[SECURITY] [DLA 1935-1] e2fsprogs security update

Package : e2fsprogs Version : 1.42.12-2+deb8u1 CVE ID : CVE-2019-5094 Lilith of Cisco Talos discovered a buffer overflow flaw in the quota code used by e2fsck from the ext2/ext3/ext4 file system utilities. Running e2fsck on a malformed file system can result in the execution of arbitrary code. Fo...

[SECURITY] [DLA 1934-1] cimg security update

Package : cimg Version : 1.5.9+dfsg-1+deb8u1 CVE ID : CVE-2018-7588 CVE-2018-7589 CVE-2018-7637 CVE-2018-7638 CVE-2018-7639 CVE-2018-7640 CVE-2018-7641 CVE-2019-1010174 Several issues have been found in cimg, a powerful image processing library. CVE-2019-1010174 is related to a missing string...

[SECURITY] [DLA 1933-1] ruby-nokogiri security update

Package : ruby-nokogiri Version : 1.6.3.1+ds-1+deb8u1 CVE ID : CVE-2019-5477 A command injection vulnerability in Nokogiri allows commands to be executed in a subprocess by Rubys Kernel.open method. For Debian 8 "Jessie", this problem has been fixed in version 1.6.3.1+ds-1+deb8u1. We recommend th...

Debian: Security Advisory (DLA-1932-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-1932-1 : openssl security update

Two security vulnerabilities were found in OpenSSL, the Secure Sockets Layer toolkit. CVE-2019-1547 Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit...

Debian DLA-1933-1 : ruby-nokogiri security update

A command injection vulnerability in Nokogiri allows commands to be executed in a subprocess by Ruby's Kernel.open method. For Debian 8 'Jessie', this problem has been fixed in version 1.6.3.1+ds-1+deb8u1. We recommend that you upgrade your ruby-nokogiri packages. NOTE: Tenable Network Security h...

[SECURITY] [DLA 1932-1] openssl security update

Package : openssl Version : 1.0.1t-1+deb8u12 CVE ID : CVE-2019-1547 CVE-2019-1563 Two security vulnerabilities were found in OpenSSL, the Secure Sockets Layer toolkit. CVE-2019-1547 Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths...

Debian DLA-1928-1 : php5 security update

An update has been made to php5, a server-side, HTML-embedded scripting language. Specficially, as reported in 805222, the ability to build extensions in certain older versions of PHP within Debian has been hindered by an upstream change which first appeared in PHP 5.6.15. This update applies a f...

Debian DLA-1931-2 : libgcrypt20 regression update

It was discovered that the fix to address an ECDSA timing attack in the libgcrypt20 cryptographic library was incomplete. For Debian 8 'Jessie', this issue has been fixed in libgcrypt20 version 1.6.3-2+deb8u8. Thanks to Albert Chin-A-Young for the report. We recommend that you upgrade your...

Debian: Security Advisory (DLA-1928-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-1931-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1928-1] php5 security update

Package : php5 Version : 5.6.40+dfsg-0+deb8u6 Debian Bug : 805222 An update has been made to php5, a server-side, HTML-embedded scripting language. Specficially, as reported in 805222, the ability to build extensions in certain older versions of PHP within Debian has been hindered by an upstream...

Debian DLA-1929-1 : php-pecl-http security update

A vulnerability has been discovered in php-pecl-http, the peclhttp module for PHP 5 Extended HTTP Support. A type confusion vulnerability in the mergeparam function allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests. For Debian 8 'Jessie', this problem has...

Debian DLA-1927-1 : qemu security update

Several vulnerabilities were found in QEMU, a fast processor emulator notably used in KVM and Xen HVM virtualization. CVE-2016-5126 Heap-based buffer overflow in the iscsiaioioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service QEMU process crash or...

Debian: Security Advisory (DLA-1927-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1929-1] php-pecl-http security update

Package : php-pecl-http Version : 2.0.4-1+deb8u1 CVE ID : CVE-2016-7398 A vulnerability has been discovered in php-pecl-http, the peclhttp module for PHP 5 Extended HTTP Support. A type confusion vulnerability in the mergeparam function allows attackers to crash PHP and possibly execute arbitrary...

Debian DLA-1926-1 : thunderbird security update

Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code, cross-site scripting, information disclosure and a covert content attack on S/MIME encryption using a crafted multipart/alternative message. For Debian 8 'Jessie', these...

Debian DLA-1923-1 : ansible security update

Several vulnerabilities were discovered in Ansible, a configuration management, deployment, and task execution system. CVE-2015-3908 A potential man-in-the-middle attack associated with insusfficient X.509 certificate verification. Ansible did not verify that the server hostname matches a domain...

Debian DLA-1924-1 : python3.4 security update

A vulnerability was discovered in Python, an interactive high-level object-oriented language. CVE-2019-16056 The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a...

Debian DLA-1922-1 : wpa security update

hostapd and wpasupplicant when controlling AP mode did not perform sufficient source address validation for some received Management frames and this could result in ending up sending a frame that caused associated stations to incorrectly believe they were disconnected from the network even if...