Debian DLA-2044-1 : cyrus-sasl2 security update

There has been an out-of-bounds write in Cyrus SASL leading to unauthenticated remote denial of service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash was ultimately caused by an off-by-one error in sasladdstring in common.c in cyrus-sasl. For Debian 8 'Jessie', this problem has been...

[SECURITY] [DLA 2047-1] cups security update

Package : cups Version : 1.7.5-11+deb8u7 CVE ID : CVE-2019-2228 An issue has been found in cups, the Common UNIX Printing Systemtm. An incorrect bounds check could lead to a possible out-of-bounds read and local information disclosure in the printer spooler. For Debian 8 "Jessie", this problem ha...

[SECURITY] [DLA 2038-2] x2goclient regression update

Package : x2goclient Version : 4.0.3.1-4+deb8u1 Debian Bug : 947129 A change introduced in libssh 0.6.3-4+deb8u4 which got released as DLA 2038-1 has broken x2goclients way of scping session setup files from client to server, resulting in an error message shown in a GUI error dialog box during...

[SECURITY] [DLA 2045-1] tightvnc security update

Package : tightvnc Version : 1.3.9-6.5+deb8u1 CVE ID : CVE-2014-6053 CVE-2018-7225 CVE-2019-8287 CVE-2018-20021 CVE-2018-20022 CVE-2019-15678 CVE-2019-15679 CVE-2019-15680 CVE-2019-15681 Debian Bug : 945364 Several vulnerabilities have recently been discovered in TightVNC 1.x, an X11 based VNC...

Debian: Security Advisory (DLA-2044-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2044-1] cyrus-sasl2 security update

Package : cyrus-sasl2 Version : 2.1.26.dfsg1-13+deb8u2 CVE ID : CVE-2019-19906 Debian Bug : 947043 There has been an out-of-bounds write in Cyrus SASL leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash was ultimately caused by an...

[SECURITY] [DLA 2043-2] gdk-pixbuf regression update

Package : gdk-pixbuf Version : 2.31.1-2+deb8u9 While preparing a fix for CVE-2017-6314 an unknown symbol guintcheckedmul was introduced. For Debian 8 "Jessie", this problem has been fixed in version 2.31.1-2+deb8u9. We recommend that you upgrade your gdk-pixbuf packages. Further information about...

Debian: Security Advisory (DLA-2043-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2041-1 : debian-edu-config security update

It was discovered that debian-edu-config, the package containing the configuration files and scripts for Debian Edu Skolelinux, contained an insecure configuration for kadmin, the Kerberos administration server. The insecure configuration allowed every user to change other users' passwords, thus...

[SECURITY] [DLA 2042-1] python-django security update

Package : python-django Version : 1.7.11-1+deb8u8 CVE ID : CVE-2019-19844 Debian Bug : 946937 It was discovered that there was a potential account hijack vulnerabilility in Django, the Python-based web development framework. Djangos password-reset form used a case-insensitive query to retrieve...

[SECURITY] [DLA 2041-1] debian-edu-config security update

Package : debian-edu-config Version : 1.818+deb8u3 CVE ID : CVE-2019-3467 Debian Bug : 946797 It was discovered that debian-edu-config, the package containing the configuration files and scripts for Debian Edu Skolelinux, contained an insecure configuration for kadmin, the Kerberos administration...

Debian DLA-2038-2 : x2goclient regression update

A change introduced in libssh 0.6.3-4+deb8u4 which got released as DLA 2038-1 has broken x2goclient's way of scp'ing session setup files from client to server, resulting in an error message shown in a GUI error dialog box during session startup and session resuming. For Debian 8 'Jessie', this...

Debian: Security Advisory (DLA-2039-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2040-1] harfbuzz security update

Package : harfbuzz Version : 0.9.35-2+deb8u1 CVE ID : CVE-2015-8947 An issue has been found in harfbuzz, an OpenType text shaping engine. Due to a buffer over-read, remote attackers are able to cause a denial of service or possibly have other impact via crafted data. For Debian 8 "Jessie", this...

[SECURITY] [DLA 2038-1] libssh security update

Package : libssh Version : 0.6.3-4+deb8u4 CVE ID : CVE-2019-14889 Debian Bug : 946548 It was found that libssh, a tiny C SSH library, does not sufficiently sanitize path parameters provided to the server, allowing an attacker with only SCP file access to execute arbitrary commands on the server...

Debian DLA-2036-1 : thunderbird security update

Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code. For Debian 8 'Jessie', these problems have been fixed in version 1:68.3.0-2deb8u1. We recommend that you upgrade your thunderbird packages. NOTE: Tenable Network Security has...

[SECURITY] [DLA 2037-1] spamassassin security update

Package : spamassassin Version : 3.4.2-0+deb8u2 CVE ID : CVE-2018-11805 CVE-2019-12420 Debian Bug : 946652 946653 Two vulnerabilities were discovered in spamassassin, a Perl-based spam filter using text analysis. CVE-2018-11805 Malicious rule or configuration files, possibly downloaded from an...

[SECURITY] [DLA 2036-1] thunderbird security update

Package : thunderbird Version : 1:68.3.0-2deb8u1 CVE ID : CVE-2019-17005 CVE-2019-17008 CVE-2019-17010 CVE-2019-17011 CVE-2019-17012 Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code. For Debian 8 "Jessie", these problems hav...

Debian DLA-2034-1 : davical security update

Multiple cross-site scripting and cross-site request forgery issues were discovered in the DAViCal CalDAV Server. For Debian 8 'Jessie', these problems have been fixed in version 1.1.3.1-1+deb8u1. We recommend that you upgrade your davical packages. NOTE: Tenable Network Security has extracted th...

Debian DLA-2033-1 : php-horde security update

A vulnerability has been found in php-horde, the Horde Application Framework, which may result in information disclosure via cross-site scripting. For Debian 8 'Jessie', this problem has been fixed in version 5.2.1+debian0-2+deb8u5. We recommend that you upgrade your php-horde packages. NOTE:...