[SECURITY] [DLA 1094-1] tiff3 security update

Package : tiff3 Version : 3.9.6-11+deb7u8 CVE ID : CVE-2017-11335 Debian Bug : 868513 A heap based buffer overflow has been discovered in the tiff2pdf utility, part of the Tag Image File Format TIFF library. A PlanarConfig=Contig image can cause an out-of-bounds write related to the ZIPDecode...

[SECURITY] [DLA 1093-1] tiff security update

Package : tiff Version : 4.0.2-6+deb7u16 CVE ID : CVE-2017-11335 CVE-2017-12944 CVE-2017-13726 CVE-2017-13727 Debian Bug : 868513 872607 873880 873879 Several vulnerabilities have been discovered in the Tag Image File Format TIFF library and its associated tools. CVE-2017-11335 A heap based buffe...

[SECURITY] [DLA 1092-1] libarchive security update

Package : libarchive Version : 3.0.4-3+wheezy6+deb7u1 CVE ID : CVE-2017-14166 Debian Bug : 874539 It was discovered that there was a denial of service vulnerability in the libarchive multi-format compression library. A specially-crafted .xar archive could cause via a heap-based buffer over-read...

Debian DLA-1091-1 : unrar-free security update

It was discovered that there was a directory traversal vulnerability in unrar-free, a unarchiver for .rar files, where pathnames of the form '../filename' were unpacked into the parent directory. For Debian 7 'Wheezy', this issue has been fixed in unrar-free version 1:0.0.1+cvs20071127-2+deb7u1. ...

[SECURITY] [DLA 1087-2] icedove/thunderbird regression update

Package : icedove Version : 1:52.3.0-4deb7u2 The update for icedove/thunderbird issued as DLA-1087-1 did not build on i386. This update corrects this. For reference, the original advisory text follows. Multiple security issues have been found in the Mozilla Thunderbird mail client: Multiple memor...

[SECURITY] [DLA 1091-1] unrar-free security update

Package : unrar-free Version : 1:0.0.1+cvs20071127-2+deb7u1 CVE ID : CVE-2017-14120 Debian Bug : 874059 It was discovered that there was a directory traversal vulnerability in unrar-free, a unarchiver for .rar files, where pathnames of the form "../filename" were unpacked into the parent director...

Debian DLA-1090-1 : tcpdump security update

Several vulnerabilities have been discovered in tcpdump, a command-line network traffic analyzer. These vulnerabilities might result in denial of service application crash. For Debian 7 'Wheezy', these problems have been fixed in version 4.9.0-1deb7u2. We recommend that you upgrade your tcpdump...

[SECURITY] [DLA 1090-1] tcpdump security update

Package : tcpdump Version : 4.9.0-1deb7u2 CVE ID : CVE-2017-11108 CVE-2017-11541 CVE-2017-11542 CVE-2017-11543 Several vulnerabilities have been discovered in tcpdump, a command-line network traffic analyzer. These vulnerabilities might result in denial of service application crash. For Debian 7...

Debian DLA-1087-2 : icedove/thunderbird regression update

The update for icedove/thunderbird issued as DLA-1087-1 did not build on i386. This update corrects this. For reference, the original advisory text follows. Multiple security issues have been found in the Mozilla Thunderbird mail client: Multiple memory safety errors, buffer overflows and other...

[SECURITY] [DLA 1087-1] icedove/thunderbird security update

Package : icedove Version : 1:52.3.0-4deb7u1 CVE ID : CVE-2017-7753 CVE-2017-7779 CVE-2017-7784 CVE-2017-7785 CVE-2017-7786 CVE-2017-7787 CVE-2017-7791 CVE-2017-7792 CVE-2017-7800 CVE-2017-7801 CVE-2017-7802 CVE-2017-7803 CVE-2017-7804 CVE-2017-7807 CVE-2017-7809 Multiple security issues have bee...

Debian DLA-1088-1 : irssi security update

Irssi has some issues where remote attackers might be able to cause a crash. CVE-2017-9468 In irssi, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. CVE-2017-9469 In irssi, when receiving certain incorrectly quoted DCC files, it tries to find the...

Debian DLA-1085-1 : libidn2-0 security update

It was discovered that there was an integer overflow vulnerability in libidn2-0's Punycode handling an encoding used to convert Unicode characters to ASCII which would have allowed attackers to cause a remote denial of service. For Debian 7 'Wheezy', this issue has been fixed in libidn2-0 version...

[SECURITY] [DLA 1088-1] irssi security update

Package : irssi Version : 0.8.15-5+deb7u2 CVE ID : CVE-2017-9468 CVE-2017-9469 Debian Bug : 864400 Irssi has some issues where remote attackers might be able to cause a crash. CVE-2017-9468 In irssi, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer...

[SECURITY] [DLA 1086-1] enigmail security update

Package : enigmail Version : 2:1.9.8.1-1deb7u1 In DLA 1007-1 Thunderbird was upgraded to the latest ESR series. This update upgrades Enigmail, the OpenPGP extention for Thunderbird, to version 1.9.8.1 to restore full compatibility. For Debian 7 "Wheezy", these problems have been fixed in version...

[SECURITY] [DLA 1085-1] libidn2-0 security update

Package : libidn2-0 Version : 0.8-2+deb7u1 CVE ID : CVE-2017-14062 Debian Bug : 873902 It was discovered that there was an integer overflow vulnerability in libidn2-0s Punycode handling an encoding used to convert Unicode characters to ASCII which would have allowed attackers to cause a remote...

[SECURITY] [DLA 1084-1] libidn security update

Package : libidn Version : 1.25-2+deb7u3 CVE ID : CVE-2017-14062 Debian Bug : 873903 It was discovered that there was an integer overflow vulnerability in libidns Punycode handling an encoding used to convert Unicode characters to ASCII which would have allowed remote attackers to cause a denial ...

Debian DLA-1083-1 : openexr security update

Brandon Perry discovered that openexr, a high dynamic-range HDR image library, was affected by an integer overflow vulnerability and missing boundary checks that would allow a remote attacker to cause a denial of service application crash via specially crafted image files. For Debian 7 'Wheezy',...

Debian DLA-1082-1 : graphicsmagick security update

CVE-2017-13776 CVE-2017-13777 denial of service issue in ReadXBMImage CVE-2017-12935 The ReadMNGImage function in coders/png.c mishandles large MNG images, leading to an invalid memory read in the SetImageColorCallBack function in magick/image.c. CVE-2017-12936 The ReadWMFImage function in...

Debian DLA-1072-1 : mercurial security update

Two significant vulnerabilities were found in the Mercurial version control system which could lead to shell injection attacks and out-of-tree file overwrite. CVE-2017-1000115 Mercurial's symlink auditing was incomplete prior to 4.3, and could be abused to write to files outside the repository...

Debian DLA-1081-1 : imagemagick security update

This updates fixes numerous vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed DPX, RLE, CIN, DIB, EPT, MAT, VST, PNG, JNG, MNG, DVJ...