[SECURITY] [DLA 822-1] vim security update

Package : vim Version : 2:7.3.547-7+deb7u2 CVE ID : CVE-2017-5953 Debian Bug : 854969 A vulnerability has been discovered in Vim where a malformed spell file could cause an integer overflow which is used as the size for memory allocation, resulting in a subsequent buffer overflow. For Debian 7...

Debian DLA-822-1 : vim security update

A vulnerability has been discovered in Vim where a malformed spell file could cause an integer overflow which is used as the size for memory allocation, resulting in a subsequent buffer overflow. For Debian 7 'Wheezy', these problems have been fixed in version 2:7.3.547-7+deb7u2. We recommend tha...

Debian DLA-821-1 : openjdk-7 security update

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the bypass of Java sandbox restrictions, denial of service, arbitrary code execution, incorrect parsing or URLs/LDAP DNs or cryptoraphice timing side channel attacks. For Debian 7...

[SECURITY] [DLA 821-1] openjdk-7 security update

Package : openjdk-7 Version : 7u121-2.6.8-2deb7u1 CVE ID : CVE-2016-5546 CVE-2016-5547 CVE-2016-5548 CVE-2016-5552 CVE-2017-3231 CVE-2017-3241 CVE-2017-3252 CVE-2017-3253 CVE-2017-3260 CVE-2017-3261 CVE-2017-3272 CVE-2017-3289 Several vulnerabilities have been discovered in OpenJDK, an...

Debian DLA-819-2 : mysql-5.5 version number correction

This is a correction of DLA 819-1 that mentioned that mysql-5.5 5.5.47-0+deb7u2 was corrected. The corrected package version was 5.5.54-0+deb7u2. For completeness the text from DLA 819-1 is available below with only corrected version information. No other changes. It has been found that the C...

[SECURITY] [DLA 819-1] mysql-5.5 security update

Package : mysql-5.5 Version : 5.5.47-0+deb7u2 CVE ID : not assigned yet Debian Bug : 854713 It has been found that the C client library for MySQL libmysqlclient.so has use-after-free vulnerability which can cause crash of applications using that MySQL client. For Debian 7 "Wheezy", these problems...

Debian DLA-818-1 : php5 security update

Several issues have been discovered in PHP recursive acronym for PHP: Hypertext Preprocessor, a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. - CVE-2016-2554 Stack-based buffer overflow in ext/phar/tar.c...

[SECURITY] [DLA 693-2] tiff regression update

Package : tiff Version : 4.0.2-6+deb7u10 Debian Bug : 852610 Version 4.0.2-6+deb7u7 introduced changes that resulted in libtiff being unable to write out tiff files when the compression scheme in use relies on codec-specific TIFF tags embedded in the image. This problem manifested itself with...

Debian DLA-817-1 : libphp-phpmailer security update

It was discovered that there was a local file disclosure vulnerability in libphp-phpmailer, a email transfer class for PHP, where insufficient parsing of HTML messages could potentially be used by attacker to read a local file. For Debian 7 'Wheezy', this issue has been fixed in libphp-phpmailer...

[SECURITY] [DLA 817-1] libphp-phpmailer security update

Package : libphp-phpmailer Version : 5.1-1.3+deb7u1 CVE ID : CVE-2017-5223 Debian Bug : 853232 It was discovered that there was a local file disclosure vulnerability in libphp-phpmailer, a email transfer class for PHP, where insufficient parsing of HTML messages could potentially be used by...

[SECURITY] [DLA 816-1] svgsalamander security update

Package : svgsalamander Version : 0svn95-1+deb7u1 CVE ID : CVE-2017-5617 Debian Bug : 853134 Luc Lynx discovered a Server-Side Request Forgery in svgSalamander allowing access to the trusted network with specially crafted SVG files. For Debian 7 "Wheezy", these problems have been fixed in version...

[SECURITY] [DLA 815-1] ntfs-3g security update

Package : ntfs-3g Version : 1:2012.1.15AR.5-2.1+deb7u3 CVE ID : CVE-2017-0358 Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this fla...

Debian DLA-813-1 : wordpress security update

Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following issues. CVE-2017-5488 Multiple cross-site scripting XSS vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers...

[SECURITY] [DLA 814-1] openssl security update

Package : openssl Version : 1.0.1t-1+deb7u2 CVE ID : CVE-2016-7056 CVE-2016-8610 CVE-2017-3731 Several vulnerabilities were discovered in OpenSSL: CVE-2016-7056 A local timing attack was discovered against ECDSA P-256. CVE-2016-8610 It was discovered that no limit was imposed on alert packets...

[SECURITY] [DLA 812-1] ikiwiki security update

Package : ikiwiki Version : 3.20120629.2+deb7u2 CVE ID : CVE-2016-9646 CVE-2016-10026 CVE-2017-0356 Several vulnerabilities have been found in ikiwiki, a wiki compiler: CVE-2016-9646 Commit metadata forgery CVE-2016-10026 Authorization bypass when reverting changes CVE-2017-0356 Authentication...

[SECURITY] [DLA 811-1] libplist security update

Package : libplist Version : 1.8-1+deb7u1 CVE ID : CVE-2017-5209 CVE-2017-5545 Debian Bug : 851196 852385 The following vulnerabilities have been fixed in libplist: CVE-2017-5209 Out of bounds read when parsing specially crafted Apple plist file CVE-2017-5545 Heap buffer overflow via crafted Appl...

[SECURITY] [DLA 808-1] ruby-archive-tar-minitar security update

Package : ruby-archive-tar-minitar Version : 0.5.2-2+deb7u1 CVE ID : CVE-2016-10173 Debian Bug : 853249 It has been found that rubygem archive-tar-minitar allows attackers to overwrite arbitrary files during archive extraction via a .. dot dot in an extracted filename. For Debian 7 "Wheezy", thes...

[SECURITY] [DLA 610-2] tiff3 regression update

Package : tiff3 Version : 3.9.6-11+deb7u3 Debian Bug : 852610 Version 3.9.6-11+deb7u1 and 3.9.6-11+deb7u2 introduced changes that resulted in libtiff writing out invalid tiff files when the compression scheme in use relies on codec-specific TIFF tags embedded in the image. For Debian 7 "Wheezy",...

[SECURITY] [DLA 807-1] imagemagick security update

Package : imagemagick Version : 8:6.7.7.10-5+deb7u11 CVE ID : CVE-2016-10144 CVE-2016-10145 CVE-2016-10146 CVE-2017-5506 CVE-2017-5507 CVE-2017-5508 CVE-2017-5510 CVE-2017-5511 Debian Bug : 851485, 851483, 851380, 851383, 851382, 851381, 851376, 851374 Numerous vulnerabilities were discovered in...

Debian DLA-806-1 : zoneminder security update

Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30.0, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images...