Debian DLA-1188-1 : libxml2 security update

Pranjal Jumde @pjumde reported an heap overflow in memory debug code of libxml2. For Debian 7 'Wheezy', these problems have been fixed in version 2.8.0+dfsg1-7+wheezy10. We recommend that you upgrade your libxml2 packages. NOTE: Tenable Network Security has extracted the preceding description blo...

[SECURITY] [DLA 1190-1] python2.6 security update

Package : python2.6 Version : 2.6.8-1.1+deb7u1 CVE ID : CVE-2017-1000158 A minor security vulnerability has been discovered in Python 2.7, an interactive high-level object-oriented language. CVE-2017-1000158 CPython the reference implementation of Python also commonly known as simply Python...

[SECURITY] [DLA 1189-1] python2.7 security update

Package : python2.7 Version : 2.7.3-6+deb7u4 CVE ID : CVE-2017-1000158 A minor security vulnerability has been discovered in Python 2.7, an interactive high-level object-oriented language. CVE-2017-1000158 CPython the reference implementation of Python also commonly known as simply Python version...

[SECURITY] [DLA 1187-1] openjdk-7 security update

Package : openjdk-7 Version : 7u151-2.6.11-2deb7u2 CVE ID : CVE-2017-10274 CVE-2017-10281 CVE-2017-10285 CVE-2017-10295 CVE-2017-10345 CVE-2017-10346 CVE-2017-10347 CVE-2017-10348 CVE-2017-10349 CVE-2017-10350 CVE-2017-10355 CVE-2017-10356 CVE-2017-10357 CVE-2017-10388 Several vulnerabilities hav...

[SECURITY] [DLA 1186-1] xorg-server security update

Package : xorg-server Version : 2:1.12.4-6+deb7u8 CVE ID : CVE-2017-2624 CVE-2017-12176 CVE-2017-12177 CVE-2017-12178 CVE-2017-12180 CVE-2017-12182 CVE-2017-12183 CVE-2017-12184 CVE-2017-12185 CVE-2017-12187 CVE-2017-13723 Several vulnerabilities have been discovered in the X.Org X server. An...

[SECURITY] [DLA 1185-1] sam2p security update

Package : sam2p Version : 0.49.1-1+deb7u2 CVE ID : CVE-2017-16663 It was discovered that sam2p, a utility to convert raster images and other image formats, was affected by an integer overflow vulnerability with resultant heap-based buffer overflow in input-bmp.ci because width and height...

Debian DLA-1181-1 : xen security update

Multiple vulnerabilities have been discovered in the Xen hypervisor : CVE-2017-15588 Jann Horn discovered a race condition that can cause a stale TLB entry which might result in privilege escalation, denial of service or information leak. CVE-2017-15589 Roger Pau Monn discovered a hypervisor stac...

Debian DLA-1179-1 : shibboleth-sp2 security update

Rod Widdowson of Steading System Software LLP discovered a coding error in the 'Dynamic' metadata plugin of the Shibboleth Service Provider, causing the plugin to fail configuring itself with the filters provided and omitting whatever checks they are intended to perform. For Debian 7 'Wheezy',...

Debian DLA-1178-1 : opensaml2 security update

Rod Widdowson of Steading System Software LLP discovered a coding error in the OpenSAML library, causing the DynamicMetadataProvider class to fail configuring itself with the filters provided and omitting whatever checks they are intended to perform. For Debian 7 'Wheezy', these problems have bee...

Debian DLA-1174-1 : konversation security update

It was discovered that there was a denial of service vulnerability in the konversation IRC client related to parsing of color formatting codes. For Debian 7 'Wheezy', this issue has been fixed in konversation version 1.4-1+deb7u2. We recommend that you upgrade your konversation packages. NOTE:...

[SECURITY] [DLA 1178-1] opensaml2 security update

Package : opensaml2 Version : 2.4.3-4+deb7u2 CVE ID : CVE-2017-16853 Debian Bug : 881856 Rod Widdowson of Steading System Software LLP discovered a coding error in the OpenSAML library, causing the DynamicMetadataProvider class to fail configuring itself with the filters provided and omitting...

[SECURITY] [DLA 1173-1] procmail security update

Package : procmail Version : 3.22-20+deb7u2 CVE ID : CVE-2017-16844 Debian Bug : 876511 It was discovered that there was a heap-based buffer overflow in procmail, a tool used to sort incoming mail into various directories and filter out spam messages. For Debian 7 "Wheezy", this issue has been...

[SECURITY] [DLA 1172-1] firefox-esr security update

Package : firefox-esr Version : 52.5.0esr-1deb7u1 CVE ID : CVE-2017-7826 CVE-2017-7828 CVE-2017-7830 Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary...

[SECURITY] [DLA 1170-1] graphicsmagick security update

Package : graphicsmagick Version : 1.3.16-1.1+deb7u15 CVE ID : CVE-2017-13134 CVE-2017-16547 Debian Bug : 881524 Security vulnerabilities have been identified in graphicsmagick, a collection of image processing utilities and libraries. CVE-2017-13134 Graphicsmagick was vulnerable to a heap-based...

Debian DLA-1168-1 : graphicsmagick security update

A remote denial of service vulnerability has been discovered in graphicsmagick, a collection of image processing tools and associated libraries. A specially crafted file can be used to produce a heap-based buffer overflow and application crash by exploiting a defect in the AcquireCacheNexus...

[SECURITY] [DLA 1166-2] tomcat7 regression update

Package : tomcat7 Version : 7.0.28-4+deb7u17 Debian Bug : 881162 The update for tomcat7 issued as DLA-1166-1 caused a regressions whereby every request, including for the root document /, returned HTTP status 404. Updated packages are now available to address this problem. For reference, the...

[SECURITY] [DLA-1157-1] openssl security update

Package : openssl Version : 1.0.1t-1+deb7u3 CVE ID : CVE-2017-3735 A security vulnerability was discovered in OpenSSL, the Secure Sockets Layer toolkit. CVE-2017-3735 It was discovered that OpenSSL is prone to a one-byte buffer overread while parsing a malformed IPAddressFamily extension in an...

Debian DLA-1165-1 : libpam4j security update

It was discovered that libpam4j, a Java binding for libpam.so, does not call pamacctmgmt. As a consequence, the PAM account is not properly verified. Any user with a valid password but with deactivated or disabled account was able to log in. For Debian 7 'Wheezy', these problems have been fixed i...

Debian DLA-1164-1 : mupdf security update

Two security issues were discovered in mupdf, a lightweight PDF viewer. CVE-2017-14687 MuPDF allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because of mishandling of XML tag name comparisons. CVE-2017-15587 An integer...

Debian DLA-1166-2 : tomcat7 regression update

The update for tomcat7 issued as DLA-1166-1 caused a regressions whereby every request, including for the root document /, returned HTTP status 404. Updated packages are now available to address this problem. For reference, the original advisory text follows. When HTTP PUT was enabled e.g., via...