Debian DLA-2488-2 : python-apt regression update

The update for python-apt released as 2488-1 introduced a regression by causing a segmentation fault, which is now fixed with this update. For Debian 9 stretch, this problem has been fixed in version 1.4.3. We recommend that you upgrade your python-apt packages. For the detailed security status o...

Debian DLA-2487-1 : apt security update

It was discovered that missing input validation in the ar/tar implementations of APT, the high level package manager, could cause out-of-bounds reads or infinite loops, resulting in denial of service when processing malformed deb files. For Debian 9 stretch, this problem has been fixed in version...

Debian DLA-2486-1 : xorg-server security update

Jan-Niklas Sohn discovered that the XKB extension of the Xorg X server performed incomplete input validation, which could result in privilege escalation. For Debian 9 stretch, these problems have been fixed in version 2:1.19.2-1+deb9u7. We recommend that you upgrade your xorg-server packages. For...

[SECURITY] [DLA 2486-1] xorg-server security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2486-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort December 09, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2484-1 : python-certbot - switch to ACMEv2 API

Let's Encrypt's ACMEv1 API is deprecated and in the process of being shut down. Beginning with brownouts in January 2021, and ending with a total shutdown in June 2021, the Let's Encrypt APIs will become unavailable. To prevent users having disruptions to their certificate renewals, this update...

Debian DLA-2485-1 : golang-golang-x-net-dev security update (Ping Flood) (Reset Flood)

The http2 server support in this package was vulnerable to certain types of DOS attacks. CVE-2019-9512 This code was vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of response...

[SECURITY] [DLA 2484-1] python-certbot - switch to ACMEv2 API

----------------------------------------------------------------------- Debian LTS Advisory DLA-2484-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta December 07, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2482-1 : debian-security-support security update

debian-security-support, the Debian security support coverage checker, has been updated in stretch-security. This marks the end of life of the mongodb package in stretch due to licence incompatibility. See https://lists.debian.org/debian-lts/2020/11/msg00058.html and https://bugs.debian.org/91553...

Debian DLA-2479-1 : thunderbird security update

Chiaki Ishikawa discovered a stack overflow in SMTP server status handling which could potentially result in the execution of arbitrary code. For Debian 9 stretch, this problem has been fixed in version 1:78.5.1-1deb9u1. We recommend that you upgrade your thunderbird packages. For the detailed...

Debian DLA-2480-2 : salt regression update

Past security updates of Salt, a remote execution manager, introduced regressions for which follow-up fixes were published : CVE 2020-16846 regression 'salt-ssh' master key initialization fails CVE 2021-3197 regression Valid parameters are discarded for the SSHClient CVE 2020-28243 follow-up...

[SECURITY] [DLA 2482-1] debian-security-support security update

Debian LTS Advisory DLA-2482-1 [email protected] https://www.debian.org/lts/security/ Holger Levsen December 04, 2020 https://wiki.debian.org/LTS Package : debian-security-support Version : 1:9+2020.12.04 debian-security-support, the Debian security support coverage checker, has been...

[SECURITY] [DLA 2481-1] openldap security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2481-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta December 04, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2477-1 : jupyter-notebook security update

It was discovered that there was an issue in the 'jupyter-notebook' interactive notebook system where a maliciously-crafted link could redirect the browser to a malicious/spoofed website. For Debian 9 'Stretch', this problem has been fixed in version 4.2.3-4+deb9u2. We recommend that you upgrade...

[SECURITY] [DLA 2478-1] postgresql-9.6 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2478-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort December 02, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2477-1] jupyter-notebook security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2477-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb December 02, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2476-1 : brotli security update

A buffer overflow was discovered in Brotli, a generic-purpose lossless compression suite. For Debian 9 stretch, this problem has been fixed in version 0.5.2+dfsg-2+deb9u1. We recommend that you upgrade your brotli packages. For the detailed security status of brotli please refer to its security...

Debian LTS: Security Advisory for zsh (DLA-2470-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] [DLA 2476-1] brotli security update

Debian LTS Advisory DLA-2476-1 [email protected] https://www.debian.org/lts/security/ Roberto C. Sánchez December 01, 2020 https://wiki.debian.org/LTS Package : brotli Version : 0.5.2+dfsg-2+deb9u1 CVE ID : CVE-2020-8927 A buffer overflow was discovered in Brotli, a generic-purpose...

Debian DLA-2472-1 : mutt security update

In Mutt, a text-based Mail User Agent, invalid IMAP server responses were not properly handled, potentially resulting in authentication credentials being exposed or man-in-the-middle attacks. For Debian 9 stretch, this problem has been fixed in version 1.7.2-1+deb9u4. We recommend that you upgrad...

Debian DLA-2473-1 : vips security update

In VIPS, an image processing system, an uninitialized variable which may cause the leakage of remote server path or stack address was fixed. For Debian 9 stretch, this problem has been fixed in version 8.4.5-1+deb9u2. We recommend that you upgrade your vips packages. For the detailed security...