Debian DLA-985-1 : libsndfile security update

It was discovered that there was a vulnerability in libsndfile, a library for reading/writing audio files. A specially crafted AIFF 'Audio Interchange File Format' file could result in an out-of-bounds memory read. For Debian 7 'Wheezy', this issue has been fixed in libsndfile version...

[SECURITY] [DLA 983-1] tiff3 security update

Package : tiff3 Version : 3.9.6-11+deb7u6 CVE ID : CVE-2016-10095 CVE-2017-9147 CVE-2017-9403 CVE-2017-9404 tiff3 was affected by multiple memory leaks CVE-2017-9403, CVE-2017-9404 that could result in denial of service. Furthermore, while the current version in Debian was already patched for...

Debian DLA-982-1 : tor security update

It has been discovered that Tor, a connection-based low-latency anonymous communication system, contains a flaw in the hidden service code. A remote attacker can take advantage of this flaw to cause a hidden service to crash with an assertion failure TROVE-2017-005. For Debian 7 'Wheezy', this...

Debian DLA-981-1 : apng2gif security update

It was discovered that apng2gif was vulnerable to an integer overflow resulting in a heap-based buffer over-read/write. A remote attacker could use this flaw to cause a denial of service application crash via a crafted APNG file. For Debian 7 'Wheezy', these problems have been fixed in version...

Debian DLA-979-1 : debian-security-support update

Besides bringing the package up to date regarding translations this update marks several packages as no longer supported by wheezy-lts : autotrace, inspircd, ioquake3, kfreebsd-8, kfreebsd-9, matrixssl, teeworlds and trn For the reasoning please see the links provided in...

Debian DLA-978-1 : perl security update

The cPanel Security Team reported a time of check to time of use TOCTTOU race condition flaw in File::Path, a core module from Perl to create or remove directory trees. An attacker can take advantage of this flaw to set the mode on an attacker-chosen file to an attacker-chosen value. For Debian 7...

Debian DLA-973-1 : strongswan security update

Two denial of service vulnerabilities were identified in strongSwan, an IKE/IPsec suite, using Google's OSS-Fuzz fuzzing project. CVE-2017-9022 RSA public keys passed to the gmp plugin aren't validated sufficiently before attempting signature verification, so that invalid input might lead to a...

Debian DLA-964-1 : xen security update

Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2016-9932 XSA-200 CMPXCHG8B emulation allows local HVM guest OS users to obtain sensitive information from host stack memory. CVE-2017-7995...

Debian DLA-971-1 : nss security update

CVE-2017-7502 A NULL pointer dereference vulnerability in NSS was found when server receives empty SSLv2 messages. This issue was introduced with the recent removal of SSLv2 protocol from upstream code in 3.24.0 and introduction of dedicated parser able to handle just sslv2-style hello messages...

Debian DLA-968-1 : libpodofo security update

Several heap-based buffer overflows and NULL pointer dereferences have been discovered in libpodofo, a library for manipulating PDF files, that allow remote attackers to cause a denial of service application crash or other unspecified impact via a crafted PDF document. For Debian 7 'Wheezy', thes...

Debian DLA-967-1 : gajim security update

Gajim implements XEP-0146, an XMPP extension to run commands remotely from another client. However it was found that malicious servers can trigger commands, which could lead to leaking private conversations from encrypted sessions. To solve this, XEP-0146 support has been disabled by default. For...

Debian DLA-956-1 : libsndfile security update

CVE-2017-8361 The flacbuffercopy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service buffer overflow and application crash or possibly have unspecified other impact via a crafted audio file. CVE-2017-8362 The flacbuffercopy function in flac.c in libsndfile...

Debian DLA-960-1 : imagemagick security update

This update fixes several vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure, or the execution of arbitrary code if malformed PCX, DCM, JPEG, PSD, HDR, MIFF, PDB, VICAR, SGI, SVG,...

Debian DLA-954-1 : openjdk-7 security update

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in privilege escalation, denial of service, newline injection in SMTP or use of insecure cryptography. For Debian 7 'Wheezy', these problems have been fixed in version...

Debian DLA-957-1 : bind9 security update

CVE-2017-3136 Oleg Gorokhov of Yandex discovered that BIND does not properly handle certain queries when using DNS64 with the 'break-dnssec yes;' option, allowing a remote attacker to cause a denial of service. CVE-2017-3137 It was discovered that BIND makes incorrect assumptions about the orderi...

Debian DLA-955-1 : rzip security update

Agostino Sarubbo of Gentoo discovered a heap buffer overflow write in the rzip program when uncompressing maliciously crafted files. For Debian 7 'Wheezy', these problems have been fixed in version 2.1-1+deb7u1. We recommend that you upgrade your rzip packages. NOTE: Tenable Network Security has...

[SECURITY] [DLA 960-1] imagemagick security update

Package : imagemagick Version : 6.7.7.10-5+deb7u14 CVE ID : CVE-2014-8354 CVE-2014-8355 CVE-2014-8562 CVE-2014-8716 CVE-2014-9841 CVE-2015-8900 CVE-2015-8901 CVE-2015-8902 CVE-2015-8903 CVE-2017-7941 CVE-2017-7943 CVE-2017-8343 CVE-2017-8344 CVE-2017-8345 CVE-2017-8346 CVE-2017-8347 CVE-2017-8348...

[SECURITY] [DLA 955-1] rzip security update

Package : rzip Version : 2.1-1+deb7u1 CVE ID : CVE-2017-8364 Debian Bug : 861614 Agostino Sarubbo of Gentoo discovered a heap buffer overflow write in the rzip program when uncompressing maliciously crafted files. For Debian 7 "Wheezy", these problems have been fixed in version 2.1-1+deb7u1. We...

[SECURITY] [DSA 3862-1] puppet security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3862-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 25, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 952-1] kde4libs security update

Package : kde4libs Version : 4:4.8.4-4+deb7u3 CVE ID : CVE-2013-2074 CVE-2017-6410 CVE-2017-8422 Debian Bug : 856890 Several vulnerabilities were discovered in kde4libs, the core libraries for all KDE 4 applications. The Common Vulnerabilities and Exposures project identifies the following...