Debian DLA-1100-1 : gdk-pixbuf security update

Marcin Noga discovered a buffer overflow in the JPEG loader of the GDK Pixbuf library, which may result in the execution of arbitrary code if a malformed file is opened. For Debian 7 'Wheezy', these problems have been fixed in version 2.26.1-1+deb7u6. We recommend that you upgrade your gdk-pixbuf...

Debian DLA-1098-1 : freexl security update

The Cisco Talos team reported two sensitive security issues affecting FreeXL-1.0.3 and any previous version. CVE-2017-2923 An exploitable heap based buffer overflow vulnerability exists in the readbiffnextrecord function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption...

[SECURITY] [DLA 1097-1] tcpdump security update

Package : tcpdump Version : 4.9.2-1deb7u1 CVE ID : CVE-2017-12894 CVE-2017-12895 CVE-2017-12896 CVE-2017-12897 CVE-2017-12898 CVE-2017-12899 CVE-2017-12900 CVE-2017-12901 CVE-2017-12902 CVE-2017-12985 CVE-2017-12986 CVE-2017-12987 CVE-2017-12988 CVE-2017-12989 CVE-2017-12990 CVE-2017-12991...

[SECURITY] [DLA 1096-1] wordpress-shibboleth security update

Package : wordpress-shibboleth Version : 1.4-2+deb7u1 CVE ID : CVE-2017-14313 Debian Bug : 874416 It was discovered that there was a an XSS vulnerability in the login form of the "Shibboleth" identity provider module for Wordpress. For Debian 7 "Wheezy", this issue has been fixed in...

Debian DLA-1095-1 : freerdp security update

Tyler Bohan of Talos discovered that FreeRDP, a free implementation of the Remote Desktop Protocol RDP, contained several vulnerabilities that allowed a malicious remote server or a man-in-the-middle to either cause a DoS by forcibly terminating the client, or execute arbitrary code on the client...

[SECURITY] [DLA 1087-2] icedove/thunderbird regression update

Package : icedove Version : 1:52.3.0-4deb7u2 The update for icedove/thunderbird issued as DLA-1087-1 did not build on i386. This update corrects this. For reference, the original advisory text follows. Multiple security issues have been found in the Mozilla Thunderbird mail client: Multiple memor...

CVE-2017-14173

In the function ReadTXTImage in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuantumRangedepth+1" when "depth" is large, producing a smaller value than expected. As a result, an infinite loop would occur for a crafted TXT file that claims a...

Debian DLA-1090-1 : tcpdump security update

Several vulnerabilities have been discovered in tcpdump, a command-line network traffic analyzer. These vulnerabilities might result in denial of service application crash. For Debian 7 'Wheezy', these problems have been fixed in version 4.9.0-1deb7u2. We recommend that you upgrade your tcpdump...

[SECURITY] [DLA 1090-1] tcpdump security update

Package : tcpdump Version : 4.9.0-1deb7u2 CVE ID : CVE-2017-11108 CVE-2017-11541 CVE-2017-11542 CVE-2017-11543 Several vulnerabilities have been discovered in tcpdump, a command-line network traffic analyzer. These vulnerabilities might result in denial of service application crash. For Debian 7...

Debian DLA-1087-2 : icedove/thunderbird regression update

The update for icedove/thunderbird issued as DLA-1087-1 did not build on i386. This update corrects this. For reference, the original advisory text follows. Multiple security issues have been found in the Mozilla Thunderbird mail client: Multiple memory safety errors, buffer overflows and other...

Debian DLA-1089-1 : irssi security update

Some Irssi issues were found : CVE-2017-10965 An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer. CVE-2017-10966 An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi...

Debian DLA-1088-1 : irssi security update

Irssi has some issues where remote attackers might be able to cause a crash. CVE-2017-9468 In irssi, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. CVE-2017-9469 In irssi, when receiving certain incorrectly quoted DCC files, it tries to find the...

Debian DLA-1085-1 : libidn2-0 security update

It was discovered that there was an integer overflow vulnerability in libidn2-0's Punycode handling an encoding used to convert Unicode characters to ASCII which would have allowed attackers to cause a remote denial of service. For Debian 7 'Wheezy', this issue has been fixed in libidn2-0 version...

Debian DLA-1082-1 : graphicsmagick security update

CVE-2017-13776 CVE-2017-13777 denial of service issue in ReadXBMImage CVE-2017-12935 The ReadMNGImage function in coders/png.c mishandles large MNG images, leading to an invalid memory read in the SetImageColorCallBack function in magick/image.c. CVE-2017-12936 The ReadWMFImage function in...

[SECURITY] [DLA 1083-1] openexr security update

Package : openexr Version : 1.6.1-6+deb7u1 CVE ID : CVE-2017-9110 CVE-2017-9112 CVE-2017-9116 Debian Bug : 864078 Brandon Perry discovered that openexr, a high dynamic-range HDR image library, was affected by an integer overflow vulnerability and missing boundary checks that would allow a remote...

[SECURITY] [DLA 1082-1] graphicsmagick security update

Package : graphicsmagick Version : 1.3.16-1.1+deb7u9 CVE ID : CVE-2017-12935 CVE-2017-12936 CVE-2017-12937 CVE-2017-13063 CVE-2017-13064 CVE-2017-13065 CVE-2017-13776 CVE-2017-13777 CVE-2017-13776 CVE-2017-13777 denial of service issue in ReadXBMImage CVE-2017-12935 The ReadMNGImage function in...

[SECURITY] [DLA 1080-1] gnupg security update

Package : gnupg Version : 1.4.12-7+deb7u9 CVE ID : CVE-2017-7526 Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink, Nadia Heninger, Tanja Lange, Christine van Vredendaal and Yuval Yarom discovered that gnupg is prone to a local side-channel attack allowing full key...

[SECURITY] [DLA 1076-1] php5 security update

Package : php5 Version : 5.4.45-0+deb7u11 CVE ID : CVE-2017-12933 The finishnesteddata function in ext/standard/varunserializer.re in PHP is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of PHP. For Debia...

[SECURITY] [DLA 1074-1] poppler security update

Package : poppler Version : 0.18.4-6+deb7u2 CVE ID : CVE-2013-4473 CVE-2013-4474 CVE-2017-9775 CVE-2017-9776 CVE-2017-9865 Several buffer and integer overflow issues were discovered in Poppler, a PDF library, that could lead to application crash or possibly other unspecified impact via maliciousl...

Debian DLA-1070-1 : qemu security update

Multiple vulnerabilities were discovered in qemu, a fast processor emulator. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2017-6505 Denial of service via infinite loop in the USB OHCI emulation CVE-2017-8309 Denial of service via VNC audio capture...