[SECURITY] [DLA 1203-1] xrdp security update

Package : xrdp Version : 0.5.0-2+deb7u2 CVE ID : CVE-2017-16927 The scpv0saccept function in sesman/libscp/libscpv0.c in the session manager in xrdp uses an untrusted integer as a write length, which allows local users to cause a denial of service buffer overflow and application crash or possibly...

Debian DLA-1199-1 : thunderbird security update

Multiple security issues have been found in the Mozilla Thunderbird mail client: Multiple memory safety errors, use after free and other implementation errors may lead to crashes or the execution of arbitrary code. For Debian 7 'Wheezy', these problems have been fixed in version 1:52.5.0-1deb7u1...

Debian DLA-1201-1 : libxcursor security update

It was discovered that libXcursor, a X cursor management library, is prone to several heap overflows when parsing malicious files. An attacker can take advantage of these flaws for arbitrary code execution, if a user is tricked into processing a specially crafted cursor file. For Debian 7 'Wheezy...

[SECURITY] [DLA 1202-1] firefox-esr security update

Package : firefox-esr Version : 52.5.2esr-1deb7u1 CVE ID : CVE-2017-7843 It was discovered that the private browsing mode in Firefox was able to write persistent data to a database, which could lead to websites tracking users even when browsing in this mode. For Debian 7 "Wheezy", these problems...

Debian DLA-1195-1 : curl security update

CVE-2017-8817 Fuzzing by the OSS-Fuzz project led to the discovery of a read out of bounds flaw in the FTP wildcard function in libcurl. A malicious server could redirect a libcurl-based client to an URL using a wildcard pattern, triggering the out-of-bound read. For Debian 7 'Wheezy', these...

Debian DLA-1194-1 : libxml2 security update

CVE-2017-16931 parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name. CVE-2017-16932 parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in paramet...

Debian DLA-1197-1 : sox security update

Various security vulnerabilities were discovered in sox, a command line utility to convert audio formats, that may lead to a denial of service application crash / infinite loop or memory corruptions by processing a malformed input file. For Debian 7 'Wheezy', these problems have been fixed in...

Debian DLA-1196-1 : optipng security update

optipng, an advanced PNG Portable Network Graphics optimizer, has been found vulnerable to a buffer overflow which allows remote attackers to cause a denial of service attack or other unspecified impact with a maliciously crafted GIF format file, related to an uncontrolled loop in the LZWReadByte...

[SECURITY] [DLA 1197-1] sox security update

Package : sox Version : 14.4.0-3+deb7u2 CVE ID : CVE-2017-11332 CVE-2017-11358 CVE-2017-11359 CVE-2017-15370 CVE-2017-15371 CVE-2017-15372 CVE-2017-15642 Debian Bug : 870328 878810 878809 878808 882236 882144 Various security vulnerabilities were discovered in sox, a command line utility to conve...

[SECURITY] [DLA 1196-1] optipng security update

Package : optipng Version : 0.6.4-1+deb7u4 CVE ID : CVE-2017-16938 Debian Bug : 878839 optipng, an advanced PNG Portable Network Graphics optimizer, has been found vulnerable to a buffer overflow which allows remote attackers to cause a denial-of-service attack or other unspecified impact with a...

[SECURITY] [DLA 1195-1] curl security update

Package : curl Version : 7.26.0-1+wheezy23 CVE ID : CVE-2017-8817 CVE-2017-8817 Fuzzing by the OSS-Fuzz project led to the discovery of a read out of bounds flaw in the FTP wildcard function in libcurl. A malicious server could redirect a libcurl-based client to an URL using a wildcard pattern,...

[SECURITY] [DLA 1194-1] libxml2 security update

Package : libxml2 Version : 2.8.0+dfsg1-7+wheezy11 CVE ID : CVE-2017-16931 CVE-2017-16932 CVE-2017-16931 parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a % character in a DTD name...

[SECURITY] [DLA 1193-1] roundcube security update

Package : roundcube Version : 0.7.2-9+deb7u9 CVE ID : CVE-2017-16651 A file disclosure vulnerability was discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers. CVE-2017-16651 An authenticated attacker can take advantage of this flaw to read roundcubes configuration fil...

Debian DLA-1191-1 : python-werkzeug security update

A security issue that allows XSS on the Werkzeug debugger allows remote attackers to inject arbitrary stuff via a field that contains an exception message. For Debian 7 'Wheezy', these problems have been fixed in version 0.8.3+dfsg-1+deb7u1. We recommend that you upgrade your python-werkzeug...

Debian DLA-1185-1 : sam2p security update

It was discovered that sam2p, a utility to convert raster images and other image formats, was affected by an integer overflow vulnerability with resultant heap-based buffer overflow in input-bmp.ci because width and height multiplications occur unsafely. This may lead to an application crash or...

Debian DLA-1186-1 : xorg-server security update

Several vulnerabilities have been discovered in the X.Org X server. An attacker who's able to connect to an X server could cause a denial of service or potentially the execution of arbitrary code. For Debian 7 'Wheezy', these problems have been fixed in version 2:1.12.4-6+deb7u8. We recommend tha...

Debian DLA-1190-1 : python2.6 security update

A minor security vulnerability has been discovered in Python 2.7, an interactive high-level object-oriented language. CVE-2017-1000158 CPython the reference implementation of Python also commonly known as simply Python versions 2.6 and 2.7 are vulnerable to an integer overflow and heap corruption...

Debian DLA-1187-1 : openjdk-7 security update

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in impersonation of Kerberos services, denial of service, unauthorized access, sandbox bypass or HTTP header injection. For Debian 7 'Wheezy', these problems have been fixed in versio...

Debian DLA-1189-1 : python2.7 security update

A minor security vulnerability has been discovered in Python 2.7, an interactive high-level object-oriented language. CVE-2017-1000158 CPython the reference implementation of Python also commonly known as simply Python versions 2.6 and 2.7 are vulnerable to an integer overflow and heap corruption...

[SECURITY] [DLA 1192-1] libofx security update

Package : libofx Version : 1:0.9.4-2.1+deb7u1 CVE ID : CVE-2017-2816 CVE-2017-14731 CVE-2017-2816 An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on t...