[SECURITY] [DLA 1029-1] libmtp security update

Package : libmtp
Version : 1.1.3-35-g0ece104-5+deb7u1
CVE ID : CVE-2017-9831 CVE-2017-9832

libmtp, a library for communicating with MTP aware devices (like
cellular phones and audio players), was found to be vulnerable to
several integer overflow vulnerabilities, which allowed malicious
devices to cause denial of service crashes and maybe remote code
execution.

CVE-2017-9831

An integer overflow vulnerability in the
ptp_unpack_EOS_CustomFuncEx function of the ptp-pack.c file of
libmtp (version 1.1.12 and below) allows attackers to cause a
denial of service (out-of-bounds memory access) or maybe remote
code execution by inserting a mobile device into a personal
computer through a USB cable.

CVE-2017-9832

An integer overflow vulnerability in ptp-pack.c (ptp_unpack_OPL
function) of libmtp (version 1.1.12 and below) allows attackers to
cause a denial of service (out-of-bounds memory access) or maybe
remote code execution by inserting a mobile device into a personal
computer through a USB cable.

For Debian 7 "Wheezy", these problems have been fixed in version
1.1.3-35-g0ece104-5+deb7u1.

We recommend that you upgrade your libmtp packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature