Debian DLA-2361-1 : libx11 security update

Jayden Rivers found an integer overflow in the initom function of libX11, the X11 client-side library, which could lead to a double free. For Debian 9 stretch, this problem has been fixed in version 2:1.6.4-3+deb9u3. We recommend that you upgrade your libx11 packages. For the detailed security...

[SECURITY] [DLA 2360-1] thunderbird security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2360-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort August 31, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2359-1 : xorg-server security update

Several issues have been found in xorg-server, the X server from xorg. Basically all issues are out-of-bounds access or integer underflows in different request handlers. One CVE is about a leak of uninitialize heap memory to clients. For Debian 9 stretch, these problems have been fixed in version...

Debian DLA-2354-1 : ndpi security update

An issue has been found in ndpi, an extensible deep packet inspection library. The Oracle protocol dissector contains an heap-based buffer over-read, which could crash the application that uses this library and may result in denial of service. For Debian 9 stretch, this problem has been fixed in...

Debian DLA-2357-1 : ros-actionlib security update

Use of unsafe yaml load was fixed in ros-actionlib, the Robot OS actionlib library. For Debian 9 stretch, this problem has been fixed in version 1.11.7-1+deb9u1. We recommend that you upgrade your ros-actionlib packages. For the detailed security status of ros-actionlib please refer to its securi...

health-record-tracker-for-adults.com Cross Site Scripting vulnerability OBB-1287360

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

[SECURITY] [DLA 2358-1] openexr security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2358-1 [email protected] https://www.debian.org/lts/security/ August 30, 2020 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package...

[SECURITY] [DLA 2357-1] ros-actionlib security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2357-1 [email protected] https://www.debian.org/lts/security/ August 30, 2020 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package...

[SECURITY] [DLA 2354-1] ndpi security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2354-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz August 29, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2351-1] php-horde-kronolith security update

Debian LTS Advisory DLA-2351-1 [email protected] https://www.debian.org/lts/security/ Mike Gabriel August 29, 2020 https://wiki.debian.org/LTS Package : php-horde-kronolith Version : 4.2.19-1+deb9u2 CVE ID : CVE-2017-16906 Debian Bug : 909737 In Horde Groupware, there has been an XSS...

Debian DLA-2346-1 : firefox-esr security update

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or unintended or malicious extensions being installed. For Debian 9 stretch, these problems have been fixed in version 68.12.0esr-1deb9u1. We recommend th...

Server secret was included in static assets and served to clients

Impact Server JWT signing secret was included in static assets and served to clients. This ALLOWS Flood's builtin authentication to be bypassed. Given Flood is granted access to rTorrent's SCGI interface which is unprotected and ALLOWS arbitrary code execution and usually wide-ranging privileges ...

[SECURITY] [DLA 2345-1] php7.0 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2345-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb August 26, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2338-2] proftpd-dfsg regression update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2338-2 [email protected] https://www.debian.org/lts/security/ Markus Koschany August 25, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2343-1 : icingaweb2 security update

A directory traversal vulnerability was discovered in Icinga Web 2, a web interface for Icinga, which could result in the disclosure of files readable by the process. For Debian 9 stretch, this problem has been fixed in version 2.4.1-1+deb9u1. We recommend that you upgrade your icingaweb2 package...

Debian DLA-2336-1 : firejail security update

Tim Starling discovered two vulnerabilities in firejail, a sandbox program to restrict the running environment of untrusted applications. CVE-2020-17367 It was reported that firejail does not respect the end-of-options separator '--', allowing an attacker with control over the command line option...

Debian DLA-2340-2 : sqlite3 regression update

The update of sqlite3 released as DLA-2340-1 contained an incomplete fix for CVE-2019-20218. Updated sqlite3 packages are now available to correct this issue. For Debian 9 stretch, this problem has been fixed in version 3.16.2-5+deb9u3. We recommend that you upgrade your sqlite3 packages. For the...

CVE-2020-7711

This affects all versions of package github.com/russellhaering/goxmldsig. There is a crash on nil-pointer dereference caused by sending malformed XML signatures...

[SECURITY] [DLA 2336-1] firejail security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2336-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz August 22, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2333-1] imagemagick security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2333-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany August 18, 2020 https://wiki.debian.org/LTS -...