Debian DLA-2447-2 : pacemaker regression update

The update of pacemaker released as DLA-2447-1 caused a regression when the communication between the Corosync cluster engine and pacemaker takes place. A permission problem prevents IPC requests between cluster nodes. The patch for CVE-2020-25654 has been reverted until a better solution can be...

Debian DLA-2445-1 : libmaxminddb security update

A heap-based buffer over-read has been found in libmaxminddb, an IP geolocation database library. This could be exploited when the mmdblookup tool is used to open a specially crafted database file. For Debian 9 stretch, this problem has been fixed in version 1.2.0-1+deb9u1. We recommend that you...

Debian DLA-2448-1 : firefox-esr security update

A use-after-free was found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code. For Debian 9 stretch, this problem has been fixed in version 78.4.1esr-1deb9u1. We recommend that you upgrade your firefox-esr packages. For the detailed security stat...

Debian: Security Advisory (DLA-2445-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2446-1] moin security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2446-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz November 10, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2445-1] libmaxminddb security update

Debian LTS Advisory DLA-2445-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany November 10, 2020 https://wiki.debian.org/LTS Package : libmaxminddb Version : 1.2.0-1+deb9u1 CVE ID : CVE-2020-28241 Debian Bug : 973878 A heap-based buffer over-read has been found in...

[SECURITY] [DLA 2444-1] tcpdump security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2444-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta November 10, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2442-1 : obfs4proxy security update

golang-go.crypto was recently updated with a fix for CVE-2019-11840. This in turn requires all packages that use the affected code to be recompiled in order to pick up the security fix. CVE-2019-11840 An issue was discovered in supplementary Go cryptography libraries, aka...

Debian DLA-2441-1 : sympa security update

A privilege escalation was discovered in Sympa, a modern mailing list manager. It is fixed when Sympa is used in conjunction with common MTAs such as Exim or Postfix by disabling a setuid executable, although no fix is currently available for all environments such as sendmail. Additionally, an...

[SECURITY] [DLA 2442-1] obfs4proxy security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2442-1 [email protected] https://www.debian.org/lts/security/ Brian May November 10, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2437-1 : krb5 security update

It was discovered that there was a denial of service vulnerability in the MIT Kerberos network authentication system, krb5. The lack of a limit in the ASN.1 decoder could lead to infinite recursion and allow an attacker to overrun the stack and cause the process to crash. For Debian 9 'Stretch',...

Debian DLA-2436-1 : sddm security update

It was discovered that there was an issue in the sddm display manager where local unprivileged users could create a connection to the X server. For Debian 9 'Stretch', this problem has been fixed in version 0.14.0-4+deb9u2. We recommend that you upgrade your sddm packages. For the detailed securi...

Debian DLA-2435-1 : guacamole-server security update

The server component of Apache Guacamole, a remote desktop gateway, did not properly validate data received from RDP servers. This could result in information disclosure or even the execution of arbitrary code. CVE-2020-9497 Apache Guacamole does not properly validate data received from RDP serve...

Debian DLA-2438-1 : raptor2 security update

It was discovered that there were two heap overflow vulnerabilities in raptor2, a set of parsers for RDF files that is used, amongst others, in LibreOffice. For Debian 9 'Stretch', this problem has been fixed in version 2.0.14-1+deb9u1. We recommend that you upgrade your raptor2 packages. For the...

[SECURITY] [DLA 2440-1] poppler security update

Debian LTS Advisory DLA-2440-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany November 08, 2020 https://wiki.debian.org/LTS Package : poppler Version : 0.48.0-2+deb9u4 CVE ID : CVE-2017-14926 CVE-2017-14928 CVE-2018-19058 CVE-2018-20650 CVE-2018-20662 CVE-2019-73...

Debian: Security Advisory (DLA-2437-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2439-1] libexif security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2439-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta November 07, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2438-1] raptor2 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2438-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb November 07, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2436-1] sddm security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2436-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb November 06, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2430-1 : blueman security update

Vaisha Bernard discovered that Blueman, a graphical bluetooth manager performed insufficient validation on a D-Bus interface, which could result in denial of service or privilege escalation. For Debian 9 stretch, this problem has been fixed in version 2.0.4-1+deb9u1. We recommend that you upgrade...