[SECURITY] [DLA 805-1] bind9 security update

Package : bind9 Version : 1:9.8.4.dfsg.P1-6+nmu2+deb7u14 CVE ID : CVE-2016-9131 CVE-2016-9147 CVE-2016-9444 Several denial-of-service vulnerabilities assertion failures were discovered in BIND, a DNS server implementation. CVE-2016-9131 A crafted upstream response to an ANY query could cause an...

[SECURITY] [DLA 781-2] asterisk regression update

Package : asterisk Version : 1:1.8.13.1dfsg1-3+deb7u6 CVE ID : CVE-2014-2287 Brad Barnett found that the recent security update of Asterisk could cause immediate SIP termination due to an incomplete fix for CVE-2014-2287. For Debian 7 "Wheezy", these problems have been fixed in version...

Debian DLA-799-1 : ming security update

Multiple security issues have been found in Ming. They may lead to the execution of arbitrary code or causing application crash. CVE-2016-9264 global-buffer-overflow in printMP3Headers CVE-2016-9265 divide-by-zero in printMP3Headers CVE-2016-9266 left shift in listmp3.c CVE-2016-9827 listswf:...

Debian DLA-800-1 : firefox-esr security update

Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code or information leaks or privilege escalation. For Debian 7 'Wheezy', these problems have been fix...

Debian DLA-802-1 : openjdk-7 security update

openjdk-7 7u111-2.6.7-2deb7u1 backported the security fixes from 7u121. openjdk-7 has now been updated to the full 7u121 version, which includes extra bug fixes and other improvements. For Debian 7 'Wheezy', these problems have been fixed in version 7u121-2.6.8-1deb7u1. We recommend that you...

[SECURITY] [DLA 803-1] lcms2 security update

Package : lcms2 Version : 2.2+git20110628-2.2+deb7u2 CVE ID : CVE-2016-10165 Debian Bug : https://bugs.debian.org/852627 An out of bounds read was found in lcms2, which can lead to heap memory leak or denial of service via a specially-crafted ICC profile. For Debian 7 "Wheezy", these problems hav...

[SECURITY] [DLA 802-1] openjdk-7 security update

Package : openjdk-7 Version : 7u121-2.6.8-1deb7u1 openjdk-7 7u111-2.6.7-2deb7u1 backported the security fixes from 7u121. openjdk-7 has now been updated to the full 7u121 version, which includes extra bug fixes and other improvements. For Debian 7 "Wheezy", these problems have been fixed in versi...

[SECURITY] [DLA 800-1] firefox-esr security update

Package : firefox-esr Version : 45.7.0esr-1deb7u1 CVE ID : CVE-2017-5373 CVE-2017-5375 CVE-2017-5376 CVE-2017-5378 CVE-2017-5380 CVE-2017-5383 CVE-2017-5386 CVE-2017-5390 CVE-2017-5396 Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors,...

[SECURITY] [DLA 799-1] ming security update

Package : ming Version : 1:0.4.4-1.1+deb7u1 CVE ID : CVE-2016-9264 CVE-2016-9265 CVE-2016-9266 CVE-2016-9827 CVE-2016-9828 CVE-2016-9829 CVE-2016-9831 Debian Bug : 843928 Multiple security issues have been found in Ming. They may lead to the execution of arbitrary code or causing application cras...

[SECURITY] [DLA 798-1] pdns security update

Package : pdns Version : 3.1-4.1+deb7u3 CVE ID : CVE-2016-2120 CVE-2016-7068 CVE-2016-7072 CVE-2016-7073 CVE-2016-7074 Multiple vulnerabilities have been discovered in pdns, an authoritative DNS server. The Common Vulnerabilities and Exposures project identifies the following problems:...

[SECURITY] [DLA 797-1] mysql-5.5 security update

Package : mysql-5.5 Version : 5.5.54-0+deb7u1 CVE ID : CVE-2017-3238 CVE-2017-3243 CVE-2017-3244 CVE-2017-3258 CVE-2017-3265 CVE-2017-3291 CVE-2017-3312 CVE-2017-3313 CVE-2017-3317 CVE-2017-3318 Debian Bug : 851233 Several issues have been discovered in the MySQL database server. The...

Debian DLA-794-1 : groovy security update

It was found that a flaw in Apache Groovy, a dynamic language for the Java Virtual Machine, allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All...

Debian DLA-793-1 : opus security update

A remote code execution vulnerability was discovered in opus, an audio codec, that could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. For Debian 7 'Wheezy', these problems have been fixed in version...

[SECURITY] [DLA 794-1] groovy security update

Package : groovy Version : 1.8.6-1+deb7u2 CVE ID : CVE-2016-6814 Debian Bug : 851408 It was found that a flaw in Apache Groovy, a dynamic language for the Java Virtual Machine, allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft...

[SECURITY] [DLA 793-1] opus security update

Package : opus Version : 0.9.14+20120615-1+nmu1+deb7u1 CVE ID : CVE-2017-0381 Debian Bug : 851612 A remote code execution vulnerability was discovered in opus, an audio codec, that could enable an attacker using a specially crafted file to cause memory corruption during media file and data...

Debian DLA-791-1 : libav security update

Multiple integer overflows have been discovered in libav 11.8 and earlier, allowing remote attackers to cause a crash via a crafted MP3 file. For Debian 7 'Wheezy', these problems have been fixed in version 6:0.8.20-0+deb7u1. We recommend that you upgrade your libav packages. NOTE: Tenable Networ...

Debian DLA-792-1 : libphp-swiftmailer security update

Dawid Golunski from legalhackers-com 1 discovered that the mail transport in Swift Mailer allowed remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a ' backslash double quote in a crafted e-mail address in the From, ReturnPath, or Sender...

Debian DLA-790-1 : mapserver security update

It was discovered that mapserver, a CGI-based framework for Internet map services, was vulnerable to a stack-based overflow. This issue allowed a remote user to crash the service, or potentially execute arbitrary code. For Debian 7 'Wheezy', these problems have been fixed in version...

[SECURITY] [DLA 790-1] mapserver security update

Package : mapserver Version : 6.0.1-3.2+deb7u4 CVE ID : CVE-2017-5522 It was discovered that mapserver, a CGI-based framework for Internet map services, was vulnerable to a stack-based overflow. This issue allowed a remote user to crash the service, or potentially execute arbitrary code. For Debi...

[SECURITY] [DLA 791-1] libav security update

Package : libav Version : 6:0.8.20-0+deb7u1 CVE ID : CVE-2016-9819 CVE-2016-9820 CVE-2016-9821 CVE-2016-9822 Multiple integer overflows have been discovered in libav 11.8 and earlier, allowing remote attackers to cause a crash via a crafted MP3 file. For Debian 7 "Wheezy", these problems have bee...