Debian DLA-930-1 : libxstream-java security update

It was discovered that there was a remote application crash vulnerability in libxstream-java, a Java library to serialize objects to XML and back again. This was due to mishandled attempts to create an instance of the primitive type 'void' during unmarshalling. For Debian 7 'Wheezy', this issue h...

[SECURITY] [DLA 930-1] libxstream-java security update

Package : libxstream-java Version : 1.4.2-1+deb7u2 CVE ID : CVE-2017-7957 Debian Bug : 861521 It was discovered that there was a remote application crash vulnerability in libxstream-java, a Java library to serialize objects to XML and back again. This was due to mishandled attempts to create an...

Debian DLA-922-1 : linux security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or have other impacts. CVE-2016-2188 Ralf Spenneberg of OpenSource Security reported that the iowarrior device driver did not sufficiently validate USB descriptors. This...

Debian DLA-925-1 : kedpm security update

An information disclosure vulnerability was found in kedpm, a password manager compatible with the figaro password manager file format. The history file can reveal the master password if it is provided on the commandline. The name of entries created or read in the password manager are also expose...

Debian DLA-928-1 : libsndfile security update

Multiple vulnerabilities were found in libsndfile, a popular library for reading/writing audio files. CVE-2017-7585 In libsndfile before 1.0.28, an error in the 'flacbuffercopy' function flac.c can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file. CVE-2017-758...

Debian DLA-927-1 : fop security update

In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full...

[SECURITY] [DLA 927-1] fop security update

Package : fop Version : 1:1.0.dfsg2-6+deb7u1 CVE ID : CVE-2017-5661 Debian Bug : 860567 In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the use...

[SECURITY] [DLA 925-1] kedpm security update

Package : kedpm Version : 0.5.0-4+deb7u1 CVE ID : CVE-2017-8296 Debian Bug : 860817 An information disclosure vulnerability was found in kedpm, a password manager compatible with the figaro password manager file format. The history file can reveal the master password if it is provided on the...

[SECURITY] [DLA 926-1] batik security update

Package : batik Version : 1.7+dfsg-3+deb7u2 CVE ID : CVE-2017-5662 Debian Bug : 860566 In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the...

[SECURITY] [DLA 923-1] partclone security update

Package : partclone Version : 0.2.48-1+deb7u1 CVE ID : CVE-2017-6596 Debian Bug : 857966 It was discovered that partclone, an utility to backup partitions, was prone to a heap-based buffer overflow vulnerability due to insufficient validation of the partclone image header. This could allow remote...

Debian DLA-921-1 : slurm-llnl security update

With this vulnerability arbitrary files can be overwritten on nodes running jobs provided that the user can run a job that is able to trigger a failure of a Prolog script. For Debian 7 'Wheezy', these problems have been fixed in version 2.3.4-2+deb7u1. We recommend that you upgrade your slurm-lln...

[SECURITY] [DLA 921-1] slurm-llnl security update

Package : slurm-llnl Version : 2.3.4-2+deb7u1 CVE ID : CVE-2016-10030 Debian Bug : 850491 With this vulnerability arbitrary files can be overwritten on nodes running jobs provided that the user can run a job that is able to trigger a failure of a Prolog script. For Debian 7 "Wheezy", these proble...

Debian DLA-918-1 : freetype security update

It was found that an out of bounds write caused by a heap-based buffer overflow could be triggered in freetype via a crafted font. This update also reverts the fix for CVE-2016-10328, as it was determined that freetype 2.4.9 is not affected by that issue. For Debian 7 'Wheezy', these problems hav...

[SECURITY] [DLA 920-1] jasper security update

Package : jasper Version : 1.900.1-13+deb7u6 CVE ID : CVE-2016-9591 CVE-2016-10251 CVE-2016-9591 Use-after-free on heap in jasmatrixdestroy The vulnerability exists in code responsible for re-encoding the decoded input image file to a JP2 image. The vulnerability is caused by not setting related...

[SECURITY] [DLA 919-1] weechat security update

Package : weechat Version : 0.3.8-1+deb7u2 CVE ID : CVE-2017-8073 Debian Bug : 861121 WeeChat before allows a remote crash by sending a filename via DCC to the IRC plugin. For Debian 7 "Wheezy", these problems have been fixed in version 0.3.8-1+deb7u2. We recommend that you upgrade your weechat...

[SECURITY] [DLA 918-1] freetype security update

Package : freetype Version : 2.4.9-1.1+deb7u6 CVE ID : CVE-2017-8105 Debian Bug : 861220 860303 It was found that an out of bounds write caused by a heap-based buffer overflow could be triggered in freetype via a crafted font. This update also reverts the fix for CVE-2016-10328, as it was...

Debian DLA-916-1 : mysql-5.5 security update (Riddle)

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.55, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly incompatible changes. Please see th...

[SECURITY] [DLA 917-1] rtmpdump security update

Package : rtmpdump Version : 2.4+20111222.git4e06e21-1+deb7u1 CVE ID : CVE-2015-8270 CVE-2015-8271 CVE-2015-8272 Several vulnerabilities were found in rtmpdump and the librtmp library. CVE-2015-8270 A bug in AMF3ReadString in librtmp can cause a denial of service via application crash to librtmp...

[SECURITY] [DLA 916-1] mysql-5.5 security update

Package : mysql-5.5 Version : 5.5.55-0+deb7u1 CVE ID : CVE-2016-5483 CVE-2017-3302 CVE-2017-3305 CVE-2017-3308 CVE-2017-3309 CVE-2017-3329 CVE-2017-3453 CVE-2017-3456 CVE-2017-3461 CVE-2017-3462 CVE-2017-3463 CVE-2017-3464 CVE-2017-3600 Debian Bug : 854713 860544 Several issues have been discover...

[SECURITY] [DLA 915-1] botan1.10 security update

Package : botan1.10 Version : 1.10.5-1+deb7u3 CVE ID : CVE-2017-2801 Debian Bug : 860072 A bug in X509 DN string comparisons could result in out of bound reads. This could result in information leakage, denial of service, or potentially incorrect certificate validation results. For Debian 7...