[SECURITY] [DLA 1759-1] clamav security update

Package : clamav Version : 0.100.3+dfsg-0+deb8u1 CVE ID : CVE-2019-1787 CVE-2019-1788 CVE-2019-1789 Debian Bug : Out-of-bounds read and write conditions have been fixed in clamav. CVE-2019-1787 An out-of-bounds heap read condition may occur when scanning PDF documents. The defect is a failure to...

Debian DLA-1758-1 : debian-security-support update

debian-security-support, the Debian security support coverage checker, has been updated in jessie. The jessie relevant changes are : - Mark spice-xpi as end-of-life for Jessie. - Add edk2 to security-support-ended.deb8 - Add robocode to security-support-ended.deb8 For Debian 8 'Jessie', this...

[SECURITY] [DLA 1758-1] debian-security-support update

Package : debian-security-support Version : 2019.02.02deb8u1 debian-security-support, the Debian security support coverage checker, has been updated in jessie. The jessie relevant changes are: Mark spice-xpi as end-of-life for Jessie. Add edk2 to security-support-ended.deb8 Add robocode to...

Debian DLA-1757-1 : cacti security update

It was discovered that there were a number of cross-site scripting vulnerabilities XSS in cacti, a web-based front-end for the RRDTool monitoring tool. For Debian 8 'Jessie', this issue has been fixed in cacti version 0.8.8b+dfsg-8+deb8u7. We recommend that you upgrade your cacti packages. NOTE:...

Debian: Security Advisory (DLA-1756-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1756-1] libxslt security update

Package : libxslt Version : 1.1.28-2+deb8u4 CVE ID : CVE-2019-11068 Debian Bug : 926895 It was discovered that there was a authentication bypass vulnerability in libxslt, a widely-used library for transforming files from XML to other arbitrary format. The xsltCheckRead and xsltCheckWrite routines...

Debian DLA-1755-1 : graphicsmagick security update

Several security vulnerabilities were discovered in Graphicsmagick, a collection of image processing tools. Heap-based buffer over-reads and a memory leak may lead to a denial of service or information disclosure. For Debian 8 'Jessie', these problems have been fixed in version 1.3.20-3+deb8u6. W...

Debian: Security Advisory (DLA-1755-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1755-1] graphicsmagick security update

Package : graphicsmagick Version : 1.3.20-3+deb8u6 CVE ID : CVE-2017-10799 CVE-2019-11006 CVE-2019-11007 CVE-2019-11008 CVE-2019-11009 CVE-2019-11010 Debian Bug : 927029 Several security vulnerabilities were discovered in Graphicsmagick, a collection of image processing tools. Heap-based buffer...

[SECURITY] [DLA 1628-2] jasper regression update

Package : jasper Version : 1.900.1-debian1-2.4+deb8u6 The update of jasper issued as DLA-1628-1 caused a regression due to the fix for CVE-2018-19542, a NULL pointer dereference in the function jp2decode, which could lead to a denial-of-service. In some cases not only invalid jp2 files but also...

[SECURITY] [DLA 1754-1] samba security update

Package : samba Version : 2:4.2.14+dfsg-0+deb8u12 CVE ID : CVE-2017-9461 CVE-2018-1050 CVE-2018-1057 CVE-2019-3880 Various vulnerabilities were discovered in Samba, SMB/CIFS file, print, and login server/client for Unix CVE-2017-9461 smbd in Samba had a denial of service vulnerability fdopenatomi...

[SECURITY] [DLA 1753-1] proftpd-dfsg security update

Package : proftpd-dfsg Version : 1.3.5e-0+deb8u1 CVE ID : not-available Debian Bug : 923926 Several memory leaks were discovered in proftpd-dfsg, a versatile, virtual-hosting FTP daemon, when modfacl or modsftp is used which could lead to memory exhaustion and a denial-of-service. For Debian 8...

Debian DLA-1752-1 : poppler security update

A security issue was discovered in the poppler PDF rendering shared library. The Poppler shared library had a heap-based buffer over-read in the CairoRescaleBox.cc downsamplerowboxfilter function. For Debian 8 'Jessie', this problem has been fixed in version 0.26.5-2+deb8u9. We recommend that you...

Debian DLA-1751-1 : suricata security update

Multiple vulnerabilities have been found in suricata, the network threat detection engine : CVE-2018-10242 Missing length check causing out-of-bounds read in SSHParseBanner app-layer-ssh.c. Remote attackers might leverage this vulnerability to cause DoS or potentially unauthorized disclosure of...

Debian DLA-1753-3 : proftpd-dfsg regression update

The update of proftpd-dfsg issued as DLA-1753-1 caused a regression when the creation of a directory failed during sftp transfer. The sftp session would be terminated instead of failing gracefully due to a non-existing debug logging function. For Debian 8 'Jessie', this problem has been fixed in...

[SECURITY] [DLA 1752-1] poppler security update

Package : poppler Version : 0.26.5-2+deb8u9 CVE ID : CVE-2019-9631 Debian Bug : A security issue was discovered in the poppler PDF rendering shared library. The Poppler shared library had a heap-based buffer over-read in the CairoRescaleBox.cc downsamplerowboxfilter function. For Debian 8 "Jessie...

[SECURITY] [DLA 1751-1] suricata security update

Package : suricata Version : 2.0.7-2+deb8u4 CVE ID : CVE-2018-10242 CVE-2018-10243 Multiple vulnerabilities have been found in suricata, the network threat detection engine: CVE-2018-10242 Missing length check causing out-of-bounds read in SSHParseBanner app-layer-ssh.c. Remote attackers might...

Debian DLA-1750-1 : roundup security update

Hanno Bck was discovered that there was a cross-site scripting XSS vulnerability in the web front-end of the roundup issue- tracking system. For Debian 8 'Jessie', this issue has been fixed in roundup version 1.4.20-1.1+deb8u2. We recommend that you upgrade your roundup packages. NOTE: Tenable...

[SECURITY] [DLA 1750-1] roundup security update

Package : roundup Version : 1.4.20-1.1+deb8u2 CVE ID : CVE-2019-10904 Hanno Böck was discovered that there was a cross-site scripting XSS vulnerability in the web front-end of the roundup issue- tracking system. For Debian 8 "Jessie", this issue has been fixed in roundup version 1.4.20-1.1+deb8u2...

Debian DLA-1749-1 : golang security update

It was discovered that there was a CRLF injection attack in the Go programming language runtime library. Passing \r\n to http.NewRequest could allow execution of arbitrary HTTP headers or Redis commands. For Debian 8 'Jessie', this issue has been fixed in golang version 2:1.3.3-1+deb8u2. We...