Debian DLA-877-1 : tiff security update

libtiff is vulnerable to multiple buffer overflows and integer overflows that can lead to application crashes denial of service or worse. CVE-2016-10266 Integer overflow that can lead to divide-by-zero in TIFFReadEncodedStrip tifread.c. CVE-2016-10267 Divide-by-zero error in OJPEGDecodeRaw...

[SECURITY] [DLA 879-1] firebird2.5 security update

Package : firebird2.5 Version : 2.5.2.26540.ds4-1deb7u3 CVE ID : CVE-2017-6369 Debian Bug : 858641 George Noseevich discovered that firebird2.5, a relational database system, did not properly check User-Defined Functions UDF, thus allowing remote authenticated users to execute arbitrary code on t...

[SECURITY] [DLA 877-1] tiff security update

Package : tiff Version : 4.0.2-6+deb7u11 CVE ID : CVE-2016-10266 CVE-2016-10267 CVE-2016-10268 CVE-2016-10269 libtiff is vulnerable to multiple buffer overflows and integer overflows that can lead to application crashes denial of service or worse. CVE-2016-10266 Integer overflow that can lead to...

Debian DLA-872-1 : xrdp security update

It was discovered that xrdp, a Remote Desktop Protocol RDP server, calls the PAM function authstartsession in an incorrect location, leading to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pamlimits....

Debian DLA-875-1 : php5 security update

Several issues have been discovered in PHP recursive acronym for PHP: Hypertext Preprocessor, a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. CVE-2016-7478: Zend/zendexceptions.c in PHP allows remote attacke...

[SECURITY] [DLA 874-1] jbig2dec security update

Package : jbig2dec Version : 0.13-4deb7u1 CVE ID : CVE-2016-9601 Multiple security issues have been found in the JBIG2 decoder library, which may lead to lead to denial of service or the execution of arbitrary code if a malformed image file usually embedded in a PDF document is opened. For Debian...

[SECURITY] [DLA 873-1] apt-cacher security update

Package : apt-cacher Version : 1.7.6+deb7u1 Debian Bug : 858739 It was discovered that there was a HTTP response splitting vulnerability in apt-cacher, a proxy server for Debian/Ubuntu software repositories. For Debian 7 "Wheezy", this issue has been fixed in apt-cacher version 1.7.6+deb7u1. We...

Debian DLA-868-1 : imagemagick security update

Several issues have been discovered in ImageMagick, a popular set of programs and libraries for image manipulation. These issues include denial of service and memory buffer over-read. For Debian 7 'Wheezy', these problems have been fixed in version 8:6.7.7.10-5+deb7u12. We recommend that you...

[SECURITY] [DLA 870-1] libplist security update

Package : libplist Version : 1.8-1+deb7u3 CVE ID : CVE-2017-6435 CVE-2017-6436 CVE-2017-6439 More vulnerabilities were discovered in libplist, a library for reading and writing the Apple binary and XML property lists format. A maliciously crafted plist file could cause a denial-of-service...

[SECURITY] [DLA 868-1] imagemagick security update

Package : imagemagick Version : 8:6.7.7.10-5+deb7u12 CVE ID : CVE-2016-10062 CVE-2017-6498 CVE-2017-6500 Debian Bug : 849439 856878 856879 Several issues have been discovered in ImageMagick, a popular set of programs and libraries for image manipulation. These issues include denial of service and...

Debian DLA-867-1 : audiofile security update

Multiple vulnerabilities has been found in audiofile. CVE-2017-6829 Allows remote attackers to cause a denial of service crash via a crafted file. CVE-2017-6830, CVE-2017-6834, CVE-2017-6831, CVE-2017-6832, CVE-2017-6838, CVE-2017-6839, CVE-2017-6836 Heap-based buffer overflow in that allows remo...

Design/Logic Flaw

The postrm script in the tomcat6 package before 6.0.45+dfsg-1deb7u3 on Debian wheezy, before 6.0.45+dfsg-1deb8u1 on Debian jessie, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u7 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian...

CVE-2016-9775

The postrm script in the tomcat6 package before 6.0.45+dfsg-1deb7u3 on Debian wheezy, before 6.0.45+dfsg-1deb8u1 on Debian jessie, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u7 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian...

CVE-2016-9775

The postrm script in the tomcat6 package before 6.0.45+dfsg-1deb7u3 on Debian wheezy, before 6.0.45+dfsg-1deb8u1 on Debian jessie, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u7 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian...

CVE-2016-9774

Removed by vendor...

[SECURITY] [DLA 866-1] libxslt security update

Package : libxslt Version : 1.1.26-14.1+deb7u3 CVE ID : CVE-2017-5029 Debian Bug : 858546 libxslt is vulnerable to an integer overflow in the xsltAddTextString function that can be exploited to trigger an out of bounds write on 64-bit systems. For Debian 7 "Wheezy", this problem has been fixed in...

Debian DLA-863-1 : deluge security update

It was discovered that there was a cross-site request forgery vulnerability in the WebUI component of the 'deluge' Bittorrent client. For Debian 7 'Wheezy', this issue has been fixed in deluge version 1.3.3-2+nmu1+deb7u1. We recommend that you upgrade your deluge packages. NOTE: Tenable Network...

[SECURITY] [DLA 863-1] deluge security update

Package : deluge Version : 1.3.3-2+nmu1+deb7u1 CVE ID : CVE-2017-7178 Debian Bug : 857903 It was discovered that there was a cross-site request forgery vulnerability in the WebUI component of the "deluge" Bittorrent client. For Debian 7 "Wheezy", this issue has been fixed in deluge version...

[SECURITY] [DLA 860-1] wordpress security update

Package : wordpress Version : 3.6.1+dfsg-1deb7u14 CVE ID : CVE-2017-6814 CVE-2017-6815 CVE-2017-6816 Debian Bug : 857026 Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following issues. CVE-2017-6814...

[SECURITY] [DLA 859-1] calibre security update

Package : calibre Version : 0.8.51+dfsg1-0.1+deb7u1 CVE ID : CVE-2016-10187 Debian Bug : 853004 It was found that a javascript present in the book can access files on the computer using XMLHttpRequest. For Debian 7 "Wheezy", these problems have been fixed in version 0.8.51+dfsg1-0.1+deb7u1. We...