Debian DLA-1133-1 : ming security update

Multiple vulnerabilities have been discovered in Ming : CVE-2017-11704 Heap-based buffer over-read in the function decompileIF in util/decompile.c in Ming = 0.4.8, which allows attackers to cause a denial of service via a crafted file. CVE-2017-11728 Heap-based buffer over-read in the function...

[SECURITY] [DLA 1142-1] libav security update

Package : libav Version : 6:0.8.21-0+deb7u1 CVE ID : CVE-2015-8365 CVE-2017-7208 CVE-2017-7862 CVE-2017-9992 Multiple vulnerabilities have been found in libav: CVE-2015-8365 The smkadecodeframe function in libavcodec/smacker.c does not verify that the data size is consistent with the number of...

Debian DLA-1138-1 : nss security update

Martin Thomson discovered that nss, the Mozilla Network Security Service library, is prone to a use-after-free vulnerability in the TLS 1.2 implementation when handshake hashes are generated. A remote attacker can take advantage of this flaw to cause an application using the nss library to crash,...

[SECURITY] [DLA 1138-1] nss security update

Package : nss Version : 2:3.26-1+debu7u5 CVE ID : CVE-2017-7805 Martin Thomson discovered that nss, the Mozilla Network Security Service library, is prone to a use-after-free vulnerability in the TLS 1.2 implementation when handshake hashes are generated. A remote attacker can take advantage of...

Debian DLA-1135-1 : db security update

It was found that the Berkeley DB reads DBCONFIG from the current working directory, leading to information leak by tricking privileged processes into reading arbitrary files. For Debian 7 'Wheezy', these problems have been fixed in version 5.1.29-5+deb7u1. We recommend that you upgrade your db...

[SECURITY] [DLA 1136-1] db4.8 security update

Package : db4.8 Version : 4.8.30-12+deb7u1 CVE ID : CVE-2017-10140 Debian Bug : 872436 It was found that the Berkeley DB reads DBCONFIG from the current working directory, leading to information leak by tricking privileged processes into reading arbitrary files. For Debian 7 "Wheezy", these...

[SECURITY] [DLA 1134-1] sdl-image1.2 security update

Package : sdl-image1.2 Version : 1.2.12-2+deb7u1 CVE ID : CVE-2017-2887 Debian Bug : 878267 It was discovered that there was a buffer overflow vulnerability in sdl-image1.2, an image loading library. A specially crafted .xcf file could cause a stack-based buffer overflow resulting in potential co...

Debian DLA-1125-1 : botan1.10 security update

CVE-2017-14737 Fix of cache-based side channel attack, which could recover information about RSA secret keys. For Debian 7 'Wheezy', these problems have been fixed in version 1.10.5-1+deb7u4. We recommend that you upgrade your botan1.10 packages. NOTE: Tenable Network Security has extracted the...

Debian DLA-1129-1 : qemu security update

Multiple vulnerabilities were discovered in qemu, a fast processor emulator. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2017-14167 Incorrect validation of multiboot headers could result in the execution of arbitrary code. CVE-2017-15038 When using 9pf...

Debian DLA-1128-1 : qemu-kvm security update

Multiple vulnerabilities were discovered in qemu-kvm, a full virtualization solution for Linux hosts on x86 hardware with x86 guests based on the Quick EmulatorQemu. CVE-2017-14167 Incorrect validation of multiboot headers could result in the execution of arbitrary code. CVE-2017-15038 When using...

Debian DLA-1127-1 : sam2p security update

Several vulnerabilites, like heap-based buffer overflows, integer signedness or overflow errors have been found by fpbibi and have been fixed by upstream. For Debian 7 'Wheezy', these problems have been fixed in version 0.49.1-1+deb7u1. We recommend that you upgrade your sam2p packages. NOTE:...

Debian DLA-1123-1 : golang security update

It was discovered that there was an issue in the Go programming language library where an attacker could generate a MIME request such that the server ran out of file descriptors. For Debian 7 'Wheezy', this issue has been fixed in golang version 2:1.0.2-1.1+deb7u1. We recommend that you upgrade...

[SECURITY] [DLA 1127-1] sam2p security update

Package : sam2p Version : 0.49.1-1+deb7u1 CVE ID : CVE-2017-14628 CVE-2017-14629 CVE-2017-14630 CVE-2017-14631 CVE-2017-14636 CVE-2017-14637 Several vulnerabilites, like heap-based buffer overflows, integer signedness or overflow errors have been found by fpbibi and have been fixed by upstream. F...

[SECURITY] [DLA 1126-1] libxfont security update

Package : libxfont Version : 1:1.4.5-5+deb7u1 CVE IDs : CVE-2017-13720 CVE-2017-13722 It was discovered that there two vulnerabilities the library providing font selection and rasterisation, libxfont: CVE-2017-13720: If a pattern contained a ? character any character in the string is skipped even...

[SECURITY] [DLA 1125-1] botan1.10 security update

Package : botan1.10 Version : 1.10.5-1+deb7u4 CVE ID : CVE-2017-14737 CVE-2017-14737 Fix of cache-based side channel attack, which could recover information about RSA secret keys. For Debian 7 "Wheezy", these problems have been fixed in version 1.10.5-1+deb7u4. We recommend that you upgrade your...

[SECURITY] [DLA 1124-1] dnsmasq security update

Package : dnsmasq Version : 2.62-3+deb7u4 CVE ID : CVE-2017-14491 CVE-2017-14492 CVE-2017-14494 Felix Wilhelm, Fermin J. Serna, Gabriel Campana, Kevin Hamacher, Ron Bowes and Gynvael Coldwind of the Google Security Team discovered several vulnerabilities in dnsmasq, a small caching DNS proxy and...

Debian DLA-1121-1 : curl security update

It was discovered that there was a out-of-bounds read vulnerability in curl, a command-line and library for transferring data over HTTP/FTP, etc. A malicious FTP server could abuse this to prevent curl-based clients from interacting with it. See for more details. For Debian 7 'Wheezy', this issue...

[SECURITY] [DLA 1121-1] curl security update

Package : curl Version : 7.26.0-1+wheezy21 CVE ID : CVE-2017-1000254 Debian Bug : 877671 It was discovered that there was a out-of-bounds read vulnerability in curl, a command-line and library for transferring data over HTTP/FTP, etc. A malicious FTP server could abuse this to prevent curl-based...

CVE-2017-15017

ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadOneMNGImage in coders/png.c...

Debian DLA-1120-1 : git security update

joernchen discovered that the git-cvsserver subcommand of Git, a distributed version control system, suffers from a shell command injection vulnerability due to unsafe use of the Perl backtick operator. The git-cvsserver subcommand is reachable from the git-shell subcommand even if CVS support ha...