[SECURITY] [DLA 613-1] roundcube security update

Package : roundcube Version : 0.7.2-9+deb7u4 CVE ID : CVE-2014-9587 CVE-2015-1433 CVE-2016-4069 Debian Bug : 822333 775576 776700 Multiple CSRF and XSS issues allow remote attackers to hijack the authentication and execute roundcube operations without the consent of the user. In some cases, this...

DLA-615-1 icu - security update

Bulletin has no description...

DLA-613-1 roundcube - security update

Bulletin has no description...

Debian DLA-612-1 : libtomcrypt security update

It was discovered that the implementation of RSA signature verification in libtomcrypt is vulnerable to the Bleichenbacher signature attack. If an RSA key with exponent 3 is used it may be possible to forge a PKCS1 v1.5 signature signed by that key. For Debian 7 'Wheezy', these problems have been...

[SECURITY] [DLA 612-1] libtomcrypt security update

Package : libtomcrypt Version : 1.17-3.2+deb7u1 CVE ID : CVE-2016-6129 It was discovered that the implementation of RSA signature verification in libtomcrypt is vulnerable to the Bleichenbacher signature attack. If an RSA key with exponent 3 is used it may be possible to forge a PKCS1 v1.5...

Debian DLA-610-2 : tiff3 regression update

Version 3.9.6-11+deb7u1 and 3.9.6-11+deb7u2 introduced changes that resulted in libtiff writing out invalid tiff files when the compression scheme in use relies on codec-specific TIFF tags embedded in the image. For Debian 7 'Wheezy', these problems have been fixed in version 3.9.6-11+deb7u3. We...

DLA-611-1 jsch - security update

Bulletin has no description...

[SECURITY] [DLA 610-1] tiff3 security update

Package : tiff3 Version : 3.9.6-11+deb7u1 CVE ID : CVE-2010-2596 CVE-2013-1961 CVE-2014-8128 CVE-2014-8129 CVE-2014-9655 CVE-2015-1547 CVE-2015-8665 CVE-2015-8683 CVE-2016-3186 CVE-2016-3623 CVE-2016-3945 CVE-2016-3990 CVE-2016-3991 CVE-2016-5314 CVE-2016-5315 CVE-2016-5316 CVE-2016-5317...

[SECURITY] [DLA 609-1] linux security update

Package : linux Version : 3.2.81-2 CVE ID : CVE-2016-3857 CVE-2016-4470 CVE-2016-5696 CVE-2016-5829 CVE-2016-6136 CVE-2016-6480 CVE-2016-6828 CVE-2016-7118 Debian Bug : 827561 This update fixes the CVEs described below. CVE-2016-3857 Chiachih Wu reported two bugs in the ARM OABI compatibility lay...

[SECURITY] [DLA 608-1] mailman security update

Package : mailman Version : 1:2.1.15-1+deb7u2 CVE ID : CVE-2016-6893 Debian Bug : 835970 It was discovered that there was a CSRF vulnerability in mailman, a web-based mailing list manager, which could allow an attacker to obtain a users password. For Debian 7 "Wheezy", this issue has been fixed i...

DLA-608-1 mailman - security update

Bulletin has no description...

[SECURITY] [DLA 606-1] tiff security update

Package : tiff Version : 4.0.2-6+deb7u6 CVE ID : CVE-2016-3991 CVE-2016-5314 CVE-2016-5315 CVE-2016-5316 CVE-2016-5317 CVE-2016-5320 CVE-2016-5321 CVE-2016-5322 CVE-2016-5323 CVE-2016-5875 Several vulnerabilities were found in the tiff library, potentially causing denial of services to applicatio...

Debian DLA-602-1 : gnupg security and hardening update

CVE-2016-6313 Felix Doerre and Vladimir Klebanov from the Karlsruhe Institute of Technology discovered a flaw in the mixing functions of GnuPG's random number generator. An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output. A first analysis on the impac...

DLA-606-1 tiff - security update

Bulletin has no description...

[SECURITY] [DLA 602-1] gnupg security and hardening update

Package : gnupg Version : 1.4.12-7+deb7u8 CVE ID : CVE-2016-6313 Debian Bug : 834893 CVE-2016-6313 Felix Doerre and Vladimir Klebanov from the Karlsruhe Institute of Technology discovered a flaw in the mixing functions of GnuPGs random number generator. An attacker who obtains 4640 bits from the...

Debian DLA-603-1 : ruby-activesupport-3.2 security update

The support and utility classes used by the Rails 3.2 framework allow remote attackers to cause a denial of service SystemStackError via a large XML document depth. For Debian 7 'Wheezy', these problems have been fixed in version 3.2.6-6+deb7u2. Additionally this upload adds...

Debian DLA-605-1 : eog security update

It was discovered that Eye of GNOME incorrectly handled certain invalid UTF-8 strings. If a user were tricked into opening a specially crafted image, a remote attacker could use this issue to cause Eye of GNOME to crash, resulting in a denial of service, or possibly execute arbitrary code. For...

[SECURITY] [DLA 605-1] eog security update

Package : eog Version : 3.4.2-1+build1+deb7u1 CVE ID : CVE-2016-6855 It was discovered that Eye of GNOME incorrectly handled certain invalid UTF-8 strings. If a user were tricked into opening a specially-crafted image, a remote attacker could use this issue to cause Eye of GNOME to crash, resulti...

[SECURITY] [DLA 604-1] ruby-actionpack-3.2 security update

Package : ruby-actionpack-3.2 Version : 3.2.6-6+deb7u3 CVE ID : CVE-2015-7576 CVE-2016-0751 CVE-2016-0752 CVE-2016-2097 CVE-2016-2098 CVE-2016-6316 Multiple vulnerabilities have been discovered in ruby-actionpack-3.2, a web-flow and rendering framework and part of Rails: CVE-2015-7576 A flaw was...

[SECURITY] [DLA 603-1] ruby-activesupport-3.2 security update

Package : ruby-activesupport-3.2 Version : 3.2.6-6+deb7u2 CVE ID : CVE-2015-3227 The support and utility classes used by the Rails 3.2 framework allow remote attackers to cause a denial of service SystemStackError via a large XML document depth. For Debian 7 "Wheezy", these problems have been fix...