[SECURITY] [DLA 1480-1] ruby2.1 security update

Package : ruby2.1 Version : 2.1.5-2+deb8u5 CVE ID : CVE-2016-2337 CVE-2018-1000073 CVE-2018-1000074 Debian Bug : 895778 851161 Several vulnerabilities were discovered in Ruby 2.1. CVE-2016-2337 Type confusion exists in canceleval Rubys TclTkIp class method. Attacker passing different type of obje...

[SECURITY] [DLA 1472-1] libcgroup security update

Package : libcgroup Version : 0.41-6+deb8u1 CVE ID : CVE-2018-14348 Debian Bug : 906308 The cgrulesengd daemon in libcgroup creates log files with world readable and writable permissions due to a reset of the file mode creation mask umask0. For Debian 8 "Jessie", this problem has been fixed in...

[SECURITY] [DLA 1471-1] kamailio security update

Package : kamailio Version : 4.2.0-2+deb8u4 CVE ID : CVE-2018-14767 CVE-2018-14767 Fix for missing input validation, which could result in denial of service and potentially the execution of arbitrary code. For Debian 8 "Jessie", this problem has been fixed in version 4.2.0-2+deb8u4. We recommend...

[SECURITY] [DLA 1466-1] linux-4.9 security update

Package : linux-4.9 Version : 4.9.110-3+deb9u2deb8u1 CVE ID : CVE-2018-5390 CVE-2018-5391 CVE-2018-13405 Debian Bug : 893393 903122 903767 903776 903838 903914 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation or denial of service...

[SECURITY] [DLA 1444-1] vim-syntastic security update

Package : vim-syntastic Version : 3.5.0-1+deb8u1 CVE ID : CVE-2018-11319 CVE-2018-11319 The improper handling of search for configuration files might be exploited for arbitrary code execution via a malicious gcc plugin. For Debian 8 "Jessie", this problem has been fixed in version 3.5.0-1+deb8u1...

[SECURITY] [DLA 1430-1] taglib security update

Package : taglib Version : 1.9.1-2.1+deb8u1 CVE ID : CVE-2018-11439 CVE-2018-11439 Fix for a heap-based buffer over-read via a crafted audio file. For Debian 8 "Jessie", these problems have been fixed in version 1.9.1-2.1+deb8u1. We recommend that you upgrade your taglib packages. Further...

[SECURITY] [DLA 1416-1] libsoup2.4 security update

Package : libsoup2.4 Version : 2.48.0-1+deb8u2 CVE ID : CVE-2018-12910 It was discovered that the Soup HTTP library performed insuffient validation of cookie requests which could result in an out-of-bounds memory read. For Debian 8 "Jessie", these problems have been fixed in version...

[SECURITY] [DLA 1412-1] cups security update

Package : cups Version : 1.7.5-11+deb8u3 CVE ID : CVE-2017-18190 CVE-2017-18248 Two vulnerabilities affecting the cups printing server were found which can lead to arbitrary IPP command execution and denial of service. CVE-2017-18190 A localhost.localdomain whitelist entry in validhost in...

[SECURITY] [DLA 1408-1] simplesamlphp security update

Package : simplesamlphp Version : 1.13.1-2+deb8u2 CVE ID : CVE-2017-12868 CVE-2017-12872 CVE-2017-12872 / CVE-2017-12868 The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing...

[SECURITY] [DLA 1398-1] php-horde-crypt security update

Package : php-horde-crypt Version : 2.5.0-5+deb8u1 CVE ID : CVE-2017-7413 CVE-2017-7414 Debian Bug : 859635 It was discovered that in Horde-Crypt, a cryptographic library and part of the PHP Horde framework, a command injection was possible when a Horde user used the PGP features to view an...

[SECURITY] [DLA 1391-1] tiff security update

Package : tiff Version : 4.0.2-6+deb7u21 CVE ID : CVE-2017-11613 CVE-2018-5784 Debian Bug : 869823 890441 Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service: CVE-2017-11613 Ddenial of service vulnerability in the...

Debian: Security Advisory (DLA-1380-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1380-1] libmad security update

Package : libmad Version : 0.15.1b-7+deb7u1 CVE ID : CVE-2017-8372 CVE-2017-8373 CVE-2017-8374 Several vulnerabilities were discovered in MAD, an MPEG audio decoder library, which could result in denial of service if a malformed audio file is processed. For Debian 7 "Wheezy", these problems have...

[SECURITY] [DLA 1378-1] tiff3 security update

Package : tiff3 Version : 3.9.6-11+deb7u11 CVE ID : CVE-2018-8905 Debian Bug : 893806 A heap-based buffer overflow was discovered in the LZWDecodeCompat function in tiflzw.c LibTIFF 4.0.9 and earlier. This vulnerability might be leveraged by remote attackers to crash the client via a crafted TIFF...

[SECURITY] [DLA 1375-1] wget security update

Package : wget Version : 1.13.4-3+deb7u6 CVE ID : CVE-2018-0494 Debian Bug : 898076 Harry Sintonen have discovered a cookie injection vulnerability in wget caused by insufficient input validation, enabling an external attacker to inject arbitrary cookie values cookie jar file, adding new or...

[SECURITY] [DLA 1373-1] php5 security update

Package : php5 Version : 5.4.45-0+deb7u14 CVE ID : CVE-2018-10545 CVE-2018-10547 CVE-2018-10548 Several issues have been discovered in PHP recursive acronym for PHP: Hypertext Preprocessor, a widely-used open source general-purpose scripting language that is especially suited for web development...

[SECURITY] [DLA 1372-1] libdatetime-timezone-perl new upstream release

Package : libdatetime-timezone-perl Version : 1:1.58-1+2018e This update includes the changes in tzdata 2018e for the Perl bindings. For the list of changes, see DLA-1371-1. For Debian 7 "Wheezy", these problems have been fixed in version 1:1.58-1+2018e. We recommend that you upgrade your...

[SECURITY] [DLA 1364-1] openslp-dfsg security update

Package : openslp-dfsg Version : 1.2.1-9+deb7u2 CVE ID : CVE-2017-17833 CVE-2017-17833 An issue has been found in openslp that is related to heap memory corruption, which may result in a denial-of-service or remote code execution. For Debian 7 "Wheezy", these problems have been fixed in version...

[SECURITY] [DLA 1356-1] libreoffice security update

Package : libreoffice Version : 1:3.5.4+dfsg2-0+deb7u11 CVE ID : CVE-2018-10119 CVE-2018-10120 Fuzzing by the OSS-Fuzz project found two memory safety issues in LibreOffice, which could result in an application crash or possibly other unspecified impact. For Debian 7 "Wheezy", these problems have...

[SECURITY] [DLA 1339-1] openjdk-7 security update

Package : openjdk-7 Version : 7u171-2.6.13-1deb7u1 CVE ID : CVE-2018-2579 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2629 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Debian Bug : 891330 Several vulnerabiliti...