Debian DLA-1100-1 : gdk-pixbuf security update

Marcin Noga discovered a buffer overflow in the JPEG loader of the GDK Pixbuf library, which may result in the execution of arbitrary code if a malformed file is opened. For Debian 7 'Wheezy', these problems have been fixed in version 2.26.1-1+deb7u6. We recommend that you upgrade your gdk-pixbuf...

Debian DLA-1098-1 : freexl security update

The Cisco Talos team reported two sensitive security issues affecting FreeXL-1.0.3 and any previous version. CVE-2017-2923 An exploitable heap based buffer overflow vulnerability exists in the readbiffnextrecord function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption...

[SECURITY] [DLA 1097-1] tcpdump security update

Package : tcpdump Version : 4.9.2-1deb7u1 CVE ID : CVE-2017-12894 CVE-2017-12895 CVE-2017-12896 CVE-2017-12897 CVE-2017-12898 CVE-2017-12899 CVE-2017-12900 CVE-2017-12901 CVE-2017-12902 CVE-2017-12985 CVE-2017-12986 CVE-2017-12987 CVE-2017-12988 CVE-2017-12989 CVE-2017-12990 CVE-2017-12991...

[SECURITY] [DLA 1096-1] wordpress-shibboleth security update

Package : wordpress-shibboleth Version : 1.4-2+deb7u1 CVE ID : CVE-2017-14313 Debian Bug : 874416 It was discovered that there was a an XSS vulnerability in the login form of the "Shibboleth" identity provider module for Wordpress. For Debian 7 "Wheezy", this issue has been fixed in...

Debian DLA-1095-1 : freerdp security update

Tyler Bohan of Talos discovered that FreeRDP, a free implementation of the Remote Desktop Protocol RDP, contained several vulnerabilities that allowed a malicious remote server or a man-in-the-middle to either cause a DoS by forcibly terminating the client, or execute arbitrary code on the client...

[SECURITY] [DLA 1087-2] icedove/thunderbird regression update

Package : icedove Version : 1:52.3.0-4deb7u2 The update for icedove/thunderbird issued as DLA-1087-1 did not build on i386. This update corrects this. For reference, the original advisory text follows. Multiple security issues have been found in the Mozilla Thunderbird mail client: Multiple memor...

CVE-2017-14173

In the function ReadTXTImage in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuantumRangedepth+1" when "depth" is large, producing a smaller value than expected. As a result, an infinite loop would occur for a crafted TXT file that claims a...

Debian DLA-1090-1 : tcpdump security update

Several vulnerabilities have been discovered in tcpdump, a command-line network traffic analyzer. These vulnerabilities might result in denial of service application crash. For Debian 7 'Wheezy', these problems have been fixed in version 4.9.0-1deb7u2. We recommend that you upgrade your tcpdump...

[SECURITY] [DLA 1090-1] tcpdump security update

Package : tcpdump Version : 4.9.0-1deb7u2 CVE ID : CVE-2017-11108 CVE-2017-11541 CVE-2017-11542 CVE-2017-11543 Several vulnerabilities have been discovered in tcpdump, a command-line network traffic analyzer. These vulnerabilities might result in denial of service application crash. For Debian 7...

Debian DLA-1087-2 : icedove/thunderbird regression update

The update for icedove/thunderbird issued as DLA-1087-1 did not build on i386. This update corrects this. For reference, the original advisory text follows. Multiple security issues have been found in the Mozilla Thunderbird mail client: Multiple memory safety errors, buffer overflows and other...

Debian DLA-1089-1 : irssi security update

Some Irssi issues were found : CVE-2017-10965 An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer. CVE-2017-10966 An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi...

Debian DLA-1088-1 : irssi security update

Irssi has some issues where remote attackers might be able to cause a crash. CVE-2017-9468 In irssi, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. CVE-2017-9469 In irssi, when receiving certain incorrectly quoted DCC files, it tries to find the...

Debian DLA-1085-1 : libidn2-0 security update

It was discovered that there was an integer overflow vulnerability in libidn2-0's Punycode handling an encoding used to convert Unicode characters to ASCII which would have allowed attackers to cause a remote denial of service. For Debian 7 'Wheezy', this issue has been fixed in libidn2-0 version...

Debian DLA-1082-1 : graphicsmagick security update

CVE-2017-13776 CVE-2017-13777 denial of service issue in ReadXBMImage CVE-2017-12935 The ReadMNGImage function in coders/png.c mishandles large MNG images, leading to an invalid memory read in the SetImageColorCallBack function in magick/image.c. CVE-2017-12936 The ReadWMFImage function in...

[SECURITY] [DLA 1083-1] openexr security update

Package : openexr Version : 1.6.1-6+deb7u1 CVE ID : CVE-2017-9110 CVE-2017-9112 CVE-2017-9116 Debian Bug : 864078 Brandon Perry discovered that openexr, a high dynamic-range HDR image library, was affected by an integer overflow vulnerability and missing boundary checks that would allow a remote...

[SECURITY] [DLA 1082-1] graphicsmagick security update

Package : graphicsmagick Version : 1.3.16-1.1+deb7u9 CVE ID : CVE-2017-12935 CVE-2017-12936 CVE-2017-12937 CVE-2017-13063 CVE-2017-13064 CVE-2017-13065 CVE-2017-13776 CVE-2017-13777 CVE-2017-13776 CVE-2017-13777 denial of service issue in ReadXBMImage CVE-2017-12935 The ReadMNGImage function in...

[SECURITY] [DLA 1080-1] gnupg security update

Package : gnupg Version : 1.4.12-7+deb7u9 CVE ID : CVE-2017-7526 Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink, Nadia Heninger, Tanja Lange, Christine van Vredendaal and Yuval Yarom discovered that gnupg is prone to a local side-channel attack allowing full key...

[SECURITY] [DLA 1076-1] php5 security update

Package : php5 Version : 5.4.45-0+deb7u11 CVE ID : CVE-2017-12933 The finishnesteddata function in ext/standard/varunserializer.re in PHP is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of PHP. For Debia...

[SECURITY] [DLA 1074-1] poppler security update

Package : poppler Version : 0.18.4-6+deb7u2 CVE ID : CVE-2013-4473 CVE-2013-4474 CVE-2017-9775 CVE-2017-9776 CVE-2017-9865 Several buffer and integer overflow issues were discovered in Poppler, a PDF library, that could lead to application crash or possibly other unspecified impact via maliciousl...

Debian DLA-1073-1 : openjdk-7 security update

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in sandbox bypass, incorrect authentication, the execution of arbitrary code, denial of service, information disclosure, use of insecure cryptography or bypassing Jar verification. Fo...