Pwët,
Petit retard … rattrapé !
[quote]Package : samba
Vulnerability : several issues
Problem type : remote
Debian-specific: no
CVE ID : CVE-2013-0213 CVE-2013-0214
Jann Horn had reported two vulnerabilities in Samba, a popular
cross-platform network file and printer sharing suite. In particular,
these vulnerabilities affect to SWAT, the Samba Web Administration Tool.
CVE-2013-0213: Clickjacking issue in SWAT
An attacker can integrate a SWAT page into a malicious web page via a
frame or iframe and then overlaid by other content. If an
authenticated valid user interacts with this malicious web page, she
might perform unintended changes in the Samba settings.
CVE-2013-0214: Potential Cross-site request forgery
An attacker can persuade a valid SWAT user, who is logged in, to
click in a malicious link and trigger arbitrary unintended changes in
the Samba settings.
For the stable distribution (squeeze), these problems have been fixed in
version 3.5.6~dfsg-3squeeze9.
For the testing distribution (wheezy), these problems have been fixed in
version 2:3.6.6-5.
For the unstable distribution (sid), these problems have been fixed in
version 2:3.6.6-5.
We recommend that you upgrade your samba packages.[/quote]
[quote]Package : nagios3
Vulnerability : buffer overflow in CGI scripts
Problem type : remote
Debian-specific: no
CVE ID : CVE-2012-6096
Debian Bug : 697930
A buffer overflow problem has been found in nagios3, a host/service/network
monitoring and management system. A mailicious client could craft a
request to history.cgi and cause application crashes.
For the stable distribution (squeeze), this problem has been fixed in
version 3.2.1-2+squeeze1.
For the testing distribution (wheezy), this problem will be fixed soon.
For the unstable distribution (sid), this problem has been fixed in
version 3.4.1-3.
We recommend that you upgrade your nagios3 packages.[/quote]
[quote]Package : ircd-hybrid
Vulnerability : denial of service
Problem type : remote
Debian-specific: no
CVE ID : CVE-2013-0238
Debian Bug : 699267
Bob Nomnomnom reported a Denial of Service vulnerability in IRCD-Hybrid,
an Internet Relay Chat server. A remote attacker may use an error in
the masks validation and crash the server.
For the stable distribution (squeeze), this problem has been fixed in
version 7.2.2.dfsg.2-6.2+squeeze1.
For the testing distribution (wheezy), this problem has been fixed in
version 1:7.2.2.dfsg.2-10.
For the unstable distribution (sid), this problem has been fixed in
version 1:7.2.2.dfsg.2-10.
We recommend that you upgrade your ircd-hybrid packages.[/quote]
[quote]Package : xen-qemu-dm-4.0
Vulnerability : buffer overflow
Problem type : remote
Debian-specific: no
CVE ID : CVE-2012-6075
A buffer overflow was found in the e1000e emulation, which could be
triggered when processing jumbo frames.
For the stable distribution (squeeze), this problem has been fixed in
version 4.0.1-2+squeeze3.
For the unstable distribution (sid), this problem has been fixed in
version 4.1.3-8 of the xen source package.
We recommend that you upgrade your xen-qemu-dm-4.0 packages.[/quote]
[quote]Package : ircd-ratbox
Vulnerability : programming error
Problem type : remote
Debian-specific: no
CVE ID : CVE-2012-6084
This update to the previous ircd-ratbox DSA only raises the version number
to ensure that a higher version is used than a previously binNMU on some
architectures.
For the stable distribution (squeeze), this problem has been fixed in
version 3.0.6.dfsg-2+squeeze1.
We recommend that you upgrade your ircd-ratbox packages.[/quote]
[quote]Package : rails
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2013-0276 CVE-2013-0277
Two vulnerabilities were discovered in Ruby on Rails, a Ruby framework
for web application development.
CVE-2013-0276
The blacklist provided by the attr_protected method could be
bypassed with crafted requests, having an application-specific
impact.
CVE-2013-0277
In some applications, the +serialize+ helper in ActiveRecord
could be tricked into deserializing arbitrary YAML data,
possibly leading to remote code execution.
For the stable distribution (squeeze), these problems have been fixed
in version 2.3.5-1.2+squeeze7.
We recommend that you upgrade your rails packages.[/quote]
[quote]Package : openssl
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2013-0166 CVE-2013-0169
Debian Bug : 699889
Multiple vulnerabilities have been found in OpenSSL. The Common
Vulnerabilities and Exposures project identifies the following issues:
CVE-2013-0166
OpenSSL does not properly perform signature verification for OCSP
responses, which allows remote attackers to cause a denial of
service via an invalid key.
CVE-2013-0169
A timing side channel attack has been found in CBC padding
allowing an attacker to recover pieces of plaintext via statistical
analysis of crafted packages, known as the "Lucky Thirteen" issue.
For the stable distribution (squeeze), these problems have been fixed in
version 0.9.8o-4squeeze14.
For the testing distribution (wheezy), these problems will be fixed soon.
For the unstable distribution (sid), these problems have been fixed in
version 1.0.1e-1.
We recommend that you upgrade your openssl packages.[/quote]
[quote]Package : polarssl
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2013-0169 CVE-2013-1621 CVE-2013-1622
Debian Bug : 699887
Multiple vulnerabilities have been found in OpenSSL. The Common
Vulnerabilities and Exposures project identifies the following issues:
CVE-2013-0169
A timing side channel attack has been found in CBC padding
allowing an attacker to recover pieces of plaintext via statistical
analysis of crafted packages, known as the "Lucky Thirteen" issue.
CVE-2013-1621
An array index error might allow remote attackers to cause a denial
of service via vectors involving a crafted padding-length value
during validation of CBC padding in a TLS session
CVE-2013-1622
Malformed CBC data in a TLS session could allow remote attackers to
conduct distinguishing attacks via statistical analysis of timing
side-channel data for crafted packets.
For the stable distribution (squeeze), these problems have been fixed in
version 0.12.1-1squeeze1.
For the testing distribution (wheezy), and the unstable distribution
(sid), these problems have been fixed in version 1.1.4-2.
We recommend that you upgrade your polarssl packages.[/quote]
[quote]Package : openconnect
Vulnerability : buffer overflow
Problem type : remote
Debian-specific: no
CVE ID : CVE-2012-6128
Kevin Cernekee discovered that a malicious VPN gateway can send
crafted responses which trigger stack-based buffer overflows.
For the stable distribution (squeeze), this problem has been fixed in
version 2.25-0.1+squeeze2.
We recommend that you upgrade your openconnect packages.[/quote]
À vos apt-get/aptitude si vous n’avez pas encore mis à jour !
Usti
