Debian DLA-2474-1 : musl security update

The wcsnrtombs function in all musl libc versions up through 1.2.1 has been found to have multiple bugs in handling of destination buffer size when limiting the input character count, which can lead to infinite loop with no forward progress no overflow or writing past the end of the destination...

Debian DLA-2470-1 : zsh security update

Several security vulnerabilities were found and corrected in zsh, a powerful shell and scripting language. Off-by-one errors, wrong parsing of shebang lines and buffer overflows may lead to unexpected behavior. A local, unprivileged user can create a specially crafted message file or directory...

Debian DLA-2466-1 : drupal7 security update

Two vulnerabilities were found in the ArchiveTar PHP module, used by Drupal, which could result in the execution of arbitrary code if a malicious user is allowed to upload tar archives. For Debian 9 stretch, these problems have been fixed in version 7.52-2+deb9u13. We recommend that you upgrade...

Debian DLA-2467-2 : lxml regression update

The fix for CVE-2020-27783, released as DLA 2467-1, was incomplete as the component was still affected by the vulnerability. This update includes an additional patch that completes the fix. Note that a package with version 3.7.1-1+deb9u2 was uploaded, but before the publication of the advisory a...

Debian DLA-2468-1 : tcpflow security update

An issue has been found in tcpflow, a TCP flow recorder. Due to an overflow vulnerability in function handle80211, an out-of-bounds read with access to sensitive memory or a denial of service might happen. For Debian 9 stretch, this problem has been fixed in version 1.4.4+repack1-3+deb8u1. We...

[SECURITY] [DLA 2468-1] tcpflow security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2468-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz November 29, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2466-1] drupal7 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2466-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort November 27, 2020 https://wiki.debian.org/LTS -...

Lxml Cross-Site Scripting Vulnerability

Lxml is a software from the individual developer of Lxml that interacts with Python to locate elements in Html. Lxml suffers from a cross-site scripting vulnerability that arises from javascript escaping via a combination of noscript and style. The following products and versions are affected:...

Debian: Security Advisory (DLA-2465-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2465-1 : php-pear security update

It was discovered that there was a filename sanitisation issue in php-pear, a distribution system for reusable PHP components. For Debian 9 'Stretch', this problem has been fixed in version 1:1.10.1+submodules+notgz-9+deb9u2. We recommend that you upgrade your php-pear packages. For the detailed...

[SECURITY] [DLA 2465-1] php-pear security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2465-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb November 23, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2463-1] samba security update

Debian LTS Advisory DLA-2463-1 [email protected] https://www.debian.org/lts/security/ Roberto C. Sánchez November 22, 2020 https://wiki.debian.org/LTS Package : samba Version : 2:4.5.16+dfsg-1+deb9u3 CVE ID : CVE-2020-1472 CVE-2020-10704 CVE-2020-10730 CVE-2020-10745 CVE-2020-10760...

Debian DLA-2463-1 : samba security update

Multiple vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. CVE-2020-1472 Unauthenticated domain controller compromise by subverting Netlogon cryptography. This vulnerability includes both ZeroLogon and non-ZeroLogon variations. CVE-2020-10704 An...

Debian DLA-2460-1 : golang-1.8 security update

Three issues have been found in golang-1.8, a Go programming language compiler version 1.8 CVE-2020-15586 Using the 100-continue in HTTP headers received by a net/http/Server can lead to a data race involving the connection's buffered writer. CVE-2020-16845 Certain invalid inputs to ReadUvarint o...

Debian DLA-2459-1 : golang-1.7 security update

Two issues have been found in golang-1.7, a Go programming language compiler version 1.7 CVE-2020-15586 Using the 100-continue in HTTP headers received by a net/http/Server can lead to a data race involving the connection's buffered writer. CVE-2020-16845 Certain invalid inputs to ReadUvarint or...

[SECURITY] [DLA 2462-1] cimg security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2462-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk November 23, 2020 https://wiki.debian.org/LTS -...

Debian: Security Advisory (DLA-2460-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2460-1] golang-1.8 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2460-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz November 21, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2459-1] golang-1.7 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2459-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz November 21, 2020 https://wiki.debian.org/LTS -...

Debian: Security Advisory (DLA-2458-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...