[SECURITY] [DLA 361-1] bouncycastle security update

Package : bouncycastle Version : 1.44+dfsg-2+deb6u1 CVE ID : CVE-2015-7940 Debian Bug : 802671 The Bouncy Castle Java library before 1.51 does not validate that a point is within the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic...

[SECURITY] [DLA 357-1] libphp-snoopy security update

Package : libphp-snoopy Version : 2.0.0-1deb6u1 CVE ID : CVE-2008-7313 CVE-2014-5008 Debian Bug : 778634 It was discovered that missing input sanitizing in Snoopy, a PHP class that simulates a web browser may result in the execution of arbitrary commands. For the oldoldstable distribution...

[SECURITY] [DLA 356-1] libsndfile security update

Package : libsndfile Version : 1.0.21-3+squeeze2 CVE ID : CVE-2014-9496 CVE-2014-9756 CVE-2015-7805 Debian Bug : 774162 804445 804447 CVE-2014-9496 The sd2parsersrcfork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a 1 map offset or 2 rsrc...

[SECURITY] [DLA 355-1] libxml2 security update

Package : libxml2 Version : 2.7.8.dfsg-2+squeeze15 CVE ID : CVE-2015-8241 CVE-2015-8317 Debian Bug : 806384 CVE-2015-8241 Buffer overread with XML parser in xmlNextChar CVE-2015-8317 - issues in the xmlParseXMLDecl function: If we fail conversing the current input stream while processing the...

[SECURITY] [DSA 3400-1] lxc security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3400-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 19, 2015 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3395-1] krb5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3395-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 06, 2015 https://www.debian.org/security/faq -...

CVE-2015-8025

driver/subprocs.c in XScreenSaver before 5.34 does not properly perform an internal consistency check, which allows physically proximate attackers to bypass the lock screen by hot swapping monitors...

[SECURITY] [DSA 3379-1] miniupnpc security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3379-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 25, 2015 https://www.debian.org/security/faq -...

[SECURITY] [DLA 330-1] unzip security update

Package : unzip Version : 6.0-4+deb6u3 CVE ID : CVE-2015-7696 CVE-2015-7697 Debian Bug : 802160 802162 Gustavo Grieco discovered with a fuzzer that unzip was vulnerable to a heap overflow and to a denial of service with specially crafted password-protected ZIP archives. For the Debian 6 squeeze,...

[SECURITY] [DSA 3370-1] freetype security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3370-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini October 06, 2015 https://www.debian.org/security/faq -...

[SECURITY] [DLA 324-1] binutils security update

Package : binutils Version : 2.20.1-16+deb6u2 CVE ID : CVE-2012-3509 Debian Bug : 688951 This update fixes several issues as described below. PR ld/12613 no CVE assigned Niranjan Hasabnis discovered that passing an malformed linker script to GNU ld, part of binutils, may result in a stack buffer...

[SECURITY] [DLA 321-1] wordpress security update

Package : wordpress Version : 3.6.1+dfsg-1deb6u8 CVE ID : CVE-2015-5714 CVE-2015-5715 Debian Bug : 799140 Various security issue have been fixed in the Debian LTS squeeze version of the Wordpress content management system. CVE-2015-5714 A cross-site scripting vulnerability when processing shortco...

CVE-2015-7312

Multiple race conditions in the Advanced Union Filesystem aufs aufs3-mmap.patch and aufs4-mmap.patch patches for the Linux kernel 3.x and 4.x allow local users to cause a denial of service use-after-free and BUG or possibly gain privileges via a 1 madvise or 2 msync system call, related to...

[SECURITY] [DSA 3364-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3364-1 [email protected] https://www.debian.org/security/ Ben Hutchings September 21, 2015 https://www.debian.org/security/faq -...

[SECURITY] [DLA 306-1] libvdpau security update

Package : libvdpau Version : 0.4.1-2+deb6u1 CVE ID : CVE-2015-5198 CVE-2015-5199 CVE-2015-5200 Debian Bug : 797895 Florian Weimer of Red Hat Product Security discovered that libvdpau, the VDPAU wrapper library, did not properly validate environment variables, allowing local attackers to gain...

[SECURITY] [DLA 305-1] screen security update

Package : screen Version : 4.0.3-14+deb6u1 CVE ID : CVE-2015-6806 Debian Bug :797624 A vulnerability was found in screen causing a stack overflow which results in crashing the screen server process, resulting in denial of service. See DSA-3352-1 for information on other Debian releases. We...

[SECURITY] [DLA 304-1] openslp-dfsg security update

Package : openslp-dfsg Version : 1.2.1-7.8+deb6u1 CVE ID : CVE-2010-3609 CVE-2012-4428 CVE-2015-5177 Debian Bug : 623551 687597 795429 Several issues have been found and solved in OpenSLP, that implements the Internet Engineering Task Force IETF Service Location Protocol standards protocol...

CVE-2015-5225

Buffer overflow in the vncrefreshserversurface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a denial of service heap memory corruption and process crash or possibly execute arbitrary code on the host via unspecified vectors, related to refreshing the serve...

[SECURITY] [DSA 3325-2] apache2 regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3325-2 [email protected] https://www.debian.org/security/ Stefan Fritsch August 18, 2015 https://www.debian.org/security/faq -...

[SECURITY] [DLA 290-1] xmltooling security update

Package : xmltooling Version : 1.3.3-2+deb6u1 CVE ID : CVE-2015-0851 Debian Bug : 793855 Shibboleth SP software crashes on well-formed but invalid XML Another upload for opensaml2 is needed to really solve this issue. This will be done shortly...