File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c.

...

Debian DLA-2410-1 : bluez security update

It was discovered that there was a double-free vulnerability in bluez, a suite of Bluetooth tools, utilities and daemons. For Debian 9 'Stretch', this problem has been fixed in version 5.43-2+deb9u3. We recommend that you upgrade your bluez packages. For the detailed security status of bluez plea...

MGASA-2014-0554 Updated xlockmore packages fix a security vulnerability

Updated xlockmore packages fix security vulnerability xlockmore before 5.45 contains a security flaw related to a bad value of fnt for pyro2 which could cause an X error. This update backports the fix for version 5.43...