DLA-366-1 arts - security update

Bulletin has no description...

Debian DLA-364-1 : gnutls26 security update

Hanno Bck discovered that GnuTLS, a library implementing the TLS and SSL protocols, incorrectly validated the first padding byte in CBC modes. A remote attacker can possibly take advantage of this flaw to perform a padding oracle attack. For Debian 6 'Squeeze', this issue has been fixed in gnutls...

[SECURITY] [DLA 365-1] foomatic-filters security update

Package : foomatic-filters Version : 4.0.5-6+squeeze2+deb6u11 CVE ID : CVE-2015-8327 Debian Bug : 806886 It was discovered that there was an injection vulnerability in foomatic-filters which is used by printer spoolers to convert incoming PostScript data into the printers native format. For Debia...

Debian DLA-361-1 : bouncycastle security update

The Bouncy Castle Java library before 1.51 does not validate that a point is within the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman ECDH key exchanges, aka an 'invalid curve attack.' For Debian 6 'Squeeze'...

DLA-365-1 foomatic-filters - security update

Bulletin has no description...

[SECURITY] [DLA 363-1] libphp-phpmailer security update

Package : libphp-phpmailer Version : 5.1-1+deb6u11 CVE ID : CVE-2015-8476 Debian Bug : 807265 It was discovered that there was a header injection vulnerability in libphp-phpmailer, am email transfer library for PHP. For Debian 6 Squeeze, this issue has been fixed in libphp-phpmailer version...

[SECURITY] [DLA 362-1] dhcpcd security update

Package : dhcpcd Version : 1:3.2.3-5+squeeze2 CVE ID : CVE-2012-6698 CVE-2012-6699 CVE-2012-6700 Guido Vranken discovered several memory-related vulnerabilities while fuzzing DHCP messages sent to dhcpcd. For Debian 6 “Squeeze”, those issues have been fixed in version 1:3.2.3-5+squeeze2...

DLA-362-1 dhcpcd - security update

Bulletin has no description...

DLA-364-1 gnutls26 - security update

Bulletin has no description...

DLA-363-1 libphp-phpmailer - security update

Bulletin has no description...

DLA-361-1 bouncycastle - security update

Bulletin has no description...

Debian DLA-350-1 : eglibc security update

The strxfrm function is vulnerable to integer overflows when computing memory allocation sizes similar to CVE-2012-4412. Furthermore since it fallbacks to use alloca when malloc fails, it is vulnerable to stack-based buffer overflows similar to CVE-2012-4424. Those issues have been fixed in Debia...

[SECURITY] [DLA 353-1] imagemagick security update

Package : imagemagick Version : 8:6.6.0.4-3+squeeze7 Debian Bug : 806441 Submitting specially crafted icons .ico or .pict images to ImageMagick can trigger integer overflows that can lead to buffer overflows and memory allocations issues. Depending on the case, this can lead to a denial of servic...

DLA-353-1 imagemagick - security update

Bulletin has no description...

[SECURITY] [DLA 352-1] libcommons-collections3-java security update

Package : libcommons-collections3-java Version : 3.2.1-4+deb6u1 The Apache commons collection suffered from security issues, making applications to accept serialized objects from untrusted sources. Remote attackers might take advantage of these issues to execute arbitrary Java functions and even...

[SECURITY] [DLA 350-1] eglibc security update

Package : eglibc Version : 2.11.3-4+deb6u8 CVE ID : not assigned yet Debian Bug : 803927 The strxfrm function is vulnerable to integer overflows when computing memory allocation sizes similar to CVE-2012-4412. Furthermore since it fallbacks to use alloca when malloc fails, it is vulnerable to...

[SECURITY] [DLA 351-1] redmine security update

Package : redmine Version : 1.0.1-2+deb6u11 CVE ID : CVE-2015-8346 It was discovered that there was a data disclosure vulnerability in Redmine, a web-based bug and project management tool. The time logging form could disclose subjects of issues that are not visible/public. Patch by Holger Just. F...

DLA-352-1 libcommons-collections3-java - security update

Bulletin has no description...

DLA-350-1 eglibc - security update

Bulletin has no description...

[SECURITY] [DLA 349-1] python-django security update

Package : python-django Version : 1.2.3-3+squeeze15 CVE ID : CVE-2015-8213 It was discovered that there was a potential settings leak in date template filter of Django, a web-development framework. If an application allows users to specify an unvalidated format for dates and passes this format to...