunderbird < 102.6.


definition_id: oval:org.debian:def:268743603583831779720240974965110629082
title: CVE-2022-46881 firefox-esr
description:
An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 106, Firefox ESR < 102.6, and Thunderbird < 102.6.


definition_id: oval:org.debian:def:183212577849511785634585856409874052782
title: CVE-2022-46882 firefox-esr
description:
A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Firefox < 107, Firefox ESR < 102.6, and Thunderbird < 102.6.


definition_id: oval:org.debian:def:284406028505562610037335779095423671976
title: CVE-2022-4728 graphite-web
description:
A vulnerability has been found in Graphite Web and classified as problematic. This vulnerability affects unknown code of the component Cookie Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. VDB-216742 is the identifier assigned to this vulnerability.


definition_id: oval:org.debian:def:320795375499945283388317280200349485309
title: CVE-2022-4729 graphite-web
description:
A vulnerability was found in Graphite Web and classified as problematic. This issue affects some unknown processing of the component Template Name Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216743.


definition_id: oval:org.debian:def:235243785638546934181286484104171568993
title: CVE-2022-4730 graphite-web
description:
A vulnerability was found in Graphite Web. It has been classified as problematic. Affected is an unknown function of the component Absolute Time Range Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216744.


definition_id: oval:org.debian:def:337659061337920937221190253931135827106
title: CVE-2022-47318 ruby-git
description:
ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648.


definition_id: oval:org.debian:def:81331030957970909949461857891405072177
title: CVE-2022-4743 libsdl2
description:
A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected.


definition_id: oval:org.debian:def:2008662644699247859545760321078625980
title: CVE-2022-47518 linux-5.10
description:
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames.


definition_id: oval:org.debian:def:195302059773248537372812569212342737765
title: CVE-2022-47519 linux-5.10
description:
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames.


definition_id: oval:org.debian:def:331948195020796570762620048050012699049
title: CVE-2022-47520 linux-5.10
description:
An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet.


definition_id: oval:org.debian:def:305186908805687531118201194314547842818
title: CVE-2022-47521 linux-5.10
description:
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames.


definition_id: oval:org.debian:def:325519366289958328979725976062856462764
title: CVE-2022-47950 swift
description:
An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).


definition_id: oval:org.debian:def:152456081172259319891902859764829077339
title: CVE-2022-47951 cinder
description:
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.


definition_id: oval:org.debian:def:284795037631586538518728738808017424473
title: CVE-2022-48279 modsecurity-apache
description:
In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity (C language) codebase.


definition_id: oval:org.debian:def:137373558504821575641315785296037031254
title: CVE-2022-48281 tiff
description:
processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a crafted TIFF image.


definition_id: oval:org.debian:def:317619654370696111060723798502611559351
title: CVE-2023-0411 wireshark
description:
Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file


definition_id: oval:org.debian:def:214570295255895172460011080980280774067
title: CVE-2023-0412 wireshark
description:
TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file


definition_id: oval:org.debian:def:262012325048023190122249695041646521619
title: CVE-2023-0413 wireshark
description:
Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file


definition_id: oval:org.debian:def:205668549252312115704301221824932355884
title: CVE-2023-0415 wireshark
description:
iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file


definition_id: oval:org.debian:def:222596626635277836988030475369495299396
title: CVE-2023-0417 wireshark
description:
Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file


definition_id: oval:org.debian:def:53712012860566829134748223487841638818
title: CVE-2023-21835 openjdk-11
description:
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and  22.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via DTLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).


definition_id: oval:org.debian:def:8576107508013179970685401512011227165
title: CVE-2023-21843 openjdk-11
description:
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound).  Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf, 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and  22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).


definition_id: oval:org.debian:def:286244916425259652595339214110301372083
title: CVE-2023-22456 viewvc
description:
ViewVC, a browser interface for CVS and Subversion version control repositories, as a cross-site scripting vulnerability that affects versions prior to 1.2.2 and 1.1.29. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a Subversion repository exposed by an otherwise trusted ViewVC instance. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. Users should update to at least version 1.2.2 (if they are using a 1.2.x version of ViewVC) or 1.1.29 (if they are using a 1.1.x version). ViewVC 1.0.x is no longer supported, so users of that release lineage should implement a workaround. Users can edit their ViewVC EZT view templates to manually HTML-escape changed paths during rendering. Locate in your template set's `revision.ezt` file references to those changed paths, and wrap them with `[format "html"]` and `[end]`. For most users, that means that references to `[changes.path]` will become `[format "html"][changes.path][end]`. (This workaround should be reverted after upgrading to a patched version of ViewVC, else changed path names will be doubly escaped.)


definition_id: oval:org.debian:def:15321921084336717887786924332858927000
title: CVE-2023-22464 viewvc
description:
ViewVC is a browser interface for CVS and Subversion version control repositories. Versions prior to 1.2.3 and 1.1.30 are vulnerable to cross-site scripting. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a Subversion repository exposed by an otherwise trusted ViewVC instance. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. Users should update to at least version 1.2.3 (if they are using a 1.2.x version of ViewVC) or 1.1.30 (if they are using a 1.1.x version). ViewVC 1.0.x is no longer supported, so users of that release lineage should implement one of the following workarounds. Users can edit their ViewVC EZT view templates to manually HTML-escape changed path "copyfrom paths" during rendering. Locate in your template set's `revision.ezt` file references to those changed paths, and wrap them with `[format "html"]` and `[end]`. For most users, that means that references to `[changes.copy_path]` will become `[format "html"][changes.copy_path][end]`. (This workaround should be reverted after upgrading to a patched version of ViewVC, else "copyfrom path" names will be doubly escaped.)


definition_id: oval:org.debian:def:141508922932387431555364869471791904276
title: CVE-2023-22741 sofia-sip
description:
Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. In affected versions Sofia-SIP **lacks both message length and attributes length checks** when it handles STUN packets, leading to controllable heap-over-flow. For example, in stun_parse_attribute(), after we get the attribute's type and length value, the length will be used directly to copy from the heap, regardless of the message's left size. Since network users control the overflowed length, and the data is written to heap chunks later, attackers may achieve remote code execution by heap grooming or other exploitation methods. The bug was introduced 16 years ago in sofia-sip 1.12.4 (plus some patches through 12/21/2006) to in tree libs with git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@3774 d0543943-73ff-0310-b7d9-9358b9ac24b2. Users are advised to upgrade. There are no known workarounds for this vulnerability.


definition_id: oval:org.debian:def:60330937715253936612221054322385670686
title: CVE-2023-22809 sudo
description:
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.


definition_id: oval:org.debian:def:244665964381371283282898342108765030594
title: CVE-2023-23589 tor
description:
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002.


definition_id: oval:org.debian:def:24384305048884582857805240893723301594
title: CVE-2023-23969 python-django
description:
In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.


definition_id: oval:org.debian:def:277582283470372379132035298631580929018
title: CVE-2023-24021 modsecurity-apache
description:
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.


definition_id: oval:org.debian:def:3577052662553285897579187330724930954
title: CVE-2023-24038 libhtml-stripscripts-perl
description:
The HTML-StripScripts module through 1.06 for Perl allows _hss_attval_style ReDoS because of catastrophic backtracking for HTML content with certain style attributes.


# debians

cve_id: DSA-2892-1 a2ps
date: 2014-03-31 00:00:00+00:00
more_info:
Several vulnerabilities have been found in a2ps, an <q>Anything to PostScript</q> converter and pretty-printer. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2701-1 krb5
date: 2013-05-29 00:00:00+00:00
more_info:
It was discovered that the kpasswd service running on UDP port 464 could respond to response packets, creating a packet loop and a denial of service condition.


cve_id: DSA-3105-1 heirloom-mailx
date: 2014-12-16 00:00:00+00:00
more_info:
Two security vulnerabilities were discovered in Heirloom mailx, an  implementation of the <q>mail</q> command:


cve_id: DSA-2626-1 lighttpd
date: 2013-02-17 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in the TLS/SSL protocol. This update addresses these protocol vulnerabilities in lighttpd.


cve_id: DSA-3253-1 pound
date: 2015-05-07 00:00:00+00:00
more_info:
Pound, a HTTP reverse proxy and load balancer, had several issues related to vulnerabilities in the Secure Sockets Layer (SSL) protocol.


cve_id: DSA-2256-1 tiff
date: 2011-06-09 00:00:00+00:00
more_info:
Tavis Ormandy discovered that the Tag Image File Format (TIFF) library is vulnerable to a buffer overflow triggered by a crafted OJPEG file which allows for a crash and potentially execution of arbitrary code.


cve_id: DSA-2188-1 webkit
date: 2011-03-10 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in WebKit, a Web content engine library for GTK+. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2552-1 tiff
date: 2012-09-26 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in TIFF, a library set and tools  to support the Tag Image File Format (TIFF), allowing denial of service and potential privilege escalation.


cve_id: DSA-2645-1 inetutils
date: 2013-03-14 00:00:00+00:00
more_info:
Ovidiu Mara reported in 2010 a vulnerability in the ping util, commonly used by system and network administrators. By carefully crafting ICMP responses, an attacker could make the ping command hangs.


cve_id: DSA-2357-1 evince
date: 2011-12-03 00:00:00+00:00
more_info:
Jon Larimer from IBM X-Force Advanced Research discovered multiple vulnerabilities in the DVI backend of the Evince document viewer:


cve_id: DSA-2278-1 horde3
date: 2011-07-16 00:00:00+00:00
more_info:
It was discovered that horde3, the horde web application framework, is prone to a cross-site scripting attack and a cross-site request forgery.


cve_id: DSA-2170-1 mailman
date: 2011-02-18 00:00:00+00:00
more_info:
Two cross site scripting vulnerabilities were been discovered in Mailman, a web-based mailing list manager. These allowed an attacker to retrieve session cookies via inserting crafted JavaScript into confirmation messages (<a href="https://security-tracker.debian.org/tracker/CVE-2011-0707">CVE-2011-0707</a>) and in the list admin interface (<a href="https://security-tracker.debian.org/tracker/CVE-2010-3089">CVE-2010-3089</a>; oldstable only).


cve_id: DSA-2442-2 openarena
date: 2012-03-31 00:00:00+00:00
more_info:
It has been discovered that spoofed <q>getstatus</q> UDP requests are being sent by attackers to servers for use with games derived from the Quake 3 engine (such as openarena).  These servers respond with a packet flood to the victim whose IP address was impersonated by the attackers, causing a denial of service.


cve_id: DSA-2908-1 openssl
date: 2014-04-17 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in OpenSSL. The following Common Vulnerabilities and Exposures project ids identify them:


cve_id: DSA-3249-1 jqueryui
date: 2015-05-03 00:00:00+00:00
more_info:
Shadowman131 discovered that jqueryui, a JavaScript UI library for dynamic web applications, failed to properly sanitize its <q>title</q> option. This would allow a remote attacker to inject arbitrary code through cross-site scripting.


cve_id: DSA-2162-1 openssl
date: 2011-02-14 00:00:00+00:00
more_info:
Neel Mehta discovered that an incorrectly formatted ClientHello handshake message could cause OpenSSL to parse past the end of the message.  This allows an attacker to crash an application using OpenSSL by triggering an invalid memory access.  Additionally, some applications may be vulnerable to expose contents of a parsed OCSP nonce extension.


cve_id: DSA-2184-1 isc-dhcp
date: 2011-03-05 00:00:00+00:00
more_info:
It was discovered that the ISC DHCPv6 server does not correctly process requests which come from unexpected source addresses, leading to an assertion failure and a daemon crash.


cve_id: DSA-2208-1 bind9
date: 2011-03-30 00:00:00+00:00
more_info:
It was discovered that BIND, a DNS server, contains a race condition when processing zones updates in an authoritative server, either through dynamic DNS updates or incremental zone transfer (IXFR).  Such an update while processing a query could result in deadlock and denial of service.   (<a href="https://security-tracker.debian.org/tracker/CVE-2011-0414">\ CVE-2011-0414</a>)


cve_id: DSA-2177-1 pywebdav
date: 2011-03-02 00:00:00+00:00
more_info:
It was discovered that PyWebDAV, a WebDAV server implementation, contains several SQL injection vulnerabilities in the processing of user credentials.


cve_id: DSA-2181-1 subversion
date: 2011-03-04 00:00:00+00:00
more_info:
Philip Martin discovered that HTTP-based Subversion servers crash when processing lock requests on repositories which support unauthenticated read access.


cve_id: DSA-2167-1 phpmyadmin
date: 2011-02-16 00:00:00+00:00
more_info:
It was discovered that phpMyAdmin, a tool to administer MySQL over the web, when the bookmarks feature is enabled, allowed to create a bookmarked query which would be executed unintentionally by other users.


cve_id: DSA-2174-1 avahi
date: 2011-02-26 00:00:00+00:00
more_info:
It was discovered that Avahi, an implementation of the zeroconf protocol, can be crashed remotely by a single UDP packet, which may result in a denial of service.


cve_id: DSA-2182-1 logwatch
date: 2011-03-04 00:00:00+00:00
more_info:
Dominik George discovered that Logwatch does not guard against shell meta-characters in crafted log file names (such as those produced by Samba).  As a result, an attacker might be able to execute shell commands on the system running Logwatch.


cve_id: DSA-2202-1 apache2
date: 2011-03-23 00:00:00+00:00
more_info:
MPM_ITK is an alternative Multi-Processing Module for Apache HTTPD that is included in Debian's apache2 package.


cve_id: DSA-2214-1 ikiwiki
date: 2011-04-08 00:00:00+00:00
more_info:
Tango discovered that ikiwiki, a wiki compiler, is not validating if the htmlscrubber plugin is enabled or not on a page when adding alternative stylesheets to pages.  This enables an attacker who is able to upload custom stylesheets to add malicious stylesheets as an alternate stylesheet, or replace the default stylesheet, and thus conduct cross-site scripting attacks.


cve_id: DSA-2219-1 xmlsec1
date: 2011-04-18 00:00:00+00:00
more_info:
Nicolas Gregoire discovered that the XML Security Library xmlsec allowed remote attackers to create or overwrite arbitrary files through specially crafted XML files using the libxslt output extension and a ds:Transform element during signature verification.


cve_id: DSA-2319-1 policykit-1
date: 2011-10-08 00:00:00+00:00
more_info:
Neel Mehta discovered that a race condition in Policykit, a framework for managing administrative policies and privileges, allowed local users to elevate privileges by executing a setuid program from pkexec.


cve_id: DSA-2265-1 perl
date: 2011-06-20 00:00:00+00:00
more_info:
Mark Martinec discovered that Perl incorrectly clears the tainted flag on values returned by case conversion functions such as <q>lc</q>.  This may expose preexisting vulnerabilities in applications which use these functions while processing untrusted input.  No such applications are known at this stage.  Such applications will cease to work when this security update is applied because taint checks are designed to prevent such unsafe use of untrusted input data.


cve_id: DSA-2212-1 tmux
date: 2011-04-07 00:00:00+00:00
more_info:
Daniel Danner discovered that tmux, a terminal multiplexer, is not properly dropping group privileges.  Due to a patch introduced by Debian, when invoked with the -S option, tmux is not dropping permissions obtained through its setgid installation.


cve_id: DSA-2379-1 krb5
date: 2012-01-04 00:00:00+00:00
more_info:
It was discovered that the Key Distribution Center (KDC) in Kerberos 5 crashes when processing certain crafted requests:


cve_id: DSA-2254-1 oprofile
date: 2011-06-03 00:00:00+00:00
more_info:
OProfile is a performance profiling tool which is configurable by opcontrol, its control utility. Stephane Chauveau reported several ways to inject arbitrary commands in the arguments of this utility. If a local unprivileged user is authorized by sudoers file to run opcontrol as root, this user could use the flaw to escalate his privileges.


cve_id: DSA-2413-1 libarchive
date: 2012-02-20 00:00:00+00:00
more_info:
Two buffer overflows have been discovered in libarchive, a library providing a flexible interface for reading and writing archives in various formats. The possible buffer overflows while reading ISO 9660 or tar streams allow remote attackers to execute arbitrary code depending on the application that makes use of this functionality.


cve_id: DSA-2258-1 kolab-cyrus-imapd
date: 2011-06-11 00:00:00+00:00
more_info:
It was discovered that the STARTTLS implementation of the Kolab Cyrus IMAP server does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted IMAP, LMTP, NNTP and POP3 sessions by sending a cleartext command that is processed after TLS is in place.


cve_id: DSA-2391-1 phpmyadmin
date: 2012-01-22 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2271-1 curl
date: 2011-07-02 00:00:00+00:00
more_info:
Richard Silverman discovered that when doing GSSAPI authentication, libcurl unconditionally performs credential delegation. This hands the server a copy of the client's security credentials, allowing the server to impersonate the client to any other using the same GSSAPI mechanism. This is obviously a very sensitive operation, which should only be done when the user explicitly so directs.


cve_id: DSA-2329-1 torque
date: 2011-10-27 00:00:00+00:00
more_info:
Bartlomiej Balcerek discovered several buffer overflows in TORQUE server, a PBS-derived batch processing server.  This allows an attacker to crash the service or execute arbitrary code with privileges of the server via crafted job or host names.


cve_id: DSA-2290-1 samba
date: 2011-08-07 00:00:00+00:00
more_info:
The Samba Web Administration Tool (SWAT) contains several cross-site request  forgery (CSRF) vulnerabilities  (<a href="https://security-tracker.debian.org/tracker/CVE-2011-2522">\ CVE-2011-2522</a>) and a cross-site scripting vulnerability  (<a href="https://security-tracker.debian.org/tracker/CVE-2011-2694">\ CVE-2011-2694</a>).


cve_id: DSA-2369-1 libsoup2.4
date: 2011-12-21 00:00:00+00:00
more_info:
It was discovered that libsoup, a HTTP library implementation in C, is not properly validating input when processing requests made to SoupServer. A remote attacker can exploit this flaw to access system files via a directory traversal attack.


cve_id: DSA-2276-1 asterisk
date: 2011-07-10 00:00:00+00:00
more_info:
Paul Belanger reported a vulnerability in Asterisk identified as <a href="http://downloads.asterisk.org/pub/security/AST-2011-008.html">AST-2011-008</a> (<a href="https://security-tracker.debian.org/tracker/CVE-2011-2529">CVE-2011-2529</a>) through which an unauthenticated attacker may crash an Asterisk server remotely. A package containing a NULL char causes the SIP header parser to alter unrelated memory structures.


cve_id: DSA-2380-1 foomatic-filters
date: 2012-01-04 00:00:00+00:00
more_info:
It was discovered that the foomatic-filters, a support package for setting up printers, allowed authenticated users to submit crafted print jobs which would execute shell commands on the print servers.


cve_id: DSA-2327-1 libfcgi-perl
date: 2011-10-24 00:00:00+00:00
more_info:
Ferdinand Smit discovered that FCGI, a Perl module for writing FastCGI applications, is incorrectly restoring environment variables of a prior request in subsequent requests.  In some cases this may lead to authentication bypasses or worse.


cve_id: DSA-2335-1 man2html
date: 2011-11-05 00:00:00+00:00
more_info:
Tim Starling discovered that the Debian-native CGI wrapper for man2html, a program to convert UNIX man pages to HTML, is not properly escaping user-supplied input when displaying various error messages.  A remote attacker can exploit this flaw to conduct cross-site scripting (XSS) attacks.


cve_id: DSA-2354-1 cups
date: 2011-11-28 00:00:00+00:00
more_info:
Petr Sklenar and Tomas Hoger discovered that missing input sanitising in the GIF decoder inside the CUPS printing system could lead to denial of service or potentially arbitrary code execution through crafted GIF files.


cve_id: DSA-2655-1 rails
date: 2013-03-28 00:00:00+00:00
more_info:
Several cross-site-scripting and denial of service vulnerabilities were discovered in Ruby on Rails, a Ruby framework for web application development.


cve_id: DSA-3260-1 iceweasel
date: 2015-05-13 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser:  Multiple memory safety errors, buffer overflows and use-after-frees may lead to the execution of arbitrary code, privilege escalation or denial of service.


cve_id: DSA-2582-1 xen
date: 2012-12-07 00:00:00+00:00
more_info:
Multiple denial of service vulnerabilities have been discovered in the Xen Hypervisor. One of the issue (<a href="https://security-tracker.debian.org/tracker/CVE-2012-5513">CVE-2012-5513</a>) could even lead to privilege escalation from guest to host.


cve_id: DSA-2304-1 squid3
date: 2011-09-11 00:00:00+00:00
more_info:
Ben Hawkes discovered that SquidÂ 3, a full featured Web Proxy cache (HTTP proxy), is vulnerable to a buffer overflow when processing Gopher server replies.  An attacker can exploit this flaw by connecting to a Gopher server that returns lines longer than 4096 bytes.  This may result in denial of service conditions (daemon crash) or the possibly the execution of arbitrary code with rights of the squid daemon.


cve_id: DSA-2302-1 bcfg2
date: 2011-09-07 00:00:00+00:00
more_info:
It has been discovered that the Bcfg2 server, a configuration management server for Bcfg2 clients, is not properly sanitizing input from Bcfg2 clients before passing it to various shell commands.  This enables an attacker in control of a Bcfg2 client to execute arbitrary commands on the server with root privileges.


cve_id: DSA-2316-1 quagga
date: 2011-10-05 00:00:00+00:00
more_info:
Riku Hietamaki, Tuomo Untinen and Jukka Taimisto discovered several vulnerabilities in Quagga, an Internet routing daemon:


cve_id: DSA-2377-1 cyrus-imapd-2.2
date: 2012-01-01 00:00:00+00:00
more_info:
It was discovered that cyrus-imapd, a highly scalable mail system designed for use in enterprise environments, is not properly parsing mail headers when a client makes use of the IMAP threading feature.  As a result, a NULL pointer is dereferenced which crashes the daemon.  An attacker can trigger this by sending a mail containing crafted reference headers and access the mail with a client that uses the server threading feature of IMAP.


cve_id: DSA-2323-1 radvd
date: 2011-10-26 00:00:00+00:00
more_info:
Multiple security issues were discovered by Vasiliy Kulikov in radvd, an IPv6 Router Advertisement daemon:


cve_id: DSA-2314-1 puppet
date: 2011-10-03 00:00:00+00:00
more_info:
Multiple security issues have been discovered in Puppet, a centralized configuration management system.  The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3003-1 libav
date: 2014-08-10 00:00:00+00:00
more_info:
Several security issues have been corrected in multiple demuxers and  decoders of the libav multimedia library. A full list of the changes is  available at  <a href="http://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v0.8.15">\ http://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v0.8.15</a> 


cve_id: DSA-2855-1 libav
date: 2014-02-05 00:00:00+00:00
more_info:
Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library. The IDs mentioned above are just a portion of the security issues fixed in this update. A full list of the changes is available at <a href="http://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v0.8.10">http://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v0.8.10</a>


cve_id: DSA-2381-1 squid3
date: 2012-01-06 00:00:00+00:00
more_info:
It was discovered that the IPv6 support code in Squid does not properly handle certain DNS responses, resulting in deallocation of an invalid pointer and a daemon crash.


cve_id: DSA-2344-1 python-django-piston
date: 2011-11-11 00:00:00+00:00
more_info:
It was discovered that the Piston framework can deserializes untrusted YAML and Pickle data, leading to remote code execution (<a href="https://security-tracker.debian.org/tracker/CVE-2011-4103">CVE-2011-4103</a>). 


cve_id: DSA-2332-1 python-django
date: 2011-10-29 00:00:00+00:00
more_info:
Paul McMillan, Mozilla and the Django core team discovered several vulnerabilities in Django, a Python web framework:


cve_id: DSA-2359-1 mojarra
date: 2011-12-06 00:00:00+00:00
more_info:
It was discovered that Mojarra, an implementation of JavaServer Faces, evaluates untrusted values as EL expressions if includeViewParameters is set to true.


cve_id: DSA-2370-1 unbound
date: 2011-12-22 00:00:00+00:00
more_info:
It was discovered that Unbound, a recursive DNS resolver, would crash when processing certain malformed DNS responses from authoritative DNS servers, leading to denial of service.


cve_id: DSA-2425-1 plib
date: 2012-03-04 00:00:00+00:00
more_info:
It was discovered that PLIB, a library used by TORCS, contains a buffer overflow in error message processing, which could allow remote attackers to execute arbitrary code.


cve_id: DSA-2832-1 memcached
date: 2014-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities have been found in memcached, a high-performance memory object caching system. The Common Vulnerabilities and Exposures project identifies the following issues:


cve_id: DSA-2392-1 openssl
date: 2012-01-23 00:00:00+00:00
more_info:
Antonio Martin discovered a denial-of-service vulnerability in OpenSSL, an implementation of TLS and related protocols.  A malicious client can cause the DTLS server implementation to crash.  Regular, TCP-based TLS is not affected by this issue.


cve_id: DSA-2452-1 apache2
date: 2012-04-15 00:00:00+00:00
more_info:
Niels Heinen noticed a security issue with the default Apache configuration on Debian if certain scripting modules like mod_php or mod_rivet are installed. The problem arises because the directory /usr/share/doc, which is mapped to the URL /doc, may contain example scripts that can be executed by requests to this URL. Although access to the URL /doc is restricted to connections from localhost, this still creates security issues in two specific configurations:


cve_id: DSA-2508-1 kfreebsd-8
date: 2012-07-22 00:00:00+00:00
more_info:
Rafal Wojtczuk from Bromium discovered that FreeBSD wasn't handling correctly uncanonical return addresses on Intel amd64 CPUs, allowing privilege escalation to kernel for local users.


cve_id: DSA-2490-1 nss
date: 2012-06-07 00:00:00+00:00
more_info:
Kaspar Brand discovered that Mozilla's Network Security Services (NSS) libraries did insufficient length checking in the QuickDER decoder, allowing to crash a program using the libraries.


cve_id: DSA-2496-1 mysql-5.1
date: 2012-06-18 00:00:00+00:00
more_info:
    Due to the non-disclosure of security patch information from Oracle,    we are forced to ship an upstream version update of MySQL 5.1.    There are several known incompatible    changes, which are listed in /usr/share/doc/mysql-server/NEWS.Debian.gz. 


cve_id: DSA-2576-1 trousers
date: 2012-11-23 00:00:00+00:00
more_info:
Andy Lutomirski discovered that tcsd (the TPM userspace daemon) was missing input validation. Using carefully crafted input, it can lead to a denial of service by making the daemon crash with a segmentation fault.


cve_id: DSA-2651-1 smokeping
date: 2013-03-20 00:00:00+00:00
more_info:
A cross-site scripting vulnerability was discovered in smokeping, a latency logging and graphing system. Input passed to the <q>displaymode</q> parameter was not properly sanitized. An attacker could use this flaw to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.


cve_id: DSA-2449-1 sqlalchemy
date: 2012-04-12 00:00:00+00:00
more_info:
It was discovered that SQLAlchemy, an SQL toolkit and object relational mapper for Python, is not sanitizing input passed to the limit/offset keywords to select() as well as the value passed to select.limit()/offset(). This allows an attacker to perform SQL injection attacks against applications using SQLAlchemy that do not implement their own filtering.


cve_id: DSA-2624-1 ffmpeg
date: 2013-02-16 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in FFmpeg, a multimedia player, server and encoder. Multiple input validations in the decoders/demuxers for Shorten, Chinese AVS video, VP5, VP6, AVI, AVS and MPEG-1/2 files could lead to the execution of arbitrary code.


cve_id: DSA-2411-1 mumble
date: 2012-02-19 00:00:00+00:00
more_info:
It was discovered that Mumble, a VoIP client, does not properly manage permissions on its user-specific configuration files, allowing other local users on the system to access them.


cve_id: DSA-2525-1 expat
date: 2012-08-06 00:00:00+00:00
more_info:
It was discovered that Expat, a C library to parse XML, is vulnerable to denial of service through hash collisions and a memory leak in pool handling.


cve_id: DSA-2456-1 dropbear
date: 2012-04-23 00:00:00+00:00
more_info:
Danny Fullerton discovered a use-after-free in the Dropbear SSH daemon, resulting in potential execution of arbitrary code. Exploitation is limited to users, who have been authenticated through public key authentication and for which command restrictions are in place.


cve_id: DSA-2518-1 krb5
date: 2012-07-31 00:00:00+00:00
more_info:
Emmanuel Bouillon from NCI Agency discovered multiple vulnerabilities in MIT Kerberos, a daemon implementing the network authentication protocol.


cve_id: DSA-2466-1 rails
date: 2012-05-09 00:00:00+00:00
more_info:
Sergey Nartimov discovered that in Rails, a Ruby based framework for web development, when developers generate html options tags manually, user input concatenated with manually built tags may not be escaped and an attacker can inject arbitrary HTML into the document.


cve_id: DSA-2473-1 openoffice.org
date: 2012-05-16 00:00:00+00:00
more_info:
Tielei Wang discovered that OpenOffice.org does not allocate a large enough memory region when processing a specially crafted JPEG object, leading to a heap-based buffer overflow and potentially arbitrary code execution.


cve_id: DSA-2482-1 libgdata
date: 2012-06-02 00:00:00+00:00
more_info:
Vreixo Formoso discovered that libgdata, a library used to access various Google services, wasn't validating certificates against trusted system root CAs when using an HTTPS connection.


cve_id: DSA-2497-1 quagga
date: 2012-06-20 00:00:00+00:00
more_info:
It was discovered that Quagga, a routing daemon, contains a vulnerability in processing the ORF capability in BGP OPEN messages. A malformed OPEN message from a previously configured BGP peer could cause bgpd to crash, causing a denial of service.


cve_id: DSA-2448-1 inspircd
date: 2012-04-10 00:00:00+00:00
more_info:
It was discovered that a heap-based buffer overflow in InspIRCd could allow remote attackers to execute arbitrary code via a crafted DNS query.


cve_id: DSA-2451-1 puppet
date: 2012-04-13 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in Puppet, a centralized configuration management system.  The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2528-1 icedove
date: 2012-08-14 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Icedove, Debian's version of the Mozilla Thunderbird mail and news client.


cve_id: DSA-2553-1 iceweasel
date: 2012-09-24 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in Iceweasel, a web browser based on Firefox. The included XULRunner library provides rendering services for several other applications included in Debian.


cve_id: DSA-2453-1 gajim
date: 2012-04-16 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in Gajim, a feature-rich Jabber client.  The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2461-1 spip
date: 2012-04-26 00:00:00+00:00
more_info:
Several vulnerabilities have been found in SPIP, a website engine for publishing, resulting in cross-site scripting, script code injection and bypass of restrictions.


cve_id: DSA-2498-1 dhcpcd
date: 2012-06-23 00:00:00+00:00
more_info:
It was discovered that dhcpcd, a DHCP client, was vulnerable to a stack overflow. A malformed DHCP message could crash the client, causing a denial of service, and potentially remote code execution through properly designed malicous DHCP packets.


cve_id: DSA-2550-2 asterisk
date: 2012-09-26 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Asterisk, a PBX and telephony toolkit, allowing privilege escalation in the Asterisk Manager, denial of service or privilege escalation.


cve_id: DSA-2578-1 rssh
date: 2012-11-28 00:00:00+00:00
more_info:
James Clawson discovered that rssh, a restricted shell for OpenSSH to be used with scp, sftp, rdist and cvs, was not correctly filtering command line options. This could be used to force the execution of a remote script and thus allow arbitrary command execution. Two CVE were assigned:


cve_id: DSA-2475-1 openssl
date: 2012-05-17 00:00:00+00:00
more_info:
It was discovered that openssl did not correctly handle explicit Initialization Vectors for CBC encryption modes, as used in TLS 1.1, 1.2, and DTLS. An incorrect calculation would lead to an integer underflow and incorrect memory access, causing denial of service (application crash.)


cve_id: DSA-2467-1 mahara
date: 2012-05-09 00:00:00+00:00
more_info:
It was discovered that Mahara, the portfolio, weblog, and resume builder, had an insecure default with regards to SAML-based authentication used with more than one SAML identity provider. Someone with control over one IdP could impersonate users from other IdP's.


cve_id: DSA-2476-1 pidgin-otr
date: 2012-05-19 00:00:00+00:00
more_info:
intrigeri discovered a format string error in pidgin-otr, an Off-the-Record Messaging plugin for Pidgin.


cve_id: DSA-2492-1 php5
date: 2012-06-10 00:00:00+00:00
more_info:
The Phar extension for PHP does not properly handle crafted tar files, leading to a heap-based buffer overflow.  PHP applications processing tar files could crash or, potentially, execute arbitrary code.


cve_id: DSA-2483-1 strongswan
date: 2012-05-31 00:00:00+00:00
more_info:
An authentication bypass issue was discovered by the Codenomicon CROSS project in strongSwan, an IPsec-based VPN solution. When using RSA-based setups, a missing check in the gmp plugin could allow an attacker presenting a forged signature to successfully authenticate against a strongSwan responder.


cve_id: DSA-2481-1 arpwatch
date: 2012-06-02 00:00:00+00:00
more_info:
Steve Grubb from Red Hat discovered that a patch for arpwatch (as shipped at least in Red Hat and Debian distributions) in order to make it drop root privileges would fail to do so and instead add the root group to the list of the daemon uses.


cve_id: DSA-2520-1 openoffice.org
date: 2012-08-01 00:00:00+00:00
more_info:
Timo Warns from PRE-CERT discovered multiple heap-based buffer overflows in OpenOffice.org, an office productivity suite. The issues lies in the XML manifest encryption tag parsing code. Using specially crafted files, an attacker can cause application crash and could cause arbitrary code execution.


cve_id: DSA-2506-1 libapache-mod-security
date: 2012-07-02 00:00:00+00:00
more_info:
Qualys Vulnerability &amp; Malware Research Labs discovered a vulnerability in ModSecurity, a security module for the Apache webserver. In situations where both <q>Content:Disposition: attachment</q> and <q>Content-Type: multipart</q> were present in HTTP headers, the vulnerability could allow an attacker to bypass policy and execute cross-site script (XSS) attacks through properly crafted HTML documents.


cve_id: DSA-2535-1 rtfm
date: 2012-08-29 00:00:00+00:00
more_info:
It was discovered that rtfm, the Request Tracker FAQ Manager, contains multiple cross-site scripting vulnerabilities in the topic administration page.


cve_id: DSA-2521-1 libxml2
date: 2012-08-04 00:00:00+00:00
more_info:
Jueri Aedla discovered several integer overflows in libxml, which could lead to the execution of arbitrary code or denial of service.


cve_id: DSA-2559-1 libexif
date: 2012-10-11 00:00:00+00:00
more_info:
Several vulnerabilities were found in libexif, a library used to parse EXIF meta-data on camera files.


cve_id: DSA-2581-1 mysql-5.1
date: 2012-12-04 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to a new upstream version, 5.1.66, which includes additional changes, such as performance improvements and corrections for data loss defects.  These changes are described in the  <a href="http://dev.mysql.com/doc/refman/5.1/en/news-5-1-66.html">\ MySQL release notes</a>. 


cve_id: DSA-2594-1 virtualbox-ose
date: 2012-12-30 00:00:00+00:00
more_info:
<q>halfdog</q> discovered that incorrect interrupt handling in VirtualBox, a x86 virtualization solution, can lead to denial of service.


cve_id: DSA-2523-1 globus-gridftp-server
date: 2012-08-06 00:00:00+00:00
more_info:
It was discovered that the GridFTP component from the Globus Toolkit, a toolkit used for building Grid systems and applications, performed insufficient validation of a name lookup, which could lead to privilege escalation.


cve_id: DSA-2510-1 extplorer
date: 2012-07-12 00:00:00+00:00
more_info:
John Leitch has discovered a vulnerability in eXtplorer, a very feature rich web server file manager, which can be exploited by malicious people to conduct cross-site request forgery attacks.


cve_id: DSA-2509-1 pidgin
date: 2012-07-08 00:00:00+00:00
more_info:
Ulf H&auml;rnhammar found a buffer overflow in Pidgin, a multi protocol instant messaging client. The vulnerability can be exploited by an incoming  message in the MXit protocol plugin. A remote attacker may cause a crash, and in some circumstances can lead to remote code execution.


cve_id: DSA-2610-1 ganglia
date: 2013-01-21 00:00:00+00:00
more_info:
Insufficient input sanitization in Ganglia, a web based monitoring system, could lead to remote PHP script execution with permissions of the user running the web server.


cve_id: DSA-2541-1 beaker
date: 2012-09-07 00:00:00+00:00
more_info:
It was discovered that Beaker, a cache and session library for Python, when using the python-crypto backend, is vulnerable to information disclosure due to a cryptographic weakness related to the use of the AES cipher in ECB mode.


cve_id: DSA-2526-1 libotr
date: 2012-08-12 00:00:00+00:00
more_info:
Just Ferguson discovered that libotr, an off-the-record (OTR) messaging library, can be forced to perform zero-length allocations for heap buffers that are used in base64 decoding routines.  An attacker can exploit this flaw by sending crafted messages to an application that is using libotr to perform denial of service attacks or potentially execute arbitrary code.


cve_id: DSA-2603-1 emacs23
date: 2013-01-09 00:00:00+00:00
more_info:
Paul Ling discovered that Emacs insufficiently restricted the evaluation of Lisp code if enable-local-variables is set to <q>safe</q>.


cve_id: DSA-2564-1 tinyproxy
date: 2012-10-23 00:00:00+00:00
more_info:
gpernot discovered that Tinyproxy, a HTTP proxy, is vulnerable to a denial of service by remote attackers by sending crafted request headers.


cve_id: DSA-2551-1 isc-dhcp
date: 2012-09-23 00:00:00+00:00
more_info:
Glen Eustace discovered that the ISC DHCP server, a server for automatic IP address assignment, is not properly handling changes in the expiration times of a lease.  An attacker may use this flaw to crash the service and cause denial of service conditions, by reducing the expiration time of an active IPv6 lease.


cve_id: DSA-2569-1 icedove
date: 2012-10-29 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in Icedove, Debian's version of the Mozilla Thunderbird mail client.  The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2522-1 fckeditor
date: 2012-08-05 00:00:00+00:00
more_info:
Emilio Pinna discovered a cross site scripting vulnerability in the spellchecker.php page of FCKeditor, a popular HTML/DHTML editor for the web.


cve_id: DSA-2584-1 iceape
date: 2012-12-08 00:00:00+00:00
more_info:
Multiple vulnerabilities have been found in Iceape, the Debian Internet suite based on Mozilla Seamonkey:


cve_id: DSA-2583-1 iceweasel
date: 2012-12-08 00:00:00+00:00
more_info:
Multiple vulnerabilities have been found in Iceweasel, the Debian web browser based on Mozilla Firefox:


cve_id: DSA-2570-1 openoffice.org
date: 2012-10-31 00:00:00+00:00
more_info:
High-Tech Bridge SA Security Research Lab discovered multiple null-pointer dereferences based vulnerabilities in OpenOffice.org which could cause application crash or even arbitrary code execution using specially crafted files. Affected file types are LWP (Lotus Word Pro), ODG, PPT (PowerPoint 2003) and XLS (Excel 2003).


cve_id: DSA-2595-1 ghostscript
date: 2012-12-30 00:00:00+00:00
more_info:
Marc Schoenefeld discovered that an integer overflow in the ICC parsing code of Ghostscript can lead to the execution of arbitrary code.


cve_id: DSA-2561-1 tiff
date: 2012-10-21 00:00:00+00:00
more_info:
It was discovered that a buffer overflow in libtiff's parsing of files using PixarLog compression could lead to the execution of arbitrary code.


cve_id: DSA-2760-1 chrony
date: 2013-09-18 00:00:00+00:00
more_info:
Florian Weimer discovered two security problems in the Chrony time synchronisation software (buffer overflows and use of uninitialised data in command replies).


cve_id: DSA-2571-1 libproxy
date: 2012-11-04 00:00:00+00:00
more_info:
The Red Hat Security Response Team discovered that libproxy, a library for automatic proxy configuration management, applied insufficient validation to the Content-Length header sent by a server providing a proxy.pac file. Such remote server could trigger an integer overflow and consequently overflow an in-memory buffer.


cve_id: DSA-2573-1 radsecproxy
date: 2012-11-10 00:00:00+00:00
more_info:
Ralf Paffrath reported that Radsecproxy, a RADIUS protocol proxy, mixed up  pre- and post-handshake verification of clients. This vulnerability may wrongly accept clients without checking their certificate chain under  certain configurations.


cve_id: DSA-2636-2 xen
date: 2013-03-03 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2592-1 elinks
date: 2012-12-28 00:00:00+00:00
more_info:
Marko Myllynen discovered that ELinks, a powerful text-mode browser, incorrectly delegates user credentials during GSS-Negotiate.


cve_id: DSA-2671-1 request-tracker4
date: 2013-05-22 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in Request Tracker, an extensible trouble-ticket tracking system. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2627-1 nginx
date: 2013-02-17 00:00:00+00:00
more_info:
Juliano Rizzo and Thai Duong discovered a weakness in the TLS/SSL protocol when using compression. This side channel attack, dubbed <q>CRIME</q>, allows eavesdroppers to gather information to recover the original plaintext in the protocol. This update to nginx disables SSL compression.


cve_id: DSA-2585-1 bogofilter
date: 2012-12-11 00:00:00+00:00
more_info:
A heap-based buffer overflow was discovered in bogofilter, a software package for classifying mail messages as spam or non-spam.  Crafted mail messages with invalid base64 data could lead to heap corruption and, potentially, arbitrary code execution.


cve_id: DSA-2600-1 cups
date: 2013-01-06 00:00:00+00:00
more_info:
Jann Horn discovered that users of the CUPS printing system who are part of the lpadmin group could modify several configuration parameters with security impact.  Specifically, this allows an attacker to read or write arbitrary files as root which can be used to elevate privileges.


cve_id: DSA-2589-1 tiff
date: 2012-12-16 00:00:00+00:00
more_info:
The tiff library for handling TIFF image files contained a stack-based buffer overflow, potentially allowing attackers who can submit such files to a vulnerable system to execute arbitrary code.


cve_id: DSA-3054-1 mysql-5.5
date: 2014-10-20 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.40. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-2631-1 squid3
date: 2013-02-24 00:00:00+00:00
more_info:
Squid3, a fully featured Web proxy cache, is prone to a denial of service attack due to memory consumption caused by memory leaks in cachemgr.cgi:


cve_id: DSA-2602-1 zendframework
date: 2013-01-08 00:00:00+00:00
more_info:
Yury Dyachenko discovered that Zend Framework uses the PHP XML parser in an insecure way, allowing attackers to open files and trigger HTTP requests, potentially accessing restricted information.


cve_id: DSA-2566-1 exim4
date: 2012-10-25 00:00:00+00:00
more_info:
It was discovered that Exim, a mail transport agent, is not properly handling the decoding of DNS records for DKIM.  Specifically, crafted records can yield to a heap-based buffer overflow.  An attacker can exploit this flaw to execute arbitrary code.


cve_id: DSA-2614-1 libupnp
date: 2013-02-01 00:00:00+00:00
more_info:
Multiple stack-based buffer overflows were discovered in libupnp, a library used for handling the Universal Plug and Play protocol. HD Moore from Rapid7 discovered that SSDP queries where not correctly handled by the unique_service_name() function.


cve_id: DSA-2615-1 libupnp4
date: 2013-02-01 00:00:00+00:00
more_info:
Multiple stack-based buffer overflows were discovered in libupnp4, a library used for handling the Universal Plug and Play protocol. HD Moore from Rapid7 discovered that SSDP queries where not correctly handled by the unique_service_name() function.


cve_id: DSA-2612-2 ircd-ratbox
date: 2013-02-10 00:00:00+00:00
more_info:
It was discovered that a bug in the server capability negotiation code of ircd-ratbox could result in denial of service.


cve_id: DSA-2601-1 gnupg, gnupg2
date: 2013-01-06 00:00:00+00:00
more_info:
KB Sriram discovered that GnuPG, the GNU Privacy Guard did not sufficiently sanitise public keys on import, which could lead to memory and keyring corruption.


cve_id: DSA-2653-1 icinga
date: 2013-03-26 00:00:00+00:00
more_info:
It was discovered that Icinga, a host and network monitoring system, contains several buffer overflows in the history.cgi CGI program.


cve_id: DSA-2654-1 libxslt
date: 2013-04-03 00:00:00+00:00
more_info:
Nicolas Gregoire discovered that libxslt, an XSLT processing runtime library, is prone to denial of service vulnerabilities via crafted XSL stylesheets.


cve_id: DSA-3168-1 ruby-redcloth
date: 2015-02-22 00:00:00+00:00
more_info:
Kousuke Ebihara discovered that redcloth, a Ruby module used to convert Textile markup to HTML, did not properly sanitize its input. This allowed a remote attacker to perform a cross-site scripting attack by injecting arbitrary JavaScript code into the generated HTML.


cve_id: DSA-3534-1 dhcpcd
date: 2016-03-29 00:00:00+00:00
more_info:
Guido Vranken discovered several vulnerabilities in dhcpcd, a DHCP client, which may result in denial of service.


cve_id: DSA-2669-1 linux
date: 2013-05-15 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leak or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2622-1 polarssl
date: 2013-02-13 00:00:00+00:00
more_info:
Multiple vulnerabilities have been found in PolarSSL. The Common Vulnerabilities and Exposures project identifies the following issues:


cve_id: DSA-2829-1 hplip
date: 2013-12-28 00:00:00+00:00
more_info:
Multiple vulnerabilities have been found in the HP Linux Printing and Imaging System: Insecure temporary files, insufficient permission checks in PackageKit and the insecure hp-upgrade service has been disabled.


cve_id: DSA-2611-1 movabletype-opensource
date: 2013-01-22 00:00:00+00:00
more_info:
An input sanitation problem has been found in upgrade functions of movabletype-opensource, a web-based publishing platform. Using carefully crafted requests to the mt-upgrade.cgi file, it would be possible to inject OS command and SQL queries.


cve_id: DSA-2617-1 samba
date: 2013-02-02 00:00:00+00:00
more_info:
Jann Horn had reported two vulnerabilities in Samba, a popular cross-platform network file and printer sharing suite. In particular, these vulnerabilities affect to SWAT, the Samba Web Administration Tool.


cve_id: DSA-2640-1 zoneminder
date: 2013-03-14 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in zoneminder, a Linux video camera security and surveillance solution. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2618-1 ircd-hybrid
date: 2013-02-07 00:00:00+00:00
more_info:
Bob Nomnomnom reported a Denial of Service vulnerability in IRCD-Hybrid, an Internet Relay Chat server. A remote attacker may use an error in the masks validation and crash the server.


cve_id: DSA-2630-1 postgresql-8.4
date: 2013-02-20 00:00:00+00:00
more_info:
Sumit Soni discovered that PostgreSQL, an object-relational SQL database, could be forced to crash when an internal function was called with invalid arguments, resulting in denial of service.


cve_id: DSA-2628-1 nss-pam-ldapd
date: 2013-06-18 00:00:00+00:00
more_info:
Garth Mollett discovered that a file descriptor overflow issue in the use of FD_SET() in nss-pam-ldapd, which provides NSS and PAM modules for using LDAP as a naming service, can lead to a stack-based buffer overflow. An attacker could, under some circumstances, use this flaw to cause a process that has the NSS or PAM module loaded to crash or potentially execute arbitrary code.


cve_id: DSA-2652-1 libxml2
date: 2013-03-24 00:00:00+00:00
more_info:
Brad Hill of iSEC Partners discovered that many XML implementations are vulnerable to external entity expansion issues, which can be used for various purposes such as firewall circumvention, disguising an IP address, and denial-of-service.  libxml2 was susceptible to these problems when performing string substitution during entity expansion.


cve_id: DSA-2599-1 nss
date: 2013-01-06 00:00:00+00:00
more_info:
Google, Inc. discovered that the TurkTrust certification authority included in the Network Security Service libraries (nss) mis-issued two intermediate CAs which could be used to generate rogue end-entity certificates. This update explicitly distrusts those two intermediate CAs. The two existing TurkTrust root CAs remain active.


cve_id: DSA-2699-1 iceweasel
date: 2013-06-02 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version  of the Mozilla Firefox web browser: Multiple memory safety errors,  missing input sanitising vulnerabilities, use-after-free vulnerabilities,  buffer overflows and other programming errors may lead to the execution  of arbitrary code, privilege escalation, information leaks or  cross-site-scripting.


cve_id: DSA-2720-1 icedove
date: 2013-07-06 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client. Multiple memory safety errors, use-after-free vulnerabilities, missing permission checks, incorrect memory handling and other implementation errors may lead to the execution of arbitrary code, privilege escalation, information disclosure or cross-site request forgery.


cve_id: DSA-2793-1 libav
date: 2013-11-09 00:00:00+00:00
more_info:
Several security issues have been corrected in multiple demuxers and  decoders of the libav multimedia library. The CVE IDs mentioned above are  just a small portion of the security issues fixed in this update. A full list of the changes is available at <a href="http://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v0.8.9">http://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v0.8.9</a>


cve_id: DSA-2786-1 icu
date: 2013-10-27 00:00:00+00:00
more_info:
The Google Chrome Security Team discovered two issues (a race condition and a use-after-free issue) in the International Components for Unicode (ICU) library.


cve_id: DSA-2635-1 cfingerd
date: 2013-03-01 00:00:00+00:00
more_info:
Malcolm Scott discovered a remote-exploitable buffer overflow in the RFC1413 (ident) client of cfingerd, a configurable finger daemon. This vulnerability was introduced in a previously applied patch to the cfingerd package in 1.4.3-3.


cve_id: DSA-2649-1 lighttpd
date: 2013-03-15 00:00:00+00:00
more_info:
Stefan BĂźhler discovered that the Debian specific configuration file for lighttpd webserver FastCGI PHP support used a fixed socket name in the world-writable /tmp directory. A symlink attack or a race condition could be exploited by a malicious user on the same machine to take over the PHP control socket and for example force the webserver to use a different PHP version.


cve_id: DSA-2663-1 tinc
date: 2013-04-22 00:00:00+00:00
more_info:
Martin Schobert discovered a stack-based vulnerability in tinc, a Virtual Private Network (VPN) daemon.


cve_id: DSA-2702-1 telepathy-gabble
date: 2013-06-03 00:00:00+00:00
more_info:
Maksim Otstavnov discovered that the Wocky submodule used by telepathy-gabble, the Jabber/XMPP connection manager for the Telepathy framework, does not respect the tls-required flag on legacy Jabber servers. A network intermediary could use this vulnerability to bypass TLS verification and perform a man-in-the-middle attack.


cve_id: DSA-3006-1 xen
date: 2014-08-18 00:00:00+00:00
more_info:
Multiple security issues have been discovered in the Xen virtualisation  solution which may result in information leaks or denial of service.


cve_id: DSA-2739-1 cacti
date: 2013-08-21 00:00:00+00:00
more_info:
Two security issues (SQL injection and command line injection via SNMP settings) were found in Cacti, a web interface for graphing of monitoring  systems. 


cve_id: DSA-2748-1 exactimage
date: 2013-09-01 00:00:00+00:00
more_info:
Several denial-of-service vulnerabilities were discovered in the dcraw code base, a program for procesing raw format images from digital cameras.  This update corrects them in the copy that is embedded in the exactimage package.


cve_id: DSA-2754-1 exactimage
date: 2013-09-10 00:00:00+00:00
more_info:
It was discovered that exactimage, a fast image processing library, does not correctly handle error conditions of the embedded copy of dcraw. This could result in a crash or other behaviour in an application using the library due to an uninitialized variable being passed to longjmp.


cve_id: DSA-2758-1 python-django
date: 2013-09-17 00:00:00+00:00
more_info:
It was discovered that python-django, a high-level Python web develompent framework, is prone to a denial of service vulnerability via large passwords.


cve_id: DSA-2781-1 python-crypto
date: 2013-10-18 00:00:00+00:00
more_info:
A cryptographic vulnerability was discovered in the pseudo random number generator in python-crypto.


cve_id: DSA-2808-1 openjpeg
date: 2013-12-03 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in OpenJPEG, a JPEG 2000 image library, that may lead to denial of service (<a href="https://security-tracker.debian.org/tracker/CVE-2013-1447">CVE-2013-1447</a>) via application crash or high memory consumption, possible code execution through heap buffer overflows (<a href="https://security-tracker.debian.org/tracker/CVE-2013-6045">CVE-2013-6045</a>), information disclosure (<a href="https://security-tracker.debian.org/tracker/CVE-2013-6052">CVE-2013-6052</a>), or yet another heap buffer overflow that only appears to affect OpenJPEG 1.3 (<a href="https://security-tracker.debian.org/tracker/CVE-2013-6054">CVE-2013-6054</a>).


cve_id: DSA-2772-1 typo3-src
date: 2013-10-10 00:00:00+00:00
more_info:
Markus Pieton and Vytautas Paulikas discovered that the embedded video and audio player in the TYPO3 web content management system is suspectible to cross-site-scripting.


cve_id: DSA-2667-1 mysql-5.5
date: 2013-05-12 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to a new upstream version, 5.5.31, which includes additional changes, such as performance improvements and corrections for data loss defects.


cve_id: DSA-2641-2 perl
date: 2013-03-20 00:00:00+00:00
more_info:
Yves Orton discovered a flaw in the rehashing code of Perl. This flaw could be exploited to carry out a denial of service attack against code that uses arbitrary user input as hash keys. Specifically an attacker could create a set of keys of a hash causing a denial of service via memory exhaustion.


cve_id: DSA-2716-1 iceweasel
date: 2013-06-26 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, use-after-free vulnerabilities, missing permission checks, incorrect memory handling and other implementation errors may lead to the execution of arbitrary code, privilege escalation, information disclosure or cross-site request forgery.


cve_id: DSA-2746-1 icedove
date: 2013-08-29 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of  the Mozilla Thunderbird mail and news client. Multiple memory safety  errors, missing permission checks and other implementation errors may  lead to the execution of arbitrary code or cross-site scripting.


cve_id: DSA-2735-1 iceweasel
date: 2013-08-07 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version  of the Mozilla Firefox web browser: multiple memory safety errors,  missing permission checks and other implementation errors may lead to  the execution of arbitrary code, cross-site scripting, privilege  escalation, bypass of the same-origin policy or the installation of  malicious addons.


cve_id: DSA-2762-1 icedove
date: 2013-09-23 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client. Multiple memory safety errors and buffer overflows may lead to the execution of arbitrary code.


cve_id: DSA-2759-1 iceweasel
date: 2013-09-18 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows may lead to the execution of arbitrary code.


cve_id: DSA-2790-1 nss
date: 2013-11-02 00:00:00+00:00
more_info:
A flaw was found in the way the Mozilla Network Security Service library (nss) read uninitialized data when there was a decryption failure. A remote attacker could use this flaw to cause a denial of service (application crash) for applications linked with the nss library.


cve_id: DSA-2664-1 stunnel4
date: 2013-05-02 00:00:00+00:00
more_info:
Stunnel, a program designed to work as an universal SSL tunnel for network daemons, is prone to a buffer overflow vulnerability when using the Microsoft NT LAN Manager (NTLM) authentication (<q>protocolAuthentication = NTLM</q>) together with the <q>connect</q> protocol method (<q>protocol = connect</q>). With these prerequisites and using stunnel4 in SSL client mode (<q>client = yes</q>) on a 64 bit host, an attacker could possibly execute arbitrary code with the privileges of the stunnel process, if the attacker can either control the specified proxy server or perform man-in-the-middle attacks on the tcp session between stunnel and the proxy sever.


cve_id: DSA-2650-2 libvirt
date: 2013-03-17 00:00:00+00:00
more_info:
Bastian Blank discovered that libvirtd, a daemon for management of virtual machines, network and storage, would change ownership of devices files so they would be owned by user <q>libvirt-qemu</q> and group <q>kvm</q>, which is a general purpose group not specific to libvirt, allowing unintended write access to those devices and files for the kvm group members.


cve_id: DSA-2642-1 sudo
date: 2013-03-09 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in sudo, a program designed to allow a sysadmin to give limited root privileges to users. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3120-1 mantis
date: 2015-01-06 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mantis bug tracking  system, which may result in phishing, information disclosure, CAPTCHA  bypass, SQL injection, cross-site scripting or the execution of arbitrary PHP code.


cve_id: DSA-2809-1 ruby1.8
date: 2013-12-04 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2738-1 ruby1.9.1
date: 2013-08-18 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may lead to denial of service and other security problems. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2818-1 mysql-5.5
date: 2013-12-16 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to a new upstream version, 5.5.33, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly incompatible changes. Please see the MySQL 5.5 Release Notes for further details:


cve_id: DSA-2973-1 vlc
date: 2014-07-07 00:00:00+00:00
more_info:
Multiple buffer overflows have been found in the VideoLAN media player. Processing malformed subtitles or movie files could lead to denial of service and potentially the execution of arbitrary code.


cve_id: DSA-2704-1 mesa
date: 2013-06-09 00:00:00+00:00
more_info:
It was discovered that applications using the mesa library, a free implementation of the OpenGL API, may crash or execute arbitrary code due to an out of bounds memory access in the library. This vulnerability only affects systems with Intel chipsets.


cve_id: DSA-2813-1 gimp
date: 2013-12-09 00:00:00+00:00
more_info:
Murray McAllister discovered multiple integer and buffer overflows in the XWD plugin in Gimp, which can result in the execution of arbitrary code.


cve_id: DSA-2659-1 libapache-mod-security
date: 2013-04-09 00:00:00+00:00
more_info:
Timur Yunusov and Alexey Osipov from Positive Technologies discovered that the XML files parser of ModSecurity, an Apache module whose purpose is to tighten the Web application security, is vulnerable to XML external entities attacks. A specially-crafted XML file provided by a remote attacker, could lead to local file disclosure or excessive resources (CPU, memory) consumption when processed.


cve_id: DSA-2661-1 xorg-server
date: 2013-04-17 00:00:00+00:00
more_info:
David Airlie and Peter Hutterer of Red Hat discovered that xorg-server, the X.Org X server was vulnerable to an information disclosure flaw related to input handling and devices hotplug.


cve_id: DSA-2660-1 curl
date: 2013-04-20 00:00:00+00:00
more_info:
Yamada Yasuharu discovered that cURL, an URL transfer library, is vulnerable to expose potentially sensitive information when doing requests across domains with matching tails. Due to a bug in the tailmatch function when matching domain names, it was possible that cookies set for a domain <q>ample.com</q> could accidentally also be sent by libcurl when communicating with <q>example.com</q>.


cve_id: DSA-2698-1 tiff
date: 2013-06-18 00:00:00+00:00
more_info:
Multiple issues were discovered in the TIFF tools, a set of utilities for TIFF image file manipulation and conversion.


cve_id: DSA-2703-1 subversion
date: 2013-06-09 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Subversion, a version control system. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2693-1 libx11
date: 2013-05-24 00:00:00+00:00
more_info:
Ilja van Sprundel of IOActive discovered several security issues in multiple components of the X.org graphics stack and the related libraries: Various integer overflows, sign handling errors in integer conversions, buffer overflows, memory corruption and missing input sanitising may lead to privilege escalation or denial of service.


cve_id: DSA-2891-1 mediawiki, mediawiki-extensions
date: 2014-03-30 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in MediaWiki, a wiki engine. The Common Vulnerabilities and Exposures project identifies the following issues:


cve_id: DSA-2721-1 nginx
date: 2013-07-07 00:00:00+00:00
more_info:
A buffer overflow has been identified in nginx, a small, powerful, scalable web/proxy server, when processing certain chunked transfer encoding requests if proxy_pass to untrusted upstream HTTP servers is used.  An attacker may use this flaw to perform denial of service attacks, disclose worker process memory, or possibly execute arbitrary code.


cve_id: DSA-3041-1 xen
date: 2014-10-01 00:00:00+00:00
more_info:
Multiple security issues have been discovered in the Xen virtualisation solution which may result in denial of service, information disclosure or privilege escalation.


cve_id: DSA-2697-1 gnutls26
date: 2013-05-29 00:00:00+00:00
more_info:
It was discovered that a malicious client could crash a GNUTLS server and vice versa, by sending TLS records encrypted with a block cipher which contain invalid padding.


cve_id: DSA-2694-1 spip
date: 2013-05-26 00:00:00+00:00
more_info:
A privilege escalation vulnerability has been found in SPIP, a website engine for publishing, which allows anyone to take control of the website.


cve_id: DSA-2705-1 pymongo
date: 2013-06-10 00:00:00+00:00
more_info:
Jibbers McGee discovered that PyMongo, a high-performance schema-free document-oriented data store, is prone to a denial-of-service vulnerability.


cve_id: DSA-2840-1 srtp
date: 2014-01-10 00:00:00+00:00
more_info:
Fernando Russ from Groundworks Technologies reported a buffer overflow   flaw in srtp, Cisco's reference implementation of the Secure Real-time   Transport Protocol (SRTP), in how the   crypto_policy_set_from_profile_for_rtp() function applies   cryptographic profiles to an srtp_policy. A remote attacker could   exploit this vulnerability to crash an application linked against   libsrtp, resulting in a denial of service.


cve_id: DSA-2710-1 xml-security-c
date: 2013-06-18 00:00:00+00:00
more_info:
James Forshaw from Context Information Security discovered several vulnerabilities in xml-security-c, an implementation of the XML Digital Security specification. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2737-1 swift
date: 2013-08-12 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in Swift, the Openstack object storage. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2707-1 dbus
date: 2013-06-13 00:00:00+00:00
more_info:
Alexandru Cornea discovered a vulnerability in libdbus caused by an implementation bug in _dbus_printf_string_upper_bound(). This vulnerability can be exploited by a local user to crash system services that use libdbus, causing denial of service. Depending on the dbus services running, it could lead to complete system crash.


cve_id: DSA-2714-1 kfreebsd-9
date: 2013-06-25 00:00:00+00:00
more_info:
Konstantin Belousov and Alan Cox discovered that insufficient permission checks in the memory management of the FreeBSD kernel could lead to privilege escalation.


cve_id: DSA-3065-1 libxml-security-java
date: 2014-11-06 00:00:00+00:00
more_info:
James Forshaw discovered that, in Apache Santuario XML Security for Java, CanonicalizationMethod parameters were incorrectly validated: by specifying an arbitrary weak canonicalization algorithm, an attacker could spoof XML signatures.


cve_id: DSA-2718-1 wordpress
date: 2013-07-01 00:00:00+00:00
more_info:
Several vulnerabilities were identified in WordPress, a web blogging tool. As the CVEs were allocated from releases announcements and specific fixes are usually not identified, it has been decided to upgrade the wordpress package to the latest upstream version instead of backporting the patches.


cve_id: DSA-2713-1 curl
date: 2013-06-24 00:00:00+00:00
more_info:
Timo Sirainen discovered that cURL, an URL transfer library, is prone to a heap overflow vulnerability due to bad checking of the input data in the curl_easy_unescape function.


cve_id: DSA-2708-1 fail2ban
date: 2013-06-16 00:00:00+00:00
more_info:
Krzysztof Katowicz-Kowalewski discovered a vulnerability in Fail2ban, a log monitoring and system which can act on attack by preventing hosts to connect to specified services using the local firewall.


cve_id: DSA-3183-1 movabletype-opensource
date: 2015-03-12 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in Movable Type, a blogging system. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2827-1 libcommons-fileupload-java
date: 2013-12-24 00:00:00+00:00
more_info:
It was discovered that Apache Commons FileUpload, a package to make it easy to add robust, high-performance, file upload capability to servlets and web applications, incorrectly handled file names with NULL bytes in serialized instances. A remote attacker able to supply a serialized instance of the DiskFileItem class, which will be deserialized on a server, could use this flaw to write arbitrary content to any location on the server that is accessible to the user running the application server process.


cve_id: DSA-2717-1 xml-security-c
date: 2013-06-28 00:00:00+00:00
more_info:
Jon Erickson of iSIGHT Partners Labs discovered a heap overflow in xml-security-c, an implementation of the XML Digital Security specification. The fix to address <a href="https://security-tracker.debian.org/tracker/CVE-2013-2154">CVE-2013-2154</a> introduced the possibility of a heap overflow in the processing of malformed XPointer expressions in the XML Signature Reference processing code, possibly leading to arbitrary code execution.


cve_id: DSA-2726-1 php-radius
date: 2013-07-25 00:00:00+00:00
more_info:
A buffer overflow has been discovered in the Radius extension for PHP. The function handling Vendor Specific Attributes assumed that the attributes given would always be of valid length. An attacker could use this assumption to trigger a buffer overflow.


cve_id: DSA-2656-1 bind9
date: 2013-03-30 00:00:00+00:00
more_info:
Matthew Horsfall of Dyn, Inc. discovered that BIND, a DNS server, is prone to a denial of service vulnerability. A remote attacker could use this flaw to send a specially-crafted DNS query to named that, when processed, would cause named to use an excessive amount of memory, or possibly crash.


cve_id: DSA-2695-1 chromium-browser
date: 2013-05-29 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Chromium web browser. Multiple use-after-free, out-of-bounds read, memory safety, and cross-site scripting issues were discovered and corrected.


cve_id: DSA-2779-1 libxml2
date: 2013-10-13 00:00:00+00:00
more_info:
Aki Helin of OUSPG discovered many out-of-bounds read issues in libxml2, the GNOME project's XML parser library, which can lead to denial of service issues when handling XML documents that end abruptly. 


cve_id: DSA-2743-1 kfreebsd-9
date: 2013-08-27 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the FreeBSD kernel that may lead to a privilege escalation or information leak. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2672-1 kfreebsd-9
date: 2013-05-22 00:00:00+00:00
more_info:
Adam Nowacki discovered that the new FreeBSD NFS implementation processes a crafted READDIR request which instructs to operate a file system on a file node as if it were a directory node, leading to a kernel crash or potentially arbitrary code execution.


cve_id: DSA-2696-1 otrs2
date: 2013-05-29 00:00:00+00:00
more_info:
A vulnerability has been discovered in the Open Ticket Request System, which can be exploited by malicious users to disclose potentially sensitive information.


cve_id: DSA-2700-1 wireshark
date: 2013-06-02 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors for GTPv2, ASN.1 BER, PPP CCP, DCP ETSI, MPEG DSM-CC and Websocket, which could  result in denial of service or the execution of arbitrary code.


cve_id: DSA-2715-1 puppet
date: 2013-06-26 00:00:00+00:00
more_info:
It was discovered that puppet, a centralized configuration management system, did not correctly handle YAML payloads. A remote attacker could use a specially-crafted payload to execute arbitrary code on the puppet master.


cve_id: DSA-2709-1 wireshark
date: 2013-06-17 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors for CAPWAP, GMR-1 BCCH, PPP, NBAP, RDP, HTTP, DCP ETSI and in the Ixia IxVeriWave file parser, which could result in denial of service or the execution of arbitrary code.


cve_id: DSA-2712-1 otrs2
date: 2013-06-19 00:00:00+00:00
more_info:
It was discovered that users with a valid agent login could use crafted URLs to bypass access control restrictions and read tickets to which they should not have access.


cve_id: DSA-2723-1 php5
date: 2013-07-17 00:00:00+00:00
more_info:
It was discovered that PHP could perform an invalid free request when processing crafted XML documents, corrupting the heap and potentially leading to arbitrary code execution.  Depending on the PHP application, this vulnerability could be exploited remotely.


cve_id: DSA-2839-1 spice
date: 2014-01-08 00:00:00+00:00
more_info:
Multiple vulnerabilities have been found in spice, a SPICE protocol client and server library. The Common Vulnerabilities and Exposures project identifies the following issues:


cve_id: DSA-2729-1 openafs
date: 2013-07-28 00:00:00+00:00
more_info:
OpenAFS, the implementation of the distributed filesystem AFS, has been updated to no longer use DES for the encryption of tickets. Additional migration steps are needed to fully set the update into effect. For more information please see the upstream advisory: <a href="http://www.openafs.org/security/OPENAFS-SA-2013-003.txt">\ OPENAFS-SA-2013-003</a>


cve_id: DSA-2842-1 libspring-java
date: 2014-01-13 00:00:00+00:00
more_info:
Alvaro Munoz discovered a XML External Entity (XXE) injection in the Spring Framework which can be used for conducting CSRF and DoS attacks on other sites.


cve_id: DSA-2810-1 ruby1.9.1
date: 2013-12-04 00:00:00+00:00
more_info:
Charlie Somerville discovered that Ruby incorrectly handled floating point number conversion. If an application using Ruby accepted untrusted input strings and converted them to floating point numbers, an attacker able to provide such input could cause the application to crash or, possibly, execute arbitrary code with the privileges of the application.


cve_id: DSA-2736-1 putty
date: 2013-08-11 00:00:00+00:00
more_info:
Several vulnerabilities where discovered in PuTTY, a Telnet/SSH client for X. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2744-1 tiff
date: 2013-08-27 00:00:00+00:00
more_info:
Pedro Ribeiro and Huzaifa S. Sidhpurwala discovered multiple  vulnerabilities in various tools shipped by the tiff library. Processing  a malformed file may lead to denial of service or the execution of  arbitrary code.


cve_id: DSA-2751-1 libmodplug
date: 2013-09-04 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in libmodplug, a library for mod music based on ModPlug, that might allow arbitrary code execution when processing specially-crafted ABC files through applications using the library, such as media players.


cve_id: DSA-2730-1 gnupg
date: 2013-07-29 00:00:00+00:00
more_info:
Yarom and Falkner discovered that RSA secret keys could be leaked via a side channel attack, where a malicious local user could obtain private key information from another user on the system.


cve_id: DSA-2731-1 libgcrypt11
date: 2013-07-29 00:00:00+00:00
more_info:
Yarom and Falkner discovered that RSA secret keys in applications using the libgcrypt11 library, for example GnuPG 2.x, could be leaked via a side channel attack, where a malicious local user could obtain private key information from another user on the system.


cve_id: DSA-2965-1 tiff
date: 2014-06-22 00:00:00+00:00
more_info:
Murray McAllister discovered a heap-based buffer overflow in the gif2tiff command line tool.  Executing gif2tiff on a malicious tiff image could result in arbitrary code execution.


cve_id: DSA-2742-1 php5
date: 2013-08-26 00:00:00+00:00
more_info:
It was discovered that PHP, a general-purpose scripting language commonly used for web application development, did not properly process embedded NUL characters in the subjectAltName extension of X.509 certificates.  Depending on the application and with insufficient CA-level checks, this could be abused for impersonating other users.


cve_id: DSA-2771-1 nas
date: 2013-10-09 00:00:00+00:00
more_info:
Hamid Zamani discovered multiple security problems (buffer overflows, format string vulnerabilities and missing input sanitising), which could lead to the execution of arbitrary code.


cve_id: DSA-3530-1 tomcat6
date: 2016-03-25 00:00:00+00:00
more_info:
Multiple security vulnerabilities have been fixed in the Tomcat servlet and JSP engine, which may result on bypass of security manager restrictions, information disclosure, denial of service or session fixation.


cve_id: DSA-2764-1 libvirt
date: 2013-09-25 00:00:00+00:00
more_info:
Daniel P. Berrange discovered that incorrect memory handling in the remoteDispatchDomainMemoryStats() function could lead to denial of service.


cve_id: DSA-2750-1 imagemagick
date: 2013-09-03 00:00:00+00:00
more_info:
Anton Kortunov reported a heap corruption in ImageMagick, a program collection and library for converting and manipulating image files. Crafted GIF files could cause ImageMagick to crash, potentially leading to arbitrary code execution.


cve_id: DSA-2753-1 mediawiki
date: 2013-09-13 00:00:00+00:00
more_info:
It was discovered that in Mediawiki, a wiki engine, several API modules allowed anti-CSRF tokens to be accessed via JSONP. These tokens protect against cross site request forgeries and are confidential.


cve_id: DSA-3503-1 linux
date: 2016-03-03 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, information leak or data loss.


cve_id: DSA-2763-1 pyopenssl
date: 2013-09-24 00:00:00+00:00
more_info:
It was discovered that PyOpenSSL, a Python wrapper around the OpenSSL library, does not properly handle certificates with NULL characters in the Subject Alternative Name field.


cve_id: DSA-2755-1 python-django
date: 2013-09-11 00:00:00+00:00
more_info:
Rainer Koirikivi discovered a directory traversal vulnerability with <q>ssi</q> template tags in python-django, a high-level Python web development framework.


cve_id: DSA-2770-1 torque
date: 2013-10-09 00:00:00+00:00
more_info:
John Fitzpatrick of MWR InfoSecurity discovered an authentication bypass vulnerability in torque, a PBS-derived batch processing queueing system.


cve_id: DSA-2757-1 wordpress
date: 2013-09-14 00:00:00+00:00
more_info:
Several vulnerabilities were identified in Wordpress, a web blogging tool. As the CVEs were allocated from releases announcements and specific fixes are usually not identified, it has been decided to upgrade the Wordpress package to the latest upstream version instead of backporting the patches.


cve_id: DSA-2933-1 qemu-kvm
date: 2014-05-19 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution on x86 hardware.


cve_id: DSA-2768-1 icedtea-web
date: 2013-10-04 00:00:00+00:00
more_info:
A heap-based buffer overflow vulnerability was found in icedtea-web, a web browser plugin for running applets written in the Java programming language. If a user were tricked into opening a malicious website, an attacker could cause the plugin to crash or possibly execute arbitrary code as the user invoking the program.


cve_id: DSA-2773-1 gnupg
date: 2013-10-10 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in GnuPG, the GNU privacy guard, a free PGP replacement. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2774-1 gnupg2
date: 2013-10-10 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in GnuPG 2, the GNU privacy guard, a free PGP replacement. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2837-1 openssl
date: 2014-01-07 00:00:00+00:00
more_info:
Anton Johansson discovered that an invalid TLS handshake package could crash OpenSSL with a NULL pointer dereference.


cve_id: DSA-2767-1 proftpd-dfsg
date: 2013-09-29 00:00:00+00:00
more_info:
Kingcope discovered that the mod_sftp and mod_sftp_pam modules of proftpd, a powerful modular FTP/SFTP/FTPS server, are not properly validating input, before making pool allocations. An attacker can use this flaw to conduct denial of service attacks against the system running proftpd (resource exhaustion).


cve_id: DSA-2765-1 davfs2
date: 2013-09-26 00:00:00+00:00
more_info:
Davfs2, a filesystem client for WebDAV, calls the function system() insecurely while is setuid root. This might allow a privilege escalation.


cve_id: DSA-2778-1 libapache2-mod-fcgid
date: 2013-10-12 00:00:00+00:00
more_info:
Robert Matthews discovered that the Apache FCGID module, a FastCGI implementation for Apache HTTP Server, fails to perform adequate boundary checks on user-supplied input. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.


cve_id: DSA-2887-1 ruby-actionmailer-3.2
date: 2014-03-27 00:00:00+00:00
more_info:
Aaron Neyer discovered that missing input sanitising in the logging component of Ruby Actionmailer could result in denial of service through a malformed e-mail message.


cve_id: DSA-2888-1 ruby-actionpack-3.2
date: 2014-03-27 00:00:00+00:00
more_info:
Toby Hsieh, Peter McLarnan, Ankit Gupta, Sudhir Rao and Kevin Reintjes discovered multiple cross-site scripting and denial of service vulnerabilities in Ruby Actionpack.


cve_id: DSA-2784-1 xorg-server
date: 2013-10-22 00:00:00+00:00
more_info:
Pedro Ribeiro discovered a use-after-free in the handling of ImageText requests in the Xorg Xserver, which could result in denial of service or privilege escalation.


cve_id: DSA-2817-1 libtar
date: 2013-12-14 00:00:00+00:00
more_info:
Timo Warns reported multiple integer overflow vulnerabilities in libtar, a library for manipulating tar archives, which can result in the execution of arbitrary code.


cve_id: DSA-2801-1 libhttp-body-perl
date: 2013-11-21 00:00:00+00:00
more_info:
Jonathan Dolle reported a design error in HTTP::Body, a Perl module for processing data from HTTP POST requests. The HTTP body multipart parser creates temporary files which preserve the suffix of the uploaded file. An attacker able to upload files to a service that uses HTTP::Body::Multipart could potentially execute commands on the server if these temporary filenames are used in subsequent commands without further checks.


cve_id: DSA-2863-1 libtar
date: 2014-02-18 00:00:00+00:00
more_info:
A directory traversal attack was reported against libtar, a C library for manipulating tar archives. The application does not validate the filenames inside the tar archive, allowing to extract files in arbitrary path. An attacker can craft a tar file to override files beyond the tar_extract_glob and tar_extract_all prefix parameter.


cve_id: DSA-3209-1 openldap
date: 2015-03-30 00:00:00+00:00
more_info:
Multiple vulnerabilities were found in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol.


cve_id: DSA-2805-1 sup-mail
date: 2013-11-27 00:00:00+00:00
more_info:
joernchen of Phenoelit discovered two command injection flaws in Sup, a console-based email client. An attacker might execute arbitrary command  if the user opens a maliciously crafted email.


cve_id: DSA-2814-1 varnish
date: 2013-12-09 00:00:00+00:00
more_info:
A denial of service vulnerability was reported in varnish, a state of the art, high-performance web accelerator. With some configurations of varnish a remote attacker could mount a denial of service (child-process crash and temporary caching outage) via a GET request with trailing whitespace characters and no URI.


cve_id: DSA-2830-1 ruby-i18n
date: 2013-12-30 00:00:00+00:00
more_info:
Peter McLarnan discovered that the internationalization component of Ruby on Rails does not properly encode parameters in generated HTML code, resulting in a cross-site scripting vulnerability.  This update corrects the underlying vulnerability in the i18n gem, as provided by the ruby-i18n package.


cve_id: DSA-2796-1 torque
date: 2013-11-13 00:00:00+00:00
more_info:
Matt Ezell from Oak Ridge National Labs reported a vulnerability in torque, a PBS-derived batch processing queueing system.


cve_id: DSA-2791-1 tryton-client
date: 2013-11-04 00:00:00+00:00
more_info:
Cedric Krier discovered that the Tryton client does not sanitize the file extension supplied by the server when processing reports.  As a result, a malicious server could send a report with a crafted file extension that causes the client to write any local file to which the user running the client has write access.


cve_id: DSA-2798-1 curl
date: 2013-11-17 00:00:00+00:00
more_info:
Scott Cantor discovered that curl, a file retrieval tool, would disable the CURLOPT_SSLVERIFYHOST check when the CURLOPT_SSL_VERIFYPEER setting was disabled.  This would also disable ssl certificate host name checks when it should have only disabled verification of the certificate trust chain.


cve_id: DSA-2802-1 nginx
date: 2013-11-21 00:00:00+00:00
more_info:
Ivan Fratric of the Google Security Team discovered a bug in nginx, a web server, which might allow an attacker to bypass security restrictions by using a specially crafted request.


cve_id: DSA-2794-1 spip
date: 2013-11-10 00:00:00+00:00
more_info:
Several vulnerabilities have been found in SPIP, a website engine for publishing, resulting in cross-site request forgery on logout, cross-site scripting on author page, and PHP injection.


cve_id: DSA-2821-1 gnupg
date: 2013-12-18 00:00:00+00:00
more_info:
Genkin, Shamir and Tromer discovered that RSA key material could be extracted by using the sound generated by the computer during the decryption of some chosen ciphertexts.


cve_id: DSA-2782-1 polarssl
date: 2013-10-20 00:00:00+00:00
more_info:
Multiple security issues have been discovered in PolarSSL, a lightweight  crypto and SSL/TLS library:


cve_id: DSA-2733-1 otrs2
date: 2013-08-02 00:00:00+00:00
more_info:
It was discovered that otrs2, the Open Ticket Request System, does not properly sanitise user-supplied data that is used on SQL queries. An attacker with a valid agent login could exploit this issue to craft SQL queries by injecting arbitrary SQL code through manipulated URLs.


cve_id: DSA-2761-1 puppet
date: 2013-09-19 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in puppet, a centralized configuration management system. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2728-1 bind9
date: 2013-07-27 00:00:00+00:00
more_info:
Maxim Shudrak and the HP Zero Day Initiative reported a denial of service vulnerability in BIND, a DNS server. A specially crafted query that includes malformed rdata can cause named daemon to terminate with an assertion failure while rejecting the malformed query.


cve_id: DSA-2734-1 wireshark
date: 2013-08-05 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors for DVB-CI, GSMÂ A Common and ASN.1 PER and in the Netmon file parser.


cve_id: DSA-2831-1 puppet
date: 2013-12-31 00:00:00+00:00
more_info:
An unsafe use of temporary files was discovered in Puppet, a tool for centralized configuration management. An attacker can exploit this  vulnerability and overwrite an arbitrary file in the system.


cve_id: DSA-2797-1 icedove
date: 2013-11-13 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client.  Multiple memory safety errors, and other implementation errors may lead to the execution of arbitrary code.


cve_id: DSA-2788-1 iceweasel
date: 2013-10-31 00:00:00+00:00
more_info:
Multiple security issues have been found in iceweasel, Debian's version  of the Mozilla Firefox web browser: multiple memory safety errors, and other implementation errors may lead to the execution of arbitrary code.


cve_id: DSA-2800-1 nss
date: 2013-11-25 00:00:00+00:00
more_info:
Andrew Tinits reported a potentially exploitable buffer overflow in the Mozilla Network Security Service library (nss). With a specially crafted request a remote attacker could cause a denial of service or possibly execute arbitrary code.


cve_id: DSA-2820-1 nspr
date: 2013-12-17 00:00:00+00:00
more_info:
It was discovered that NSPR, Netscape Portable Runtime library, could crash an application using the library when parsing a certificate that causes an integer overflow. This flaw only affects 64-bit systems.


cve_id: DSA-2749-1 asterisk
date: 2013-09-02 00:00:00+00:00
more_info:
Colin Cuthbertson and Walter Doekes discovered two vulnerabilities in the SIP processing code of Asterisk - an open source PBX and telephony  toolkit -, which could result in denial of service.


cve_id: DSA-2769-1 kfreebsd-9
date: 2013-10-08 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the FreeBSD kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2991-1 modsecurity-apache
date: 2014-07-27 00:00:00+00:00
more_info:
Martin Holst Swende discovered a flaw in the way chunked requests are handled in ModSecurity, an Apache module whose purpose is to tighten the Web application security. A remote attacker could use this flaw to bypass intended mod_security restrictions by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header, allowing to send requests containing content that should have been removed by mod_security.


cve_id: DSA-2756-1 wireshark
date: 2013-09-13 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors for LDAP, RTPS and NBAP and in the Netmon file parser, which could result in denial of service or the execution of arbitrary code.


cve_id: DSA-2752-1 phpbb3
date: 2013-09-07 00:00:00+00:00
more_info:
Andreas Beckmann discovered that phpBB, a web forum, as installed in Debian, sets incorrect permissions for cached files, allowing a malicious local user to overwrite them.


cve_id: DSA-2848-1 mysql-5.5
date: 2014-01-23 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.35. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-2878-1 virtualbox
date: 2014-03-13 00:00:00+00:00
more_info:
Matthew Daley discovered multiple vulnerabilities in VirtualBox, a x86  virtualisation solution, resulting in denial of service, privilege escalation and an information leak.


cve_id: DSA-2882-1 extplorer
date: 2014-03-20 00:00:00+00:00
more_info:
Multiple cross-site scripting (XSS) vulnerabilities have been discovered in extplorer, a web file explorer and manager using Ext JS. A remote attacker can inject arbitrary web script or HTML code via a crafted string in the URL to application.js.php, admin.php, copy_move.php, functions.php, header.php and upload.php.


cve_id: DSA-2740-2 python-django
date: 0001-01-01 00:00:00+00:00
more_info:
Nick Brunn reported a possible cross-site scripting vulnerability in python-django, a high-level Python web development framework.


cve_id: DSA-2815-1 munin
date: 2013-12-09 00:00:00+00:00
more_info:
Christoph Biedl discovered two denial of service vulnerabilities in munin, a network-wide graphing framework. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2807-1 links2
date: 2013-11-30 00:00:00+00:00
more_info:
Mikulas Patocka discovered an integer overflow in the parsing of HTML  tables in the Links web browser. This can only be exploited when running  Links in graphical mode.


cve_id: DSA-2789-1 strongswan
date: 2013-11-01 00:00:00+00:00
more_info:
A vulnerability has been found in the ASN.1 parser of strongSwan, an IKE daemon used to establish IPsec protected links.


cve_id: DSA-2775-1 ejabberd
date: 2013-10-10 00:00:00+00:00
more_info:
It was discovered that ejabberd, a Jabber/XMPP server, uses SSLv2 and weak ciphers for communication, which are considered insecure. The software offers no runtime configuration options to disable these. This update disables the use of SSLv2 and weak ciphers.


cve_id: DSA-2787-1 roundcube
date: 2013-10-27 00:00:00+00:00
more_info:
It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, does not properly sanitize the _session parameter in steps/utils/save_pref.inc during saving preferences. The vulnerability can be exploited to overwrite configuration settings and subsequently allowing random file access, manipulated SQL queries and even code execution.


cve_id: DSA-2792-1 wireshark
date: 2013-11-04 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors for IEEE 802.15.4, NBAP, SIP and TCP, which could result in denial of service.


cve_id: DSA-2900-1 jbigkit
date: 2014-04-10 00:00:00+00:00
more_info:
Florian Weimer of the Red Hat product security team discovered multiple buffer overflows in jbigkit, which could lead to the execution of arbitrary code when processing malformed images.


cve_id: DSA-2804-1 drupal7
date: 2013-11-26 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in Drupal, a fully-featured  content management framework: Cross-site request forgery, insecure pseudo random number generation, code execution, incorrect security token validation and cross-site scripting.


cve_id: DSA-2850-1 libyaml
date: 2014-01-31 00:00:00+00:00
more_info:
Florian Weimer of the Red Hat Product Security Team discovered a heap-based buffer overflow flaw in LibYAML, a fast YAML 1.1 parser and emitter library. A remote attacker could provide a YAML document with a specially-crafted tag that, when parsed by an application using libyaml, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.


cve_id: DSA-2963-1 lucene-solr
date: 2014-06-17 00:00:00+00:00
more_info:
Multiple vulnerabilities were found in Solr, an open source enterprise  search server based on Lucene, resulting in information disclosure or  code execution.


cve_id: DSA-2806-1 nbd
date: 2013-11-29 00:00:00+00:00
more_info:
It was discovered that nbd-server, the server for the Network Block Device protocol, did incorrect parsing of the access control lists, allowing access to any hosts with an IP address sharing a prefix with an allowed address.


cve_id: DSA-2816-1 php5
date: 2013-12-12 00:00:00+00:00
more_info:
Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development. The Common Vulnerabilities and Exposures project identifies the following issues:


cve_id: DSA-2824-1 curl
date: 2013-12-19 00:00:00+00:00
more_info:
Marc Deslauriers discovered that curl, a file retrieval tool, would mistakenly skip verifying the CN and SAN name fields when digital signature verification was disabled in the libcurl GnuTLS backend.


cve_id: DSA-2822-1 xorg-server
date: 2013-12-18 00:00:00+00:00
more_info:
Bryan Quigley discovered an integer underflow in the Xorg X server which could lead to denial of service or the execution of arbitrary code.


cve_id: DSA-2823-1 pixman
date: 2013-12-18 00:00:00+00:00
more_info:
Bryan Quigley discovered an integer underflow in Pixman which could lead to denial of service or the execution of arbitrary code.


cve_id: DSA-2857-1 libspring-java
date: 2014-02-08 00:00:00+00:00
more_info:
It was discovered by the Spring development team that the fix for the XML External Entity (XXE) Injection  (<a href="https://security-tracker.debian.org/tracker/CVE-2013-4152">\ CVE-2013-4152</a>) in the Spring Framework was incomplete.


cve_id: DSA-2833-1 openssl
date: 2014-01-01 00:00:00+00:00
more_info:
Multiple security issues have been fixed in OpenSSL: The TLS 1.2 support was susceptible to denial of service and retransmission of DTLS messages was fixed. In addition this update disables the insecure Dual_EC_DRBG algorithm (which was unused anyway, see <a href="http://marc.info/?l=openssl-announce&amp;m=138747119822324&amp;w=2">http://marc.info/?l=openssl-announce&amp;m=138747119822324&amp;w=2</a> for further information) and no longer uses the RdRand feature available on some Intel CPUs as a sole source of entropy unless explicitly requested.


cve_id: DSA-2838-1 libxfont
date: 2014-01-07 00:00:00+00:00
more_info:
It was discovered that a buffer overflow in the processing of Glyph Bitmap Distribution fonts (BDF) could result in the execution of arbitrary code.


cve_id: DSA-2875-1 cups-filters
date: 2014-03-12 00:00:00+00:00
more_info:
Florian Weimer of the Red Hat Product Security Team discovered multiple vulnerabilities in the pdftoopvp CUPS filter, which could result in the execution of aribitrary code if a malformed PDF file is processed.


cve_id: DSA-2859-1 pidgin
date: 2014-02-10 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in Pidgin, a multi-protocol instant messaging client:


cve_id: DSA-2852-1 libgadu
date: 2014-02-06 00:00:00+00:00
more_info:
Yves Younan and Ryan Pentney discovered that libgadu, a library for accessing the Gadu-Gadu instant messaging service, contained an integer overflow leading to a buffer overflow.  Attackers which impersonate the server could crash clients and potentially execute arbitrary code.


cve_id: DSA-3128-1 linux
date: 2015-01-15 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or information leaks.


cve_id: DSA-2836-1 devscripts
date: 2014-01-05 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in uscan, a tool to scan upstream sites for new releases of packages, which is part of the devscripts package. An attacker controlling a website from which uscan would attempt to download a source tarball could execute arbitrary code with the privileges of the user running uscan.


cve_id: DSA-2826-1 denyhosts
date: 2013-12-22 00:00:00+00:00
more_info:
Helmut Grohne discovered that denyhosts, a tool preventing SSH brute-force attacks, could be used to perform remote denial of service against the SSH daemon. Incorrectly specified regular expressions used to detect brute force attacks in authentication logs could be exploited by a malicious user to forge crafted login names in order to make denyhosts ban arbitrary IP addresses.


cve_id: DSA-3137-1 websvn
date: 2015-01-24 00:00:00+00:00
more_info:
James Clawson discovered that websvn, a web viewer for Subversion repositories, would follow symlinks in a repository when presenting a file for download. An attacker with repository write access could thereby access any file on disk readable by the user the webserver runs as.


cve_id: DSA-3027-1 libav
date: 2014-09-17 00:00:00+00:00
more_info:
Several security issues have been corrected in multiple demuxers and  decoders of the libav multimedia library. A full list of the changes is  available at  <a href="http://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v0.8.15">\ http://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v0.8.15</a>


cve_id: DSA-2834-1 typo3-src
date: 2014-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in TYPO3, a content management system.  This update addresses cross-site scripting, information disclosure, mass assignment, open redirection and insecure unserialize vulnerabilities and corresponds to <a href="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004/">TYPO3-CORE-SA-2013-004</a>.


cve_id: DSA-2956-1 icinga
date: 2014-06-11 00:00:00+00:00
more_info:
Multiple security issues have been found in the Icinga host and network monitoring system (buffer overflows, cross-site request forgery, off-by ones) which could result in the execution of arbitrary code, denial of service or session hijacking.


cve_id: DSA-2825-1 wireshark
date: 2013-12-20 00:00:00+00:00
more_info:
Laurent Butti and Garming Sam discovered multiple vulnerabilities in the dissectors for NTLMSSPv2 and BSSGP, which could lead to denial of service or the execution of arbitrary code.


cve_id: DSA-2979-1 fail2ban
date: 2014-07-17 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in Fail2ban, a solution to ban hosts  that cause multiple authentication errors. When using Fail2ban to monitor Postfix or Cyrus IMAP logs, improper input validation in log parsing  could enable a remote attacker to trigger an IP ban on arbitrary  addresses, resulting in denial of service.


cve_id: DSA-2946-1 python-gnupg
date: 2014-06-04 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the Python wrapper for the  Gnu Privacy Guard (GPG). Insufficient sanitising could lead to the  execution of arbitrary shell commands.


cve_id: DSA-3064-1 php5
date: 2014-11-04 00:00:00+00:00
more_info:
Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development. It has been decided to follow the stable 5.4.x releases for the Wheezy PHP packages. Consequently the vulnerabilities are addressed by upgrading PHP to a new upstream version 5.4.34, which includes additional bug fixes, new features and possibly incompatible changes. Please refer to the upstream changelog for more information:


cve_id: DSA-3101-1 c-icap
date: 2014-12-13 00:00:00+00:00
more_info:
Several vulnerabilities were found in c-icap, an ICAP server implementation, which could allow a remote attacker to cause c-icap to crash, or have other, unspecified impacts.


cve_id: DSA-3170-1 linux
date: 2015-02-23 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leaks or privilege escalation.


cve_id: DSA-3224-1 libx11
date: 2015-04-12 00:00:00+00:00
more_info:
Abhishek Arya discovered a buffer overflow in the MakeBigReq macro provided by libx11, which could result in denial of service or the execution of arbitrary code.


cve_id: DSA-3271-1 nbd
date: 2015-05-23 00:00:00+00:00
more_info:
Tuomas RĂ¤sĂ¤nen discovered that unsafe signal handling in nbd-server, the server for the Network Block Device protocol, could allow remote attackers to cause a deadlock in the server process and thus a denial of service.


cve_id: DSA-3426-1 linux
date: 2015-12-17 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service.


cve_id: DSA-3485-1 didiwiki
date: 2016-02-20 00:00:00+00:00
more_info:
Alexander Izmailov discovered that didiwiki, a wiki implementation, failed to correctly validate user-supplied input, thus allowing a malicious user to access any part of the filesystem.


cve_id: DSA-2919-1 mysql-5.5
date: 2014-05-03 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.37. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-2872-1 udisks
date: 2014-03-10 00:00:00+00:00
more_info:
Florian Weimer discovered a buffer overflow in udisks's mount path  parsing code which may result in privilege escalation.


cve_id: DSA-2849-1 curl
date: 2014-01-31 00:00:00+00:00
more_info:
Paras Sethia discovered that libcurl, a client-side URL transfer library, would sometimes mix up multiple HTTP and HTTPS connections with NTLM authentication to the same server, sending requests for one user over the connection authenticated as a different user.


cve_id: DSA-2879-1 libssh
date: 2014-03-13 00:00:00+00:00
more_info:
It was discovered that libssh, a tiny C SSH library, did not reset the state of the PRNG after accepting a connection. A server mode application that forks itself to handle incoming connections could see its children sharing the same PRNG state, resulting in a cryptographic weakness and possibly the recovery of the private key.


cve_id: DSA-2854-1 mumble
date: 2014-02-05 00:00:00+00:00
more_info:
Several issues have been discovered in mumble, a low latency VoIP client. The Common Vulnerabilities and Exposures project identifies the following issues:


cve_id: DSA-2856-1 libcommons-fileupload-java
date: 2014-02-07 00:00:00+00:00
more_info:
It was discovered that the Apache Commons FileUpload package for Java could enter an infinite loop while processing a multipart request with a crafted Content-Type, resulting in a denial-of-service condition.


cve_id: DSA-2890-1 libspring-java
date: 2014-03-29 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in libspring-java, the Debian package for the Java Spring framework.


cve_id: DSA-2869-1 gnutls26
date: 2014-03-03 00:00:00+00:00
more_info:
Nikos Mavrogiannopoulos of Red Hat discovered an X.509 certificate verification issue in GnuTLS, an SSL/TLS library. A certificate validation could be reported sucessfully even in cases were an error would prevent all verification steps to be performed.


cve_id: DSA-2886-1 libxalan2-java
date: 2014-03-26 00:00:00+00:00
more_info:
Nicolas Gregoire discovered several vulnerabilities in libxalan2-java, a Java library for XSLT processing.  Crafted XSLT programs could access system properties or load arbitrary classes, resulting in information disclosure and, potentially, arbitrary code execution.


cve_id: DSA-2940-1 libstruts1.2-java
date: 2014-08-21 00:00:00+00:00
more_info:
It was discovered that missing access checks in the Struts ActionForm  object could result in the execution of arbitrary code.


cve_id: DSA-2902-1 curl
date: 2014-04-13 00:00:00+00:00
more_info:
Two vulnerabilities have been discovered in cURL, an URL transfer library. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3044-1 qemu-kvm
date: 2014-10-04 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in qemu-kvm, a full  virtualization solution on x86 hardware:


cve_id: DSA-2909-1 qemu
date: 2014-04-18 00:00:00+00:00
more_info:
Michael S. Tsirkin of Red Hat discovered a buffer overflow flaw in the way qemu processed MAC addresses table update requests from the guest.


cve_id: DSA-2899-1 openafs
date: 2014-04-09 00:00:00+00:00
more_info:
Michael Meffie discovered that in OpenAFS, a distributed filesystem, an attacker with the ability to connect to an OpenAFS fileserver can trigger a buffer overflow, crashing the fileserver, and potentially permitting the execution of arbitrary code.


cve_id: DSA-2896-1 openssl
date: 2014-04-07 00:00:00+00:00
more_info:
A vulnerability has been discovered in OpenSSL's support for the TLS/DTLS Heartbeat extension. Up to 64KB of memory from either client or server can be recovered by an attacker. This vulnerability might allow an attacker to compromise the private key and other sensitive data in memory.


cve_id: DSA-2901-1 wordpress
date: 2014-04-12 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2966-1 samba
date: 2014-06-23 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered and fixed in Samba, a SMB/CIFS file, print, and login server:


cve_id: DSA-3038-1 libvirt
date: 2014-09-27 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Libvirt, a virtualisation abstraction library. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2943-1 php5
date: 2014-06-01 00:00:00+00:00
more_info:
Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development:


cve_id: DSA-2926-1 linux
date: 2014-05-12 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leaks or privilege escalation:


cve_id: DSA-2931-1 openssl
date: 2014-05-18 00:00:00+00:00
more_info:
It was discovered that incorrect memory handling in OpenSSL's  do_ssl3_write() function could result in denial of service.


cve_id: DSA-3021-1 file
date: 2014-09-09 00:00:00+00:00
more_info:
Multiple security issues have been found in file, a tool to determine  a file type. These vulnerabilities allow remote attackers to cause a  denial of service, via resource consumption or application crash.


cve_id: DSA-2974-1 php5
date: 2014-07-08 00:00:00+00:00
more_info:
Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2927-1 libxfont
date: 2014-05-13 00:00:00+00:00
more_info:
Ilja van Sprundel of IOActive discovered several security issues in the X.Org libXfont library, which may allow a local, authenticated user to attempt to raise privileges; or a remote attacker who can control the font server to attempt to execute code with the privileges of the X server.


cve_id: DSA-2874-1 mutt
date: 2014-03-12 00:00:00+00:00
more_info:
Beatrice Torracca and Evgeni Golov discovered a buffer overflow in the mutt mailreader. Malformed RFC2047 header lines could result in denial of service or potentially the execution of arbitrary code.


cve_id: DSA-2921-1 xbuffy
date: 2014-05-04 00:00:00+00:00
more_info:
Michael Niedermayer discovered a vulnerability in xbuffy, an utility for displaying message count in mailbox and newsgroup accounts.


cve_id: DSA-2917-1 super
date: 2014-04-28 00:00:00+00:00
more_info:
John Lightsey of the Debian Security Audit project discovered that the super package did not check for setuid failures, allowing local users to increase the privileges on kernel versions which do not guard against RLIMIT_NPROC attacks.


cve_id: DSA-2915-1 dpkg
date: 2014-04-28 00:00:00+00:00
more_info:
Jakub Wilk discovered that dpkg did not correctly parse C-style filename quoting, allowing for paths to be traversed when unpacking a source package - leading to the creation of files outside the directory of the source being unpacked.


cve_id: DSA-2934-1 python-django
date: 2014-05-19 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Django, a high-level Python web development framework. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2976-1 eglibc
date: 2014-07-10 00:00:00+00:00
more_info:
Stephane Chazelas discovered that the GNU C library, glibc, processed ".." path segments in locale-related environment variables, possibly allowing attackers to circumvent intended restrictions, such as ForceCommand in OpenSSH, assuming that they can supply crafted locale settings.


cve_id: DSA-2945-1 chkrootkit
date: 2014-06-03 00:00:00+00:00
more_info:
Thomas Stangner discovered a vulnerability in chkrootkit, a rootkit detector, which may allow local attackers to gain root access when /tmp is mounted without the noexec option.


cve_id: DSA-2969-1 libemail-address-perl
date: 2014-06-27 00:00:00+00:00
more_info:
Bastian Blank reported a denial of service vulnerability in Email::Address, a Perl module for RFC 2822 address parsing and creation. Email::Address::parse used significant time on parsing empty quoted strings. A remote attacker able to supply specifically crafted input to an application using Email::Address for parsing, could use this flaw to mount a denial of service attack against the application.


cve_id: DSA-2958-1 apt
date: 2014-06-12 00:00:00+00:00
more_info:
Jakub Wilk discovered that APT, the high level package manager, did not properly perform authentication checks for source packages downloaded via "apt-get source". This only affects use cases where source packages are downloaded via this command; it does not affect regular Debian package installation and upgrading.


cve_id: DSA-2997-1 reportbug
date: 2014-08-05 00:00:00+00:00
more_info:
Jakub Wilk discovered a remote command execution flaw in reportbug, a tool to report bugs in the Debian distribution. A man-in-the-middle attacker could put shell metacharacters in the version number allowing arbitrary code execution with the privileges of the user running reportbug.


cve_id: DSA-3020-1 acpi-support
date: 2014-09-10 00:00:00+00:00
more_info:
During a review for EDF, Raphael Geissert discovered that the acpi-support package did not properly handle data obtained from a user's environment. This could lead to program malfunction or allow a local user to escalate privileges to the root user due to a programming error.


cve_id: DSA-3013-1 s3ql
date: 2014-08-27 00:00:00+00:00
more_info:
Nikolaus Rath discovered that s3ql, a file system for online data storage, used the pickle functionality of the Python programming language in an unsafe way.  As a result, a malicious storage backend or man-in-the-middle attacker was able execute arbitrary code.


cve_id: DSA-3025-1 apt
date: 2014-09-16 00:00:00+00:00
more_info:
It was discovered that APT, the high level package manager, does not properly invalidate unauthenticated data  (<a href="https://security-tracker.debian.org/tracker/CVE-2014-0488">\ CVE-2014-0488</a>), performs incorrect verification of 304 replies  (<a href="https://security-tracker.debian.org/tracker/CVE-2014-0487">\ CVE-2014-0487</a>), does not perform the checksum check when the Acquire::GzipIndexes option is used (<a href="https://security-tracker.debian.org/tracker/CVE-2014-0489">\ CVE-2014-0489</a>) and does not properly perform validation for binary packages downloaded by the <code>apt-get download</code> command  (<a href="https://security-tracker.debian.org/tracker/CVE-2014-0490">\ CVE-2014-0490</a>).


cve_id: DSA-3023-1 bind9
date: 2014-09-11 00:00:00+00:00
more_info:
Jared Mauch reported a denial of service flaw in the way BIND, a DNS server, handled queries for NSEC3-signed zones. A remote attacker could use this flaw against an authoritative name server that served NCES3-signed zones by sending a specially crafted query, which, when processed, would cause named to crash.


cve_id: DSA-2936-1 torque
date: 2014-05-23 00:00:00+00:00
more_info:
John Fitzpatrick from MWR Labs reported a stack-based buffer overflow vulnerability in torque, a PBS-derived batch processing queueing system. An unauthenticated remote attacker could exploit this flaw to execute arbitrary code with root privileges.


cve_id: DSA-2841-1 movabletype-opensource
date: 2014-01-11 00:00:00+00:00
more_info:
A cross-site scripting vulnerability was discovered in the rich text editor of the Movable Type blogging engine.


cve_id: DSA-2843-1 graphviz
date: 2014-01-13 00:00:00+00:00
more_info:
Two buffer overflow vulnerabilities were reported in Graphviz, a rich collection of graph drawing tools. The Common Vulnerabilities and Exposures project identifies the following issues:


cve_id: DSA-2904-1 virtualbox
date: 2014-04-15 00:00:00+00:00
more_info:
Francisco Falcon discovered that missing input sanitizing in the 3D  acceleration code in VirtualBox could lead to the execution of arbitrary  code on the host system.


cve_id: DSA-2984-1 acpi-support
date: 2014-07-22 00:00:00+00:00
more_info:
CESG discovered a root escalation flaw in the acpi-support package. An  unprivileged user can inject the DBUS_SESSION_BUS_ADDRESS environment  variable to run arbitrary commands as root user via the policy-funcs  script.


cve_id: DSA-2952-1 kfreebsd-9
date: 2014-06-05 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the FreeBSD kernel that may lead to a denial of service or possibly disclosure of kernel memory. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2867-1 otrs2
date: 2014-02-23 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in otrs2, the Open Ticket Request System. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2847-1 drupal7
date: 2014-01-20 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in Drupal, a fully-featured content management framework. The Common Vulnerabilities and Exposures project identifies the following issues:


cve_id: DSA-2858-1 iceweasel
date: 2014-02-10 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, too-verbose error messages and missing permission checks may lead to the execution of arbitrary code, the bypass of security checks or information disclosure. This update also addresses security issues in the bundled version of the NSS crypto library.


cve_id: DSA-2911-1 icedove
date: 2014-04-22 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client. Multiple memory safety  errors, out of bound reads, use-after-frees and other implementation  errors may lead to the execution of arbitrary code, information  disclosure or denial of service.


cve_id: DSA-2881-1 iceweasel
date: 2014-03-19 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, out of bound reads, use-after-frees and other implementation errors may lead to the execution of arbitrary code, information disclosure, denial of service.


cve_id: DSA-2924-1 icedove
date: 2014-05-05 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client: multiple memory safety errors, buffer overflows, missing permission checks, out of bound reads, use-after-frees and other implementation errors may lead to the execution of arbitrary code, privilege escalation, cross-site scripting or denial of service.


cve_id: DSA-2918-1 iceweasel
date: 2014-04-30 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors,  buffer overflows, missing permission checks, out of bound reads,  use-after-frees and other implementation errors may lead to the  execution of arbitrary code, privilege escalation, cross-site scripting or denial of service.


cve_id: DSA-2960-1 icedove
date: 2014-06-16 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client: multiple memory safety errors and buffer overflows may lead to the execution of arbitrary code or denial of service.


cve_id: DSA-2955-1 iceweasel
date: 2014-06-11 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser:  Multiple memory safety errors and buffer overflows may lead to the execution of arbitrary code or denial of service.


cve_id: DSA-2996-1 icedove
date: 2014-08-03 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client: Multiple memory safety errors and use-after-frees may lead to the execution of arbitrary code or denial of service.


cve_id: DSA-2986-1 iceweasel
date: 2014-07-23 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser:  Multiple memory safety errors and  use-after-frees may lead to the execution of arbitrary code or denial of service.


cve_id: DSA-3071-1 nss
date: 2014-11-11 00:00:00+00:00
more_info:
In nss, a set of libraries designed to support cross-platform development of security-enabled client and server applications, Tyson Smith and Jesse Schwartzentruber discovered a use-after-free vulnerability that allows remote attackers to execute arbitrary code by triggering the improper removal of an NSSCertificate structure from a trust domain.


cve_id: DSA-2962-1 nspr
date: 2014-06-17 00:00:00+00:00
more_info:
Abhiskek Arya discovered an out of bounds write in the cvt_t() function  of the NetScape Portable Runtime Library which could result in the  execution of arbitrary code.


cve_id: DSA-3028-1 icedove
date: 2014-09-17 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client: Multiple memory safety  errors and use-after-frees may lead to the execution of arbitrary code  or denial of service.


cve_id: DSA-3037-1 icedove
date: 2014-09-26 00:00:00+00:00
more_info:
Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS (the Mozilla Network Security Service library, embedded in Wheezy's Icedove), was parsing ASN.1 data used in signatures, making it vulnerable to a signature forgery attack.


cve_id: DSA-3034-1 iceweasel
date: 2014-09-25 00:00:00+00:00
more_info:
Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS (the Mozilla Network Security Service library, embedded in Wheezy's Iceweasel package), was parsing ASN.1 data used in signatures, making it vulnerable to a signature forgery attack.


cve_id: DSA-3033-1 nss
date: 2014-09-25 00:00:00+00:00
more_info:
Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS (the Mozilla Network Security Service library) was parsing ASN.1 data used in signatures, making it vulnerable to a signature forgery attack.


cve_id: DSA-3186-1 nss
date: 2015-03-13 00:00:00+00:00
more_info:
It was discovered that the Mozilla Network Security Service library (nss) incorrectly handled certain ASN.1 lengths. A remote attacker could possibly use this issue to perform a data-smuggling attack.


cve_id: DSA-3061-1 icedove
date: 2014-10-31 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client:  Multiple memory safety errors, buffer overflows, use-after-frees and other implementation errors may lead to the execution of arbitrary code or denial of service.


cve_id: DSA-3050-1 iceweasel
date: 2014-10-15 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows, use-after-frees and other implementation errors may lead to the execution of arbitrary code, denial of service, the bypass of the same-origin policy or a loss of privacy.


cve_id: DSA-3092-1 icedove
date: 2014-12-07 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of  the Mozilla Thunderbird mail and news client: Multiple memory safety  errors, buffer overflows, use-after-frees and other implementation errors may lead to the execution of arbitrary code, the bypass of security  restrictions or denial of service.


cve_id: DSA-3090-1 iceweasel
date: 2014-12-04 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser:  Multiple memory safety errors, buffer overflows, use-after-frees and other implementation errors may lead to the execution of arbitrary code, the bypass of security restrictions or denial of service.


cve_id: DSA-3146-1 requests
date: 2015-01-30 00:00:00+00:00
more_info:
Jakub Wilk discovered that in requests, an HTTP library for the Python language, authentication information was improperly handled when a redirect occured. This would allow remote servers to obtain two different types of sensitive information: proxy passwords from the Proxy-Authorization header  (<a href="https://security-tracker.debian.org/tracker/CVE-2014-1830">\ CVE-2014-1830</a>), or netrc passwords from the Authorization header  (<a href="https://security-tracker.debian.org/tracker/CVE-2014-1829">\ CVE-2014-1829</a>).


cve_id: DSA-2860-1 parcimonie
date: 2014-02-11 00:00:00+00:00
more_info:
Holger Levsen discovered that parcimonie, a privacy-friendly helper to refresh a GnuPG keyring, is affected by a design problem that undermines the usefulness of this piece of software in the intended threat model.


cve_id: DSA-2861-1 file
date: 2014-02-16 00:00:00+00:00
more_info:
It was discovered that file, a file type classification tool, contains a flaw in the handling of <q>indirect</q> magic rules in the libmagic library, which leads to an infinite recursion when trying to determine the file type of certain files. The Common Vulnerabilities and Exposures project ID <a href="https://security-tracker.debian.org/tracker/CVE-2014-1943">CVE-2014-1943</a> has been assigned to identify this flaw. Additionally, other well-crafted files might result in long computation times (while using 100% CPU) and overlong results.


cve_id: DSA-2898-1 imagemagick
date: 2014-04-09 00:00:00+00:00
more_info:
Several buffer overflows were found in Imagemagick, a suite of image  manipulation programs. Processing malformed PSD files could lead to the  execution of arbitrary code.


cve_id: DSA-2866-1 gnutls26
date: 2014-02-22 00:00:00+00:00
more_info:
Suman Jana reported that GnuTLS, deviating from the documented behavior, considers a version 1 intermediate certificate as a CA certificate by default.


cve_id: DSA-2951-1 mupdf
date: 2014-06-05 00:00:00+00:00
more_info:
It was discovered that a buffer overflow in the MuPDF viewer might lead to the execution of arbitrary code.


cve_id: DSA-3001-1 wordpress
date: 2014-08-09 00:00:00+00:00
more_info:
Multiple security issues have been discovered in Wordpress, a web blogging tool, resulting in denial of service or information disclosure. More information can be found in the upstream advisory at <a href="https://wordpress.org/news/2014/08/wordpress-3-9-2/">\ https://wordpress.org/news/2014/08/wordpress-3-9-2/</a>.


cve_id: DSA-2970-1 cacti
date: 2014-06-29 00:00:00+00:00
more_info:
Multiple security issues (cross-site scripting, cross-site request  forgery, SQL injections, missing input sanitising) have been found in  Cacti, a web frontend for RRDTool.


cve_id: DSA-2903-1 strongswan
date: 2014-04-14 00:00:00+00:00
more_info:
An authentication bypass vulnerability was found in charon, the daemon handling IKEv2 in strongSwan, an IKE/IPsec suite. The state machine handling the security association (IKE_SA) handled some state transitions incorrectly.


cve_id: DSA-2985-1 mysql-5.5
date: 2014-07-22 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.38. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-2884-1 libyaml
date: 2014-03-26 00:00:00+00:00
more_info:
Ivan Fratric of the Google Security Team discovered a heap-based buffer overflow vulnerability in LibYAML, a fast YAML 1.1 parser and emitter library. A remote attacker could provide a specially-crafted YAML document that, when parsed by an application using libyaml, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.


cve_id: DSA-2894-1 openssh
date: 2014-04-05 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in OpenSSH, an implementation of the SSH protocol suite. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2889-1 postfixadmin
date: 2014-03-28 00:00:00+00:00
more_info:
An SQL injection vulnerability was discovered in postfixadmin, a web administration interface for the Postfix Mail Transport Agent, which allowed authenticated users to make arbitrary manipulations to the database.


cve_id: DSA-3265-1 zendframework
date: 2015-05-20 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in Zend Framework, a PHP framework. Except for <a href="https://security-tracker.debian.org/tracker/CVE-2015-3154">CVE-2015-3154</a>, all these issues were already fixed in the version initially shipped with Jessie.


cve_id: DSA-2922-1 strongswan
date: 2014-05-05 00:00:00+00:00
more_info:
A vulnerability has been found in the ASN.1 parser of strongSwan, an IKE/IPsec suite used to establish IPsec protected links.


cve_id: DSA-2916-1 libmms
date: 2014-04-28 00:00:00+00:00
more_info:
Alex Chapman discovered that a buffer overflow in processing <q>MMS over HTTP</q> messages could result in the execution of arbitrary code.


cve_id: DSA-2913-1 drupal7
date: 2014-04-25 00:00:00+00:00
more_info:
An information disclosure vulnerability was discovered in Drupal, a fully-featured content management framework. When pages are cached for anonymous users, form state may leak between anonymous users. Sensitive or private information recorded for one anonymous user could thus be disclosed to other users interacting with the same form at the same time.


cve_id: DSA-2925-1 rxvt-unicode
date: 2014-05-08 00:00:00+00:00
more_info:
Phillip Hallam-Baker discovered that window property values could be  queried in rxvt-unicode, resulting in the potential execution of  arbitrary commands.


cve_id: DSA-2948-1 python-bottle
date: 2014-06-04 00:00:00+00:00
more_info:
It was discovered that Bottle, a WSGI-framework for Python, performed a too permissive detection of JSON content, resulting a potential bypass of security mechanisms.


cve_id: DSA-2949-1 linux
date: 2014-06-05 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation:


cve_id: DSA-2941-1 lxml
date: 2014-06-01 00:00:00+00:00
more_info:
It was discovered that clean_html() function of lxml (pythonic bindings  for the libxml2 and libxslt libraries) performed insufficient  sanitisation for some non-printable characters. This could lead to  cross-site scripting.


cve_id: DSA-3079-1 ppp
date: 2014-11-28 00:00:00+00:00
more_info:
A vulnerability was discovered in ppp, an implementation of the Point-to-Point Protocol: an integer overflow in the routine responsible for parsing user-supplied options potentially allows a local attacker to gain root privileges.


cve_id: DSA-2954-1 dovecot
date: 2014-06-09 00:00:00+00:00
more_info:
It was discovered that the Dovecot email server is vulnerable to a denial of service attack against imap/pop3-login processes due to incorrect handling of the closure of inactive SSL/TLS connections.


cve_id: DSA-2944-1 gnutls26
date: 2014-06-01 00:00:00+00:00
more_info:
Joonas Kuorilehto discovered that GNU TLS performed insufficient  validation of session IDs during TLS/SSL handshakes. A malicious server could use this to execute arbitrary code or perform denial of service.


cve_id: DSA-3056-1 libtasn1-3
date: 2014-10-26 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in libtasn1-3, a library that manages ASN1 (Abstract Syntax Notation One) structures. An attacker could use those to cause a denial-of-service via out-of-bounds access or NULL pointer dereference.


cve_id: DSA-2971-1 dbus
date: 2014-07-02 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in dbus, an asynchronous inter-process communication system. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2982-1 ruby-activerecord-3.2
date: 2014-07-19 00:00:00+00:00
more_info:
Sean Griffin discovered two vulnerabilities in the PostgreSQL adapter  for Active Record which could lead to SQL injection.


cve_id: DSA-2998-1 openssl
date: 2014-08-07 00:00:00+00:00
more_info:
Multiple vulnerabilities have been identified in OpenSSL, a Secure Sockets Layer toolkit, that may result in denial of service (application crash, large memory consumption), information leak, protocol downgrade. Additionally, a buffer overrun affecting only applications explicitly set up for SRP has been fixed (<a href="https://security-tracker.debian.org/tracker/CVE-2014-3512">CVE-2014-3512</a>).


cve_id: DSA-2990-1 cups
date: 2014-07-27 00:00:00+00:00
more_info:
It was discovered that the web interface in CUPS, the Common UNIX Printing System, incorrectly validated permissions on rss files and directory index files. A local attacker could possibly use this issue to bypass file permissions and read arbitrary files, possibly leading to a privilege escalation.


cve_id: DSA-3005-1 gpgme1.0
date: 2014-08-14 00:00:00+00:00
more_info:
TomĂĄĹĄ Trnka discovered a heap-based buffer overflow within the gpgsm status handler of GPGME, a library designed to make access to GnuPG easier for applications. An attacker could use this issue to cause an application using GPGME to crash (denial of service) or possibly to execute arbitrary code.


cve_id: DSA-3489-1 lighttpd
date: 2016-02-23 00:00:00+00:00
more_info:
lighttpd, a small webserver, is vulnerable to the POODLE attack via the use of SSLv3. This protocol is now disabled by default.


cve_id: DSA-3125-1 openssl
date: 2015-01-11 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit. The Common Vulnerabilities and Exposures project identifies the following issues:


cve_id: DSA-3330-1 activemq
date: 2015-08-07 00:00:00+00:00
more_info:
It was discovered that the Apache ActiveMQ message broker is susceptible to denial of service through an undocumented, remote shutdown command. 


cve_id: DSA-3107-1 subversion
date: 2014-12-20 00:00:00+00:00
more_info:
Evgeny Kotkov discovered a NULL pointer dereference while processing REPORT requests in mod_dav_svn, the Subversion component which is used to serve repositories with the Apache web server.  A remote attacker could abuse this vulnerability for a denial of service.


cve_id: DSA-3009-1 python-imaging
date: 2014-08-21 00:00:00+00:00
more_info:
Andrew Drake discovered that missing input sanitising in the icns decoder of the Python Imaging Library could result in denial of service if a malformed image is processed.


cve_id: DSA-3139-1 squid
date: 2015-01-25 00:00:00+00:00
more_info:
Matthew Daley discovered that squid, a web proxy cache, does not properly perform input validation when parsing requests. A remote attacker could use this flaw to mount a denial of service attack, by sending specially crafted Range requests.


cve_id: DSA-3014-1 squid3
date: 2014-08-28 00:00:00+00:00
more_info:
Matthew Daley discovered that Squid3, a fully featured web proxy cache, did not properly perform input validation in request parsing. A remote attacker could use this flaw to mount a denial of service by sending crafted Range requests.


cve_id: DSA-3060-1 linux
date: 2014-10-31 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service:


cve_id: DSA-3022-1 curl
date: 2014-09-10 00:00:00+00:00
more_info:
Two vulnerabilities have been discovered in cURL, an URL transfer library. They can be use to leak cookie information:


cve_id: DSA-3029-1 nginx
date: 2014-09-20 00:00:00+00:00
more_info:
Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that it was possible to reuse cached SSL sessions in unrelated contexts, allowing virtual host confusion attacks in some configurations by an attacker in a privileged network position.


cve_id: DSA-3019-1 procmail
date: 2014-09-04 00:00:00+00:00
more_info:
Boris <q>pi</q> Piwinger and Tavis Ormandy reported a heap overflow vulnerability in procmail's formail utility when processing specially-crafted email headers. A remote attacker could use this flaw to cause formail to crash, resulting in a denial of service or data loss, or possibly execute arbitrary code.


cve_id: DSA-3040-1 rsyslog
date: 2014-09-30 00:00:00+00:00
more_info:
Rainer Gerhards, the rsyslog project leader, reported a vulnerability in Rsyslog, a system for log processing. As a consequence of this vulnerability an attacker can send malformed messages to a server, if this one accepts data from untrusted sources, and trigger a denial of service attack.


cve_id: DSA-3057-1 libxml2
date: 2014-10-26 00:00:00+00:00
more_info:
Sogeti found a denial of service flaw in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to excessive CPU consumption (denial of service) based on excessive entity substitutions, even if entity substitution was disabled, which is the parser default behavior. (<a href="https://security-tracker.debian.org/tracker/CVE-2014-3660">CVE-2014-3660</a>)


cve_id: DSA-3047-1 rsyslog
date: 2014-10-08 00:00:00+00:00
more_info:
Mancha discovered a vulnerability in rsyslog, a system for log processing. This vulnerability is an integer overflow that can be triggered by malformed messages to a server, if this one accepts data from untrusted sources, provoking message loss, denial of service and, potentially, remote code execution.


cve_id: DSA-3058-1 torque
date: 2014-10-27 00:00:00+00:00
more_info:
Chad Vizino reported a vulnerability in torque, a PBS-derived batch processing queueing system. A non-root user could exploit the flaw in the tm_adopt() library call to kill any process, including root-owned ones on any node in a job.


cve_id: DSA-3052-1 wpa
date: 2014-10-15 00:00:00+00:00
more_info:
Jouni Malinen discovered an input sanitization issue in the wpa_cli and hostapd_cli tools included in the wpa package.  A remote wifi system within range could provide a crafted string triggering arbitrary code execution running with privileges of the affected wpa_cli or hostapd_cli process.


cve_id: DSA-3051-1 drupal7
date: 2014-10-15 00:00:00+00:00
more_info:
Stefan Horst discovered a vulnerability in the Drupal database  abstraction API, which may result in SQL injection.


cve_id: DSA-3069-1 curl
date: 2014-11-07 00:00:00+00:00
more_info:
Symeon Paraschoudis discovered that the curl_easy_duphandle() function in cURL, an URL transfer library, has a bug that can lead to libcurl eventually sending off sensitive data that was not intended for sending, while performing a HTTP POST operation.


cve_id: DSA-3072-1 file
date: 2014-11-11 00:00:00+00:00
more_info:
Francisco Alonso of Red Hat Product Security found an issue in the file utility: when checking ELF files, note headers are incorrectly checked, thus potentially allowing attackers to cause a denial of service (out-of-bounds read and application crash) by supplying a specially crafted ELF file.


cve_id: DSA-3074-1 php5
date: 2014-11-18 00:00:00+00:00
more_info:
Francisco Alonso of Red Hat Product Security found an issue in the file utility, whose code is embedded in PHP, a general-purpose scripting language.  When checking ELF files, note headers are incorrectly checked, thus potentially allowing attackers to cause a denial of service (out-of-bounds read and application crash) by supplying a specially crafted ELF file.


cve_id: DSA-3070-1 kfreebsd-9
date: 2014-11-07 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the FreeBSD kernel that may lead to a denial of service or information disclosure.


cve_id: DSA-2935-1 libgadu
date: 2014-05-21 00:00:00+00:00
more_info:
It was discovered that malformed responses from a Gadu-Gadu file relay server could lead to denial of service or the execution of arbitrary code in applications linked to the libgadu library.


cve_id: DSA-2953-1 dpkg
date: 2014-06-08 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in dpkg that allow file modification through path traversal when unpacking source packages with specially crafted patch files.


cve_id: DSA-2957-1 mediawiki
date: 2014-06-12 00:00:00+00:00
more_info:
Omer Iqbal discovered that Mediawiki, a wiki engine, parses invalid usernames on Special:PasswordReset as wikitext when $wgRawHtml is enabled. On such wikis this allows an unauthenticated attacker to insert malicious JavaScript, a cross site scripting attack.


cve_id: DSA-2961-1 php5
date: 2014-06-16 00:00:00+00:00
more_info:
It was discovered that PHP, a general-purpose scripting language commonly used for web application development, is vulnerable to a heap-based buffer overflow in the DNS TXT record parsing. A malicious server or man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application uses dns_get_record() to perform a DNS query.


cve_id: DSA-2964-1 iodine
date: 2014-06-21 00:00:00+00:00
more_info:
Oscar Reparaz discovered an authentication bypass vulnerability in iodine, a tool for tunneling IPv4 data through a DNS server. A remote attacker could provoke a server to accept the rest of the setup or also network traffic by exploiting this flaw.


cve_id: DSA-3017-1 php-cas
date: 2014-09-02 00:00:00+00:00
more_info:
Marvin S. Addison discovered that Jasig phpCAS, a PHP library for the CAS authentication protocol, did not encode tickets before adding them to an URL, creating a possibility for cross site scripting.


cve_id: DSA-3000-1 krb5
date: 2014-08-09 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in krb5, the MIT implementation of Kerberos. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-2995-1 lzo2
date: 2014-08-03 00:00:00+00:00
more_info:
Don A. Bailey from Lab Mouse Security discovered an integer overflow flaw in the way the lzo library decompressed certain archives compressed with the LZO algorithm. An attacker could create a specially crafted LZO-compressed input that, when decompressed by an application using the lzo library, would cause that application to crash or, potentially, execute arbitrary code.


cve_id: DSA-2977-1 libav
date: 2014-07-11 00:00:00+00:00
more_info:
Don A. Baley discovered an integer overflow in the lzo compression handler which could result in the execution of arbitrary code.


cve_id: DSA-2967-1 gnupg
date: 2014-06-25 00:00:00+00:00
more_info:
Jean-RenĂŠ Reinhard, Olivier Levillain and Florian Maury reported that GnuPG, the GNU Privacy Guard, did not properly parse certain garbled compressed data packets. A remote attacker could use this flaw to mount a denial of service against GnuPG by triggering an infinite loop.


cve_id: DSA-2972-1 linux
date: 2014-07-06 00:00:00+00:00
more_info:
Andy Lutomirski discovered that the ptrace syscall was not verifying the RIP register to be valid in the ptrace API on x86_64 processors. An unprivileged user could use this flaw to crash the kernel (resulting in denial of service) or for privilege escalation.


cve_id: DSA-3062-1 wget
date: 2014-11-01 00:00:00+00:00
more_info:
HD Moore of Rapid7 discovered a symlink attack in Wget, a command-line  utility to retrieve files via HTTP, HTTPS, and FTP. The vulnerability  allows to create arbitrary files on the user's system when Wget runs in  recursive mode against a malicious FTP server. Arbitrary file creation  may override content of user's files or permit remote code execution with  the user privilege. 


cve_id: DSA-2988-1 transmission
date: 2014-07-24 00:00:00+00:00
more_info:
Ben Hawkes discovered that incorrect handling of peer messages in the Transmission bittorrent client could result in denial of service or the execution of arbitrary code.


cve_id: DSA-2981-1 polarssl
date: 2014-07-18 00:00:00+00:00
more_info:
A flaw was discovered in PolarSSL, a lightweight crypto and SSL/TLS library, which can be exploited by a remote unauthenticated attacker to mount a denial of service against PolarSSL servers that offer GCM ciphersuites. Potentially clients are affected too if a malicious server decides to execute the denial of service attack against its clients.


cve_id: DSA-3248-1 libphp-snoopy
date: 2015-05-02 00:00:00+00:00
more_info:
It was discovered that missing input saniting in Snoopy, a PHP class that simulates a web browser may result in the execution of arbitrary commands.


cve_id: DSA-2983-1 drupal7
date: 2014-07-20 00:00:00+00:00
more_info:
Multiple security issues have been discovered in the Drupal content management system, ranging from denial of service to cross-site scripting. More information can be found at <a  href="https://www.drupal.org/SA-CORE-2014-003">\ https://www.drupal.org/SA-CORE-2014-003</a>.


cve_id: DSA-3007-1 cacti
date: 2014-08-20 00:00:00+00:00
more_info:
Multiple security issues (cross-site scripting, missing input sanitising and SQL injection) have been discovered in Cacti, a web interface for  graphing of monitoring systems.


cve_id: DSA-3004-1 kde4libs
date: 2014-08-11 00:00:00+00:00
more_info:
Sebastian Krahmer discovered that Kauth used Policykit insecurely by  relying on the process ID. This could result in privilege escalation.


cve_id: DSA-2993-1 tor
date: 2014-07-31 00:00:00+00:00
more_info:
Several issues have been discovered in Tor, a connection-based low-latency anonymous communication system, resulting in information leaks.


cve_id: DSA-3012-1 eglibc
date: 2014-08-27 00:00:00+00:00
more_info:
Tavis Ormandy discovered a heap-based buffer overflow in the transliteration module loading code in eglibc, Debian's version of the GNU C Library.  As a result, an attacker who can supply a crafted destination character set argument to iconv-related character conversation functions could achieve arbitrary code execution.


cve_id: DSA-3002-1 wireshark
date: 2014-08-10 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors for Catapult  DCT2000, IrDA, GSM Management, RLC ASN.1 BER, which could result in  denial of service.


cve_id: DSA-3011-1 mediawiki
date: 2014-08-23 00:00:00+00:00
more_info:
It was discovered that MediaWiki, a website engine for collaborative work, is vulnerable to JSONP injection in Flash (<a href="https://security-tracker.debian.org/tracker/CVE-2014-5241">CVE-2014-5241</a>) and clickjacking between OutputPage and ParserOutput (<a href="https://security-tracker.debian.org/tracker/CVE-2014-5243">CVE-2014-5243</a>). The vulnerabilities are addressed by upgrading MediaWiki to the new upstream version 1.19.18, which includes additional changes.


cve_id: DSA-2999-1 drupal7
date: 2014-08-09 00:00:00+00:00
more_info:
A denial of service vulnerability was discovered in Drupal, a fully-featured content management framework. A remote attacker could exploit this flaw to cause CPU and memory exhaustion and the site's database to reach the maximum number of open connections, leading to the site becoming unavailable or unresponsive. More information can be found at <a href="https://www.drupal.org/SA-CORE-2014-004">\ https://www.drupal.org/SA-CORE-2014-004</a>.


cve_id: DSA-3024-1 gnupg
date: 2014-09-11 00:00:00+00:00
more_info:
Genkin, Pipman and Tromer discovered a side-channel attack on Elgamal encryption subkeys  (<a href="https://security-tracker.debian.org/tracker/CVE-2014-5270">\ CVE-2014-5270</a>).


cve_id: DSA-3073-1 libgcrypt11
date: 2014-11-16 00:00:00+00:00
more_info:
Daniel Genkin, Itamar Pipman and Eran Tromer discovered that Elgamal encryption subkeys in applications using the libgcrypt11 library, for example GnuPG 2.x, could be leaked via a side-channel attack.


cve_id: DSA-3015-1 lua5.1
date: 2014-09-01 00:00:00+00:00
more_info:
A heap-based overflow vulnerability was found in the way Lua, a simple, extensible, embeddable programming language, handles varargs functions with many fixed parameters called with few arguments, leading to application crashes or, potentially, arbitrary code execution.


cve_id: DSA-3081-1 libvncserver
date: 2014-11-29 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in libvncserver, a library to  implement VNC server functionality. These vulnerabilities might result in the  execution of arbitrary code or denial of service in both the client and the  server side.


cve_id: DSA-3032-1 bash
date: 2014-09-24 00:00:00+00:00
more_info:
Stephane Chazelas discovered a vulnerability in bash, the GNU Bourne-Again Shell, related to how environment variables are processed.  In many common configurations, this vulnerability is exploitable over the network, especially if bash has been configured as the system shell.


cve_id: DSA-3119-1 libevent
date: 2015-01-06 00:00:00+00:00
more_info:
Andrew Bartlett of Catalyst reported a defect affecting certain applications using the Libevent evbuffer API. This defect leaves applications which pass insanely large inputs to evbuffers open to a possible heap overflow or infinite loop. In order to exploit this flaw, an attacker needs to be able to find a way to provoke the program into trying to make a buffer chunk larger than what will fit into a single size_t or off_t.


cve_id: DSA-3031-1 apt
date: 2014-09-23 00:00:00+00:00
more_info:
The Google Security Team discovered a buffer overflow vulnerability in the HTTP transport code in apt-get. An attacker able to man-in-the-middle a HTTP request to an apt repository can trigger the buffer overflow, leading to a crash of the <q>http</q> apt method binary, or potentially to arbitrary code execution.


cve_id: DSA-3502-1 roundup
date: 2016-03-03 00:00:00+00:00
more_info:
Ralf Schlatterbeck discovered an information leak in roundup, a web-based issue tracking system. An authenticated attacker could use it to see sensitive details about other users, including their hashed password.


cve_id: DSA-3049-1 wireshark
date: 2014-10-14 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors/parsers for RTP, MEGACO, Netflow, RTSP, SES and Sniffer, which could result in denial of service.


cve_id: DSA-3135-1 mysql-5.5
date: 2015-01-23 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.41. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-3035-1 bash
date: 2014-09-25 00:00:00+00:00
more_info:
Tavis Ormandy discovered that the patch applied to fix <a href="https://security-tracker.debian.org/tracker/CVE-2014-6271">CVE-2014-6271</a> released in DSA-3032-1 for bash, the GNU Bourne-Again Shell, was incomplete and could still allow some characters to be injected into another environment (<a href="https://security-tracker.debian.org/tracker/CVE-2014-7169">CVE-2014-7169</a>). With this update prefix and suffix for environment variable names which contain shell functions are added as hardening measure.


cve_id: DSA-3036-1 mediawiki
date: 2014-09-26 00:00:00+00:00
more_info:
It was discovered that MediaWiki, a wiki engine, did not sufficiently filter CSS in uploaded SVG files, allowing for cross site scripting.


cve_id: DSA-3042-1 exuberant-ctags
date: 2014-10-04 00:00:00+00:00
more_info:
Stefano Zacchiroli discovered a vulnerability in exuberant-ctags, a tool to build tag file indexes of source code definitions: Certain JavaScript files cause ctags to enter an infinite loop until it runs out of disk  space, resulting in denial of service.


cve_id: DSA-3048-1 apt
date: 2014-10-08 00:00:00+00:00
more_info:
Guillem Jover discovered that the changelog retrieval functionality in apt-get used temporary files in an insecure way, allowing a local user to cause arbitrary files to be overwritten.


cve_id: DSA-3114-1 mime-support
date: 2014-12-29 00:00:00+00:00
more_info:
Timothy D. Morgan discovered that run-mailcap, an utility to execute programs via entries in the mailcap file, is prone to shell command injection via shell meta-characters in filenames. In specific scenarios this flaw could allow an attacker to remotely execute arbitrary code.


cve_id: DSA-3091-1 getmail4
date: 2014-12-07 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in getmail4, a mail  retriever with support for POP3, IMAP4 and SDPS, that could allow  man-in-the-middle attacks.


cve_id: DSA-3046-1 mediawiki
date: 2014-10-05 00:00:00+00:00
more_info:
It was reported that MediaWiki, a website engine for collaborative work, allowed to load user-created CSS on pages where user-created JavaScript is not allowed. A wiki user could be tricked into performing actions by manipulating the interface from CSS, or JavaScript code being executed from CSS, on security-wise sensitive pages like Special:Preferences and Special:UserLogin. This update removes the separation of CSS and JavaScript module allowance.


cve_id: DSA-3447-1 tomcat7
date: 2016-01-17 00:00:00+00:00
more_info:
It was discovered that malicious web applications could use the Expression Language to bypass protections of a Security Manager as expressions were evaluated within a privileged code section.


cve_id: DSA-3099-1 dbus
date: 2014-12-11 00:00:00+00:00
more_info:
Simon McVittie discovered that the fix for  <a href="https://security-tracker.debian.org/tracker/CVE-2014-3636">\ CVE-2014-3636</a> was incorrect, as it did not fully address the underlying denial-of-service vector.  This update starts the D-Bus daemon as root initially, so that it can properly raise its file descriptor count.


cve_id: DSA-3104-1 bsd-mailx
date: 2014-12-16 00:00:00+00:00
more_info:
It was discovered that bsd-mailx, an implementation of the <q>mail</q>  command, had an undocumented feature which treats syntactically valid  email addresses as shell commands to execute.


cve_id: DSA-3189-1 libav
date: 2015-03-15 00:00:00+00:00
more_info:
Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library. A full list of the changes is available at <url "http://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v0.8.17" />


cve_id: DSA-3159-1 ruby1.8
date: 2015-02-10 00:00:00+00:00
more_info:
It was discovered that the REXML parser, part of the interpreter for the Ruby language, could be coerced into allocating large string objects that could consume all available memory on the system. This could allow remote attackers to cause a denial of service (crash).


cve_id: DSA-3095-1 xorg-server
date: 2014-12-10 00:00:00+00:00
more_info:
Ilja van Sprundel of IOActive discovered several security issues in the X.org X server, which may lead to privilege escalation or denial of service.


cve_id: DSA-3084-1 openvpn
date: 2014-12-01 00:00:00+00:00
more_info:
Dragana Damjanovic discovered that an authenticated client could crash an OpenVPN server by sending a control packet containing less than four bytes as payload.


cve_id: DSA-3087-1 qemu
date: 2014-12-04 00:00:00+00:00
more_info:
Paolo Bonzini of Red Hat discovered that the blit region checks were insufficient in the Cirrus VGA emulator in qemu, a fast processor emulator. A privileged guest user could use this flaw to write into qemu address space on the host, potentially escalating their privileges to those of the qemu host process.


cve_id: DSA-3088-1 qemu-kvm
date: 2014-12-04 00:00:00+00:00
more_info:
Paolo Bonzini of Red Hat discovered that the blit region checks were insufficient in the Cirrus VGA emulator in qemu-kvm, a full virtualization solution on x86 hardware. A privileged guest user could use this flaw to write into qemu address space on the host, potentially escalating their privileges to those of the qemu host process.


cve_id: DSA-3278-1 libapache-mod-jk
date: 2015-06-03 00:00:00+00:00
more_info:
An information disclosure flaw due to incorrect JkMount/JkUnmount directives processing was found in the Apache 2 module mod_jk to forward requests from the Apache web server to Tomcat. A JkUnmount rule for a subtree of a previous JkMount rule could be ignored. This could allow a remote attacker to potentially access a private artifact in a tree that would otherwise not be accessible to them.


cve_id: DSA-3121-1 file
date: 2015-01-08 00:00:00+00:00
more_info:
Multiple security issues have been found in file, a tool/library to  determine a file type. Processing a malformed file could result in denial of service. Most of the changes are related to parsing ELF files.


cve_id: DSA-3149-1 condor
date: 2015-02-02 00:00:00+00:00
more_info:
Florian Weimer, of Red Hat Product Security, discovered an issue in condor, a distributed workload management system. Upon job completion, it can optionally notify a user by sending an email; the mailx invocation used in that process allowed for any authenticated user able to submit jobs, to execute arbitrary code with the privileges of the condor user.


cve_id: DSA-3273-1 tiff
date: 2015-05-25 00:00:00+00:00
more_info:
William Robinet and Michal Zalewski discovered multiple vulnerabilities in the TIFF library and its tools, which may result in denial of service or the execution of arbitrary code if a malformed TIFF file is processed.


cve_id: DSA-3106-1 jasper
date: 2014-12-20 00:00:00+00:00
more_info:
Jose Duart of the Google Security Team discovered a double free flaw (<a href="https://security-tracker.debian.org/tracker/CVE-2014-8137">CVE-2014-8137</a>) and a heap-based buffer overflow flaw (<a href="https://security-tracker.debian.org/tracker/CVE-2014-8138">CVE-2014-8138</a>) in JasPer, a library for manipulating JPEG-2000 files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code.


cve_id: DSA-3113-1 unzip
date: 2014-12-28 00:00:00+00:00
more_info:
Michele Spagnuolo of the Google Security Team discovered that unzip, an extraction utility for archives compressed in .zip format, is affected by heap-based buffer overflows within the CRC32 verification function (<a href="https://security-tracker.debian.org/tracker/CVE-2014-8139">CVE-2014-8139</a>), the test_compr_eb() function (<a href="https://security-tracker.debian.org/tracker/CVE-2014-8140">CVE-2014-8140</a>) and the getZip64Data() function (<a href="https://security-tracker.debian.org/tracker/CVE-2014-8141">CVE-2014-8141</a>), which may lead to the execution of arbitrary code.


cve_id: DSA-3117-1 php5
date: 2014-12-31 00:00:00+00:00
more_info:
Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development.


cve_id: DSA-3112-1 sox
date: 2014-12-23 00:00:00+00:00
more_info:
Michele Spagnuolo of the Google Security Team dicovered two heap-based buffer overflows in SoX, the Swiss Army knife of sound processing programs. A specially crafted wav file could cause an application using SoX to crash or, possibly, execute arbitrary code.


cve_id: DSA-3122-1 curl
date: 2015-01-08 00:00:00+00:00
more_info:
Andrey Labunets of Facebook discovered that cURL, an URL transfer library, fails to properly handle URLs with embedded end-of-line characters. An attacker able to make an application using libcurl to access a specially crafted URL via an HTTP proxy could use this flaw to do additional requests in a way that was not intended, or insert additional request headers into the request.


cve_id: DSA-3138-1 jasper
date: 2015-01-25 00:00:00+00:00
more_info:
An off-by-one flaw, leading to a heap-based buffer overflow (<a href="https://security-tracker.debian.org/tracker/CVE-2014-8157">CVE-2014-8157</a>), and an unrestricted stack memory use flaw (<a href="https://security-tracker.debian.org/tracker/CVE-2014-8158">CVE-2014-8158</a>) were found in JasPer, a library for manipulating JPEG-2000 files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code.


cve_id: DSA-3237-1 linux
date: 2015-04-26 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.


cve_id: DSA-3068-1 konversation
date: 2014-11-07 00:00:00+00:00
more_info:
It was discovered that Konversation, an IRC client for KDE, could be crashed when receiving malformed messages using FiSH encryption.


cve_id: DSA-3063-1 quassel
date: 2014-11-02 00:00:00+00:00
more_info:
An out-of-bounds read vulnerability was discovered in Quassel-core, one  of the components of the distributed IRC client Quassel. An attacker can  send a crafted message that crash to component causing a denial of  services or disclosure of information from process memory.


cve_id: DSA-3123-1 binutils
date: 2015-01-09 00:00:00+00:00
more_info:
Multiple security issues have been found in binutils, a toolbox for binary file manipulation. These vulnerabilities include multiple memory safety errors, buffer overflows, use-after-frees and other implementation errors may lead to the execution of arbitrary code, the bypass of security restrictions, path traversal attack or denial of service.


cve_id: DSA-3094-1 bind9
date: 2014-12-08 00:00:00+00:00
more_info:
It was discovered that BIND, a DNS server, is prone to a denial of  service vulnerability.
By making use of maliciously-constructed zones or a rogue server, an  attacker can exploit an oversight in the code BIND 9 uses to follow  delegations in the Domain Name Service, causing BIND to issue unlimited  queries in an attempt to follow the delegation.
This can lead to resource exhaustion and denial of service  (up to and including termination of the named server process.)


cve_id: DSA-3096-1 pdns-recursor
date: 2014-12-11 00:00:00+00:00
more_info:
Florian Maury from ANSSI discovered a flaw in pdns-recursor, a recursive DNS server : a remote attacker controlling maliciously-constructed zones or a rogue server could affect the performance of pdns-recursor, thus leading to resource exhaustion and a potential denial-of-service.


cve_id: DSA-3097-1 unbound
date: 2014-12-10 00:00:00+00:00
more_info:
Florian Maury from ANSSI discovered that unbound, a validating, recursive, and caching DNS resolver, was prone to a denial of service vulnerability. An attacker crafting a malicious zone and able to emit (or make emit) queries to the server can trick the resolver into following an endless series of delegations, leading to resource exhaustion and huge network usage.


cve_id: DSA-3116-1 polarssl
date: 2014-12-30 00:00:00+00:00
more_info:
It was discovered that a memory leak in parsing X.509 certificates may result in denial of service.


cve_id: DSA-3132-1 icedove
date: 2015-01-19 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client: Multiple memory safety errors and implementation errors may lead to the execution of arbitrary code, information leaks or denial of service.


cve_id: DSA-3127-1 iceweasel
date: 2015-01-14 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors and implementation errors may lead to the execution of arbitrary code, information leaks or denial of service.


cve_id: DSA-3076-1 wireshark
date: 2014-11-25 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors/parsers for SigComp UDVM, AMQP, NCP and TN5250, which could result in denial of service.


cve_id: DSA-3059-1 dokuwiki
date: 2014-10-29 00:00:00+00:00
more_info:
Two vulnerabilities have been discovered in dokuwiki. Access control in the media manager was insufficiently restricted and authentication could be bypassed when using Active Directory for LDAP authentication.


cve_id: DSA-3086-1 tcpdump
date: 2014-12-03 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in tcpdump, a command-line network traffic analyzer. These vulnerabilities might result in denial of service, leaking sensitive information from memory or, potentially, execution of arbitrary code.


cve_id: DSA-3082-1 flac
date: 2014-11-30 00:00:00+00:00
more_info:
Michele Spagnuolo, of Google Security Team, and Miroslav Lichvar, of Red Hat, discovered two issues in flac, a library handling Free Lossless Audio Codec media: by providing a specially crafted FLAC file, an attacker could execute arbitrary code.


cve_id: DSA-3130-1 lsyncd
date: 2015-01-16 00:00:00+00:00
more_info:
It was discovered that lsyncd, a daemon to synchronize local directories using rsync, performed insufficient sanitising of filenames which might result in the execution of arbitrary commands.


cve_id: DSA-3075-1 drupal7
date: 2014-11-20 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in Drupal, a fully-featured content management framework. The Common Vulnerabilities and Exposures project identifies the following issues:


cve_id: DSA-3089-1 jasper
date: 2014-12-04 00:00:00+00:00
more_info:
Jose Duart of the Google Security Team discovered heap-based buffer overflow flaws in JasPer, a library for manipulating JPEG-2000 files, which could lead to denial of service (application crash) or the execution of arbitrary code.


cve_id: DSA-3085-1 wordpress
date: 2014-12-03 00:00:00+00:00
more_info:
Multiple security issues have been discovered in Wordpress, a web blogging tool, resulting in denial of service or information disclosure. More information can be found in the upstream advisory at <url "https://wordpress.org/news/2014/11/wordpress-4-0-1/" />


cve_id: DSA-3078-1 libksba
date: 2014-11-27 00:00:00+00:00
more_info:
An integer underflow flaw, leading to a heap-based buffer overflow, was found in the ksba_oid_to_str() function of libksba, an X.509 and CMS (PKCS#7) library. By using special crafted S/MIME messages or ECC based OpenPGP data, it is possible to create a buffer overflow, which could cause an application using libksba to crash (denial of service), or potentially, execute arbitrary code.


cve_id: DSA-3163-1 libreoffice
date: 2015-02-19 00:00:00+00:00
more_info:
It was discovered that LibreOffice, an office productivity suite, could try to write to invalid memory areas when importing malformed RTF files. This could allow remote attackers to cause a denial of service (crash) or arbitrary code execution via crafted RTF files.


cve_id: DSA-3111-1 cpio
date: 2014-12-22 00:00:00+00:00
more_info:
Michal Zalewski discovered an out of bounds write issue in cpio, a tool for creating and extracting cpio archive files.  In the process of fixing that issue, the cpio developers found and fixed additional range checking and null pointer dereference issues.


cve_id: DSA-3083-1 mutt
date: 2014-11-30 00:00:00+00:00
more_info:
A flaw was discovered in mutt, a text-based mailreader. A specially crafted mail header could cause mutt to crash, leading to a denial of service condition.


cve_id: DSA-3102-1 libyaml
date: 2014-12-13 00:00:00+00:00
more_info:
Jonathan Gray and Stanislaw Pitucha found an assertion failure in the way wrapped strings are parsed in LibYAML, a fast YAML 1.1 parser and emitter library. An attacker able to load specially crafted YAML input into an application using libyaml could cause the application to crash.


cve_id: DSA-3115-1 pyyaml
date: 2014-12-29 00:00:00+00:00
more_info:
Jonathan Gray and Stanislaw Pitucha found an assertion failure in the  way wrapped strings are parsed in Python-YAML, a YAML parser and emitter  for Python. An attacker able to load specially crafted YAML input into an application using python-yaml could cause the application to crash.


cve_id: DSA-3098-1 graphviz
date: 2014-12-11 00:00:00+00:00
more_info:
Joshua Rogers discovered a format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz, a rich set of graph drawing tools. An attacker could use this flaw to cause graphviz to crash or possibly execute arbitrary code.


cve_id: DSA-3118-1 strongswan
date: 2015-01-05 00:00:00+00:00
more_info:
Mike Daskalakis reported a denial of service vulnerability in charon, the IKEv2 daemon for strongSwan, an IKE/IPsec suite used to establish IPsec protected links.


cve_id: DSA-3158-1 unrtf
date: 2015-02-09 00:00:00+00:00
more_info:
Michal Zalewski and Hanno Boeck discovered several vulnerabilities in unrtf, a RTF to other formats converter, leading to a denial of service (application crash) or, potentially, the execution of arbitrary code.


cve_id: DSA-3100-1 mediawiki
date: 2014-12-12 00:00:00+00:00
more_info:
A flaw was discovered in mediawiki, a wiki engine: cross-domain-policy mangling allows an article editor to inject code into API consumers that deserialize PHP representations of the page from the API.


cve_id: DSA-3108-1 ntp
date: 2014-12-20 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in the ntp package, an implementation of the Network Time Protocol.


cve_id: DSA-3109-1 firebird2.5
date: 2014-12-21 00:00:00+00:00
more_info:
Dmitry Kovalenko discovered that the Firebird database server is prone to a denial of service vulnerability. An unauthenticated remote attacker could send a malformed network packet to a firebird server, which would cause the server to crash.


cve_id: DSA-3124-1 otrs2
date: 2015-01-10 00:00:00+00:00
more_info:
Thorsten Eckel of Znuny GMBH and Remo Staeuble of InfoGuard discovered a privilege escalation vulnerability in otrs2, the Open Ticket Request System. An attacker with valid OTRS credentials could access and manipulate ticket data of other users via the GenericInterface, if a ticket webservice is configured and not additionally secured.


cve_id: DSA-3257-1 mercurial
date: 2015-05-11 00:00:00+00:00
more_info:
Jesse Hertz of Matasano Security discovered that Mercurial, a distributed version control system, is prone to a command injection vulnerability via a crafted repository name in a clone command.


cve_id: DSA-3131-1 xdg-utils
date: 2015-01-18 00:00:00+00:00
more_info:
John Houwer discovered a way to cause xdg-open, a tool that automatically opens URLs in a user's preferred application, to execute arbitrary commands remotely.


cve_id: DSA-3152-1 unzip
date: 2015-02-03 00:00:00+00:00
more_info:
A flaw was found in the test_compr_eb() function allowing out-of-bounds read and write access to memory locations. By carefully crafting a corrupt ZIP archive an attacker can trigger a heap overflow, resulting in application crash or possibly having other unspecified impact.


cve_id: DSA-3188-1 freetype
date: 2015-03-15 00:00:00+00:00
more_info:
Mateusz Jurczyk discovered multiple vulnerabilities in Freetype. Opening malformed fonts may result in denial of service or the execution of arbitrary code.


cve_id: DSA-3172-1 cups
date: 2015-02-25 00:00:00+00:00
more_info:
Peter De Wachter discovered that CUPS, the Common UNIX Printing System, did not correctly parse compressed raster files. By submitting a specially crafted raster file, a remote attacker could use this vulnerability to trigger a buffer overflow.


cve_id: DSA-3167-1 sudo
date: 2015-02-22 00:00:00+00:00
more_info:
Jakub Wilk reported that sudo, a program designed to provide limited super user privileges to specific users, preserves the TZ variable from a user's environment without any sanitization. A user with sudo access may take advantage of this to exploit bugs in the C library functions which parse the TZ environment variable or to open files that the user would not otherwise be able to open. The later could potentially cause changes in system behavior when reading certain device special files or cause the program run via sudo to block.


cve_id: DSA-3206-1 dulwich
date: 2015-03-28 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in Dulwich, a Python implementation of the file formats and protocols used by the Git version control system. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3370-1 freetype
date: 2015-10-06 00:00:00+00:00
more_info:
It was discovered that FreeType did not properly handle some malformed inputs. This could allow remote attackers to cause a denial of service (crash) via crafted font files.


cve_id: DSA-3388-1 ntp
date: 2015-11-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in the ntp package, an implementation of the Network Time Protocol. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3484-1 xdelta3
date: 2016-02-19 00:00:00+00:00
more_info:
Stepan Golosunov discovered that xdelta3, a diff utility which works with binary files, is affected by a buffer overflow vulnerability within the main_get_appheader function, which may lead to the execution of arbitrary code.


cve_id: DSA-3525-1 pixman
date: 2016-03-22 00:00:00+00:00
more_info:
Vincent LE GARREC discovered an integer overflow in pixman, a pixel-manipulation library for X and cairo. A remote attacker can exploit this flaw to cause an application using the pixman library to crash, or potentially, to execute arbitrary code with the privileges of the user running the application.


cve_id: DSA-3171-1 samba
date: 2015-02-23 00:00:00+00:00
more_info:
Richard van Eeden of Microsoft Vulnerability Research discovered that Samba, a SMB/CIFS file, print, and login server for Unix, contains a flaw in the netlogon server code which allows remote code execution with root privileges from an unauthenticated connection.


cve_id: DSA-3161-1 dbus
date: 2015-02-11 00:00:00+00:00
more_info:
Simon McVittie discovered a local denial of service flaw in dbus, an asynchronous inter-process communication system. On systems with systemd-style service activation, dbus-daemon does not prevent forged ActivationFailure messages from non-root processes. A malicious local user could use this flaw to trick dbus-daemon into thinking that systemd failed to activate a system service, resulting in an error reply back to the requester.


cve_id: DSA-3166-1 e2fsprogs
date: 2015-02-22 00:00:00+00:00
more_info:
Jose Duart of the Google Security Team discovered a buffer overflow in e2fsprogs, a set of utilities for the ext2, ext3, and ext4 file systems.  This issue can possibly lead to arbitrary code execution if a malicious device is plugged in, the system is configured to automatically mount it, and the mounting process chooses to run fsck on the device's malicious filesystem.


cve_id: DSA-3205-1 batik
date: 2015-03-27 00:00:00+00:00
more_info:
Nicolas Gregoire and Kevin Schaller discovered that Batik, a toolkit for processing SVG images, would load XML external entities by default. If a user or automated system were tricked into opening a specially crafted SVG file, an attacker could possibly obtain access to arbitrary files or cause resource consumption.


cve_id: DSA-3199-1 xerces-c
date: 2015-03-20 00:00:00+00:00
more_info:
Anton Rager and Jonathan Brossard from the Salesforce.com Product Security Team and Ben Laurie of Google discovered a denial of service vulnerability in xerces-c, a validating XML parser library for C++. The parser mishandles certain kinds of malformed input documents, resulting in a segmentation fault during a parse operation. An unauthenticated attacker could use this flaw to cause an application using the xerces-c library to crash.


cve_id: DSA-3160-1 xorg-server
date: 2015-02-11 00:00:00+00:00
more_info:
Olivier Fourdan discovered that missing input validation in the Xserver's handling of XkbSetGeometry requests may result in an information leak or denial of service.


cve_id: DSA-3193-1 tcpdump
date: 2015-03-17 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in tcpdump, a command-line network traffic analyzer. These vulnerabilities might result in denial of service (application crash) or, potentially, execution of arbitrary code.


cve_id: DSA-3191-1 gnutls26
date: 2015-03-15 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in GnuTLS, a library implementing the TLS and SSL protocols. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3143-1 virtualbox
date: 2015-01-28 00:00:00+00:00
more_info:
Two vulnerabilities have been discovered in VirtualBox, a x86 virtualisation solution, which might result in denial of service.


cve_id: DSA-3229-1 mysql-5.5
date: 2015-04-19 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.43. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-3213-1 arj
date: 2015-04-06 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in arj, an open source version of the arj archiver. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3141-1 wireshark
date: 2015-01-27 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors/parsers for SSL/TLS and DEC DNA, which could result in denial of service.


cve_id: DSA-3225-1 gst-plugins-bad0.10
date: 2015-04-15 00:00:00+00:00
more_info:
Aki Helin discovered a buffer overflow in the GStreamer plugin for MP4 playback, which could lead to the execution of arbitrary code.


cve_id: DSA-3264-1 icedove
date: 2015-05-19 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail client: Multiple memory safety errors, buffer overflows and use-after-frees may lead to the execution of arbitrary code, privilege escalation or denial of service.


cve_id: DSA-3212-1 icedove
date: 2015-04-02 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail client: Multiple memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code, the bypass of security restrictions or denial of service.


cve_id: DSA-3211-1 iceweasel
date: 2015-04-01 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code, the bypass of security restrictions, denial of service or cross-site request forgery.


cve_id: DSA-3201-1 iceweasel
date: 2015-03-22 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3179-1 icedove
date: 2015-03-03 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client: Multiple memory safety errors and implementation errors may lead to the execution of arbitrary code or information disclosure.


cve_id: DSA-3174-1 iceweasel
date: 2015-02-25 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors and implementation errors may lead to the execution of arbitrary code or information disclosure.


cve_id: DSA-3217-1 dpkg
date: 2015-04-09 00:00:00+00:00
more_info:
Jann Horn discovered that the source package integrity verification in dpkg-source can be bypassed via a specially crafted Debian source control file (.dsc). Note that this flaw only affects extraction of local Debian source packages via dpkg-source but not the installation of packages from the Debian archive.


cve_id: DSA-3218-1 wesnoth-1.10
date: 2015-04-10 00:00:00+00:00
more_info:
Ignacio R. Morelle discovered that missing path restrictions in the <q>Battle of Wesnoth</q> game could result in the disclosure of arbitrary files in the user's home directory if malicious campaigns/maps are loaded.


cve_id: DSA-3227-1 movabletype-opensource
date: 2015-04-15 00:00:00+00:00
more_info:
John Lightsey discovered a format string injection vulnerability in the localisation of templates in Movable Type, a blogging system. An unauthenticated remote attacker could take advantage of this flaw to execute arbitrary code as the web server user.


cve_id: DSA-3230-1 django-markupfield
date: 2015-04-20 00:00:00+00:00
more_info:
James P. Turk discovered that the ReST renderer in django-markupfield, a custom Django field for easy use of markup in text fields, didn't disable the ..raw directive, allowing remote attackers to include arbitrary files.


cve_id: DSA-3302-1 libwmf
date: 2015-07-06 00:00:00+00:00
more_info:
Insufficient input sanitising in libwmf, a library to process Windows metafile data, may result in denial of service or the execution of arbitrary code if a malformed WMF file is opened.


cve_id: DSA-3321-1 xmltooling
date: 2015-07-30 00:00:00+00:00
more_info:
The InCommon Shibboleth Training team discovered that XMLTooling, a C++ XML parsing library, did not properly handle an exception when parsing well-formed but schema-invalid XML. This could allow remote attackers to cause a denial of service (crash) via crafted XML data.


cve_id: DSA-3392-1 freeimage
date: 2015-11-04 00:00:00+00:00
more_info:
Pengsu Cheng discovered that FreeImage, a library for graphic image formats, contained multiple integer underflows that could lead to a denial of service: remote attackers were able to trigger a crash by supplying a specially crafted image.


cve_id: DSA-3405-1 smokeping
date: 2015-11-25 00:00:00+00:00
more_info:
Tero Marttila discovered that the Debian packaging for smokeping installed it in such a way that the CGI implementation of Apache httpd (mod_cgi) passed additional arguments to the smokeping_cgi program, potentially leading to arbitrary code execution in response to crafted HTTP requests.


cve_id: DSA-3407-1 dpkg
date: 2015-11-26 00:00:00+00:00
more_info:
Hanno Boeck discovered a stack-based buffer overflow in the dpkg-deb component of dpkg, the Debian package management system. This flaw could potentially lead to arbitrary code execution if a user or an automated system were tricked into processing a specially crafted Debian binary package (.deb) in the old style Debian binary package format.


cve_id: DSA-3192-1 checkpw
date: 2015-03-17 00:00:00+00:00
more_info:
Hiroya Ito of GMO Pepabo, Inc. reported that checkpw, a password authentication program, has a flaw in processing account names which contain double dashes. A remote attacker can use this flaw to cause a denial of service (infinite loop).


cve_id: DSA-3536-1 libstruts1.2-java
date: 2016-03-31 00:00:00+00:00
more_info:
It was discovered that libstruts1.2-java, a Java framework for MVC applications, contains a bug in its multi-page validation code. This allows input validation to be bypassed, even if MPV is not used directly.


cve_id: DSA-3289-1 p7zip
date: 2015-06-15 00:00:00+00:00
more_info:
Alexander Cherepanov discovered that p7zip is susceptible to a directory traversal vulnerability.  While extracting an archive, it will extract symlinks and then follow them if they are referenced in further entries.  This can be exploited by a rogue archive to write files outside the current directory.


cve_id: DSA-3283-1 cups
date: 2015-06-09 00:00:00+00:00
more_info:
It was discovered that CUPS, the Common UNIX Printing System, is vulnerable to a remotely triggerable privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on the CUPS server.


cve_id: DSA-3136-1 polarssl
date: 2015-01-24 00:00:00+00:00
more_info:
A vulnerability was discovered in PolarSSL, a lightweight crypto and SSL/TLS library. A remote attacker could exploit this flaw using specially crafted certificates to mount a denial of service against an application linked against the library (application crash), or potentially, to execute arbitrary code.


cve_id: DSA-3318-1 expat
date: 2015-07-26 00:00:00+00:00
more_info:
Multiple integer overflows have been discovered in Expat, an XML parsing C library, which may result in denial of service or the execution of arbitrary code if a malformed XML file is processed.


cve_id: DSA-3134-1 sympa
date: 2015-01-20 00:00:00+00:00
more_info:
A vulnerability has been discovered in the web interface of sympa, a mailing list manager. An attacker could take advantage of this flaw in the newsletter posting area, which allows sending to a list, or to oneself, any file located on the server filesystem and readable by the sympa user.


cve_id: DSA-3297-1 unattended-upgrades
date: 2015-06-29 00:00:00+00:00
more_info:
It was discovered that unattended-upgrades, a script for automatic installation of security upgrades, did not properly authenticate downloaded packages when the force-confold or force-confnew dpkg options were enabled via the DPkg::Options::* apt configuration.


cve_id: DSA-3329-1 linux
date: 2015-08-07 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leak.


cve_id: DSA-3162-1 bind9
date: 2015-02-18 00:00:00+00:00
more_info:
Jan-Piet Mens discovered that the BIND DNS server would crash when processing an invalid DNSSEC key rollover, either due to an error on the zone operator's part, or due to interference with network traffic by an attacker.  This issue affects configurations with the directives "dnssec-validation auto;" (as enabled in the Debian default configuration) or "dnssec-lookaside auto;".


cve_id: DSA-3145-1 privoxy
date: 2015-01-30 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in Privoxy, a privacy enhancing HTTP proxy, which might result in denial of service.


cve_id: DSA-3175-1 kfreebsd-9
date: 2015-02-25 00:00:00+00:00
more_info:
Mateusz Kocielski and Marek Kroemeke discovered that an integer overflow in IGMP processing may result in denial of service through malformed IGMP packets.


cve_id: DSA-3236-1 libreoffice
date: 2015-04-25 00:00:00+00:00
more_info:
It was discovered that missing input sanitising in Libreoffice's filter for HWP documents may result in the execution of arbitrary code if a malformed document is opened.


cve_id: DSA-3182-1 libssh2
date: 2015-03-11 00:00:00+00:00
more_info:
Mariusz Ziulek reported that libssh2, a SSH2 client-side library, was reading and using the SSH_MSG_KEXINIT packet without doing sufficient range checks when negotiating a new SSH session with a remote server. A malicious attacker could man in the middle a real server and cause a client using the libssh2 library to crash (denial of service) or otherwise read and use unintended memory areas in this process.


cve_id: DSA-3194-1 libxfont
date: 2015-03-17 00:00:00+00:00
more_info:
Ilja van Sprundel, Alan Coopersmith and William Robinet discovered multiple issues in libxfont's code to process BDF fonts, which might result in privilege escalation.


cve_id: DSA-3290-1 linux
date: 2015-06-18 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, information leaks or data corruption.


cve_id: DSA-3430-1 libxml2
date: 2015-12-23 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or crash the application.


cve_id: DSA-3222-1 chrony
date: 2015-04-12 00:00:00+00:00
more_info:
Miroslav Lichvar of Red Hat discovered multiple vulnerabilities in chrony, an alternative NTP client and server:


cve_id: DSA-3298-1 jackrabbit
date: 2015-07-01 00:00:00+00:00
more_info:
It was discovered that the Jackrabbit WebDAV bundle was susceptible to a XXE/XEE attack. When processing a WebDAV request body containing XML, the XML parser could be instructed to read content from network resources accessible to the host, identified by URI schemes such as <q>http(s)</q> or <q>file</q>. Depending on the WebDAV request, this could not only be used to trigger internal network requests, but might also be used to insert said content into the request, potentially exposing it to the attacker and others.


cve_id: DSA-3245-1 ruby1.8
date: 2015-05-02 00:00:00+00:00
more_info:
It was discovered that the Ruby OpenSSL extension, part of the interpreter for the Ruby language, did not properly implement hostname matching, in violation of RFC 6125. This could allow remote attackers to perform a man-in-the-middle attack via crafted SSL certificates.


cve_id: DSA-3233-1 wpa
date: 2015-04-24 00:00:00+00:00
more_info:
The Google security team and the smart hardware research group of Alibaba security team discovered a flaw in how wpa_supplicant used SSID information when creating or updating P2P peer entries. A remote attacker can use this flaw to cause wpa_supplicant to crash, expose memory contents, and potentially execute arbitrary code.


cve_id: DSA-3165-1 xdg-utils
date: 2015-02-21 00:00:00+00:00
more_info:
Jiri Horner discovered a way to cause xdg-open, a tool that automatically opens URLs in a user's preferred application, to execute arbitrary commands remotely.


cve_id: DSA-3164-1 typo3-src
date: 2015-02-21 00:00:00+00:00
more_info:
Pierrick Caillon discovered that the authentication could be bypassed in the Typo 3 content management system. Please refer to the upstream advisory for additional information: <url "https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-001/" />


cve_id: DSA-3178-1 unace
date: 2015-03-02 00:00:00+00:00
more_info:
Jakub Wilk discovered that unace, an utility to extract, test and view .ace archives, contained an integer overflow leading to a buffer overflow. If a user or automated system were tricked into processing a specially crafted ace archive, an attacker could cause a denial of service (application crash) or, possibly, execute arbitrary code.


cve_id: DSA-3177-1 mod-gnutls
date: 2015-03-10 00:00:00+00:00
more_info:
Thomas Klute discovered that in mod-gnutls, an Apache module providing SSL and TLS encryption with GnuTLS, a bug caused the server's client verify mode not to be considered at all, in case the directory's configuration was unset. Clients with invalid certificates were then able to leverage this flaw in order to get access to that directory.


cve_id: DSA-3296-1 libcrypto++
date: 2015-06-29 00:00:00+00:00
more_info:
Evgeny Sidorov discovered that libcrypto++, a general purpose C++ cryptographic library, did not properly implement blinding to mask private key operations for the Rabin-Williams digital signature algorithm. This could allow remote attackers to mount a timing attack and retrieve the user's private key.


cve_id: DSA-3210-1 wireshark
date: 2015-03-31 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors/parsers for WCP, pcapng and TNEF, which could result in denial of service.


cve_id: DSA-3180-1 libarchive
date: 2015-03-05 00:00:00+00:00
more_info:
Alexander Cherepanov discovered that bsdcpio, an implementation of the <q>cpio</q> program part of the libarchive project, is susceptible to a directory traversal vulnerability via absolute paths.


cve_id: DSA-3204-1 python-django
date: 2015-03-24 00:00:00+00:00
more_info:
Daniel Chatfield discovered that python-django, a high-level Python web development framework, incorrectly handled user-supplied redirect URLs. A remote attacker could use this flaw to perform a cross-site scripting attack.


cve_id: DSA-3202-1 mono
date: 2015-03-22 00:00:00+00:00
more_info:
Researchers at INRIA and Xamarin discovered several vulnerabilities in mono, a platform for running and developing applications based on the ECMA/ISO Standards. Mono's TLS stack contained several problems that hampered its capabilities: those issues could lead to client impersonation (via SKIP-TLS), SSLv2 fallback, and encryption weakening (via FREAK).


cve_id: DSA-3200-1 drupal7
date: 2015-03-20 00:00:00+00:00
more_info:
Multiple vulnerabilities have been found in the Drupal content management framework. More information can be found at <url "https://www.drupal.org/SA-CORE-2015-001" />


cve_id: DSA-3308-1 mysql-5.5
date: 2015-07-18 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.44. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-3359-1 virtualbox
date: 2015-09-13 00:00:00+00:00
more_info:
This update fixes an unspecified security issue in VirtualBox related to guests using bridged networking via WiFi. Oracle no longer provides information on specific security vulnerabilities in VirtualBox. To still support users of the already released Debian releases we've decided to update these to the respective 4.1.40 and 4.3.30 bugfix releases. 


cve_id: DSA-3295-1 cacti
date: 2015-06-24 00:00:00+00:00
more_info:
Several vulnerabilities (cross-site scripting and SQL injection) have been discovered in Cacti, a web interface for graphing of monitoring systems.


cve_id: DSA-3207-1 shibboleth-sp2
date: 2015-03-28 00:00:00+00:00
more_info:
A denial of service vulnerability was found in the Shibboleth (an federated identity framework) Service Provider. When processing certain malformed SAML message generated by an authenticated attacker, the daemon could crash.


cve_id: DSA-3203-1 tor
date: 2015-03-22 00:00:00+00:00
more_info:
Several denial-of-service issues have been discovered in Tor, a connection-based low-latency anonymous communication system.


cve_id: DSA-3324-1 icedove
date: 2015-08-01 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail client:  multiple memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code or denial of service. This update also addresses a vulnerability in DHE key processing commonly known as the <q>LogJam</q> vulnerability.


cve_id: DSA-3336-1 nss
date: 2015-08-17 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in nss, the Mozilla Network Security Service library. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3300-1 iceweasel
date: 2015-07-04 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser:  Multiple memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code or denial of service. This update also addresses a vulnerability in DHE key processing commonly known as the <q>LogJam</q> vulnerability.


cve_id: DSA-3208-1 freexl
date: 2015-03-29 00:00:00+00:00
more_info:
Jodie Cunningham discovered multiple vulnerabilities in freexl, a library to read Microsoft Excel spreadsheets, which might result in denial of service or the execution of arbitrary code if a malformed Excel file is opened.


cve_id: DSA-3214-1 mailman
date: 2015-04-06 00:00:00+00:00
more_info:
A path traversal vulnerability was discovered in Mailman, the mailing list manager. Installations using a transport script (such as postfix-to-mailman.py) to interface with their MTA instead of static aliases were vulnerable to a path traversal attack. To successfully exploit this, an attacker needs write access on the local file system.


cve_id: DSA-3219-1 libdbd-firebird-perl
date: 2015-04-11 00:00:00+00:00
more_info:
Stefan Roas discovered a way to cause a buffer overflow in DBD-FireBird, a Perl DBI driver for the Firebird RDBMS, in certain error conditions, due to the use of the sprintf() function to write to a fixed-size memory buffer.


cve_id: DSA-3220-1 libtasn1-3
date: 2015-04-11 00:00:00+00:00
more_info:
Hanno Boeck discovered a stack-based buffer overflow in the asn1_der_decoding function in Libtasn1, a library to manage ASN.1 structures. A remote attacker could take advantage of this flaw to cause an application using the Libtasn1 library to crash, or potentially to execute arbitrary code.


cve_id: DSA-3221-1 das-watchdog
date: 2015-04-12 00:00:00+00:00
more_info:
Adam Sampson discovered a buffer overflow in the handling of the XAUTHORITY environment variable in das-watchdog, a watchdog daemon to ensure a realtime process won't hang the machine. A local user can exploit this flaw to escalate his privileges and execute arbitrary code as root.


cve_id: DSA-3364-1 linux
date: 2015-09-21 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, unauthorised information disclosure or unauthorised information modification.


cve_id: DSA-3216-1 tor
date: 2015-04-06 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in Tor, a connection-based low-latency anonymous communication system:


cve_id: DSA-3331-1 subversion
date: 2015-08-10 00:00:00+00:00
more_info:
Several security issues have been found in the server components of the version control system subversion.


cve_id: DSA-3266-1 fuse
date: 2015-05-21 00:00:00+00:00
more_info:
Tavis Ormandy discovered that FUSE, a Filesystem in USErspace, does not scrub the environment before executing mount or umount with elevated privileges. A local user can take advantage of this flaw to overwrite arbitrary files and gain elevated privileges by accessing debugging features via the environment that would not normally be safe for unprivileged users.


cve_id: DSA-3268-1 ntfs-3g
date: 2015-05-22 00:00:00+00:00
more_info:
Tavis Ormandy discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing mount or umount with elevated privileges. A local user can take advantage of this flaw to overwrite arbitrary files and gain elevated privileges by accessing debugging features via the environment that would not normally be safe for unprivileged users.


cve_id: DSA-3433-1 samba
date: 2016-01-02 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following issues:


cve_id: DSA-3322-1 ruby-rack
date: 2015-07-31 00:00:00+00:00
more_info:
Tomek Rabczak from the NCC Group discovered a flaw in the normalize_params() method in Rack, a modular Ruby webserver interface. A remote attacker can use this flaw via specially crafted requests to cause a `SystemStackError` and potentially cause a denial of service condition for the service.


cve_id: DSA-3326-1 ghostscript
date: 2015-08-02 00:00:00+00:00
more_info:
William Robinet and Stefan Cornelius discovered an integer overflow in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service or potentially execution of arbitrary code if a specially crafted file is opened.


cve_id: DSA-3291-1 drupal7
date: 2015-06-18 00:00:00+00:00
more_info:
Several vulnerabilities were found in drupal7, a content management platform used to power websites.


cve_id: DSA-3303-1 cups-filters
date: 2015-07-07 00:00:00+00:00
more_info:
It was discovered that the texttopdf utility, part of cups-filters, was susceptible to multiple heap-based buffer overflows due to improper handling of print jobs with a specially crafted line size. This could allow remote attackers to crash texttopdf or possibly execute arbitrary code.


cve_id: DSA-3320-1 openafs
date: 2015-07-30 00:00:00+00:00
more_info:
It was discovered that OpenAFS, the implementation of the distributed filesystem AFS, contained several flaws that could result in information leak, denial-of-service or kernel panic.


cve_id: DSA-3251-1 dnsmasq
date: 2015-05-05 00:00:00+00:00
more_info:
Nick Sampanis discovered that dnsmasq, a small caching DNS proxy and DHCP/TFTP server, did not properly check the return value of the setup_reply() function called during a TCP connection, which is used then as a size argument in a function which writes data on the client's connection. A remote attacker could exploit this issue via a specially crafted DNS request to cause dnsmasq to crash, or potentially to obtain sensitive information from process memory.


cve_id: DSA-3263-1 proftpd-dfsg
date: 2015-05-19 00:00:00+00:00
more_info:
Vadim Melihow discovered that in proftpd-dfsg, an FTP server, the mod_copy module allowed unauthenticated users to copy files around on the server, and possibly to execute arbitrary code.


cve_id: DSA-3228-1 ppp
date: 2015-04-16 00:00:00+00:00
more_info:
Emanuele Rocca discovered that ppp, a daemon implementing the Point-to-Point Protocol, was subject to a buffer overflow when communicating with a RADIUS server. This would allow unauthenticated users to cause a denial-of-service by crashing the daemon.


cve_id: DSA-3261-1 libmodule-signature-perl
date: 2015-05-15 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in libmodule-signature-perl, a Perl module to manipulate CPAN SIGNATURE files. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3250-1 wordpress
date: 2015-05-04 00:00:00+00:00
more_info:
Multiple security issues have been discovered in Wordpress, a weblog manager, that could allow remote attackers to upload files with invalid or unsafe names, mount social engineering attacks or compromise a site via cross-site scripting, and inject SQL commands.


cve_id: DSA-3243-1 libxml-libxml-perl
date: 2015-05-01 00:00:00+00:00
more_info:
Tilmann Haak from xing.com discovered that XML::LibXML, a Perl interface to the libxml2 library, did not respect the expand_entities parameter to disable processing of external entities in some circumstances. This may allow attackers to gain read access to otherwise protected resources, depending on how the library is used.


cve_id: DSA-3274-1 virtualbox
date: 2015-05-28 00:00:00+00:00
more_info:
Jason Geffner discovered a buffer overflow in the emulated floppy disk drive, resulting in potential privilege escalation.


cve_id: DSA-3262-1 xen
date: 2015-05-18 00:00:00+00:00
more_info:
Jason Geffner discovered a buffer overflow in the emulated floppy disk drive, resulting in the potential execution of arbitrary code. This only affects HVM guests.


cve_id: DSA-3277-1 wireshark
date: 2015-06-02 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors/parsers for LBMR, web sockets, WCP, X11, IEEE 802.11 and Android Logcat, which could result in denial of service.


cve_id: DSA-3272-1 ipsec-tools
date: 2015-05-23 00:00:00+00:00
more_info:
Javantea discovered a NULL pointer dereference flaw in racoon, the Internet Key Exchange daemon of ipsec-tools. A remote attacker can use this flaw to cause the IKE daemon to crash via specially crafted UDP packets, resulting in a denial of service.


cve_id: DSA-3397-1 wpa
date: 2015-11-10 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in wpa_supplicant and hostapd. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3282-1 strongswan
date: 2015-06-08 00:00:00+00:00
more_info:
Alexander E. Patrakov discovered an issue in strongSwan, an IKE/IPsec suite used to establish IPsec protected links.


cve_id: DSA-3410-1 icedove
date: 2015-12-01 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail client: Multiple memory safety errors, integer overflows, buffer overflows and other implementation errors may lead to the execution of arbitrary code or denial of service.


cve_id: DSA-3333-1 iceweasel
date: 2015-08-12 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser:  Multiple memory safety errors, integer overflows, buffer overflows, use-after-frees and other implementation errors may lead to the execution of arbitrary code, bypass of the same-origin policy or denial of service.


cve_id: DSA-3337-1 gdk-pixbuf
date: 2015-08-18 00:00:00+00:00
more_info:
Gustavo Grieco discovered a heap overflow in the processing of BMP images which may result in the execution of arbitrary code if a malformed image is opened.


cve_id: DSA-3365-1 iceweasel
date: 2015-09-23 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser:  Multiple memory safety errors, integer overflows, buffer overflows, use-after-frees and other implementation errors may lead to the execution of arbitrary code, information disclosure or denial of service.


cve_id: DSA-3393-1 iceweasel
date: 2015-11-04 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, integer overflows, buffer overflows and other implementation errors may lead to the execution of arbitrary code, information disclosure or denial of service.


cve_id: DSA-3304-1 bind9
date: 2015-07-07 00:00:00+00:00
more_info:
Breno Silveira Soares of Servico Federal de Processamento de Dados (SERPRO) discovered that the BIND DNS server is prone to a denial of service vulnerability. A remote attacker who can cause a validating resolver to query a zone containing specifically constructed contents can cause the resolver to terminate with an assertion failure, resulting in a denial of service to clients relying on the resolver.


cve_id: DSA-3312-1 cacti
date: 2015-07-22 00:00:00+00:00
more_info:
Multiple SQL injection vulnerabilities were discovered in cacti, a web interface for graphing of monitoring systems.


cve_id: DSA-3377-1 mysql-5.5
date: 2015-10-24 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.46. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-3340-1 zendframework
date: 2015-08-19 00:00:00+00:00
more_info:
Dawid Golunski discovered that when running under PHP-FPM in a threaded environment, Zend Framework, a PHP framework, did not properly handle XML data in multibyte encoding. This could be used by remote attackers to perform an XML External Entity attack via crafted XML data.


cve_id: DSA-3552-1 tomcat7
date: 2016-04-17 00:00:00+00:00
more_info:
Multiple security vulnerabilities have been discovered in the Tomcat servlet and JSP engine, which may result in information disclosure, the bypass of CSRF protections and bypass of the SecurityManager.


cve_id: DSA-3353-1 openslp-dfsg
date: 2015-09-05 00:00:00+00:00
more_info:
Qinghao Tang of QIHU 360 discovered a double free flaw in OpenSLP, an implementation of the IETF Service Location Protocol. This could allow remote attackers to cause a denial of service (crash).


cve_id: DSA-3355-1 libvdpau
date: 2015-09-10 00:00:00+00:00
more_info:
Florian Weimer of Red Hat Product Security discovered that libvdpau, the VDPAU wrapper library, did not properly validate environment variables, allowing local attackers to gain additional privileges.


cve_id: DSA-3524-1 activemq
date: 2016-03-20 00:00:00+00:00
more_info:
It was discovered that the ActiveMQ Java message broker performs unsafe deserialisation. For additional information, please refer to the upstream advisory at <a href="http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt">http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt</a>.


cve_id: DSA-3371-1 spice
date: 2015-10-09 00:00:00+00:00
more_info:
Frediano Ziglio of Red Hat discovered several vulnerabilities in spice, a SPICE protocol client and server library. A malicious guest can exploit these flaws to cause a denial of service (QEMU process crash), execute arbitrary code on the host with the privileges of the hosting QEMU process or read and write arbitrary memory locations on the host.


cve_id: DSA-3468-1 polarssl
date: 2016-02-06 00:00:00+00:00
more_info:
It was discovered that polarssl, a library providing SSL and TLS support, contained two heap-based buffer overflows that could allow a remote attacker to trigger denial of service (via application crash) or arbitrary code execution.


cve_id: DSA-3409-1 putty
date: 2015-12-01 00:00:00+00:00
more_info:
A memory-corrupting integer overflow in the handling of the ECH (erase characters) control sequence was discovered in PuTTY's terminal emulator. A remote attacker can take advantage of this flaw to mount a denial of service or potentially to execute arbitrary code.


cve_id: DSA-3327-1 squid3
date: 2015-08-03 00:00:00+00:00
more_info:
Alex Rousskov of The Measurement Factory discovered that Squid3, a fully featured web proxy cache, does not correctly handle CONNECT method peer responses when configured with cache_peer and operating on explicit proxy traffic. This could allow remote clients to gain unrestricted access through a gateway proxy to its backend proxy.


cve_id: DSA-3335-1 request-tracker4
date: 2015-08-13 00:00:00+00:00
more_info:
It was discovered that Request Tracker, an extensible trouble-ticket tracking system is susceptible to a cross-site scripting attack via the user and group rights management pages (<a href="https://security-tracker.debian.org/tracker/CVE-2015-5475">CVE-2015-5475</a>) and via the cryptography interface, allowing an attacker with a carefully-crafted key to inject JavaScript into RT's user interface. Installations which use neither GnuPG nor S/MIME are unaffected by the second cross-site scripting vulnerability.


cve_id: DSA-3319-1 bind9
date: 2015-07-28 00:00:00+00:00
more_info:
Jonathan Foote discovered that the BIND DNS server does not properly handle TKEY queries. A remote attacker can take advantage of this flaw to mount a denial of service via a specially crafted query triggering an assertion failure and causing BIND to exit.


cve_id: DSA-3440-1 sudo
date: 2016-01-11 00:00:00+00:00
more_info:
When sudo is configured to allow a user to edit files under a directory that they can already write to without using sudo, they can actually edit (read and write) arbitrary files. Daniel Svartman reported that a configuration like this might be introduced unintentionally if the editable files are specified using wildcards, for example:


cve_id: DSA-3338-1 python-django
date: 2015-08-18 00:00:00+00:00
more_info:
Lin Hua Cheng discovered that a session could be created when anonymously accessing the django.contrib.auth.views.logout view. This could allow remote attackers to saturate the session store or cause other users' session records to be evicted.


cve_id: DSA-3379-1 miniupnpc
date: 2015-10-25 00:00:00+00:00
more_info:
Aleksandar Nikolic of Cisco Talos discovered a buffer overflow vulnerability in the XML parser functionality of miniupnpc, a UPnP IGD client lightweight library. A remote attacker can take advantage of this flaw to cause an application using the miniupnpc library to crash, or potentially to execute arbitrary code with the privileges of the user running the application.


cve_id: DSA-3539-1 srtp
date: 2016-04-02 00:00:00+00:00
more_info:
Randell Jesup and the Firefox team discovered that srtp, Cisco's reference implementation of the Secure Real-time Transport Protocol (SRTP), does not properly handle RTP header CSRC count and extension header length. A remote attacker can exploit this vulnerability to crash an application linked against libsrtp, resulting in a denial of service.


cve_id: DSA-3341-1 conntrack
date: 2015-08-20 00:00:00+00:00
more_info:
It was discovered that in certain configurations, if the relevant conntrack kernel module is not loaded, conntrackd will crash when handling DCCP, SCTP or ICMPv6 packets.


cve_id: DSA-3352-1 screen
date: 2015-09-04 00:00:00+00:00
more_info:
A vulnerability was found in screen causing a stack overflow which results in crashing the screen server process, resulting in denial of service.


cve_id: DSA-3356-1 openldap
date: 2015-09-12 00:00:00+00:00
more_info:
Denis Andzakovic discovered that OpenLDAP, a free implementation of the Lightweight Directory Access Protocol, does not properly handle BER data. An unauthenticated remote attacker can use this flaw to cause a denial of service (slapd daemon crash) via a specially crafted packet.


cve_id: DSA-3406-1 nspr
date: 2015-11-25 00:00:00+00:00
more_info:
It was discovered that incorrect memory allocation in the NetScape Portable Runtime library might result in denial of service or the execution of arbitrary code.


cve_id: DSA-3422-1 iceweasel
date: 2015-12-16 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, integer overflows, use-after-frees and other implementation errors may lead to the execution of arbitrary code, bypass of the same-origin policy or denial of service.


