[SECURITY] [DLA 1372-1] libdatetime-timezone-perl new upstream release

Package : libdatetime-timezone-perl Version : 1:1.58-1+2018e This update includes the changes in tzdata 2018e for the Perl bindings. For the list of changes, see DLA-1371-1. For Debian 7 "Wheezy", these problems have been fixed in version 1:1.58-1+2018e. We recommend that you upgrade your...

[SECURITY] [DLA 1371-1] tzdata new upstream release

Package : tzdata Version : 2018e-0+deb7u1 This update includes the changes in tzdata 2018e. Notable changes are: - North Korea switches back to +09 on 2018-05-05. For Debian 7 "Wheezy", these problems have been fixed in version 2018e-0+deb7u1. We recommend that you upgrade your tzdata packages...

[SECURITY] [DLA 1370-1] quassel security update

Package : quassel Version : 0.8.0-1+deb7u4 CVE ID : CVE-2018-1000178 It was found that the Quassel IRC client was vulnerable to a remote code execution vulnerability due to insufficient checks in the deserializer code. For Debian 7 "Wheezy", these problems have been fixed in version 0.8.0-1+deb7u...

Debian: Security Advisory (DLA-1366-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-1365-1 : drupal7 security update (Drupalgeddon 2)

A remote code execution vulnerability has been found within multiple subsystems of Drupal. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. For Debian 7 'Wheezy', these problems have been fixed in version...

Debian DLA-1364-1 : openslp-dfsg security update

CVE-2017-17833 An issue has been found in openslp that is related to heap memory corruption, which may result in a denial of service or remote code execution. For Debian 7 'Wheezy', these problems have been fixed in version 1.2.1-9+deb7u2. We recommend that you upgrade your openslp-dfsg packages...

Debian DLA-1363-1 : ghostscript security update

It was discovered that the settextdistance function in base/gdevpdts.c in the pdfwrite component in Ghostscript does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a...

[SECURITY] [DLA 1364-1] openslp-dfsg security update

Package : openslp-dfsg Version : 1.2.1-9+deb7u2 CVE ID : CVE-2017-17833 CVE-2017-17833 An issue has been found in openslp that is related to heap memory corruption, which may result in a denial-of-service or remote code execution. For Debian 7 "Wheezy", these problems have been fixed in version...

Debian DLA-1360-1 : lucene-solr security update

It was discovered that there was an XML external entity expansion XXE vulnerability in lucene-solr, a search engine library for Java. It could be exploited to read arbitrary local files from the Solr server or the internal network. For Debian 7 'Wheezy', this issue has been fixed in lucene-solr...

Debian DLA-1359-1 : ruby1.8 security update

Multiple vulnerabilities were found in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2017-17742 Aaron Patterson reported that WEBrick bundled with Ruby was vulnerable to an HTTP response splitting vulnerability. It wa...

Debian: Security Advisory (DLA-1360-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-1357-1 : gunicorn security update

It was discovered that there was an issue in the gunicorn HTTP server for Python applicatons where CRLF sequences could result in an attacker tricking the server into returning arbitrary headers. For more information and background, please see :...

Debian DLA-1356-1 : libreoffice security update

Fuzzing by the OSS-Fuzz project found two memory safety issues in LibreOffice, which could result in an application crash or possibly other unspecified impact. For Debian 7 'Wheezy', these problems have been fixed in version 1:3.5.4+dfsg2-0+deb7u11. We recommend that you upgrade your libreoffice...

Debian: Security Advisory (DLA-1352-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-1352-1 : jruby security update

An unsafe object deserialization vulnerability was found in jruby, a 100% pure-Java implementation of Ruby. An attacker can use this flaw to run arbitrary code when gem owner is run on a specially crafted YAML file. For Debian 7 'Wheezy', these problems have been fixed in version 1.5.6-5+deb7u2. ...

Debian DLA-1350-1 : qemu-kvm security update

The loadmultiboot function in hw/i386/multiboot.c in Quick Emulator aka QEMU allows local guest OS users to execute arbitrary code on the QEMU host via a mhloadendaddr value greater than mhbssendaddr, which triggers an out-of-bounds read or write memory access. For Debian 7 'Wheezy', these proble...

Debian: Security Advisory (DLA-1354-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1351-1] qemu security update

Package : qemu Version : 1.1.2+dfsg-6+deb7u25 CVE ID : CVE-2018-7550 Debian Bug : 892041 The loadmultiboot function in hw/i386/multiboot.c in Quick Emulator aka QEMU allows local guest OS users to execute arbitrary code on the QEMU host via a mhloadendaddr value greater than mhbssendaddr, which...

[SECURITY] [DLA 1350-1] qemu-kvm security update

Package : qemu-kvm Version : 1.1.2+dfsg-6+deb7u25 CVE ID : CVE-2018-7550 Debian Bug : 892041 The loadmultiboot function in hw/i386/multiboot.c in Quick Emulator aka QEMU allows local guest OS users to execute arbitrary code on the QEMU host via a mhloadendaddr value greater than mhbssendaddr, whi...

[SECURITY] [DLA 1348-1] patch security update

Package : patch Version : 2.6.1-3+deb7u1 CVE ID : CVE-2018-1000156 Debian Bug : 894993 It was discovered that there was an input validation vulnerability in the patch1 utility where an ed1 script embedded in a regular input file could result in arbitrary code execution. This was reported by Rache...