Debian DLA-1309-1 : curl security update

Multiple vulnerabilities were found in cURL, an URL transfer library : CVE-2018-1000120 Duy Phan Thanh reported that curl could be fooled into writing a zero byte out of bounds when curl was told to work on an FTP URL, with the setting to only issue a single CWD command. The issue could be...

[SECURITY] [DLA 1309-1] curl security update

Package : curl Version : 7.26.0-1+wheezy25 CVE ID : CVE-2018-1000120 CVE-2018-1000121 CVE-2018-1000122 Multiple vulnerabilities were found in cURL, an URL transfer library: CVE-2018-1000120 Duy Phan Thanh reported that curl could be fooled into writing a zero byte out of bounds when curl was told...

[SECURITY] [DLA 1307-1] clamav security update

Package : clamav Version : 0.99.4+dfsg-1+deb7u1 CVE ID : CVE-2018-0202 CVE-2018-1000085 Some vulnerabilities have been found in ClamAV, an open source antivirus engine: CVE-2018-0202 It was found that ClamAV didnt process certain PDF files correctly, relating to a heap overflow. Specially crafted...

Debian DLA-1308-1 : firefox-esr security update

Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors and other implementation errors may lead to the execution of arbitrary code or denial of service. For Debian 7 'Wheezy', these problems have been fixed in version 52.7.1esr-1deb7u1. We...

[SECURITY] [DLA 1308-1] firefox-esr security update

Package : firefox-esr Version : 52.7.1esr-1deb7u1 CVE ID : CVE-2018-5125 CVE-2018-5127 CVE-2018-5129 CVE-2018-5130 CVE-2018-5131 CVE-2018-5144 CVE-2018-5145 Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors and other implementation errors ma...

Debian DLA-1305-1 : ming security update

Multiple vulnerabilities have been discovered in Ming : CVE-2018-5251 Integer signedness error vulnerability left shift of a negative value in the readSBits function util/read.c. Remote attackers can leverage this vulnerability to cause a denial of service via a crafted swf file. CVE-2018-5294...

Debian DLA-1306-1 : vips security update

It was discovered that there was NULL function pointer dereference vulnerability in vips, an image processing system for very large images. Remote attackers could cause a denial of service via a specially crafted image file which occurred due to a race condition involving a failed image load and...

[SECURITY] [DLA 1305-1] ming security update

Package : ming Version : 0.4.4-1.1+deb7u7 CVE ID : CVE-2018-5251 CVE-2018-5294 CVE-2018-6315 CVE-2018-6359 Multiple vulnerabilities have been discovered in Ming: CVE-2018-5251 Integer signedness error vulnerability left shift of a negative value in the readSBits function util/read.c. Remote...

[SECURITY] [DLA 1304-1] zsh security update

Package : zsh Version : 4.3.17-1+deb7u1 CVE IDs : CVE-2014-10070 CVE-2014-10071 CVE-2014-10072 CVE-2016-10714 CVE-2017-18206 It was discovered that there were multiple vulnerabilities in the "zsh" shell: CVE-2014-10070: Fix a privilege-elevation issue if the environment has not been properly...

Debian DLA-1303-1 : python-django security update

Several functions were extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in several regular expressions. CVE-2018-7536 The django.utils.html.urlize function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in t...

[SECURITY] [DLA 1302-1] leptonlib security update

Package : leptonlib Version : 1.69-3.1+deb7u2 CVE ID : CVE-2018-7186 CVE-2018-7440 Debian Bug : 890548 891932 Different flaws have been found in leptonlib, an image processing library. CVE-2018-7186 Leptonica did not limit the number of characters in a %s format argument to fscanf or sscanf, that...

[SECURITY] [DLA 1301-1] tomcat7 security update

Package : tomcat7 Version : 7.0.28-4+deb7u18 CVE ID : CVE-2018-1304 CVE-2018-1305 Two security vulnerabilities have been discovered in the Tomcat servlet and JSP engine. CVE-2018-1304 The URL pattern of "" the empty string which exactly maps to the context root was not correctly handled in Apache...

[SECURITY] [DLA 1300-1] xen security update

Package : xen Version : 4.1.6.lts1-13 CVE ID : CVE-2018-7540 CVE-2018-7541 Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, informations leaks or privilege escalation. For Debian 7 "Wheezy", these problems have been fixed in version...

Debian DLA-1300-1 : xen security update

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, informations leaks or privilege escalation. For Debian 7 'Wheezy', these problems have been fixed in version 4.1.6.lts1-13. We recommend that you upgrade your xen packages. NOTE: Tenable...

Debian DLA-1298-1 : simplesamlphp security update

Several vulnerabilities have been discovered in SimpleSAMLphp, a framework for authentication, primarily via the SAML protocol. CVE-2016-9814 & CVE-2016-9955 An incorrect check of return values in the signature validation utilities allowed an attacker to get invalid signatures accepted as valid i...

[SECURITY] [DLA 1299-1] libjgraphx-java security update

Package : libjgraphx-java Version : 1.4.1.0-3+deb7u1 CVE ID : CVE-2017-18197 Debian Bug : 891796 It was discovered that there was a potential XML External Entity XXE attack in libjgraphx-java, a diagramming library for Java applications. For Debian 7 "Wheezy", this issue has been fixed in...

[SECURITY] [DLA 1297-1] simplesamlphp security update

Package : simplesamlphp Version : 1.9.2-1+deb7u3 CVE ID : CVE-2016-9814 CVE-2016-9955 Several vulnerabilities have been discovered in SimpleSAMLphp, a framework for authentication, primarily via the SAML protocol. CVE-2016-9814 & CVE-2016-9955 An incorrect check of return values in the signature...

Debian DLA-1296-1 : xmltooling security update

Kelby Ludwig and Scott Cantor discovered that the Shibboleth service provider is vulnerable to impersonation attacks and information disclosure due to incorrect XML parsing. For additional details please refer to the upstream advisory at...

Debian DLA-1295-1 : drupal7 security update

Multiple vulnerabilities have been found in the Drupal content management framework. For additional information, please refer to the upstream advisory at https://www.drupal.org/sa-core-2018-001. For Debian 7 'Wheezy', these problems have been fixed in version 7.14-2+deb7u17. We recommend that you...

[SECURITY] [DLA 1296-1] xmltooling security update

Package : xmltooling Version : 1.4.2-5+deb7u3 CVE ID : CVE-2018-0489 Kelby Ludwig and Scott Cantor discovered that the Shibboleth service provider is vulnerable to impersonation attacks and information disclosure due to incorrect XML parsing. For additional details please refer to the upstream...