[SECURITY] [DLA 2604-1] dnsmasq security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2604-1 [email protected] https://www.debian.org/lts/security/ March 22, 2021 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package...

Debian DLA-2601-1 : cloud-init security update

cloud-init has the ability to generate and set a randomized password for system users. This functionality is enabled at runtime by passing cloud-config data such as : chpasswd: list: | user1:RANDOM When used this way, cloud-init logs the raw, unhashed password to a world-readable local file. For...

Debian DLA-2598-1 : squid3 security update

Due to improper input validation, Squid is vulnerable to an HTTP Request Smuggling attack. This problem allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by Squid security controls. For Debian 9 stretch, this problem has been fixed in version...

Debian: Security Advisory (DLA-2599-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2599-1] shibboleth-sp2 security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2599-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta March 19, 2021 https://wiki.debian.org/LTS -...

Debian: Security Advisory (DLA-2597-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-2595-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2595-1] velocity security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2595-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb March 17, 2021 https://wiki.debian.org/LTS -...

Debian DLA-2590-1 : pygments security update

It was found that pygments, a generic syntax highlighter, is vulnerable to a CPU exhaustion attack via a crafted SML file. For Debian 9 stretch, this problem has been fixed in version 2.2.0+dfsg-1+deb9u1. We recommend that you upgrade your pygments packages. For the detailed security status of...

Debian DLA-2593-1 : ca-certificates whitelist Symantec CA

This update reverts the Symantec CA blacklist which was originally 911289. The following root certificates were added back + : + 'GeoTrust Global CA' + 'GeoTrust Primary Certification Authority' + 'GeoTrust Primary Certification Authority - G2' + 'GeoTrust Primary Certification Authority - G3' +...

Debian DLA-2591-1 : golang-1.7 security update

Several vulnerabilities were discovered in the Go programming language. An attacker could trigger a denial of service DoS, bypasss access control, and execute arbitrary code on the developer's computer. CVE-2017-15041 Go allows 'go get' remote command execution. Using custom domains, it is possib...

Debian DLA-2592-1 : golang-1.8 security update

Several vulnerabilities were discovered in the Go programming language. An attacker could trigger a denial of service DoS, bypasss access control, and execute arbitrary code on the developer's computer. CVE-2017-15041 Go allows 'go get' remote command execution. Using custom domains, it is possib...

[SECURITY] [DLA 2591-1] golang-1.7 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2591-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler March 13, 2021 https://wiki.debian.org/LTS -...

Debian DLA-2589-2 : mupdf regression update

DLA 2589-1 incorrectly fixed CVE-2020-26519 and also induced regression where opening a PDF document resulted in a SIGFPE crash, a floating point exception. For Debian 9 stretch, this problem has been fixed in version 1.9a+ds1-4+deb9u7. We recommend that you upgrade your mupdf packages. For the...

[SECURITY] [DLA 2589-1] mupdf security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2589-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta March 12, 2021 https://wiki.debian.org/LTS -...

Debian DLA-2588-1 : zeromq3 security update

Two security issues have been detected in zeromq3. CVE-2021-20234 Memory leak in client induced by malicious servers without CURVE/ZAP. From issue description 1. When a pipe processes a delimiter and is already not in active state but still has an unfinished message, the message is leaked...

[SECURITY] [DLA 2588-1] zeromq3 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2588-1 [email protected] https://www.debian.org/lts/security/ Anton Gladky March 09, 2021 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2587-1] privoxy security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2587-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA March 09, 2021 https://wiki.debian.org/LTS -...

Debian DLA-2582-1 : mqtt-client security update

A vulnerability was discovered in mqtt-client wher unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive. For Debian 9 stretch, this problem has been fixed in version 1.14-1+deb9u1. We recommend that you upgrade your mqtt-client packages. For the...

Debian DLA-2583-1 : activemq security update

Multiple security issues were discovered in activemq, a message broker built around Java Message Service. CVE-2017-15709 When using the OpenWire protocol in activemq, it was found that certain system details such as the OS and kernel version are exposed as plain text. CVE-2018-11775 TLS hostname...