[SECURITY] [DLA 994-1] zziplib security update

Package : zziplib Version : 0.13.56-1.1+deb7u1 CVE ID : CVE-2017-5974 CVE-2017-5975 CVE-2017-5976 CVE-2017-5978 CVE-2017-5979 CVE-2017-5980 CVE-2017-5981 CVE-2017-5974 Heap-based buffer overflow in the zzipget32 function in fetch.c in zziplib allows remote attackers to cause a denial of service...

[SECURITY] [DLA 988-1] rt-authen-externalauth security update

Package : rt-authen-externalauth Version : 0.10-4+deb7u1 CVE ID : CVE-2017-5361 It was discovered that RT::Authen::ExternalAuth, an external authentication module for Request Tracker, is vulnerable to timing side-channel attacks for user passwords. Only ExternalAuth in DBI database mode is...

Debian DLA-954-1 : openjdk-7 security update

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in privilege escalation, denial of service, newline injection in SMTP or use of insecure cryptography. For Debian 7 'Wheezy', these problems have been fixed in version...

Debian DLA-941-1 : squirrelmail security update

Dawid Golunski and Filippo Cavallarin discovered that squirrelmail, a webmail application, incorrectly handled a user-supplied value. This would allow a logged-in user to run arbitrary commands on the server. For Debian 7 'Wheezy', these problems have been fixed in version...

Debian DLA-916-1 : mysql-5.5 security update (Riddle)

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.55, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly incompatible changes. Please see th...

[SECURITY] [DLA 883-1] curl security update

Package : curl Version : 7.26.0-1+wheezy18+deb7u1 CVE ID : CVE-2017-7407 It was discovered that there was a buffer read overrun vulnerability in curl, a tool for downloading files from the internet, etc. If a "%" ended the --write-out parameter, the strings trailing NUL would be skipped and memor...

Debian DLA-869-1 : cgiemail security update

The cPanel Security Team discovered several security vulnerabilities in cgiemail, a CGI program used to create HTML forms for sending mails : CVE-2017-5613 A format string injection vulnerability allowed to supply arbitrary format strings to cgiemail and cgiecho. A local attacker with permissions...

[SECURITY] [DLA 856-1] tzdata new upstream version

Package : tzdata Version : 2017a-0+deb7u1 This update includes the changes in tzdata 2017a. Notable changes are: - Mongolia no longer observes DST. - Magallanes region diverges from Santiago starting 2017-05-13, the America/PuntaArenas zone has been added. For Debian 7 "Wheezy", these problems ha...

Debian DLA-802-1 : openjdk-7 security update

openjdk-7 7u111-2.6.7-2deb7u1 backported the security fixes from 7u121. openjdk-7 has now been updated to the full 7u121 version, which includes extra bug fixes and other improvements. For Debian 7 'Wheezy', these problems have been fixed in version 7u121-2.6.8-1deb7u1. We recommend that you...

Debian DLA-771-1 : hdf5 security update

Cisco Talos discovered that hdf5, a file format and library for storing scientific data, contained several vulnerabilities that could lead to arbitrary code execution when handling untrusted data. For Debian 7 'Wheezy', these problems have been fixed in version 1.8.8-9+deb7u1. We recommend that y...

Debian DLA-752-1 : icedove security update

Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail client: Multiple memory safety errors, same-origin policy bypass issues, integer overflows, buffer overflows and use-after-frees may lead to the execution of arbitrary code or denial of service...

DLA-735-1 gst-plugins-base0.10 - security update

Bulletin has no description...

[SECURITY] [DLA 702-1] tzdata new upstream version

Package : tzdata Version : 2016i-0+deb7u1 This update includes the changes in tzdata 2016i. Notable changes are: - Pacific/Tongatapu DST starting on 2016-11-06 at 02:00. - Northern Cyprus is now +03 year round, the Asia/Famagusta zone has been added. - Antarctica/Casey switched from +08 to +11 on...

Debian DLA-650-1 : mat security update

An implementation flaw was discovered in mat, the metadata anonymisation toolkit. The implementation of PDF support lacks support to anonymize the metadata in embedded images. As there is no easy fix for this flaw, it was decided that PDF support will be removed altogether from mat for the time...

[SECURITY] [DLA 650-1] mat security update

Package : mat Version : 0.3.2-1+deb7u1 Debian Bug : 826101 An implementation flaw was discovered in mat, the metadata anonymisation toolkit. The implementation of PDF support lacks support to anonymize the metadata in embedded images. As there is no easy fix for this flaw, it was decided that PDF...

DLA-637-1 openssl - security update

Bulletin has no description...

Debian DLA-612-1 : libtomcrypt security update

It was discovered that the implementation of RSA signature verification in libtomcrypt is vulnerable to the Bleichenbacher signature attack. If an RSA key with exponent 3 is used it may be possible to forge a PKCS1 v1.5 signature signed by that key. For Debian 7 'Wheezy', these problems have been...

[SECURITY] [DLA 611-1] jsch security update

Package : jsch Version : 0.1.42-2+deb7u1 CVE ID : CVE-2016-5725 It was discovered that there was a path traversal vulnerability in jsch, a pure Java implementation of the SSH2 protocol. For Debian 7 "Wheezy", this issue has been fixed in jsch version 0.1.42-2+deb7u1. We recommend that you upgrade...

[SECURITY] [DLA 587-1] fontconfig security update

Package : fontconfig Version : 2.9.0-7.1+deb7u1 CVE ID : CVE-2016-5384 Debian Bug : 833570 A possible double free vulnerability was found in fontconfig. The problem was due to insufficient validation when parsing the cache file. For Debian 7 "Wheezy", these problems have been fixed in version...

[SECURITY] [DLA 588-1] mongodb security update

Package : mongodb Version : 2.0.6-1+deb7u1 CVE ID : CVE-2016-6494 Debian Bug : 832908, 833087 Two security related problems have been found in the mongodb package, related to logging. CVE-2016-6494 World-readable .dbshell history file TEMP-0833087-C5410D Bruteforcable challenge responses in...