[SECURITY] [DLA 901-1] radare2 security update

Package : radare2 Version : 0.9-3+deb7u2 CVE ID : CVE-2017-6448 CVE-2017-6448 The dalvikdisassemble function in libr/asm/p/asmdalvik.c in radare2 1.2.1 allows remote attackers to cause a denial of service stack-based buffer overflow and application crash or possibly have unspecified other impact...

[SECURITY] [DLA 900-1] freetype security update

Package : freetype Version : 2.4.9-1.1+deb7u5 CVE ID : CVE-2016-10328 Debian Bug : 860303 The Freetype 2 font engine was vulnerable to an out-of-bounds write caused by a heap-based buffer overflow in the cffparserrun function in cff/cffparse.c. For Debian 7 "Wheezy", these problems have been fixe...

[SECURITY] [DLA 899-1] feh security update

Package : feh Version : 2.3-2+deb7u1 CVE ID : CVE-2017-7875 Debian Bug : 860367 Tobias Stoeckmann discovered it was possible to trigger an out-of-boundary heap write with the image viewer feh while receiving an IPC message. For Debian 7 "Wheezy", these problems have been fixed in version...

Debian DLA-895-1 : openoffice.org-dictionaries update

The dictionaries provided by this package had an unversioned conflict against the thunderbird package which so far was not part of wheezy. Since the next update of Icedove introduces a thunderbird package the dictionaries would become unusable in Icedove so the unneeded conflict was dropped. For...

[SECURITY] [DLA 898-1] libosip2 security update

Package : libosip2 Version : 3.6.0-4+deb7u1 CVE ID : CVE-2016-10324 CVE-2016-10325 CVE-2016-10326 CVE-2017-7853 CVE-2016-10324 In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osipclrncpy function defined in osipparser2/osipport.c. CVE-2016-10325 In...

[SECURITY] [DLA 897-1] qbittorrent security update

Package : qbittorrent Version : 2.9.8-1+deb7u1 CVE ID : CVE-2017-6503 CVE-2017-6504 CVE-2017-6503 WebUI in qBittorrent before 3.3.11 did not escape many values, which could potentially lead to XSS. CVE-2017-6504 WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which coul...

[SECURITY] [DLA 895-1] openoffice.org-dictionaries update

Package : openoffice.org-dictionaries Version : 3.3.0rc10-4+deb7u1 Debian Bug : 646693 The dictionaries provided by this package had an unversioned conflict against the thunderbird package which so far was not part of wheezy. Since the next update of Icedove introduces a thunderbird package the...

Debian DLA-894-1 : samba security update

Jann Horn of Google discovered a time-of-check, time-of-use race condition in Samba, a SMB/CIFS file, print, and login server for Unix. A malicious client can take advantage of this flaw by exploting a symlink race to access areas of the server file system not exported under a share definition. F...

[SECURITY] [DLA 894-1] samba security update

Package : samba Version : 2:3.6.6-6+deb7u12 CVE ID : CVE-2017-2619 Jann Horn of Google discovered a time-of-check, time-of-use race condition in Samba, a SMB/CIFS file, print, and login server for Unix. A malicious client can take advantage of this flaw by exploting a symlink race to access areas...

Debian DLA-893-1 : bouncycastle security update

An information disclosure vulnerability was discovered in Bouncy Castle, a Java library which consists of various cryptographic algorithms. The Galois/Counter mode GCM implementation was missing a boundary check that could enable a local application to gain access to user's private information. F...

Debian DLA-890-1 : ming security update

It was discovered that there were multiple heap-based buffer overflows in ming, a library to generate SWF Flash files. The updated packages prevent a crash in the 'listswf' utility due to a heap-based buffer overflow in the parseSWFRGBA function and several other functions in parser.c...

[SECURITY] [DLA 893-1] bouncycastle security update

Package : bouncycastle Version : 1.44+dfsg-3.1+deb7u2 CVE ID : CVE-2015-6644 An information disclosure vulnerability was discovered in Bouncy Castle, a Java library which consists of various cryptographic algorithms. The Galois/Counter mode GCM implementation was missing a boundary check that cou...

[SECURITY] [DLA 891-1] libnl security update

Package : libnl Version : 1.1-7+deb7u1 CVE ID : CVE-2017-0553 Debian Bug : It was discovered that there was a FIXME in libnl, a FIXME... For Debian 7 "Wheezy", this issue has been fixed in libnl version 1.1-7+deb7u1. We recommend that you upgrade your libnl packages. Regards, - -- ,. : : : Chris...

[SECURITY] [DLA 892-1] libnl3 security update

Package : libnl3 Version : 3.2.7-4+deb7u1 CVE ID : CVE-2017-0553 Debian Bug : 859948 It was discovered that there was an integer overflow in libnl3, a library for dealing with netlink sockets. A missing check in nlmsgreserve could have allowed a malicious application to execute arbitrary code...

[SECURITY] [DLA 890-1] ming security update

Package : ming Version : 1:0.4.4-1.1+deb7u2 CVE ID : CVE-2017-7578 It was discovered that there were multiple heap-based buffer overflows in ming, a library to generate SWF Flash files. The updated packages prevent a crash in the "listswf" utility due to a heap-based buffer overflow in the...

Debian DLA-888-1 : logback security update

It was discovered that logback, a flexible logging library for Java, would deserialize data from untrusted sockets which may lead to the execution of arbitrary code. This issue has been resolved by adding a whitelist to use only trusted classes. For Debian 7 'Wheezy', these problems have been fix...

Debian DLA-886-1 : tzdata new upstream version

This update includes the changes in tzdata 2017b. Notable changes are : - Haiti resumed observance of DST in 2017. For Debian 7 'Wheezy', these problems have been fixed in version 2017b-0+deb7u1. We recommend that you upgrade your tzdata packages. NOTE: Tenable Network Security has extracted the...

Debian DLA-889-1 : potrace security update

It was discovered that potrace, an utility to transform bitmaps into vector graphics, was affected by an integer overflow in the findnext function, allowing remote attackers to cause a denial of service invalid memory access and crash via a crafted BMP image. For Debian 7 'Wheezy', these problems...

[SECURITY] [DLA 889-1] potrace security update

Package : potrace Version : 1.10-1+deb7u2 CVE ID : CVE-2016-8685 Debian Bug : 843861 It was discovered that potrace, an utility to transform bitmaps into vector graphics, was affected by an integer overflow in the findnext function, allowing remote attackers to cause a denial of service invalid...

[SECURITY] [DLA 888-1] logback security update

Package : logback Version : 1:1.0.4-1+deb7u1 CVE ID : CVE-2017-5929 Debian Bug : 857343 It was discovered that logback, a flexible logging library for Java, would deserialize data from untrusted sockets which may lead to the execution of arbitrary code. This issue has been resolved by adding a...