Debian DLA-1122-1 : asterisk security update

A security vulnerability was discovered in Asterisk, an Open Source PBX and telephony toolkit, that may lead to unauthorized command execution. The appminivm module has an 'externnotify' program configuration option that is executed by the MinivmNotify dialplan application. The application uses t...

Debian DLA-1121-1 : curl security update

It was discovered that there was a out-of-bounds read vulnerability in curl, a command-line and library for transferring data over HTTP/FTP, etc. A malicious FTP server could abuse this to prevent curl-based clients from interacting with it. See for more details. For Debian 7 'Wheezy', this issue...

[SECURITY] [DLA 1122-1] asterisk security update

Package : asterisk Version : 1:1.8.13.1dfsg1-3+deb7u7 CVE ID : CVE-2017-14100 Debian Bug : 873908 A security vulnerability was discovered in Asterisk, an Open Source PBX and telephony toolkit, that may lead to unauthorized command execution. The appminivm module has an "externnotify" program...

[SECURITY] [DLA 1121-1] curl security update

Package : curl Version : 7.26.0-1+wheezy21 CVE ID : CVE-2017-1000254 Debian Bug : 877671 It was discovered that there was a out-of-bounds read vulnerability in curl, a command-line and library for transferring data over HTTP/FTP, etc. A malicious FTP server could abuse this to prevent curl-based...

Debian DLA-1120-1 : git security update

joernchen discovered that the git-cvsserver subcommand of Git, a distributed version control system, suffers from a shell command injection vulnerability due to unsafe use of the Perl backtick operator. The git-cvsserver subcommand is reachable from the git-shell subcommand even if CVS support ha...

Debian DLA-1118-1 : firefox-esr security update

Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, buffer overflows and other implementation errors may lead to the execution of arbitrary code, denial of service, cross-site scripting or bypass of the phishing and malware...

[SECURITY] [DLA 1118-1] firefox-esr security update

Package : firefox-esr Version : 52.4.0esr-2deb7u1 CVE ID : CVE-2017-7793 CVE-2017-7805 CVE-2017-7810 CVE-2017-7814 CVE-2017-7818 CVE-2017-7819 CVE-2017-7823 CVE-2017-7824 Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees,...

[SECURITY] [DLA 1117-1] opencv security update

Package : opencv Version : 2.3.1-11+deb7u2 CVE ID : CVE-2016-1516 CVE-2017-12597 CVE-2017-12598 CVE-2017-12599 CVE-2017-12601 CVE-2017-12603 CVE-2017-12604 CVE-2017-12605 CVE-2017-12606 CVE-2017-12862 CVE-2017-12863 CVE-2017-12864 CVE-2017-14136 OpenCV through version 3.3 has out-of-bounds...

Debian DLA-1116-1 : poppler security update

It was discovered that poppler, a PDF rendering library, was affected by several denial of service application crash, NULL pointer dereferences and memory corruption bugs : CVE-2017-14517 NULL pointer Dereference in the XRef::parseEntry function in XRef.cc CVE-2017-14519 Memory corruption occurs ...

[SECURITY] [DLA 1116-1] poppler security update

Package : poppler Version : 0.18.4-6+deb7u3 CVE ID : CVE-2017-14517 CVE-2017-14519 CVE-2017-14617 Debian Bug : 876086 876385 876079 It was discovered that poppler, a PDF rendering library, was affected by several denial-of-service application crash, null pointer dereferences and memory corruption...

[SECURITY] [DLA 1115-1] debsecan update

Package : debsecan Version : 0.4.16+nmu1+deb7u1 Debian Bug : 842428 Debsecan in Wheezy in its default configuration currently fails to download recent vulnerability data due to an URL change. For Debian 7 "Wheezy", these problems have been fixed in version 0.4.16+nmu1+deb7u1. We recommend that yo...

[SECURITY] [DLA 1112-1] rubygems security update

Package : rubygems Version : 1.8.24-1+deb7u1 CVE ID : CVE-2017-0900 CVE-2017-0901 Debian Bug : 873802 Some vulnerabilities were found in the Rubygems package that affects the LTS distribution. CVE-2017-0900 DOS vulernerability in the query command CVE-2017-0901 gem installer allows a malicious ge...

Debian DLA-1113-1 : ruby1.8 security update

Some vulnerabilities were found in the Ruby 1.8 package that affects the LTS distribution. CVE-2017-0898 Buffer underrun vulnerability in Kernel.sprintf CVE-2017-10784 Escape sequence injection vulnerability in the Basic authentication of WEBrick For Debian 7 'Wheezy', these problems have been...

Debian DLA-1111-1 : weechat security update

It was discovered that WeeChat's logger plugin is vulnerable to an invalid buffer read which can be exploited remotely to trigger an application crash or other undefined behaviour. For Debian 7 'Wheezy', these problems have been fixed in version 0.3.8-1+deb7u3. We recommend that you upgrade your...

[SECURITY] [DLA 1113-1] ruby1.8 security update

Package : ruby1.8 Version : 1.8.7.358-7.1+deb7u4 CVE ID : CVE-2017-0898 CVE-2017-10784 Debian Bug : 875931 875936 Some vulnerabilities were found in the Ruby 1.8 package that affects the LTS distribution. CVE-2017-0898 Buffer underrun vulnerability in Kernel.sprintf CVE-2017-10784 Escape sequence...

[SECURITY] [DLA 1111-1] weechat security update

Package : weechat Version : 0.3.8-1+deb7u3 CVE ID : CVE-2017-14727 Debian Bug : 876553 It was discovered that WeeChats logger plugin is vulnerable to an invalid buffer read which can be exploited remotely to trigger an application crash or other undefined behaviour. For Debian 7 "Wheezy", these...

Debian DLA-1110-1 : samba security update

CVE-2017-12150 Stefan Metzmacher discovered multiple code paths where SMB signing was not enforced. CVE-2017-12163 Yihan Lian and Zhibin Hu discovered that insufficient range checks in the processing of SMB1 write requests could result in disclosure of server memory. For Debian 7 'Wheezy', these...

[SECURITY] [DLA 1110-1] samba security update

Package : samba Version : 2:3.6.6-6+deb7u14 CVE ID : CVE-2017-12150 CVE-2017-12163 CVE-2017-12150 Stefan Metzmacher discovered multiple code paths where SMB signing was not enforced. CVE-2017-12163 Yihan Lian and Zhibin Hu discovered that insufficient range checks in the processing of SMB1 write...

Debian DLA-1108-1 : tomcat7 security update

The Tomcat security team discovered that when using a VirtualDirContext it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request. For Debian 7 'Wheezy', these problems have been fixed in...

Debian DLA-1109-1 : libraw security update

CVE-2017-14608 An out of bounds read flaw related to kodak65000loadraw has been reported in dcraw/dcraw.c and internal/dcrawcommon.cpp. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash. For Debian 7 'Wheezy', these problems have...