Debian DLA-1211-1 : libxml2 security update

CVE-2017-15412 It was detected that some function calls in the XPath extensions functions could result in memory corruption due to 'use after free'. For Debian 7 'Wheezy', these problems have been fixed in version 2.8.0+dfsg1-7+wheezy12. We recommend that you upgrade your libxml2 packages. NOTE:...

Debian DLA-1209-1 : sensible-utils security update

It was discovered that there was a vulnerability in sensible-browser, a utility to start the most suitable web browser based on your environment or configuration. Remote attackers could conduct argument-injection attacks via specially- crafted URIs. For Debian 7 'Wheezy', this issue has been fixe...

Debian DLA-1207-1 : erlang security update (ROBOT)

An erlang TLS server configured with cipher suites using RSA key exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack against RSA, which when exploited, may result in plaintext recovery of encrypted messages and/or a Man-in-the-middle MiTM attack, despite...

[SECURITY] [DLA 1210-1] kildclient security update

Package : kildclient Version : 2.11.1-1+deb7u1 CVE ID : CVE-2017-17511 It was discovered that there was a command-injection vulnerability in kildclient, a "MUD" multiplayer real-time virtual world game. For Debian 7 "Wheezy", this issue has been fixed in kildclient version 2.11.1-1+deb7u1. Thanks...

[SECURITY] [DLA 1206-1] tiff security update

Package : tiff Version : 4.0.2-6+deb7u17 CVE ID : CVE-2017-9935 Debian Bug : 866109 In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2pwritepdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an...

Debian DLA-1205-1 : simplesamlphp security update

The simplesamlphp package in wheezy is vulnerable to multiple attacks on authentication-related code, leading to unauthorized access and information disclosure. CVE-2017-12867 The SimpleSAMLAuthTimeLimitedToken class allows attackers with access to a secret token to extend its validity period by...

Debian DLA-1206-1 : tiff security update

In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2pwritepdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or t2pfree, memory...

[SECURITY] [DLA 1205-1] simplesamlphp security update

Package : simplesamlphp Version : 1.9.2-1+deb7u1 CVE ID : CVE-2017-12867 CVE-2017-12868 CVE-2017-12869 CVE-2017-12872 CVE-2017-12873 CVE-2017-12874 The simplesamlphp package in wheezy is vulnerable to multiple attacks on authentication-related code, leading to unauthorized access and information...

Debian DLA-1201-1 : libxcursor security update

It was discovered that libXcursor, a X cursor management library, is prone to several heap overflows when parsing malicious files. An attacker can take advantage of these flaws for arbitrary code execution, if a user is tricked into processing a specially crafted cursor file. For Debian 7 'Wheezy...

CVE-2016-1255

The pgctlcluster script in postgresql-common package in Debian wheezy before 134wheezy5, in Debian jessie before 165+deb8u2, in Debian unstable before 178, in Ubuntu 12.04 LTS before 129ubuntu1.2, in Ubuntu 14.04 LTS before 154ubuntu1.1, in Ubuntu 16.04 LTS before 173ubuntu0.1, in Ubuntu 17.04...

Debian DLA-1195-1 : curl security update

CVE-2017-8817 Fuzzing by the OSS-Fuzz project led to the discovery of a read out of bounds flaw in the FTP wildcard function in libcurl. A malicious server could redirect a libcurl-based client to an URL using a wildcard pattern, triggering the out-of-bound read. For Debian 7 'Wheezy', these...

Debian DLA-1197-1 : sox security update

Various security vulnerabilities were discovered in sox, a command line utility to convert audio formats, that may lead to a denial of service application crash / infinite loop or memory corruptions by processing a malformed input file. For Debian 7 'Wheezy', these problems have been fixed in...

[SECURITY] [DLA 1197-1] sox security update

Package : sox Version : 14.4.0-3+deb7u2 CVE ID : CVE-2017-11332 CVE-2017-11358 CVE-2017-11359 CVE-2017-15370 CVE-2017-15371 CVE-2017-15372 CVE-2017-15642 Debian Bug : 870328 878810 878809 878808 882236 882144 Various security vulnerabilities were discovered in sox, a command line utility to conve...

[SECURITY] [DLA 1196-1] optipng security update

Package : optipng Version : 0.6.4-1+deb7u4 CVE ID : CVE-2017-16938 Debian Bug : 878839 optipng, an advanced PNG Portable Network Graphics optimizer, has been found vulnerable to a buffer overflow which allows remote attackers to cause a denial-of-service attack or other unspecified impact with a...

[SECURITY] [DLA 1194-1] libxml2 security update

Package : libxml2 Version : 2.8.0+dfsg1-7+wheezy11 CVE ID : CVE-2017-16931 CVE-2017-16932 CVE-2017-16931 parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a % character in a DTD name...

[SECURITY] [DLA 1193-1] roundcube security update

Package : roundcube Version : 0.7.2-9+deb7u9 CVE ID : CVE-2017-16651 A file disclosure vulnerability was discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers. CVE-2017-16651 An authenticated attacker can take advantage of this flaw to read roundcubes configuration fil...

Debian DLA-1187-1 : openjdk-7 security update

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in impersonation of Kerberos services, denial of service, unauthorized access, sandbox bypass or HTTP header injection. For Debian 7 'Wheezy', these problems have been fixed in versio...

Debian DLA-1186-1 : xorg-server security update

Several vulnerabilities have been discovered in the X.Org X server. An attacker who's able to connect to an X server could cause a denial of service or potentially the execution of arbitrary code. For Debian 7 'Wheezy', these problems have been fixed in version 2:1.12.4-6+deb7u8. We recommend tha...

Debian DLA-1189-1 : python2.7 security update

A minor security vulnerability has been discovered in Python 2.7, an interactive high-level object-oriented language. CVE-2017-1000158 CPython the reference implementation of Python also commonly known as simply Python versions 2.6 and 2.7 are vulnerable to an integer overflow and heap corruption...

Debian DLA-1191-1 : python-werkzeug security update

A security issue that allows XSS on the Werkzeug debugger allows remote attackers to inject arbitrary stuff via a field that contains an exception message. For Debian 7 'Wheezy', these problems have been fixed in version 0.8.3+dfsg-1+deb7u1. We recommend that you upgrade your python-werkzeug...