Debian DLA-949-1 : miniupnpc security update

It was discovered that there was a integer signedness error in the miniupnpc UPnP client that could allow remote attackers to cause a denial of service attack. For Debian 7 'Wheezy', this issue has been fixed in miniupnpc version 1.5-2+deb7u2. We recommend that you upgrade your miniupnpc packages...

Debian DLA-948-1 : dropbear security update

A vulnerability was found in Dropbear, a lightweight SSH2 server and client. CVE-2017-9079 Jann Horn discovered a local information leak in parsing the .authorizedkeys file. For Debian 7 'Wheezy', this problem has been fixed in version 2012.55-1.3+deb7u2. We recommend that you upgrade your dropbe...

[SECURITY] [DLA 948-1] dropbear security update

Package : dropbear Version : 2012.55-1.3+deb7u2 CVE ID : CVE-2017-9079 A vulnerability was found in Dropbear, a lightweight SSH2 server and client. CVE-2017-9079 Jann Horn discovered a local information leak in parsing the .authorizedkeys file. For Debian 7 "Wheezy", this problem has been fixed i...

[SECURITY] [DLA 944-1] openvpn security update

Package : openvpn Version : 2.2.1-8+deb7u4 CVE ID : CVE-2017-7479 Denial of Service due to Exhaustion of Packet-ID counter An authenticated client can cause the servers the packet-id counter to roll over, which would lead the server process to hit an ASSERT and stop running. To make the server hi...

[SECURITY] [DLA 942-1] jbig2dec security update

Package : jbig2dec Version : 0.13-4deb7u2 CVE ID : CVE-2017-7885 CVE-2017-7975 CVE-2017-7976 CVE-2017-7885 Artifex jbig2dec 0.13 has a heap-based buffer over-read leading to denial of service application crash or disclosure of sensitive information from process memory, because of an integer...

[SECURITY] [DLA 939-1] qemu-kvm security update

Package : qemu-kvm Version : 1.1.2+dfsg-6+deb7u21 CVE ID : CVE-2016-9603 CVE-2017-7718 CVE-2017-7980 Multiple vulnerabilities have been discovered in qemu-kvm, a full virtualization solution on x86 hardware based on Quick EmulatorQemu. The Common Vulnerabilities and Exposures project identifies t...

Debian DLA-937-1 : rpcbind security update

Guido Vranken discovered that incorrect memory management in libtirpc, a transport-independent RPC library used by rpcbind and other programs may result in denial of service via memory exhaustion depending on memory management settings. For Debian 7 'Wheezy', these problems have been fixed in...

Debian DLA-938-1 : git security update

Timo Schmid of ERNW GmbH discovered that the Git git-shell, a restricted login shell for Git-only SSH access, allows a user to run an interactive pager by causing it to spawn 'git upload-pack --help'. For Debian 7 'Wheezy', these problems have been fixed in version 1:1.7.10.4-1+wheezy4. We...

Debian DLA-936-1 : libtirpc security update

Guido Vranken discovered that incorrect memory management in libtirpc, a transport-independent RPC library used by rpcbind and other programs may result in denial of service via memory exhaustion depending on memory management settings. For Debian 7 'Wheezy', these problems have been fixed in...

[SECURITY] [DLA 938-1] git security update

Package : git Version : 1:1.7.10.4-1+wheezy4 CVE ID : CVE-2017-8386 Timo Schmid of ERNW GmbH discovered that the Git git-shell, a restricted login shell for Git-only SSH access, allows a user to run an interactive pager by causing it to spawn "git upload-pack --help". For Debian 7 "Wheezy", these...

Debian inspircd package buffer overflow vulnerability

wheezy, jessie, and sid are version numbers for a set of free operating systems maintained by the Debian Project Organization. the Debian inspircd package is a modular C++ IRC package for multiple operating systems. A buffer overflow vulnerability exists in Debian inspircd package prior to...

[SECURITY] [DLA 934-1] radicale security update

Package : radicale Version : 0.7-1.1+deb7u2 CVE ID : CVE-2017-8342 Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method. For Debian 7 "Wheezy", these problems have been fixed in version 0.7-1.1+deb7u2...

Debian DLA-931-1 : freetype security update

It was found that a malformed font could result in denial of service or the execution of arbitrary code. For Debian 7 'Wheezy', these problems have been fixed in version 2.4.9-1.1+deb7u7. We recommend that you upgrade your freetype packages. NOTE: Tenable Network Security has extracted the...

[SECURITY] [DLA 933-1] roundcube security update

Package : roundcube Version : 0.7.2-9+deb7u7 CVE ID : CVE-2017-8114 Debian Bug : 861388 Roundcube Webmail allows arbitrary password resets by authenticated users. The issue is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin. For Debian 7...

[SECURITY] [DLA 932-1] ghostscript security update

Package : ghostscript Version : 9.05dfsg-6.3+deb7u6 CVE ID : CVE-2017-8291 Debian Bug : 861295 A vulnerability was discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may lead to the execution of arbitrary code or denial of service if a specially crafted Postscript file is...

Debian DLA-930-1 : libxstream-java security update

It was discovered that there was a remote application crash vulnerability in libxstream-java, a Java library to serialize objects to XML and back again. This was due to mishandled attempts to create an instance of the primitive type 'void' during unmarshalling. For Debian 7 'Wheezy', this issue h...

[SECURITY] [DLA 930-1] libxstream-java security update

Package : libxstream-java Version : 1.4.2-1+deb7u2 CVE ID : CVE-2017-7957 Debian Bug : 861521 It was discovered that there was a remote application crash vulnerability in libxstream-java, a Java library to serialize objects to XML and back again. This was due to mishandled attempts to create an...

Debian DLA-922-1 : linux security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or have other impacts. CVE-2016-2188 Ralf Spenneberg of OpenSource Security reported that the iowarrior device driver did not sufficiently validate USB descriptors. This...

Debian DLA-925-1 : kedpm security update

An information disclosure vulnerability was found in kedpm, a password manager compatible with the figaro password manager file format. The history file can reveal the master password if it is provided on the commandline. The name of entries created or read in the password manager are also expose...

Debian DLA-928-1 : libsndfile security update

Multiple vulnerabilities were found in libsndfile, a popular library for reading/writing audio files. CVE-2017-7585 In libsndfile before 1.0.28, an error in the 'flacbuffercopy' function flac.c can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file. CVE-2017-758...