Debian DLA-2140-1 : firefox-esr security update

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code. For Debian 8 'Jessie', these problems have been fixed in version 68.6.0esr-1deb8u1. We recommend that you upgrade your firefox-esr packages. NOTE: Tenabl...

Debian DLA-2139-1 : dojo security update

The following CVEs were reported against dojo : CVE-2020-5258 In affected versions of dojo, the deepCopy method is vulnerable to Prototype Pollution. An attacker could manipulate these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting...

[SECURITY] [DLA 2140-1] firefox-esr security update

Package : firefox-esr Version : 68.6.0esr-1deb8u1 CVE ID : CVE-2019-20503 CVE-2020-6805 CVE-2020-6806 CVE-2020-6807 CVE-2020-6811 CVE-2020-6812 CVE-2020-6814 Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary...

[SECURITY] [DLA 2139-1] dojo security update

Package : dojo Version : 1.10.2+dfsg-1+deb8u3 CVE ID : CVE-2020-5258 CVE-2020-5259 Debian Bug : 953585 953587 The following CVEs were reported against dojo: CVE-2020-5258 In affected versions of dojo, the deepCopy method is vulnerable to Prototype Pollution. An attacker could manipulate these...

[SECURITY] [DLA 2138-1] wpa security update

Package : wpa Version : 2.3-1+deb8u10 CVE ID : CVE-2019-10064 Similar to CVE-2016-10743 the host access point daemon, hostapd, in EAP mode used a low quality pseudorandom number generator that leads to insufficient entropy. The problem was resolved by using the osgetrandom function which provides...

Debian: Security Advisory (DLA-2136-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2136-1] libvpx security update

Package : libvpx Version : 1.3.0-3+deb8u3 CVE ID : CVE-2020-0034 It was discovered that there was an out-of-bounds buffer read vulnerability in libvpx, a library implementing the VP8 & VP9 video codecs. For Debian 8 "Jessie", this issue has been fixed in libvpx version 1.3.0-3+deb8u3. We recommen...

Debian DLA-2132-1 : libzypp security update

It was discovered that there was an issue where incorrect default permissions on a HTTP cookie store could have allowed local attackers to read private credentials. For Debian 8 'Jessie', this issue has been fixed in libzypp version 14.29.1-2+deb8u1. We recommend that you upgrade your libzypp...

Debian DLA-2134-1 : pdfresurrect security update

It was discovered that there was an out-of-bounds write vulnerability in pdfresurrect, a tool for extracting or scrubbing versioning data from PDF documents. For Debian 8 'Jessie', this issue has been fixed in pdfresurrect version 0.12-5+deb8u1. We recommend that you upgrade your pdfresurrect...

Debian DLA-2133-1 : tomcat7 security update

Several security vulnerabilities have been discovered in the Tomcat servlet and JSP engine. CVE-2019-17569 The refactoring in 7.0.98 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request...

Debian DLA-2135-1 : jackson-databind security update

The following CVEs were reported for jackson-databind source package. CVE-2020-9546 FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig aka shaded hikari-config...

Debian DLA-2117-1 : zsh security update

A privilege escalation vulnerability was discovered in zsh, a shell with lots of features, whereby a user could regain a formerly elevated privelege level even when such an action should not be permitted. For Debian 8 'Jessie', this problem has been fixed in version 5.0.7-5+deb8u1. We recommend...

Debian: Security Advisory (DLA-2135-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2135-1] jackson-databind security update

Package : jackson-databind Version : 2.4.2-2+deb8u12 CVE ID : CVE-2020-9546 CVE-2020-9547 CVE-2020-9548 The following CVEs were reported for jackson-databind source package. CVE-2020-9546 FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and...

[SECURITY] [DLA 2134-1] pdfresurrect security update

Package : pdfresurrect Version : 0.12-5+deb8u1 CVE ID : CVE-2020-9549 Debian Bug : 952948 It was discovered that there was an out-of-bounds write vulnerability in pdfresurrect, a tool for extracting or scrubbing versioning data from PDF documents. For Debian 8 "Jessie", this issue has been fixed ...

[SECURITY] [DLA 2132-1] libzypp security update

Package : libzypp Version : 14.29.1-2+deb8u1 CVE ID : CVE-2019-18900 It was discovered that there was an issue where incorrect default permissions on a HTTP cookie store could have allowed local attackers to read private credentials. For Debian 8 "Jessie", this issue has been fixed in libzypp...

[SECURITY] [DLA 2115-2] proftpd-dfsg regression update

Package : proftpd-dfsg Version : 1.3.5e+r1.3.5-2+deb8u7 CVE ID : CVE-2020-9273 It was discovered that there was a regression in a previous fix for a use-after-free vulnerability in the proftpd-dfsg FTP server. Exploitation of the original vulnerability within the memory pool handling could have...

Debian DLA-2130-1 : libapache2-mod-auth-openidc security

An issue has been found in libapache2-mod-auth-openidc, an OpenID Connect authentication module for Apache. Due to insufficient validatation of URLs an Open Redirect vulnerability for URLs beginning with a slash and backslash could be abused. For Debian 8 'Jessie', this problem has been fixed in...

Debian DLA-2131-2 : rrdtool regression update

It was discovered that there was a regression in a previous fix, which resulted in the following error : ERROR: cannot compile regular expression: Error while compiling regular expression ^?:^%+|%%%+- 0?0-9.0-9+?leEfF%s?:^%+|%%$ at char 18: range out of order in character class ^?:^%+|%%%+-...

Debian DLA-2124-1 : php5 security update

Two issues have been found in php5, a server-side, HTML-embedded scripting language. Both issues are related to crafted data that could lead to reading after an allocated buffer and result in information disclosure or crash. For Debian 8 'Jessie', these problems have been fixed in version...