chrony: DDoS via amplification in cmdmon protocol

Chrony before 1.29.1 has traffic amplification in cmdmon protocol

node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)

nodejs-connect: XSS via HTTP request with a crafted method containing JavaScript

node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware

An issue exists in uscan in devscripts before 2.13.19, which could let a remote malicious user execute arbitrary code via a crafted tarball.

ClamAV before 0.97.7: dbg_printhex possible information leak

ClamAV before 0.97.7 has buffer overflow in the libclamav component

ClamAV before 0.97.7 has WWPack corrupt heap memory

rubygem-nokogiri: DoS while parsing XML entities

Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits

rubygem-nokogiri: DoS while parsing XML documents

Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents

Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions

Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book

Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.

python-pip: insecure software download with mirroring support

The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.

Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the STARTTLS IMAP and POP server. ssl_outgoing_ciphers not being applied to STARTTLS connections

qemu: stellaris_enet: buffer overrun on incoming migration

Qemu 1.1.2+dfsg to 2.1+dfsg suffers from a buffer overrun which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.

slim has NULL pointer dereference when using crypt() method from glibc 2.17

glibc: stack overflow in getaddrinfo()'s use of alloca()

The eglibc package before 2.14 incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service.

scipy: weave /tmp and current directory issues

The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories.

orca: Arbitrary code execution due to insecure CWD Python module load

Orca has arbitrary code execution due to insecure Python module load

Perl module Data::UUID from CPAN version 1.219 vulnerable to symlink attacks