Debian DLA-921-1 : slurm-llnl security update

With this vulnerability arbitrary files can be overwritten on nodes running jobs provided that the user can run a job that is able to trigger a failure of a Prolog script. For Debian 7 'Wheezy', these problems have been fixed in version 2.3.4-2+deb7u1. We recommend that you upgrade your slurm-lln...

Debian DLA-918-1 : freetype security update

It was found that an out of bounds write caused by a heap-based buffer overflow could be triggered in freetype via a crafted font. This update also reverts the fix for CVE-2016-10328, as it was determined that freetype 2.4.9 is not affected by that issue. For Debian 7 'Wheezy', these problems hav...

Debian DLA-916-1 : mysql-5.5 security update (Riddle)

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.55, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly incompatible changes. Please see th...

Debian DLA-912-1 : tiff3 security update

Multiple security issues have been found in the tiff3 image library that may allow remote attackers to cause a denial of service application crash, to obtain sensitive information from process memory or possibly have unspecified other impact via a crafted image. For Debian 7 'Wheezy', these...

[SECURITY] [DLA 912-1] tiff3 security update

Package : tiff3 Version : 3.9.6-11+deb7u5 CVE ID : CVE-2017-7593 CVE-2017-7594 CVE-2017-7595 CVE-2017-7596 CVE-2017-7597 CVE-2017-7599 CVE-2017-7600 CVE-2017-7601 Debian Bug : 860000 860001 860003 Multiple security issues have been found in the tiff3 image library that may allow remote attackers ...

[SECURITY] [DLA 911-1] tiff security update

Package : tiff Version : 4.0.2-6+deb7u12 CVE ID : CVE-2017-7592 CVE-2017-7593 CVE-2017-7594 CVE-2017-7595 CVE-2017-7596 CVE-2017-7597 CVE-2017-7598 CVE-2017-7599 CVE-2017-7600 CVE-2017-7601 CVE-2017-7602 Debian Bug : 859998 860000 860001 860003 Multiple security issues have been found in the tiff...

Debian DLA-909-1 : libcroco security update

CVE-2017-7960 A heap-based buffer over-read vulnerability could be triggered remotely via a crafted CSS file to cause a denial of service. CVE-2017-7961 An 'outside the range of representable values of type long' undefined behavior issue was found in libcroco, which might allow remote attackers t...

Debian DLA-908-1 : chicken security update

It was found that CHICKEN did not sanitize the size argument when allocating SRFI-4 vectors, which could lead to segfaults or buffer overflows with some sizes. For Debian 7 'Wheezy', these problems have been fixed in version 4.7.0-1+deb7u2. We recommend that you upgrade your chicken packages. NOT...

Debian DLA-906-1 : firefox-esr security update

Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, buffer overflows and other implementation errors may lead to the execution of arbitrary code, information disclosure or denial of service. For Debian 7 'Wheezy', these...

Debian DLA-910-1 : libreoffice security update

CVE-2017-3157 Ben Hayak discovered that objects embedded in Writer and Calc documents may result in information disclosure. Please see https://www.libreoffice.org/about-us/security/advisories/cve-2017-3157 / for additional information. CVE-2017-7870 An out-of-bounds write caused by a heap-based...

[SECURITY] [DLA 909-1] libcroco security update

Package : libcroco Version : 0.6.6-2+deb7u1 CVE ID : CVE-2017-7960 CVE-2017-7961 Debian Bug : 860961 CVE-2017-7960 A heap-based buffer over-read vulnerability could be triggered remotely via a crafted CSS file to cause a denial of service. CVE-2017-7961 An "outside the range of representable valu...

[SECURITY] [DLA 908-1] chicken security update

Package : chicken Version : 4.7.0-1+deb7u2 CVE ID : CVE-2017-6949 Debian Bug : 858057 It was found that CHICKEN did not sanitize the size argument when allocating SRFI-4 vectors, which could lead to segfaults or buffer overflows with some sizes. For Debian 7 "Wheezy", these problems have been fix...

Debian DLA-904-1 : uzbek-wordlist update

The dictionary provided by this package had an unnecessary unversioned conflict against the thunderbird package which recently got reintroduced into Wheezy. For Debian 7 'Wheezy', this problem has been fixed in version 0.6-3.2+deb7u1. We recommend that you upgrade your uzbek-wordlist packages...

Debian DLA-903-1 : hunspell-en-us update

The dictionary provided by this package had an unnecessary unversioned conflict against the thunderbird package which recently got reintroduced into Wheezy. For Debian 7 'Wheezy', this problem has been fixed in version 20070829-6+deb7u1. We recommend that you upgrade your hunspell-en-us packages...

[SECURITY] [DLA 903-1] hunspell-en-us update

Package : hunspell-en-us Version : 20070829-6+deb7u1 The dictionary provided by this package had an unnecessary unversioned conflict against the thunderbird package which recently got reintroduced into Wheezy. For Debian 7 "Wheezy", this problem has been fixed in version 20070829-6+deb7u1. We...

Debian DLA-896-1 : icedove/thunderbird security update

Multiple security issues have been found in the Mozilla Thunderbird mail client: Multiple memory safety errors, buffer overflows and other implementation errors may lead to the execution of arbitrary code or spoofing. With version 45.8 Debian drops it's custom branding from the Icedove package an...

Debian DLA-899-1 : feh security update

Tobias Stoeckmann discovered it was possible to trigger an out-of-boundary heap write with the image viewer feh while receiving an IPC message. For Debian 7 'Wheezy', these problems have been fixed in version 2.3-2+deb7u1. We recommend that you upgrade your feh packages. NOTE: Tenable Network...

[SECURITY] [DLA 901-1] radare2 security update

Package : radare2 Version : 0.9-3+deb7u2 CVE ID : CVE-2017-6448 CVE-2017-6448 The dalvikdisassemble function in libr/asm/p/asmdalvik.c in radare2 1.2.1 allows remote attackers to cause a denial of service stack-based buffer overflow and application crash or possibly have unspecified other impact...

Debian DLA-895-1 : openoffice.org-dictionaries update

The dictionaries provided by this package had an unversioned conflict against the thunderbird package which so far was not part of wheezy. Since the next update of Icedove introduces a thunderbird package the dictionaries would become unusable in Icedove so the unneeded conflict was dropped. For...

[SECURITY] [DLA 897-1] qbittorrent security update

Package : qbittorrent Version : 2.9.8-1+deb7u1 CVE ID : CVE-2017-6503 CVE-2017-6504 CVE-2017-6503 WebUI in qBittorrent before 3.3.11 did not escape many values, which could potentially lead to XSS. CVE-2017-6504 WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which coul...