[SECURITY] [DLA 789-1] icoutils security update

Package : icoutils Version : 0.29.1-5deb7u1 CVE ID : CVE-2017-5208 CVE-2017-5331 CVE-2017-5332 CVE-2017-5333 Debian Bug : 850017 Brief introduction CVE-2017-5208 Choongwoo Han reported0 an exploitable crash in wrestool from icoutils. The command line tools is e.g. used in KDEs metadataparsing...

Debian DLA-788-1 : pdns-recursor security update

Florian Heinz and Martin Kluge reported that pdns-recursor, a recursive DNS server, parses all records present in a query regardless of whether they are needed or even legitimate, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the pdns server, resulting in a...

[SECURITY] [DLA 788-1] pdns-recursor security update

Package : pdns-recursor Version : 3.3-3+deb7u2 CVE ID : CVE-2016-9139 Florian Heinz and Martin Kluge reported that pdns-recursor, a recursive DNS server, parses all records present in a query regardless of whether they are needed or even legitimate, allowing a remote, unauthenticated attacker to...

[SECURITY] [DLA 787-1] otrs2 security update

Package : otrs2 Version : 3.1.7+dfsg1-8+deb7u6 CVE ID : CVE-2016-9139 Debian Bug : 843091 A cross-site sripting vulnerability XSS was discovered in OTRS, a ticket requesting system for the web. An attacker could trick an authenticated user into opening a malicious attachment which could lead to t...

[SECURITY] [DLA 787-1] otrs2 security update

Package : otrs2 Version : 3.1.7+dfsg1-8+deb7u6 CVE ID : CVE-2016-9139 Debian Bug : 843091 A cross-site sripting vulnerability XSS was discovered in OTRS, a ticket requesting system for the web. An attacker could trick an authenticated user into opening a malicious attachment which could lead to t...

[SECURITY] [DLA 786-1] botan1.10 security update

Package : botan1.10 Version : 1.10.5-1+deb7u2 CVE ID : CVE-2016-9132 It was discovered that there was an integer overflow vulnerability in botan, a cryptography library. This could occur while parsing untrusted inputs such as X.509 certificates. For Debian 7 "Wheezy", this problem has been fixed ...

[SECURITY] [DLA 785-1] wireless-regdb new upstream version

Package : wireless-regdb Version : 2016.06.10-1deb7u1 This update includes the changes in wireless-regdb 2016.06.10, reflecting changes to radio regulations in many countries and adding information about additional countries. For Debian 7 "Wheezy", the update is available as version...

Debian DLA-782-1 : icedove security update

Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail client: Multiple vulnerabilities may lead to the execution of arbitrary code, data leakage or bypass of the content security policy. For Debian 7 'Wheezy', these problems have been fixed in versi...

Debian DLA-783-1 : xen security update

Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2016-10013 xsa-204 Xen mishandles SYSCALL singlestep during emulation which can lead to privilege escalation. The vulnerability is only...

[SECURITY] [DLA 761-2] python-bottle regression update

Package : python-bottle Version : 0.10.11-1+deb7u3 Debian Bug : 850176 The update for python-bottle issued as DLA 761-1 would cause a crash if a unicode string was used in a header. Updated packages are now available to correct this issue. For Debian 7 "Wheezy", these problems have been fixed in...

[SECURITY] [DLA 784-1] gcc-mozilla new package

Package : gcc-mozilla Version : 4.8.4-0deb7u1 GCC 4.8 has been packaged as gcc-mozilla for Debian 7. This package will be needed for future updates to firefox-esr and icedove, and possibly other packages that require new versions of GCC. Further information about Debian LTS security advisories, h...

[SECURITY] [DLA 684-2] libx11 regression update

Package : libx11 Version : 2:1.5.0-1+deb7u4 A possible invalid free was introduced in libx11 2:1.5.0-1+deb7u3, which could lead to application crashes or other issues. For Debian 7 "Wheezy", these problems have been fixed in version 2:1.5.0-1+deb7u4. We recommend that you upgrade your libx11...

[SECURITY] [DLA 783-1] xen security update

Package : xen Version : 4.1.6.lts1-5 CVE ID : CVE-2016-10013 CVE-2016-10024 Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-10013 xsa-204 Xen mishandles SYSCALL singlestep during...

Debian DLA-780-1 : libav security update

Multiple vulnerabilities have been found in libav : CVE-2016-7424 The putnorndpixels8xy2mmx function in x86/rndtemplate.c in libav 11.7 and earlier allows remote attackers to cause a denial of service NULL pointer dereference and crash via a crafted MP3 file. No CVE assigned The h264 codec is...

Debian DLA-781-2 : asterisk regression update

Brad Barnett found that the recent security update of Asterisk could cause immediate SIP termination due to an incomplete fix for CVE-2014-2287. For Debian 7 'Wheezy', these problems have been fixed in version 1:1.8.13.1dfsg1-3+deb7u6. We recommend that you upgrade your asterisk packages. NOTE:...

[SECURITY] [DLA 780-1] libav security update

Package : libav Version : 6:0.8.19-0+deb7u1 CVE ID : CVE-2016-7424 Multiple vulnerabilities have been found in libav: CVE-2016-7424 The putnorndpixels8xy2mmx function in x86/rndtemplate.c in libav 11.7 and earlier allows remote attackers to cause a denial of service NULL pointer dereference and...

[SECURITY] [DLA 779-1] tomcat7 security update

Package : tomcat7 Version : 7.0.28-4+deb7u9 CVE ID : CVE-2016-8745 Debian Bug : 849949 A bug in the error handling of the send file code for the NIO HTTP connector resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processo...

[SECURITY] [DLA 773-4] python-crypto update

Package : python-crypto Version : 2.6-4+deb7u7 The previous security updates for python-crypto DLA-773-1, DLA-773-2 & DLA-773-3 were not available on non-amd64 architectures. This was due to the testsuite failing to exit gracefully when "multiprocessing" based tests were not functioning or...

[SECURITY] [DLA 778-1] pcsc-lite security update

Package : pcsc-lite Version : 1.8.4-1+deb7u2 CVE ID : CVE-2016-10109 It was discovered that there was a use-after-free and double-free vulnerability in pcsc-lite, a library to access smart cards that use the WindowsR SCard interface "PC/SC". For Debian 7 "Wheezy", this issue has been fixed in...

[SECURITY] [DLA 773-2] python-crypto regression update

Package : python-crypto Version : 2.6-4+deb7u5 CVE ID : CVE-2013-7459 Debian Bug : 849495, 850025, 850077 It was discovered that there was a regression in the recent update to python-crypto, a cryptographic algorithms and protocols for Python. We now raise a warning not an error on invalid input ...