Debian DLA-2536-1 : libsdl2 security update

Several issues have been found in libsdl2, a library for portable low level access to a video framebuffer, audio output, mouse, and keyboard. All issues are related to either buffer overflow, integer overflow or heap-based buffer over-read, resulting in a DoS or remote code execution by using...

Debian: Security Advisory (DLA-2537-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2538-1 : mariadb-10.1 security update

Two vulnerabilities were fixed by upgrading the MariaDB database server packages to the latest version on the 10.1 branch. For Debian 9 stretch, these problems have been fixed in version 10.1.48-0+deb9u1. We recommend that you upgrade your mariadb-10.1 packages. For the detailed security status o...

Debian DLA-2537-1 : ffmpeg security update

Two vulnerabilities have been discovered in ffmpeg, a widely used multimedia framework. CVE-2019-17539 a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer CVE-2020-35965 an out-of-bounds write because of errors in calculations of when to...

[SECURITY] [DLA 2538-1] mariadb-10.1 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2538-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk January 31, 2021 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2431-2] libonig regression update

Debian LTS Advisory DLA-2431-2 [email protected] https://www.debian.org/lts/security/ Markus Koschany January 30, 2021 https://wiki.debian.org/LTS Package : libonig Version : 6.1.3-2+deb9u2 CVE ID : CVE-2020-26159 It was discovered that CVE-2020-26159 in the Oniguruma regular expression...

[SECURITY] [DLA 2536-1] libsdl2 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2536-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz January 30, 2021 https://wiki.debian.org/LTS -...

Debian DLA-2535-1 : ansible security update

CVE-2017-7481 Ansible fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now...

Debian DLA-2533-1 : crmsh security update

It was discovered that there was an in issue in the command-line tool for the Pacemaker High Availability stack. Local attackers were able to execute commands via shell code injection to the 'crm history' command-line tool, potentially allowing escalation of privileges. For Debian 9 'Stretch', th...

Debian: Security Advisory (DLA-2533-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2532-1 : debian-security-support security update

debian-security-support, the Debian security support coverage checker, has been updated in stretch-security to mark the end of life of the reel package. See https://lists.debian.org/debian-lts/2021/01/msg00016.html for further information. For Debian 9 stretch, this problem has been documented in...

[SECURITY] [DLA 2533-1] crmsh security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2533-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb January 25, 2021 https://wiki.debian.org/LTS -...

Debian: Security Advisory (DLA-2530-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2531-1 : python-bottle security update

The package src:python-bottle before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon ;, they can cause a difference in the interpretation of the request between the proxy running with...

Debian DLA-2530-1 : drupal7 security update

Drupal identified a vulnerability in the verson of the ArchiveTar library it bundles CVE-2020-36193, which allows out-of-path extraction vulnerabilities, granting it the Drupal Security Advisory ID SA-CORE-2021-001 : https://www.drupal.org/sa-core-2021-001 For Debian 9 'Stretch', the fix to this...

[SECURITY] [DLA-2530-1] drupal7 security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2530-1 [email protected] https://www.debian.org/lts/security/ Gunnar Wolf January 21, 2021 https://wiki.debian.org/LTS -...

Debian DLA-2529-1 : mutt security update

rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service mailbox unavailability by sending email messages with sequences of semicolon characters in RFC822 address fields aka terminators of empty groups. A small email message from the attacker can cause large memory...

[SECURITY] [DLA 2529-1] mutt security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2529-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta January 21, 2021 https://wiki.debian.org/LTS -...

Debian DLA-2525-1 : wavpack security update

Multiple vulnerabilites in wavpack were found, like OOB read which could potentially lead to a DOS attack, unexpected control flow, crashes, integer overflow, and segfaults. For Debian 9 stretch, these problems have been fixed in version 5.0.0-2+deb9u3. We recommend that you upgrade your wavpack...

Debian DLA-2526-1 : ruby-redcarpet security update

In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions, no HTML escaping was being performed when processing quotes. This applies even when the :escapehtml option was being used. For Debian 9 stretch, this proble...