[SECURITY] [DLA 992-1] eglibc security update

Package : eglibc Version : 2.13-38+deb7u12 CVE ID : CVE-2017-1000366 The Qualys Research Labs discovered various problems in the dynamic linker of the GNU C Library which allow local privilege escalation by clashing the stack. For the full details, please refer to their advisory published at:...

Debian DLA-988-1 : rt-authen-externalauth security update

It was discovered that RT::Authen::ExternalAuth, an external authentication module for Request Tracker, is vulnerable to timing side-channel attacks for user passwords. Only ExternalAuth in DBI database mode is vulnerable. For Debian 7 'Wheezy', these problems have been fixed in version...

Debian DLA-991-1 : firefox-esr security update

Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, buffer overflows and other implementation errors may lead to the execution of arbitrary code, denial of service or domain spoofing. Debian follows the extended support...

Debian DLA-990-1 : expat security update

It was discovered that there was an infinite loop vulnerability in expat, a XML parsing C library : https://libexpat.github.io/doc/cve-2017-9233/ For Debian 7 'Wheezy', this issue has been fixed in expat version 2.1.0-1+deb7u5. We recommend that you upgrade your expat packages. NOTE: Tenable...

[SECURITY] [DLA 991-1] firefox-esr security update

Package : firefox-esr Version : 52.2.0esr-1deb7u1 CVE ID : CVE-2017-5470 CVE-2017-5472 CVE-2017-7749 CVE-2017-7750 CVE-2017-7751 CVE-2017-7752 CVE-2017-7754 CVE-2017-7756 CVE-2017-7757 CVE-2017-7758 CVE-2017-7764 CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774 CVE-2017-7775 CVE-2017-7776...

[SECURITY] [DLA 990-1] expat security update

Package : expat Version : 2.1.0-1+deb7u5 CVE ID : CVE-2017-9233 It was discovered that there was an infinite loop vulnerability in expat, a XML parsing C library: https://libexpat.github.io/doc/cve-2017-9233/ For Debian 7 "Wheezy", this issue has been fixed in expat version 2.1.0-1+deb7u5. We...

[SECURITY] [DLA 988-1] rt-authen-externalauth security update

Package : rt-authen-externalauth Version : 0.10-4+deb7u1 CVE ID : CVE-2017-5361 It was discovered that RT::Authen::ExternalAuth, an external authentication module for Request Tracker, is vulnerable to timing side-channel attacks for user passwords. Only ExternalAuth in DBI database mode is...

Debian DLA-986-1 : zookeeper security update

It was discovered that Zookeeper, a service for maintaining configuration information, didn't restrict access to the computationally expensive wchp/wchc commands which could result in denial of service by elevated CPU consumption. This update disables those two commands by default. The new...

[SECURITY] [DLA 987-1] request-tracker4 security update

Package : request-tracker4 Version : 4.0.7-5+deb7u5 CVE ID : CVE-2016-6127 CVE-2017-5361 CVE-2017-5943 CVE-2017-5944 Multiple vulnerabilities have been discovered in Request Tracker, an extensible trouble-ticket tracking system. The Common Vulnerabilities and Exposures project identifies the...

[SECURITY] [DLA 985-1] libsndfile security update

Package : libsndfile Version : 1.0.25-9.1+deb7u3 CVE ID : CVE-2017-6892 Debian Bug : 864704 It was discovered that there was a vulnerability in libsndfile, a library for reading/writing audio files. A specially-crafted AIFF "Audio Interchange File Format" file could result in an out-of-bounds...

Debian DLA-985-1 : libsndfile security update

It was discovered that there was a vulnerability in libsndfile, a library for reading/writing audio files. A specially crafted AIFF 'Audio Interchange File Format' file could result in an out-of-bounds memory read. For Debian 7 'Wheezy', this issue has been fixed in libsndfile version...

[SECURITY] [DLA 984-1] tiff security update

Package : tiff Version : 4.0.2-6+deb7u14 CVE ID : CVE-2016-10095 CVE-2017-9147 CVE-2017-9403 CVE-2017-9404 Debian Bug : 863185 850316 tiff was affected by multiple memory leaks CVE-2017-9403, CVE-2017-9404 that could result in denial of service. Furthermore, while the current version in Debian wa...

[SECURITY] [DLA 983-1] tiff3 security update

Package : tiff3 Version : 3.9.6-11+deb7u6 CVE ID : CVE-2016-10095 CVE-2017-9147 CVE-2017-9403 CVE-2017-9404 tiff3 was affected by multiple memory leaks CVE-2017-9403, CVE-2017-9404 that could result in denial of service. Furthermore, while the current version in Debian was already patched for...

Debian DLA-982-1 : tor security update

It has been discovered that Tor, a connection-based low-latency anonymous communication system, contains a flaw in the hidden service code. A remote attacker can take advantage of this flaw to cause a hidden service to crash with an assertion failure TROVE-2017-005. For Debian 7 'Wheezy', this...

[SECURITY] [DLA 982-1] tor security update

Package : tor Version : 0.2.4.29-1 CVE ID : CVE-2017-0376 Debian Bug : 864424 It has been discovered that Tor, a connection-based low-latency anonymous communication system, contains a flaw in the hidden service code. A remote attacker can take advantage of this flaw to cause a hidden service to...

Debian DLA-981-1 : apng2gif security update

It was discovered that apng2gif was vulnerable to an integer overflow resulting in a heap-based buffer over-read/write. A remote attacker could use this flaw to cause a denial of service application crash via a crafted APNG file. For Debian 7 'Wheezy', these problems have been fixed in version...

[SECURITY] [DLA 979-1] debian-security-support update

Package : debian-security-support Version : 2017.06.02+deb7u1 Besides bringing the package up to date regarding translations this update marks several packages as no longer supported by wheezy-lts: autotrace, inspircd, ioquake3, kfreebsd-8, kfreebsd-9, matrixssl, teeworlds and trn For the reasoni...

[SECURITY] [DLA 981-1] apng2gif security update

Package : apng2gif Version : 1.5-1+deb7u1 CVE ID : CVE-2017-6960 Debian Bug : 854367 It was discovered that apng2gif was vulnerable to an integer overflow resulting in a heap-based buffer over-read/write. A remote attacker could use this flaw to cause a denial of service application crash via a...

[SECURITY] [DLA 980-1] ming security update

Package : ming Version : 1:0.4.4-1.1+deb7u3 CVE ID : CVE-2017-8782 It was found that ming, a library to parse and generate SWF Flash files, is susceptible to an integer overflow that would lead into out of bound memory writes via a maliciously crafted file. For Debian 7 "Wheezy", these problems...

Debian DLA-978-1 : perl security update

The cPanel Security Team reported a time of check to time of use TOCTTOU race condition flaw in File::Path, a core module from Perl to create or remove directory trees. An attacker can take advantage of this flaw to set the mode on an attacker-chosen file to an attacker-chosen value. For Debian 7...