[SECURITY] [DLA 858-1] wireshark security update

Package : wireshark Version : 1.12.1+g01b65bf-4+deb8u6deb7u7 CVE ID : CVE-2017-5596 CVE-2017-5597 CVE-2017-6467 CVE-2017-6468 CVE-2017-6469 CVE-2017-6470 CVE-2017-6471 CVE-2017-6472 CVE-2017-6473 CVE-2017-6474 It was discovered that Wireshark, a network protocol analyzer, contained several...

[SECURITY] [DLA 856-1] tzdata new upstream version

Package : tzdata Version : 2017a-0+deb7u1 This update includes the changes in tzdata 2017a. Notable changes are: - Mongolia no longer observes DST. - Magallanes region diverges from Santiago starting 2017-05-13, the America/PuntaArenas zone has been added. For Debian 7 "Wheezy", these problems ha...

Debian DLA-854-1 : icoutils security update

Icoutils is a set of programs that deal with MS Windows icons and cursors. Resources such as icons and cursors can be extracted from MS Windows executable and library files with wrestool. Three vulnerabilities has been found in these tools. CVE-2017-6009 A buffer overflow was observed in wrestool...

[SECURITY] [DLA 855-1] roundcube security update

Package : roundcube Version : 0.7.2-9+deb7u6 CVE ID : CVE-2017-6820 Debian Bug : 857473 Roundcube, a webmail solution for IMAP servers, was susceptible to a cross-site-scripting XSS vulnerability via a crafted Cascading Style Sheets CSS token sequence within an SVG element or HTML message. For...

Debian DLA-852-1 : firefox-esr security update

Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code, ASLR bypass, information disclosure or denial of service. For Debian 7 'Wheezy', these problems...

Debian DLA-849-1 : linux security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or have other impacts. CVE-2016-9588 Jim Mattson discovered that the KVM implementation for Intel x86 processors does not properly handle BP and OF exceptions in an L2 neste...

Debian DLA-851-1 : wget security update

It was discovered that there was a header injection vulnerability in wget a tool to retrieve files from the web which allowed remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL. For Debian 7 'Wheezy', this issue has been fixed in wget version...

[SECURITY] [DLA 849-1] linux security update

Package : linux Version : 3.2.86-1 CVE ID : CVE-2016-9588 CVE-2017-2636 CVE-2017-5669 CVE-2017-5986 CVE-2017-6214 CVE-2017-6345 CVE-2017-6346 CVE-2017-6348 CVE-2017-6353 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or...

Debian DLA-847-1 : texlive-base security update

The TeX system allows for calling external programs from within the TeX source code. This has been restricted to a small set of programs since a long time ago. Unfortunately it turned out that one program in the list, mpost, allows in turn to specify other programs to be run, which allows arbitra...

[SECURITY] [DLA 847-1] texlive-base security update

Package : texlive-base Version : 2012.20120611-5+deb7u1 CVE ID : CVE-2016-10243 The TeX system allows for calling external programs from within the TeX source code. This has been restricted to a small set of programs since a long time ago. Unfortunately it turned out that one program in the list,...

Debian DLA-846-1 : libzip-ruby security update

It was discovered that libzip-ruby, a Ruby module for reading and writing zip files, is prone to a directory traversal vulnerability. An attacker can take advantage of this flaw to overwrite arbitrary files during archive extraction via a .. dot dot in an extracted filename. For Debian 7 'Wheezy'...

Debian DLA-840-1 : libplist security update

Several vulnerabilities were discovered in libplist, a library for reading and writing the Apple binary and XML property lists format. A maliciously crafted plist file could cause an application to crash by triggering a heap-based buffer overflow and memory allocation error in the plistfrombin...

[SECURITY] [DLA 840-1] libplist security update

Package : libplist Version : 1.8-1+deb7u2 CVE ID : CVE-2017-5834 CVE-2017-5835 Debian Bug : 854000 Several vulnerabilities were discovered in libplist, a library for reading and writing the Apple binary and XML property lists format. A maliciously crafted plist file could cause an application to...

[SECURITY] [DLA 839-1] tnef security update

Package : tnef Version : 1.4.9-1+deb7u1 CVE ID : CVE-2017-6307 CVE-2017-6308 CVE-2017-6309 CVE-2017-6310 CVE-2017-6307 An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapiattr.c:mapiattrread. These might lead to invalid read and write operations, controll...

Debian DLA-836-2 : munin regression update

The update for munin issued as DLA-836-1 caused a regression in the zooming functionality in munin-cgi-graph. Updated packages are now available to correct this issue. For reference, the original advisory text follows. Stevie Trujillo discovered a command injection vulnerability in munin, a...

Debian DLA-837-1 : radare2 security update

CVE-2017-6197 The rread functions in libr/include/rendian.h in radare2 1.2.1 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted binary file, as demonstrated by the rreadle32 function. For Debian 7 'Wheezy', these problems have been...

Debian DLA-834-1 : phpmyadmin security update

A server-side request forgery vulnerability was reported for the setup script in phpmyadmin, a MYSQL web administration tool. This flaw may allow an unauthenticated attacker to brute-force MYSQL passwords, detect internal hostnames or opened ports on the internal network. Additionally there was a...

Debian DLA-835-1 : cakephp security update

Dawid Golunski from legalhackers.com discovered that cakephp, an application development framework for PHP, contains a vulnerability that allows attackers to spoof the source IP address. It would allow them to bypass access control lists, or the injection of malicious data which, if treated as...

[SECURITY] [DLA 836-1] munin security update

Package : munin Version : 2.0.6-4+deb7u3 CVE ID : CVE-2017-6188 Debian Bug : 855705 Stevie Trujillo discovered a command injection vulnerability in munin, a network-wide graphing framework. The CGI script for drawing graphs allowed to pass arbitrary GET parameters to local shell command, allowing...

Debian DLA-830-1 : gst-plugins-bad0.10 security update

Some memory management issues were found in the GStreamer 'bad' plugins : CVE-2017-5843 A use after free issue was found in the mxfdemux element, which can can be triggered via a maliciously crafted file. CVE-2017-5848 The psdemux was vulnerable to several invalid reads, which could be triggered...