Debian DLA-953-1 : graphicsmagick security update

Chris Evans discovered that graphicsmagick used uninitialized memory in the RLE decoder, allowing an remote attacker to leak sensitive information from process memory space. More information are available at: https://scarybeastsecurity.blogspot.de/2017/05/bleed-continues-18-byte...

Debian DLA-954-1 : openjdk-7 security update

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in privilege escalation, denial of service, newline injection in SMTP or use of insecure cryptography. For Debian 7 'Wheezy', these problems have been fixed in version...

Debian DLA-957-1 : bind9 security update

CVE-2017-3136 Oleg Gorokhov of Yandex discovered that BIND does not properly handle certain queries when using DNS64 with the 'break-dnssec yes;' option, allowing a remote attacker to cause a denial of service. CVE-2017-3137 It was discovered that BIND makes incorrect assumptions about the orderi...

[SECURITY] [DLA 963-1] exiv2 security update

Package : exiv2 Version : 0.23-1+deb7u1 CVE ID : CVE-2017-9239 Debian Bug : 863410 It was discovered that the exiv2 library fails to parse some crafted tiff images, leading to denial of service via application crash. For Debian 7 "Wheezy", these problems have been fixed in version 0.23-1+deb7u1. ...

[SECURITY] [DLA 962-1] tnef security update

Package : tnef Version : 1.4.9-1+deb7u3 CVE ID : CVE-2017-8911 CVE-2017-8911 An integer underflow has been identified in the unicodetoutf8 function in tnef 1.4.14. This might lead to invalid write operations, controlled by an attacker. For Debian 7 "Wheezy", these problems have been fixed in...

[SECURITY] [DLA 960-1] imagemagick security update

Package : imagemagick Version : 6.7.7.10-5+deb7u14 CVE ID : CVE-2014-8354 CVE-2014-8355 CVE-2014-8562 CVE-2014-8716 CVE-2014-9841 CVE-2015-8900 CVE-2015-8901 CVE-2015-8902 CVE-2015-8903 CVE-2017-7941 CVE-2017-7943 CVE-2017-8343 CVE-2017-8344 CVE-2017-8345 CVE-2017-8346 CVE-2017-8347 CVE-2017-8348...

[SECURITY] [DLA 959-1] libical security update

Package : libical Version : 0.48-2+deb7u1 CVE ID : CVE-2016-5824 CVE-2016-9584 Debian Bug : 860451, 852034 It was discovered that there was a use-after-free vulnerability in the libical iCalendar library. Remote attackers could cause a denial of service and possibly read heap memory via a special...

[SECURITY] [DLA 957-1] bind9 security update

Package : bind9 Version : 1:9.8.4.dfsg.P1-6+nmu2+deb7u16 CVE ID : CVE-2017-3136 CVE-2017-3137 CVE-2017-3138 CVE-2017-3136 Oleg Gorokhov of Yandex discovered that BIND does not properly handle certain queries when using DNS64 with the "break-dnssec yes;" option, allowing a remote attacker to cause...

[SECURITY] [DLA 956-1] libsndfile security update

Package : libsndfile Version : 1.0.25-9.1+deb7u2 CVE ID : CVE-2017-8361 CVE-2017-8362 CVE-2017-8363 CVE-2017-8365 CVE-2017-8361 The flacbuffercopy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service buffer overflow and application crash or possibly have...

[SECURITY] [DLA 955-1] rzip security update

Package : rzip Version : 2.1-1+deb7u1 CVE ID : CVE-2017-8364 Debian Bug : 861614 Agostino Sarubbo of Gentoo discovered a heap buffer overflow write in the rzip program when uncompressing maliciously crafted files. For Debian 7 "Wheezy", these problems have been fixed in version 2.1-1+deb7u1. We...

[SECURITY] [DLA 954-1] openjdk-7 security update

Package : openjdk-7 Version : 7u131-2.6.9-2deb7u1 CVE ID : CVE-2017-3509 CVE-2017-3511 CVE-2017-3526 CVE-2017-3533 CVE-2017-3539 CVE-2017-3544 Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in privilege escalation, denial of...

[SECURITY] [DLA 953-1] graphicsmagick security update

Package : graphicsmagick Version : 1.3.16-1.1+deb7u7 CVE ID : CVE-2017-9098 Debian Bug : 862967 Chris Evans discovered that graphicsmagick used uninitialized memory in the RLE decoder, allowing an remote attacker to leak sensitive information from process memory space. More information are...

[SECURITY] [DLA 952-1] kde4libs security update

Package : kde4libs Version : 4:4.8.4-4+deb7u3 CVE ID : CVE-2013-2074 CVE-2017-6410 CVE-2017-8422 Debian Bug : 856890 Several vulnerabilities were discovered in kde4libs, the core libraries for all KDE 4 applications. The Common Vulnerabilities and Exposures project identifies the following...

Debian DLA-951-1 : samba security update (SambaCry)

steelo discovered a remote code execution vulnerability in Samba, a SMB/CIFS file, print, and login server for Unix. A malicious client with access to a writable share, can take advantage of this flaw by uploading a shared library and then cause the server to load and execute it. For Debian 7...

[SECURITY] [DLA 951-1] samba security update

Package : samba Version : 2:3.6.6-6+deb7u13 CVE ID : CVE-2017-7494 steelo discovered a remote code execution vulnerability in Samba, a SMB/CIFS file, print, and login server for Unix. A malicious client with access to a writable share, can take advantage of this flaw by uploading a shared library...

[SECURITY] [DLA 950-1] libtasn1-3 security update

Package : libtasn1-3 Version : 2.13-2+deb7u4 CVE ID : CVE-2017-6891 Secunia Research has discovered multiple vulnerabilities in GnuTLS libtasn1, which can be exploited by malicious people to compromise a vulnerable system. Two errors in the "asn1findnode" function lib/parseraux.c can be exploited...

Debian DLA-949-1 : miniupnpc security update

It was discovered that there was a integer signedness error in the miniupnpc UPnP client that could allow remote attackers to cause a denial of service attack. For Debian 7 'Wheezy', this issue has been fixed in miniupnpc version 1.5-2+deb7u2. We recommend that you upgrade your miniupnpc packages...

Debian DLA-948-1 : dropbear security update

A vulnerability was found in Dropbear, a lightweight SSH2 server and client. CVE-2017-9079 Jann Horn discovered a local information leak in parsing the .authorizedkeys file. For Debian 7 'Wheezy', this problem has been fixed in version 2012.55-1.3+deb7u2. We recommend that you upgrade your dropbe...

[SECURITY] [DLA 948-1] dropbear security update

Package : dropbear Version : 2012.55-1.3+deb7u2 CVE ID : CVE-2017-9079 A vulnerability was found in Dropbear, a lightweight SSH2 server and client. CVE-2017-9079 Jann Horn discovered a local information leak in parsing the .authorizedkeys file. For Debian 7 "Wheezy", this problem has been fixed i...

[SECURITY] [DLA 947-1] icu security update

Package : icu Version : 4.8.1.1-12+deb7u7 CVE ID : CVE-2017-7867 CVE-2017-7868 It was discovered that icu, the International Components for Unicode library, did not correctly validate its input. An attacker could use this problem to trigger an out-of-bound write through a heap-based buffer...