[SECURITY] [DSA 4071-1] sensible-utils security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4071-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 21, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1216-1] wordpress security update

Package : wordpress Version : 3.6.1+dfsg-1deb7u20 CVE ID : CVE-2017-17091 CVE-2017-17092 CVE-2017-17093 CVE-2017-17094 Debian Bug : 883314 Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following issues...

[SECURITY] [DLA 1215-1] otrs2 security update

Package : otrs2 Version : 3.3.18-1deb7u3 CVE ID : CVE-2017-17476 Debian Bug : 884801 Francesco Sirocco discovered a flaw in otrs2, the Open Ticket Request System, which could result in session information disclosure when cookie support is disabled. A remote attacker can take advantage of this fla...

[SECURITY] [DLA 1206-1] tiff security update

Package : tiff Version : 4.0.2-6+deb7u17 CVE ID : CVE-2017-9935 Debian Bug : 866109 In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2pwritepdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an...

[SECURITY] [DLA 1196-1] optipng security update

Package : optipng Version : 0.6.4-1+deb7u4 CVE ID : CVE-2017-16938 Debian Bug : 878839 optipng, an advanced PNG Portable Network Graphics optimizer, has been found vulnerable to a buffer overflow which allows remote attackers to cause a denial-of-service attack or other unspecified impact with a...

CVE-2017-15118

A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requir...

DEBIAN-CVE-2017-14176

Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117...

[SECURITY] [DSA 4042-1] libxml-libxml-perl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4042-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 19, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4041-1] procmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4041-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 19, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1178-1] opensaml2 security update

Package : opensaml2 Version : 2.4.3-4+deb7u2 CVE ID : CVE-2017-16853 Debian Bug : 881856 Rod Widdowson of Steading System Software LLP discovered a coding error in the OpenSAML library, causing the DynamicMetadataProvider class to fail configuring itself with the filters provided and omitting...

[SECURITY] [DLA 1177-1] poppler security update

Package : poppler Version : 0.18.4-6+deb7u4 CVE ID : CVE-2017-14975 CVE-2017-14976 CVE-2017-14977 CVE-2017-15565 Debian Bug : 879066 877952 877954 877957 It was discovered that poppler, a PDF rendering library, was affected by several denial-of-service application crash, null pointer dereferences...

[SECURITY] [DLA 1170-1] graphicsmagick security update

Package : graphicsmagick Version : 1.3.16-1.1+deb7u15 CVE ID : CVE-2017-13134 CVE-2017-16547 Debian Bug : 881524 Security vulnerabilities have been identified in graphicsmagick, a collection of image processing utilities and libraries. CVE-2017-13134 Graphicsmagick was vulnerable to a heap-based...

[SECURITY] [DSA 4006-2] mupdf security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4006-2 [email protected] https://www.debian.org/security/ November 10, 2017 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DSA 4006-2] mupdf security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4006-2 [email protected] https://www.debian.org/security/ November 10, 2017 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DLA 1166-2] tomcat7 regression update

Package : tomcat7 Version : 7.0.28-4+deb7u17 Debian Bug : 881162 The update for tomcat7 issued as DLA-1166-1 caused a regressions whereby every request, including for the root document /, returned HTTP status 404. Updated packages are now available to address this problem. For reference, the...

[SECURITY] [DSA 4026-1] bchunk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4026-1 [email protected] https://www.debian.org/security/ Sebastien Delafond November 09, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1164-1] mupdf security update

Package : mupdf Version : 0.9-2+deb7u4 CVE ID : CVE-2017-14687 CVE-2017-15587 Debian Bug : 877379 879055 Two security issues were discovered in mupdf, a lightweight PDF viewer. CVE-2017-14687 MuPDF allows attackers to cause a denial of service or possibly have unspecified other impact via a craft...

[SECURITY] [DSA 4019-1] imagemagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4019-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 05, 2017 https://www.debian.org/security/faq -...

CVE-2017-15955

bchunk related to BinChunker 1.2.0 and 1.2.1 is vulnerable to an "Access violation near NULL on destination operand" and crash when processing a malformed CUE .cue file...

[SECURITY] [DLA 1147-1] exiv2 security update

Package : exiv2 Version : 0.23-1+deb7u2 CVE ID : CVE-2017-11591 CVE-2017-11683 CVE-2017-14859 CVE-2017-14862 CVE-2017-14864 Debian Bug : 876893 The exiv2 library is vulnerable to multiple issues that can all lead to denial of service of the applications relying on the library to parse images...