DLA-584-1 libsys-syslog-perl - security update

Bulletin has no description...

Debian DLA-581-1 : libreoffice security update

Aleksandar Nikolic discovered that missing input sanitising in the RTF parser in Libreoffice may result in the execution of arbitrary code if a malformed documented is opened. For Debian 7 'Wheezy', these problems have been fixed in version 1:3.5.4+dfsg2-0+deb7u7. We recommend that you upgrade yo...

[SECURITY] [DLA 583-1] lighttpd security update

Package : lighttpd Version : 1.4.31-4+deb7u5 CVE ID : CVE-2016-1000212 Debian Bug : 832571 Dominic Scheirlinck and Scott Geary of Vend reported an insecure behaviour in the lighttpd web server. Lighttpd assigned Proxy header values from client requests to internal HTTPPROXY environment variables...

DLA-575-2 collectd - regression update

Bulletin has no description...

WikWiki 2.1 Cross Site Scripting

Exploit Title: WikWiki - Reflected XSS Date: 2016-08-01 Exploit Author: HaHwul Vendor Homepage: https://github.com/smasty/WikWiki Software Link: https://github.com/smasty/WikWiki/archive/master.zip Version: v2.1 Tested on: DebianWhezzy CVE : none Vulnerability Point Edit page is not filtered...

Debian DLA-547-2 : graphicsmagick regression update

The fix for CVE-2016-5240 was improperly applied which resulted in GraphicsMagick crashing instead of entering an infinite loop with the given proof of concept. Furthermore, the original announcement mistakently used the identifier 'DLA 574-1' instead of the correct one, 'DLA 547-1'. For Debian 7...

DLA-583-1 lighttpd - security update

Bulletin has no description...

DLA-581-1 libreoffice - security update

Bulletin has no description...

DLA-582-1 libidn - security update

Bulletin has no description...

[SECURITY] [REGRESSION] [DLA -] graphite2 regression update

Package : graphite2 Version : 1.3.6-1deb7u2 The previous upload of graphite2 on 2016-04-26 included a .shlib file which did not match the shipped shared libraries preventing packages build-depending on graphite2 libraries to build. For Debian 7 "Wheezy", these problems have been fixed in version...

Debian DLA-569-1 : xmlrpc-epi security update

Integer signedness error in the simplestringaddn function in simplestring.c in xmlrpc-epi through 0.54.2 allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via a long first argument to the PHP xmlrpcencoderequest function. For...

Debian DLA-570-1 : kde4libs security update

It was possible to trick kde4libs's KArchiveDirectory::copyTo function to extract files to arbitrary system locations from a specially prepared tar file outside of the extraction folder. For Debian 7 'Wheezy', these problems have been fixed in version 4:4.8.4-4+deb7u2. We recommend that you upgra...

Debian DLA-566-1 : cakephp security update

CakePHP, an open source web application framework for PHP, was vulnerable to SSRF Server Side Request Forgery attacks. Remote attacker can utilize it for at least DoS Denial of Service attacks, if the target application accepts XML as an input. It is caused by insecure design of Cake's Xml class...

Debian DLA-571-1 : xen security update (Bunker Buster)

Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2014-3672 XSA-180 Andrew Sorensen discovered that a HVM domain can exhaust the hosts disk space by filling up the log file. CVE-2016-3158,...

Debian DLA-575-2 : collectd regression update

The previous upload of collectd surfaced a problem in the way the network plugin initializes gcrypt preventing the plugin from being loaded when packet signing or encryption is enabled. Previously, this may have led to program crashes. For Debian 7 'Wheezy', these problems have been fixed in...

Debian DLA-568-1 : wordpress security update (httpoxy)

Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following issues. CVE-2016-5387 WordPress allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via...

DLA-580-1 graphite2 - regression update

Bulletin has no description...

Debian DLA-573-1 : qemu security update

Multiple vulnerabilities have been discovered in QEMU, a fast processor emulator. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2015-5239 Lian Yihan discovered that QEMU incorrectly handled certain payload messages in the VNC display driver. A malicious...

DLA-579-1 openjdk-7 - security update

Bulletin has no description...

[SECURITY] [DLA 578-1] openssh security update

Package : openssh Version : 6.0p1-4+deb7u5 CVE ID : CVE-2016-6210 OpenSSH secure shell client and server had a user enumeration problem reported. CVE-2016-6210 User enumeration via covert timing channel For Debian 7 "Wheezy", this problem has been fixed in version 6.0p1-4+deb7u5. We recommend tha...