Debian DLA-2332-2 : sane-backends regression update

A regression was introduced in DLA-2332-1, where changes in the Debian package building process triggered a bug in the sane-backends packages, causing missing files. For Debian 9 stretch, this problem has been fixed in version 1.0.25-4.1+deb9u2. We recommend that you upgrade your sane-backends...

Debian DLA-2327-1 : lucene-solr security update

A security vulnerability was discovered in lucene-solr, an enterprise search server. The DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's 'dataConfig' parameter. The deb...

[SECURITY] [DLA 2327-1] lucene-solr security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2327-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany August 15, 2020 htps://wiki.debian.org/LTS -...

[SECURITY] [DLA 2320-1] golang-github-seccomp-libseccomp-golang security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2320-1 [email protected] https://www.debian.org/lts/security/ August 10, 2020 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package...

Debian DLA-2314-1 : clamav security update

Several vulnerabilities have been found in the ClamAV antivirus toolkit : CVE-2020-3327 An out of bounds read in the ARJ archive-parsing module could cause denial of service. The fix in 0.102.3 was incomplete. CVE-2020-3350 A malicious user could trick clamscan, clamdscan or clamonacc into moving...

Debian DLA-2312-1 : libx11 security update

Todd Carson discovered some integer overflows in libX11, which could lead to heap corruption when processing crafted messages from an input method. For Debian 9 stretch, this problem has been fixed in version 2:1.6.4-3+deb9u2. We recommend that you upgrade your libx11 packages. For the detailed...

Debian DLA-2304-1 : libpam-radius-auth security update

addpassword in pamradiusauth.c in pamradius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy. An attacker could send a crafted password to an application loading the pamradius library and crash it. Arbitrary code...

Debian DLA-2306-1 : libphp-phpmailer security update

It was discovered that there was an escaping issue in libphp-phpmailer, an email generation utility class for the PHP programming language. The Content-Type and Content-Disposition headers could have permitted file attachments that bypassed attachment filters which match on filename extensions. F...

Debian DLA-2305-1 : transmission security update

Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted torrent file. For Debian 9 stretch, this problem has been fixed in version 2.92-2+deb9u2. We recommend that you upgra...

Debian DLA-2309-1 : evolution-data-server security update

In Evolution Data Server a vulnerability was discovered that allowed a malicious server to crash the mail client. For Debian 9 stretch, this problem has been fixed in version 3.22.7-1+deb9u2. We recommend that you upgrade your evolution-data-server packages. For the detailed security status of...

Debian DLA-2303-1 : libssh security update

The code in src/sftpserver.c did not verify the validity of certain pointers and expected them to be valid. A NULL pointer dereference could have been occurred that typically causes a crash and thus a denial of service. For Debian 9 stretch, this problem has been fixed in version 0.7.3-2+deb9u3. ...

Debian DLA-2307-1 : ruby-zip security update

rubyzip gem version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via if a site allows uploading of .zip files, an attacker can upload a malicious file that...

[SECURITY] [DLA 2301-1] json-c security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2301-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort July 30, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2297-1 : firefox-esr security update

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code. For Debian 9 stretch, these problems have been fixed in version 68.11.0esr-1deb9u1. We recommend that you upgrade your firefox-esr packages. For the...

[SECURITY] [DSA 4736-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4736-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 29, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DLA 2297-1] firefox-esr security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2297-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort July 29, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2291-1] ffmpeg security update

Debian LTS Advisory DLA-2291-1 [email protected] https://www.debian.org/lts/security/ July 27, 2020 https://wiki.debian.org/LTS Package : ffmpeg Version : 7:3.2.15-0+deb9u1 CVE ID : CVE-2019-13390 CVE-2019-17542 CVE-2020-13904 Debian Bug : Several vulnerabilities have been fixed by...

Debian DLA-2290-1 : e2fsprogs security update

An issue has been found in e2fsprogs, a package that contains ext2/ext3/ext4 file system utilities. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. For Debian 9 stretc...

Debian DLA-2289-1 : mupdf security update

Several issues have been found in mupdf, a lightweight PDF viewer. The issues could be exploited by crafted PDF files that result in denial of service by heap-based buffer overflows, segmentation faults or out of bound reads. For Debian 9 stretch, these problems have been fixed in version...

Debian DLA-2284-1 : ksh security update

A flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables cou...