[SECURITY] [DLA 2458-1] drupal7 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2458-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort November 19, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2457-1] firefox-esr security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2457-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort November 19, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2432-1] jupyter-notebook security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2432-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA November 19, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2456-1 : python3.5 security update

Multiple security issues were discovered in Python. CVE-2019-20907 In Lib/tarfile.py, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks header validation CVE-2020-26116 http.client allows CRLF injection if the attacker contro...

Debian DLA-2454-1 : rclone security update

golang-go.crypto was recently updated with a fix for CVE-2019-11840. This in turn requires all packages that use the affected code to be recompiled in order to pick up the security fix. CVE-2019-11840 An issue was discovered in supplementary Go cryptography libraries, aka...

Debian DLA-2432-1 : jupyter-notebook security update

Several vulnerabilities have been discovered in jupyter-notebook. CVE-2018-8768 A maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous. CVE-2018-19351 allows...

[SECURITY] [DLA 2454-1] rclone security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2454-1 [email protected] https://www.debian.org/lts/security/ Brian May November 19, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2447-2] pacemaker regression update

Debian LTS Advisory DLA-2447-2 [email protected] https://www.debian.org/lts/security/ Markus Koschany November 17, 2020 https://wiki.debian.org/LTS Package : pacemaker Version : 1.1.16-1+deb9u2 Debian Bug : 974563 The update of pacemaker released as DLA-2447-1 caused a regression when t...

Debian DLA-2449-1 : thunderbird security update

A use-after-free was found in Thunderbird, which could potentially result in the execution of arbitrary code. For Debian 9 stretch, this problem has been fixed in version 1:78.4.2-1deb9u1. We recommend that you upgrade your thunderbird packages. For the detailed security status of thunderbird...

Debian DLA-2451-1 : libvncserver security update

An issue has been found in libvncserver, an API to write one's own VNC server. Due to some missing checks, a divide by zero could happen, which could result in a denial of service. For Debian 9 stretch, this problem has been fixed in version 0.9.11+dfsg-1.3deb9u6. We recommend that you upgrade yo...

Debian DLA-2452-2 : libdatetime-timezone-perl regression update

2.09-1+2020d accidentally did omit changes to some files, resulting in warnings. For Debian 9 stretch, this problem has been fixed in version 2.09-1+2020d+1. We recommend that you upgrade your libdatetime-time zone-perl packages. NOTE: Tenable Network Security has extracted the preceding...

[SECURITY] [DLA 2453-1] restic security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2453-1 [email protected] https://www.debian.org/lts/security/ Brian May November 17, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2451-1] libvncserver security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2451-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz November 15, 2020 https://wiki.debian.org/LTS -...

Debian: Security Advisory (DLA-2450-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2450-1] libproxy security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2450-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort November 13, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2449-1] thunderbird security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2449-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort November 13, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2448-1] firefox-esr security update

Debian LTS Advisory DLA-2448-1 [email protected] https://www.debian.org/lts/security/ Roberto C. Sánchez November 11, 2020 https://wiki.debian.org/LTS Package : firefox-esr Version : 78.4.1esr-1deb9u1 CVE ID : CVE-2020-26950 A use-after-free was found in the Mozilla Firefox web browser,...

Debian DLA-2446-1 : moin security update

Two vulnerabilities were discovered in moin, a Python clone of WikiWiki. CVE-2020-15275 Catarina Leite discovered that moin is prone to a stored XSS vulnerability via SVG attachments. CVE-2020-25074 Michael Chapman discovered that moin is prone to a remote code execution vulnerability via the cac...

Debian DLA-2443-1 : zeromq3 security update

It was discovered that ZeroMQ, a lightweight messaging kernel library does not properly handle connecting peers before a handshake is completed. A remote, unauthenticated client connecting to an application using the libzmq library, running with a socket listening with CURVE...

Debian DLA-2444-1 : tcpdump security update

The ppp de-capsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory. The buffer should be big enough to hold the captured data, but it doesnt need to be big enough to hold the entire on-the-network packet, if we havent captured all of it. For Debian 9 stretch, this proble...