[SECURITY] [DLA 1219-1] enigmail security update

Package : enigmail Version : 2:1.9.9-1deb7u1 CVE ID : CVE-2017-17843 CVE-2017-17844 CVE-2017-17845 CVE-2017-17846 CVE-2017-17847 CVE-2017-17848 Multiple vulnerabilities were discovered in Enigmail, an OpenPGP extension for Thunderbird, which could result in a loss of confidentiality, faked...

[SECURITY] [DLA 1218-1] rsync security update

Package : rsync Version : 3.0.9-4+deb7u1 CVE ID : CVE-2017-16548 CVE-2017-17433 CVE-2017-17434 Several vulnerabilities were discovered in rsync, a fast, versatile, remote and local file-copying tool, allowing a remote attacker to bypass intended access restrictions or cause a denial of service. F...

Debian DLA-1214-1 : libreoffice security update

Marcin Noga discovered two vulnerabilities in LibreOffice, which could result in the execution of arbitrary code if a malformed PPT or DOC document is opened. For Debian 7 'Wheezy', these problems have been fixed in version 1:3.5.4+dfsg2-0+deb7u10. We recommend that you upgrade your libreoffice...

Debian DLA-1215-1 : otrs2 security update

Francesco Sirocco discovered a flaw in otrs2, the Open Ticket Request System, which could result in session information disclosure when cookie support is disabled. A remote attacker can take advantage of this flaw to take over an agent's session if the agent is tricked into clicking a link in a...

[SECURITY] [DLA 1215-1] otrs2 security update

Package : otrs2 Version : 3.3.18-1deb7u3 CVE ID : CVE-2017-17476 Debian Bug : 884801 Francesco Sirocco discovered a flaw in otrs2, the Open Ticket Request System, which could result in session information disclosure when cookie support is disabled. A remote attacker can take advantage of this fla...

[SECURITY] [DLA 1214-1] libreoffice security update

Package : libreoffice Version : 1:3.5.4+dfsg2-0+deb7u10 CVE ID : CVE-2017-12607 CVE-2017-12608 Marcin Noga discovered two vulnerabilities in LibreOffice, which could result in the execution of arbitrary code if a malformed PPT or DOC document is opened. For Debian 7 "Wheezy", these problems have...

[SECURITY] [DLA 1213-1] openafs security update

Package : openafs Version : 1.6.1-3+deb7u8 CVE ID : CVE-2017-17432 CVE-2017-17432 It was discovered that malformed jumbogram packets could result in denial of service against OpenAFS, an implementation of the Andrew distributed file system. For Debian 7 "Wheezy", these problems have been fixed in...

Debian DLA-1212-1 : otrs2 security update

Four vulnerabilities were discovered in the Open Ticket Request System which could result in information disclosure or the execution of arbitrary shell commands by logged-in agents. For Debian 7 'Wheezy', these problems have been fixed in version 3.3.18-1deb7u2. We recommend that you upgrade your...

[SECURITY] [DLA 1212-1] otrs2 security update

Package : otrs2 Version : 3.3.18-1deb7u2 CVE ID : CVE-2017-15864 CVE-2017-16664 CVE-2017-16854 CVE-2017-16921 Four vulnerabilities were discovered in the Open Ticket Request System which could result in information disclosure or the execution of arbitrary shell commands by logged-in agents. For...

Debian DLA-1211-1 : libxml2 security update

CVE-2017-15412 It was detected that some function calls in the XPath extensions functions could result in memory corruption due to 'use after free'. For Debian 7 'Wheezy', these problems have been fixed in version 2.8.0+dfsg1-7+wheezy12. We recommend that you upgrade your libxml2 packages. NOTE:...

Debian DLA-1207-1 : erlang security update (ROBOT)

An erlang TLS server configured with cipher suites using RSA key exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack against RSA, which when exploited, may result in plaintext recovery of encrypted messages and/or a Man-in-the-middle MiTM attack, despite...

Debian DLA-1208-1 : reportbug update

Reportbug, a tool designed to make the reporting of bugs in Debian easier, was further enhanced to automatically detect bug reports for potential regressions caused by a security update. After user confirmation an additional email with a copy of the report will be sent to the debian-lts mailing...

Debian DLA-1209-1 : sensible-utils security update

It was discovered that there was a vulnerability in sensible-browser, a utility to start the most suitable web browser based on your environment or configuration. Remote attackers could conduct argument-injection attacks via specially- crafted URIs. For Debian 7 'Wheezy', this issue has been fixe...

[SECURITY] [DLA 1210-1] kildclient security update

Package : kildclient Version : 2.11.1-1+deb7u1 CVE ID : CVE-2017-17511 It was discovered that there was a command-injection vulnerability in kildclient, a "MUD" multiplayer real-time virtual world game. For Debian 7 "Wheezy", this issue has been fixed in kildclient version 2.11.1-1+deb7u1. Thanks...

[SECURITY] [DLA 1203-2] xrdp regression update

Package : xrdp Version : 0.5.0-2+deb7u3 A regression was added by the patch introduced in version 0.5.0-2+deb7u2 to fix CVE-2017-16927: xrdp-sesman started to segfault in libscp. For Debian 7 "Wheezy", these problems have been fixed in version 0.5.0-2+deb7u3. We recommend that you upgrade your xr...

[SECURITY] [DLA 1206-1] tiff security update

Package : tiff Version : 4.0.2-6+deb7u17 CVE ID : CVE-2017-9935 Debian Bug : 866109 In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2pwritepdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an...

Debian DLA-1206-1 : tiff security update

In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2pwritepdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or t2pfree, memory...

[SECURITY] [DLA 1205-1] simplesamlphp security update

Package : simplesamlphp Version : 1.9.2-1+deb7u1 CVE ID : CVE-2017-12867 CVE-2017-12868 CVE-2017-12869 CVE-2017-12872 CVE-2017-12873 CVE-2017-12874 The simplesamlphp package in wheezy is vulnerable to multiple attacks on authentication-related code, leading to unauthorized access and information...

Debian DLA-1203-2 : xrdp regression update

A regression was added by the patch introduced in version 0.5.0-2+deb7u2 to fix CVE-2017-16927: xrdp-sesman started to segfault in libscp. For Debian 7 'Wheezy', these problems have been fixed in version 0.5.0-2+deb7u3. We recommend that you upgrade your xrdp packages. NOTE: Tenable Network...

[SECURITY] [DLA 1204-1] evince security update

Package : evince Version : 3.4.0-3.1+deb7u2 CVE ID : CVE-2017-1000159 It was discovered that there was an arbitrary command injection in the evince PDF viewer. A specially-crafted embedded DVI filename could be exploited to run commands as the current user when "printing" to PDF. For Debian 7...