[SECURITY] [DSA 3323-1] icu security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3323-1 [email protected] https://www.debian.org/security/ Laszlo Boszormenyi August 01, 2015 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3322-1] ruby-rack security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3322-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 31, 2015 https://www.debian.org/security/faq -...

[SECURITY] [DLA 280-1] ghostscript security update

Package : ghostscript Version : 8.71dfsg2-9+squeeze2 CVE ID : CVE-2015-3228 Debian Bug : 793489 In gsheapallocbytes, add a sanity check to ensure we dont overflow the variable holding the actual number of bytes we allocate...

[SECURITY] [DSA 3309-1] tidy security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3309-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini July 18, 2015 https://www.debian.org/security/faq -...

[SECURITY] [DLA 273-1] tidy security update

Package : tidy Version : 20091223cvs-1+deb6u1 CVE ID : CVE-2015-5522 CVE-2015-5523 Debian Bug : 792571 Fernando Muñoz discovered a security issue on the HTML syntax checker and reformatter tidy. Tidy did not properly process specific character sequences, and a remote attacker could exploit this...

[SECURITY] [DSA 3308-1] mysql-5.5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3308-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 18, 2015 https://www.debian.org/security/faq -...

[SECURITY] [DLA 261-2] aptdaemon regression update

Package : aptdaemon Version : 0.31+bzr413-1.1+deb6u2 Debian Bug : 791469 It was reported that version 0.31+bzr413-1.1+deb6u1 of aptdaemon which fixed CVE-2015-1323 was not installable if you have Python 2.5 installed. This has been fixed in version 0.31+bzr413-1.1+deb6u2. Raphaël Hertzog ◈ Debian...

[SECURITY] [DLA 264-1] libmodule-signature-perl security update

Package : libmodule-signature-perl Version : 0.63-1+squeeze2 CVE ID : CVE-2015-3406 CVE-2015-3407 CVE-2015-3408 CVE-2015-3409 Debian Bug : 783451 John Lightsey discovered multiple vulnerabilities in Module::Signature, a Perl module to manipulate CPAN SIGNATURE files. The Common Vulnerabilities an...

[SECURITY] [DLA 263-1] ruby1.9.1 security update

Package : ruby1.9.1 Version : 1.9.2.0-2+deb6u5 CVE ID : CVE-2012-5371 CVE-2013-0269 Debian Bug : 693024 700471 Two vulnerabilities were identified in the Ruby language interpreter, version 1.9.1. CVE-2012-5371 Jean-Philippe Aumasson identified that Ruby computed hash values without properly...

[SECURITY] [DLA 261-1] aptdaemon security update

Package : aptdaemon Version : 0.31+bzr413-1.1+deb6u1 CVE ID : CVE-2015-1323 Debian Bug : 789162 Tavis Ormandy discovered that Aptdeamon incorrectly handled the simulate dbus method. A local attacker could use this issue to possibly expose sensitive information, or perform other file access as the...

[SECURITY] [DLA 257-1] libwmf security update

Package : libwmf Version : 0.2.8.4-6.2+deb6u2 CVE ID : CVE-2015-4695 CVE-2015-4696 Debian Bug : 784192 784205 libwmf is vulnerable to two denial of service due to invalid read operations when processing specially crafted WMF files. CVE-2015-4695 Heap buffer overread in libwmf CVE-2015-4696 Read...

[SECURITY] [DLA 246-2] linux-2.6 regression update

Package : linux-2.6 Version : 2.6.32-48squeeze13 CVE ID : CVE-2011-5321 CVE-2012-6689 CVE-2014-3184 CVE-2014-8159 CVE-2014-9683 CVE-2014-9728 CVE-2014-9729 CVE-2014-9730 CVE-2014-9731 CVE-2015-1805 CVE-2015-2041 CVE-2015-2042 CVE-2015-2830 CVE-2015-2922 CVE-2015-3339 CVE-2015-4167 Debian Bug :...

[SECURITY] [DLA 242-1] imagemagick security update

Package : imagemagick Version : 8:6.6.0.4-3+squeeze6 CVE ID : CVE-2012-3437 CVE-2014-8354 CVE-2014-8355 CVE-2014-8562 Debian Bug : 773834 767240 683285 692367 This update fixes a large number of potential security problems due to insufficient data validation when parsing different input formats...

[SECURITY] [DLA 243-1] libraw security update

Package : libraw Version : 0.9.1-1+deb6u1 CVE ID : CVE-2015-3885 Debian Bug : 786788 This DLA supersedes my wrong announcement using DLA 241-1 CVE-2015-3885: Integer overflow in the ljpegstart function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service crash via a...

[SECURITY] [DLA 240-1] libapache-mod-jk security update

Package : libapache-mod-jk Version : 1:1.2.30-1squeeze2 CVE ID : CVE-2014-8111 Debian Bug : 783233 An information disclosure flaw due to incorrect JkMount/JkUnmount directives processing was found in the Apache 2 module modjk to forward requests from the Apache web server to Tomcat. A JkUnmount...

CVE-2015-0212

Cross-site scripting XSS vulnerability in course/pending.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted course summary...

CVE-2015-0218

Cross-site request forgery CSRF vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout...

[SECURITY] [DLA 234-1] ipsec-tools security update

Package : ipsec-tools Version : 1:0.7.3-12+deb6u1 CVE ID : CVE-2015-4047 Debian Bug : 785778 Javantea discovered a NULL pointer dereference flaw in racoon, the Internet Key Exchange daemon of ipsec-tools. A remote attacker can use this flaw to cause the IKE daemon to crash via specially crafted U...

[SECURITY] [DLA 232-1] tomcat6 security update

Package : tomcat6 Version : 6.0.41-2+squeeze7 CVE ID : CVE-2014-0227 CVE-2014-0230 CVE-2014-7810 Debian Bug : 787010 785312 785316 The following vulnerabilities were found in Apache Tomcat 6: CVE-2014-0227 The Tomcat security team identified that it was possible to conduct HTTP request smuggling...

[SECURITY] [DLA 228-1] exactimage security update

Package : exactimage Version : 0.8.1-3+deb6u4 CVE ID : CVE-2015-3885 Debian Bug : 786785 A vulnerability has been discovered in the ExactImage image manipulation programs. CVE-2015-3885 Eduardo Castellanos discovered an Integer overflow in the dcraw version included in ExactImage. This...