DLA-482-1 libgd2 - security update

Bulletin has no description...

[SECURITY] [DLA 472-2] icedove regression update

Package : icedove Version : 31.8.0-1deb7u1.1 CVE ID : CVE-2016-1979 CVE-2016-2805 CVE-2016-2807 Debian Bug : 823430 The security update for icedove did not build on armhf. This is resolved by this upload. The text of the original DLA follows: Multiple security issues have been found in Icedove,...

[SECURITY] [DLA 480-1] nss security update

Package : nss Version : 3.14.5-1+deb7u6 CVE ID : CVE-2015-7181 CVE-2015-7182 CVE-2016-1938 CVE-2016-1950 CVE-2016-1978 CVE-2016-1979 This security update fixes serious security issues in NSS including arbitrary code execution and remote denial service attacks. For Debian 7 "wheezy", these problem...

DLA-480-1 nss - security update

Bulletin has no description...

Debian DLA-476-1 : libidn security update

It was discovered that libidn, the GNU library for Internationalized Domain Names IDNs, did not correctly handle invalid UTF-8 input, causing an out-of-bounds read. This could allow attackers to disclose sensitive information from an application using the libidn library. For Debian 7 'Wheezy',...

[SECURITY] [DLA 479-1] xen security update

Package : xen Version : 4.1.6.1-1+deb7u1 CVE ID : CVE-2015-2752 CVE-2015-2756 CVE-2015-5165 CVE-2015-5307 CVE-2015-7969 CVE-2015-7970 CVE-2015-7971 CVE-2015-7972 CVE-2015-8104 CVE-2015-8339 CVE-2015-8340 CVE-2015-8550 CVE-2015-8554 CVE-2015-8555 CVE-2015-8615 CVE-2016-1570 CVE-2016-1571...

[SECURITY] [DLA 477-1] librsvg security update

Package : librsvg Version : 2.36.1-2+deb7u2 CVE ID : CVE-2015-7558 CVE-2016-4347 CVE-2016-4348 Note CVE-2016-4347 is a duplicate of CVE-2015-7558 Two DoS in librsvg 2.40.2 parsing SVGs with circular definitions were found they will produce stack exhaustion by Gustavo Grieco. The version in wheezy...

[SECURITY] [DLA 476-1] libidn security update

Package : libidn Version : 1.25-2+deb7u1 CVE ID : CVE-2015-2059 It was discovered that libidn, the GNU library for Internationalized Domain Names IDNs, did not correctly handle invalid UTF-8 input, causing an out-of-bounds read. This could allow attackers to disclose sensitive information from an...

[SECURITY] [DLA 478-1] squid3 security update

Package : squid3 Version : 3.1.20-2.2+deb7u5 CVE ID : CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054 CVE-2016-4554 CVE-2016-4555 CVE-2016-4556 Debian Bug : 823968 Several security issues have been discovered in the Squid caching proxy. CVE-2016-4051 CESG and Yuriy M. Kaminskiy discovered...

Debian DLA-474-1 : dosfstools security update

It was discovered that there was an invalid memory and heap overflow vulnerability in dosfstools, a collection of utilities for making and checking MS-DOS FAT filesystems. For Debian 7 'Wheezy', this issue has been fixed in dosfstools version 3.0.13-1+deb7u1. We recommend that you upgrade your...

DLA-477-1 librsvg - security update

Bulletin has no description...

Debian DLA-473-1 : wpa security update

A vulnerability was found in how hostapd and wpasupplicant writes the configuration file update for the WPA/WPA2 passphrase parameter. If this parameter has been updated to include control characters either through a WPS operation CVE-2016-4476 or through local configuration change over the...

Debian DLA-471-1 : jansson security update

Applications that depend on Jansson, a C library for encoding, decoding and manipulating JSON data, could crash due to stack exhaustion while parsing a JSON file. This was caused due to an unlimited parsing depth when parsing JSON arrays and is now fixed by limiting the depth to 2048. For Debian ...

DLA-476-1 libidn - security update

Bulletin has no description...

Debian DLA-475-1 : python-tornado security update

It was discovered that python-tornado, a Python web framework and asynchronous networking library, was susceptible for the BREACH attack. The XSRF token is now encoded with a random mask on each request. This makes it safe to include in compressed pages without being vulnerable. For Debian 7...

[SECURITY] [DLA 475-1] python-tornado security update

Package : python-tornado Version : 2.3-2+deb7u1 CVE ID : CVE-2014-9720 It was discovered that python-tornado, a Python web framework and asynchronous networking library, was susceptible for the BREACH attack. The XSRF token is now encoded with a random mask on each request. This makes it safe to...

DLA-475-1 python-tornado - security update

Bulletin has no description...

[SECURITY] [DLA 472-1] icedove security update

Package : icedove Version : 38.8.0-1deb7u1 CVE ID : CVE-2016-1979 CVE-2016-2805 CVE-2016-2807 Multiple security issues have been found in Icedove, Debians version of the Mozilla Thunderbird mail client. Multiple memory safety errors may lead to the execution of arbitrary code or denial of service...

[SECURITY] [DLA 471-1] jansson security update

Package : jansson Version : 2.3.1-2+deb7u1 CVE ID : CVE-2016-4425 Debian Bug : 823238 Applications that depend on Jansson, a C library for encoding, decoding and manipulating JSON data, could crash due to stack exhaustion while parsing a JSON file. This was caused due to an unlimited parsing dept...

[SECURITY] [DLA 470-1] libksba security update

Package : libksba Version : 1.2.0-2+deb7u2 CVE ID : CVE-2016-4579 It was discovered that there was a possible read access beyond a buffer vulnerability in libksba, a X.509 and CMS certificate support library. The returned length of the object from ksbaberparsetl ti.length was not always checked...