[SECURITY] [DLA 2401-1] sympa security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2401-1 [email protected] https://www.debian.org/lts/security/ October 07, 2020 https://wiki.debian.org/LTS - -------------------------------------------------------------------------...

[SECURITY] [DLA 2399-1] packagekit security update

Debian LTS Advisory DLA-2399-1 [email protected] https://www.debian.org/lts/security/ Roberto C. Sánchez October 07, 2020 https://wiki.debian.org/LTS Package : packagekit Version : 1.1.5-2+deb9u2 CVE ID : CVE-2020-16121 CVE-2020-16122 Two vulnerabilities have been discovered in...

Debian DLA-2397-1 : php7.0 security update

A vulnerability was discovered in PHP, a server-side, HTML-embedded scripting language. When PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like Host confused with cookies that decode to such prefix, thus leading to an...

[SECURITY] [DLA 2397-1] php7.0 security update

Debian LTS Advisory DLA-2397-1 [email protected] https://www.debian.org/lts/security/ Roberto C. Sánchez October 06, 2020 https://wiki.debian.org/LTS Package : php7.0 Version : 7.0.33-0+deb9u10 CVE ID : CVE-2020-7070 A vulnerability was discovered in PHP, a server-side, HTML-embedded...

Debian DLA-2389-1 : ruby-rack-cors security update

This package allowed ../ directory traversal to access private resources because resource matching did not ensure that pathnames were in a canonical format. For Debian 9 stretch, this problem has been fixed in version 0.4.0-1+deb9u2. We recommend that you upgrade your ruby-rack-cors packages. For...

Debian DLA-2395-1 : libvirt security update

A double free vulnerability was discovered in libvirt, a toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. For Debian 9 stretch, this problem has been fixed in version 3.0.0-4+deb9u5. We recommend that you upgrade your libvirt packages. For the...

Debian DLA-2391-1 : ruby2.3 security update

A potential HTTP request smuggling vulnerability in WEBrick was reported. WEBrick bundled along with ruby2.3 was too tolerant against an invalid Transfer-Encoding header. This may lead to inconsistent interpretation between WEBrick and some HTTP proxy servers, which may allow the attacker to...

Debian DLA-2393-1 : snmptt security update

It was found that SNMP Trap Translator does not drop privileges as configured and does not properly escape shell commands in certain functions. A remote attacker, by sending a malicious crafted SNMP trap, could possibly execute arbitrary shell code with the privileges of the process or cause a...

[SECURITY] [DLA 2393-1] snmptt security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2393-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA October 01, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2392-1] jruby security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2392-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta October 01, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2389-1] ruby-rack-cors security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2389-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta October 01, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2388-1 : nss security update

Various vulnerabilities were fixed in nss, the Network Security Service libraries. CVE-2018-12404 Cache side-channel variant of the Bleichenbacher attack. CVE-2018-18508 NULL pointer dereference in several CMS functions resulting in a denial of service. CVE-2019-11719 Out-of-bounds read when...

[SECURITY] [DLA 2387-2] firefox-esr regression update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2387-2 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort September 29, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2387-2 : firefox-esr regression update

This update fixes a problem that caused Firefox to fail to build on the arm64 and armhf architectures. For Debian 9 stretch, this problem has been fixed in version 78.3.0esr-1deb9u2. We recommend that you upgrade your firefox-esr packages. For the detailed security status of firefox-esr please...

Debian DLA-2377-1 : qt4-x11 security update

Several vulnerabilities were fixed in qt4-x11, the legacy version of the Qt toolkit. CVE-2018-15518 Double-free or corruption in QXmlStreamReader during parsing of a specially crafted illegal XML document. CVE-2018-19869 A malformed SVG image causes a segmentation fault. CVE-2018-19870 A malforme...

Debian DLA-2386-1 : libdbi-perl security update

Several vulnerabilities were discovered in the Perl5 Database Interface DBI. An attacker could trigger a denial of service DoS and possibly execute arbitrary code. CVE-2019-20919 The hvfetch documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls...

[SECURITY] [DLA 2387-1] firefox-esr security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2387-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort September 28, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2386-1] libdbi-perl security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2386-1 [email protected] https://www.debian.org/lts/security/ September 28, 2020 https://wiki.debian.org/LTS - -------------------------------------------------------------------------...

[SECURITY] [DLA 2377-1] qt4-x11 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2377-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk September 21, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2376-1] qtbase-opensource-src security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2376-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk September 21, 2020 https://wiki.debian.org/LTS -...