[SECURITY] [DLA 1065-1] fontforge security update

Package : fontforge Version : 0.0.20120101+git-2+deb7u1 CVE ID : CVE-2017-11568 CVE-2017-11569 CVE-2017-11571 CVE-2017-11572 CVE-2017-11574 CVE-2017-11575 CVE-2017-11576 CVE-2017-11577 FontForge is vulnerable to heap-based buffer over-read in several functions, resulting in DoS or code execution...

[SECURITY] [DLA 1063-1] extplorer security update

Package : extplorer Version : 2.1.0b6+dfsg.3-4+deb7u5 CVE ID : CVE-2017-12756 CVE-2017-12756 Fix command inject in transfer from another server in extplorer 2.1.9 and prior allows attacker to inject command via the userfile0 parameter. For Debian 7 "Wheezy", these problems have been fixed in...

Debian DLA-1061-1 : newsbeuter security update

Jeriko One discovered that newsbeuter, a text-mode RSS feed reader, did not properly escape the title and description of a news article when bookmarking it. This allowed a remote attacker to run an arbitrary shell command on the client machine. For Debian 7 'Wheezy', these problems have been fixe...

Debian DLA-1062-1 : curl security update

CVE-2017-1000100 Wrong handling of very long filenames during TFTP might result in curl sending more than buffer size. For Debian 7 'Wheezy', this problem has been fixed in version 7.26.0-1+wheezy20. We recommend that you upgrade your curl packages. NOTE: Tenable Network Security has extracted th...

Debian DLA-1059-1 : strongswan security update

It was discovered that there was a denial of service vulnerability in the Strongswan Virtual Private Network VPN software. Specific RSA signatures passed to the gmp plugin for verification could cause a NULL pointer dereference. Potential triggers are signatures in certificates, but also signatur...

[SECURITY] [DLA 1062-1] curl security update

Package : curl Version : 7.26.0-1+wheezy20 CVE ID : CVE-2017-1000100 CVE-2017-1000100 Wrong handling of very long filenames during TFTP might result in curl sending more than buffer size. For Debian 7 "Wheezy", this problem has been fixed in version 7.26.0-1+wheezy20. We recommend that you upgrad...

[SECURITY] [DLA 1061-1] newsbeuter security update

Package : newsbeuter Version : 2.5-2+deb7u2 CVE ID : CVE-2017-12904 Jeriko One discovered that newsbeuter, a text-mode RSS feed reader, did not properly escape the title and description of a news article when bookmarking it. This allowed a remote attacker to run an arbitrary shell command on the...

[SECURITY] [DLA 1060-1] libxml2 security update

Package : libxml2 Version : 2.8.0+dfsg1-7+wheezy9 CVE ID : CVE-2017-0663 CVE-2017-7376 CVE-2017-0663 Invalid casting of different structs could enable an attacker to remotely execute some code within the context of an unprivileged process. CVE-2017-7376 Incorrect limit used for port values. For...

[SECURITY] [DLA 1059-1] strongswan security update

Package : strongswan Version : 4.5.2-1.5+deb7u10 CVE ID : CVE-2017-11185 Debian Bug : 872155 It was discovered that there was a denial-of-service vulnerability in the Strongswan Virtual Private Network VPN software. Specific RSA signatures passed to the gmp plugin for verification could cause a...

Debian DLA-1057-1 : libraw security update

Some memory corruption bugs were discovered in libraw, a raw image decoder library, which could be triggered via maliciously crafted input files to cause denial of service or other unspecified impact. For Debian 7 'Wheezy', these problems have been fixed in version 0.14.6-2+deb7u2. We recommend...

[SECURITY] [DLA 1058-1] krb5 security update

From: Lucas Kanashiro [email protected] To: [email protected] Subject: SECURITY DLA 1058-1 krb5 security update Package : krb5 Version : 1.10.1+dfsg-5+deb7u8 CVE ID : CVE-2017-11368 Debian Bug : 869260 In MIT Kerberos 5 aka krb5 1.7 and later, an authenticated attacker can...

[SECURITY] [DLA 1057-1] libraw security update

Package : libraw Version : 0.14.6-2+deb7u2 CVE ID : CVE-2017-6886 CVE-2017-6887 Debian Bug : 864183 Some memory corruption bugs were discovered in libraw, a raw image decoder library, which could be triggered via maliciously crafted input files to cause denial of service or other unspecified...

Debian DLA-1052-1 : subversion security update

It was discovered that there was a arbitrary code execution vulnerability in the subversion revision control system via malicious 'svn+ssh' URLs in 'svn:externals' and 'svn:sync-from-url'. For Debian 7 'Wheezy', this issue has been fixed in subversion version 1.6.17dfsg-4+deb7u12. We recommend th...

Debian DLA-1056-1 : cvs security update

It was discovered that there was a command injection vulnerability in the CVS revision control system. For Debian 7 'Wheezy', this issue has been fixed in cvs version 2:1.12.13+real-9+deb7u1. We recommend that you upgrade your cvs packages. Thanks to Thorsten Glaser for preparing and testing this...

[SECURITY] [DLA 1056-1] cvs security update

Package : cvs Version : 2:1.12.13+real-9+deb7u1 CVE ID : CVE-2017-12836 Debian Bug : 871810 It was discovered that there was a command injection vulnerability in the CVS revision control system. For Debian 7 "Wheezy", this issue has been fixed in cvs version 2:1.12.13+real-9+deb7u1. We recommend...

[SECURITY] [DLA 1055-1] libgd2 security update

Package : libgd2 Version : 2.0.36rc1dfsg-6.1+deb7u9 CVE ID : CVE-2017-7890 Matviy Kotoniy reported that the gdImageCreateFromGifCtx function used to load images from GIF format files in libgd2, a library for programmatic graphics creation and manipulation, does not zero stack allocated color map...

[SECURITY] [DLA 1054-1] libgxps security update

Package : libgxps Version : 0.2.2-2+deb7u1 CVE ID : CVE-2017-11590 Debian Bug : 870183 It was discovered that there was a NULL pointer dereference in libgxps, a library to handle XML Paper Specification specifications. Specially-crafted input could lead to a remote denial of service attack. For...

[SECURITY] [DLA 1053-1] firefox-esr security update

Package : firefox-esr Version : 52.3.0esr-1deb7u1 CVE ID : CVE-2017-7753 CVE-2017-7779 CVE-2017-7784 CVE-2017-7785 CVE-2017-7786 CVE-2017-7787 CVE-2017-7791 CVE-2017-7792 CVE-2017-7798 CVE-2017-7800 CVE-2017-7801 CVE-2017-7802 CVE-2017-7803 CVE-2017-7807 CVE-2017-7809 Several security issues have...

[SECURITY] [DLA 1052-1] subversion security update

Package : subversion Version : 1.6.17dfsg-4+deb7u12 CVE ID : CVE-2017-9800 It was discovered that there was a arbitrary code execution vulnerability in the subversion revision control system via malicious "svn+ssh" URLs in "svn:externals" and "svn:sync-from-url". For Debian 7 "Wheezy", this issue...

[SECURITY] [DLA 1051-1] postgresql-9.1 security update

Package : postgresql-9.1 Version : 9.1.24-0+deb7u1 CVE ID : CVE-2017-7486 CVE-2017-7546 CVE-2017-7547 Debian Bug : Several vulnerabilities have been found in the PostgreSQL database system: CVE-2017-7486 Andrew Wheelwright discovered that user mappings were insufficiently restricted. CVE-2017-754...