Debian DLA-2454-1 : rclone security update

golang-go.crypto was recently updated with a fix for CVE-2019-11840. This in turn requires all packages that use the affected code to be recompiled in order to pick up the security fix. CVE-2019-11840 An issue was discovered in supplementary Go cryptography libraries, aka...

[SECURITY] [DSA 4792-1] openldap security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4792-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 17, 2020 https://www.debian.org/security/faq -...

Debian DLA-2443-1 : zeromq3 security update

It was discovered that ZeroMQ, a lightweight messaging kernel library does not properly handle connecting peers before a handshake is completed. A remote, unauthenticated client connecting to an application using the libzmq library, running with a socket listening with CURVE...

Debian DLA-2445-1 : libmaxminddb security update

A heap-based buffer over-read has been found in libmaxminddb, an IP geolocation database library. This could be exploited when the mmdblookup tool is used to open a specially crafted database file. For Debian 9 stretch, this problem has been fixed in version 1.2.0-1+deb9u1. We recommend that you...

[SECURITY] [DLA 2446-1] moin security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2446-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz November 10, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2442-1] obfs4proxy security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2442-1 [email protected] https://www.debian.org/lts/security/ Brian May November 10, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2441-1] sympa security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2441-1 [email protected] https://www.debian.org/lts/security/ November 09, 2020 https://wiki.debian.org/LTS - -------------------------------------------------------------------------...

Debian DLA-2437-1 : krb5 security update

It was discovered that there was a denial of service vulnerability in the MIT Kerberos network authentication system, krb5. The lack of a limit in the ASN.1 decoder could lead to infinite recursion and allow an attacker to overrun the stack and cause the process to crash. For Debian 9 'Stretch',...

Debian DLA-2436-1 : sddm security update

It was discovered that there was an issue in the sddm display manager where local unprivileged users could create a connection to the X server. For Debian 9 'Stretch', this problem has been fixed in version 0.14.0-4+deb9u2. We recommend that you upgrade your sddm packages. For the detailed securi...

[SECURITY] [DSA 4785-1] raptor2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4785-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 07, 2020 https://www.debian.org/security/faq -...

Debian DLA-2430-1 : blueman security update

Vaisha Bernard discovered that Blueman, a graphical bluetooth manager performed insufficient validation on a D-Bus interface, which could result in denial of service or privilege escalation. For Debian 9 stretch, this problem has been fixed in version 2.0.4-1+deb9u1. We recommend that you upgrade...

Debian DLA-2412-2 : openjdk-8 regression update

A few issues have been found in the OpenJDK 8u272 update, including LDAP connection failures and application crash. For Debian 9 stretch, this problem has been fixed in version 8u275-b01-1deb9u1. We recommend that you upgrade your openjdk-8 packages. For the detailed security status of openjdk-8...

[SECURITY] [DLA 2422-1] qtsvg-opensource-src security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2422-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk October 31, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2416-1 : thunderbird security update

Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code or denial of service. For Debian 9 stretch, these problems have been fixed in version 1:78.4.0-1deb9u1. We recommend that you upgrade your thunderbird packages. For the detailed security...

Debian DLA-2411-1 : firefox-esr security update

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code. For Debian 9 stretch, these problems have been fixed in version 78.4.0esr-1deb9u1. We recommend that you upgrade your firefox-esr packages. For the...

Debian DLA-2408-1 : thunderbird security update

Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code or denial of service. Debian follows the Thunderbird upstream releases. Support for the 68.x series has ended, so starting with this update we're now following the 78.x releases. The 78.x...

Debian DLA-2406-1 : jackson-databind security update

It was discovered that there was an external entity expansion vulnerability in jackson-databind, a Java library for processing JSON. For Debian 9 'Stretch', this problem has been fixed in version 2.8.6-1+deb9u8. We recommend that you upgrade your jackson-databind packages. For the detailed securi...

[SECURITY] [DLA 2407-1] tomcat8 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2407-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb October 14, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2403-1 : rails security update

A potential Cross-Site Scripting XSS vulnerability was found in rails, a ruby based MVC framework. Views that allow the user to control the default not found value of the t and translate helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing...

[SECURITY] [DLA 2405-1] httpcomponents-client security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2405-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany October 10, 2020 https://wiki.debian.org/LTS -...