Debian DLA-2487-1 : apt security update

It was discovered that missing input validation in the ar/tar implementations of APT, the high level package manager, could cause out-of-bounds reads or infinite loops, resulting in denial of service when processing malformed deb files. For Debian 9 stretch, this problem has been fixed in version...

Debian DLA-2486-1 : xorg-server security update

Jan-Niklas Sohn discovered that the XKB extension of the Xorg X server performed incomplete input validation, which could result in privilege escalation. For Debian 9 stretch, these problems have been fixed in version 2:1.19.2-1+deb9u7. We recommend that you upgrade your xorg-server packages. For...

[SECURITY] [DLA 2486-1] xorg-server security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2486-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort December 09, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2484-1 : python-certbot - switch to ACMEv2 API

Let's Encrypt's ACMEv1 API is deprecated and in the process of being shut down. Beginning with brownouts in January 2021, and ending with a total shutdown in June 2021, the Let's Encrypt APIs will become unavailable. To prevent users having disruptions to their certificate renewals, this update...

Debian DLA-2485-1 : golang-golang-x-net-dev security update (Ping Flood) (Reset Flood)

The http2 server support in this package was vulnerable to certain types of DOS attacks. CVE-2019-9512 This code was vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of response...

[SECURITY] [DLA 2484-1] python-certbot - switch to ACMEv2 API

----------------------------------------------------------------------- Debian LTS Advisory DLA-2484-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta December 07, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2479-1 : thunderbird security update

Chiaki Ishikawa discovered a stack overflow in SMTP server status handling which could potentially result in the execution of arbitrary code. For Debian 9 stretch, this problem has been fixed in version 1:78.5.1-1deb9u1. We recommend that you upgrade your thunderbird packages. For the detailed...

[SECURITY] [DLA 2482-1] debian-security-support security update

Debian LTS Advisory DLA-2482-1 [email protected] https://www.debian.org/lts/security/ Holger Levsen December 04, 2020 https://wiki.debian.org/LTS Package : debian-security-support Version : 1:9+2020.12.04 debian-security-support, the Debian security support coverage checker, has been...

[SECURITY] [DLA 2481-1] openldap security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2481-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta December 04, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2478-1] postgresql-9.6 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2478-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort December 02, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2477-1] jupyter-notebook security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2477-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb December 02, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2476-1 : brotli security update

A buffer overflow was discovered in Brotli, a generic-purpose lossless compression suite. For Debian 9 stretch, this problem has been fixed in version 0.5.2+dfsg-2+deb9u1. We recommend that you upgrade your brotli packages. For the detailed security status of brotli please refer to its security...

Debian LTS: Security Advisory for zsh (DLA-2470-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] [DLA 2476-1] brotli security update

Debian LTS Advisory DLA-2476-1 [email protected] https://www.debian.org/lts/security/ Roberto C. Sánchez December 01, 2020 https://wiki.debian.org/LTS Package : brotli Version : 0.5.2+dfsg-2+deb9u1 CVE ID : CVE-2020-8927 A buffer overflow was discovered in Brotli, a generic-purpose...

Debian DLA-2472-1 : mutt security update

In Mutt, a text-based Mail User Agent, invalid IMAP server responses were not properly handled, potentially resulting in authentication credentials being exposed or man-in-the-middle attacks. For Debian 9 stretch, this problem has been fixed in version 1.7.2-1+deb9u4. We recommend that you upgrad...

Debian DLA-2474-1 : musl security update

The wcsnrtombs function in all musl libc versions up through 1.2.1 has been found to have multiple bugs in handling of destination buffer size when limiting the input character count, which can lead to infinite loop with no forward progress no overflow or writing past the end of the destination...

Debian DLA-2470-1 : zsh security update

Several security vulnerabilities were found and corrected in zsh, a powerful shell and scripting language. Off-by-one errors, wrong parsing of shebang lines and buffer overflows may lead to unexpected behavior. A local, unprivileged user can create a specially crafted message file or directory...

Debian DLA-2466-1 : drupal7 security update

Two vulnerabilities were found in the ArchiveTar PHP module, used by Drupal, which could result in the execution of arbitrary code if a malicious user is allowed to upload tar archives. For Debian 9 stretch, these problems have been fixed in version 7.52-2+deb9u13. We recommend that you upgrade...

Debian DLA-2468-1 : tcpflow security update

An issue has been found in tcpflow, a TCP flow recorder. Due to an overflow vulnerability in function handle80211, an out-of-bounds read with access to sensitive memory or a denial of service might happen. For Debian 9 stretch, this problem has been fixed in version 1.4.4+repack1-3+deb8u1. We...

[SECURITY] [DLA 2466-1] drupal7 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2466-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort November 27, 2020 https://wiki.debian.org/LTS -...