[SECURITY] [DLA 1045-1] graphicsmagick security update

Package : graphicsmagick Version : 1.3.16-1.1+deb7u8 CVE ID : CVE-2017-10799 CVE-2017-11102 CVE-2017-11140 CVE-2017-11403 CVE-2017-11636 CVE-2017-11637 CVE-2017-11638 CVE-2017-11641 CVE-2017-11642 CVE-2017-11643 Debian Bug : 867077 867746 870149 Multiple security vulnerabilities, NULL pointer...

[SECURITY] [DLA 1040-1] resiprocate security update

Package : resiprocate Version : 1.8.5-4+deb7u1 CVE ID : CVE-2017-11521 CVE-2017-11521 The SdpContents::Session::Medium::parse function in resip/stack/SdpContents.cxx in reSIProcate 1.10.2 allows remote attackers to cause a denial of service memory consumption by triggering many media connections...

[SECURITY] [DLA 1025-2] bind9 regression update

Package : bind9 The security update announced as DLA-1025-1 in bind9 introduced a regression. The fix for CVE-2017-3142 broke verification of TSIG signed TCP message sequences where not all the messages contain TSIG records. This is conform to the spec and may be used in AXFR and IXFR response. F...

Debian DLA-1037-1 : catdoc security update

A heap-based buffer underflow flaw was discovered in catdoc, a text extractor for MS-Office files, which may lead to denial of service application crash or have unspecified other impact, if a specially crafted file is processed. For Debian 7 'Wheezy', these problems have been fixed in version...

Debian DLA-1038-1 : libtasn1-3 security update

CVE-2017-10790 The asn1checkidentifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1node structure. It may lead to a remote denial of service attack. For Debian 7 'Wheezy', these...

[SECURITY] [DLA 1036-1] gsoap security update

Package : gsoap Version : 2.8.7-2+deb7u1 CVE ID : CVE-2017-9765 A vulnerability was discovered in gsoap, a library for the development of SOAP web services and clients, that may be exposed with a large and specific XML message over 2 GB in size. After receiving this 2 GB message, a buffer overflo...

Debian DLA-1034-1 : php5 security update

Several issues have been discovered in PHP recursive acronym for PHP: Hypertext Preprocessor, a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. CVE-2016-10397 Incorrect handling of various URI components in th...

Debian DLA-1035-1 : qemu security update

Several vulnerabilities were discovered in qemu, a fast processor emulator. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2016-9603 qemu-kvm built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support is vulnerable to a heap buffer...

Debian DLA-1032-1 : unattended-upgrades regression update

Since the release of the last Debian stable release 'stretch', Debian LTS 'wheezy' has been renamed 'oldoldstable', which broke the unattended-upgrades package as described in bug 867169. Updates would simply not be performed anymore. For Debian 7 'Wheezy', these problems have been fixed in versi...

[SECURITY] [DLA 1032-1] unattended-upgrades regression update

Package : unattended-upgrades Version : 0.79.5+wheezy3 Debian Bug : 867169 Since the release of the last Debian stable release "stretch", Debian LTS "wheezy" has been renamed "oldoldstable", which broke the unattended-upgrades package as described in bug 867169. Updates would simply not be...

Debian DLA-1030-1 : vim security update

Vim 8.0 allows attackers to cause a denial of service invalid free or possibly have unspecified other impact via a crafted source aka -S file. For Debian 7 'Wheezy', these problems have been fixed in version 2:7.3.547-7+deb7u4. We recommend that you upgrade your vim packages. NOTE: Tenable Networ...

[SECURITY] [DLA 1031-1] evince security update

Package : evince Version : 3.4.0-3.1+deb7u1 CVE ID : CVE-2017-1000083 Debian Bug : 868500 from the Google Security Team discovered that the Evince document viewer made insecure use of tar when opening tar comic book archives CBT. Opening a malicious CBT archive could result in the execution of...

Debian DLA-1024-1 : nginx security update

It was discovered that there was vulnerability in the range filter of nginx, a web/proxy server. A specially crafted request might result in an integer overflow and incorrect processing of HTTP ranges, potentially resulting in a sensitive information leak. For Debian 7 'Wheezy', this issue has be...

Debian DLA-1021-1 : jetty8 security update

It was discovered that Jetty8, a Java servlet engine and webserver, was vulnerable to a timing attack which might reveal cryptographic credentials such as passwords to a local user. For Debian 7 'Wheezy', these problems have been fixed in version 8.1.3-4+deb7u1. We recommend that you upgrade your...

Debian DLA-1023-1 : tiff3 security update

A vulnerabilitie has been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code. CVE-2017-9936 A crafted TIFF document can lead to a memory leak resulting in a remote denial of service attack. For Debian 7 'Wheezy', thes...

[SECURITY] [DLA 1022-1] tiff security update

Package : tiff Version : 4.0.2-6+deb7u15 CVE ID : CVE-2017-9936 CVE-2017-10688 Debian Bug : 866113 866611 Two vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code. CVE-2017-9936 A crafted TIFF...

[SECURITY] [DLA 1021-1] jetty8 security update

Package : jetty8 Version : 8.1.3-4+deb7u1 CVE ID : CVE-2017-9735 Debian Bug : 864898 It was discovered that Jetty8, a Java servlet engine and webserver, was vulnerable to a timing attack which might reveal cryptographic credentials such as passwords to a local user. For Debian 7 "Wheezy", these...

Debian DLA-1017-1 : mpg123 security update

It was discovered that there was a remote denial of service vulnerability in the mpg123 audio library/player. This was caused by a heap-based buffer over-read in the 'convertlatin1' function. For Debian 7 'Wheezy', this issue has been fixed in mpg123 version 1.14.4-1+deb7u2. We recommend that you...

[SECURITY] [DLA 1020-1] jetty security update

Package : jetty Version : 6.1.26-1+deb7u1 CVE ID : CVE-2017-9735 Debian Bug : 864898 It was discovered that Jetty, a Java servlet engine and webserver, was vulnerable to a timing attack which might reveal cryptographic credentials such as passwords to a local user. For Debian 7 "Wheezy", these...

Debian DLA-1013-1 : graphite2 security update

Multiple vulnerabilities have been found in the Graphite font rendering engine which might result in denial of service or the execution of arbitrary code if a malformed font file is processed. For Debian 7 'Wheezy', these problems have been fixed in version 1.3.10-1deb7u1. We recommend that you...