Debian DLA-826-1 : wireshark security update

It was discovered that there was denial of service vulnerability in wireshark, a network traffic analyzer. A malformed NATO Ground Moving Target Indicator Format 'STANAG 4607' capture file could cause a memory exhausion/infinite loop. For Debian 7 'Wheezy', this issue has been fixed in wireshark...

Debian DLA-829-1 : gst-plugins-ugly0.10 security update

Two memory management issues were found in the asfdemux element of the GStreamer 'ugly' plugin collection, which can be triggered via a maliciously crafted file. For Debian 7 'Wheezy', these problems have been fixed in version 0.10.19-2+deb7u1. We recommend that you upgrade your...

Debian DLA-828-1 : gst-plugins-good0.10 security update

Two memory handling issues were found in gst-plugins-good0.10 : CVE-2016-10198 An invalid read can be triggered in the aacparse element via a maliciously crafted file. CVE-2017-5840 An out of bounds heap read can be triggered in the qtdemux element via a maliciously crafted file. For Debian 7...

[SECURITY] [DLA 829-1] gst-plugins-ugly0.10 security update

Package : gst-plugins-ugly0.10 Version : 0.10.19-2+deb7u1 CVE ID : CVE-2017-5846 CVE-2017-5847 Two memory management issues were found in the asfdemux element of the GStreamer "ugly" plugin collection, which can be triggered via a maliciously crafted file. For Debian 7 "Wheezy", these problems ha...

[SECURITY] [DLA 827-1] gst-plugins-base0.10 security update

Package : gst-plugins-base0.10 Version : 0.10.36-1.1+deb7u2 CVE ID : CVE-2017-5837 CVE-2017-5844 It was discovered that it is possible to trigger a floating point exception in GStreamer via specially crafted files, causing a denial of service. For Debian 7 "Wheezy", these problems have been fixed...

Debian DLA-825-1 : spice security update

Several vulnerabilities were discovered in spice, a SPICE protocol client and server library. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2016-9577 Frediano Ziglio of Red Hat discovered a buffer overflow vulnerability in the mainchannelallocmsgrcvbuf...

Debian DLA-819-2 : mysql-5.5 version number correction

This is a correction of DLA 819-1 that mentioned that mysql-5.5 5.5.47-0+deb7u2 was corrected. The corrected package version was 5.5.54-0+deb7u2. For completeness the text from DLA 819-1 is available below with only corrected version information. No other changes. It has been found that the C...

Debian DLA-818-1 : php5 security update

Several issues have been discovered in PHP recursive acronym for PHP: Hypertext Preprocessor, a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. - CVE-2016-2554 Stack-based buffer overflow in ext/phar/tar.c...

Debian DLA-816-1 : svgsalamander security update

Luc Lynx discovered a Server-Side Request Forgery in svgSalamander allowing access to the trusted network with specially crafted SVG files. For Debian 7 'Wheezy', these problems have been fixed in version 0svn95-1+deb7u1. We recommend that you upgrade your svgsalamander packages. NOTE: Tenable...

Debian DLA-814-1 : openssl security update

Several vulnerabilities were discovered in OpenSSL : CVE-2016-7056 A local timing attack was discovered against ECDSA P-256. CVE-2016-8610 It was discovered that no limit was imposed on alert packets during an SSL handshake. CVE-2017-3731 Robert Swiecki discovered that the RC4-MD5 cipher when...

[SECURITY] [DLA 814-1] openssl security update

Package : openssl Version : 1.0.1t-1+deb7u2 CVE ID : CVE-2016-7056 CVE-2016-8610 CVE-2017-3731 Several vulnerabilities were discovered in OpenSSL: CVE-2016-7056 A local timing attack was discovered against ECDSA P-256. CVE-2016-8610 It was discovered that no limit was imposed on alert packets...

[SECURITY] [DLA 811-1] libplist security update

Package : libplist Version : 1.8-1+deb7u1 CVE ID : CVE-2017-5209 CVE-2017-5545 Debian Bug : 851196 852385 The following vulnerabilities have been fixed in libplist: CVE-2017-5209 Out of bounds read when parsing specially crafted Apple plist file CVE-2017-5545 Heap buffer overflow via crafted Appl...

[SECURITY] [DLA 610-2] tiff3 regression update

Package : tiff3 Version : 3.9.6-11+deb7u3 Debian Bug : 852610 Version 3.9.6-11+deb7u1 and 3.9.6-11+deb7u2 introduced changes that resulted in libtiff writing out invalid tiff files when the compression scheme in use relies on codec-specific TIFF tags embedded in the image. For Debian 7 "Wheezy",...

Debian DLA-803-1 : lcms2 security update

An out of bounds read was found in lcms2, which can lead to heap memory leak or denial of service via a specially crafted ICC profile. For Debian 7 'Wheezy', these problems have been fixed in version 2.2+git20110628-2.2+deb7u2. We recommend that you upgrade your lcms2 packages. NOTE: Tenable...

Debian DLA-800-1 : firefox-esr security update

Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code or information leaks or privilege escalation. For Debian 7 'Wheezy', these problems have been fix...

Debian DLA-799-1 : ming security update

Multiple security issues have been found in Ming. They may lead to the execution of arbitrary code or causing application crash. CVE-2016-9264 global-buffer-overflow in printMP3Headers CVE-2016-9265 divide-by-zero in printMP3Headers CVE-2016-9266 left shift in listmp3.c CVE-2016-9827 listswf:...

[SECURITY] [DLA 802-1] openjdk-7 security update

Package : openjdk-7 Version : 7u121-2.6.8-1deb7u1 openjdk-7 7u111-2.6.7-2deb7u1 backported the security fixes from 7u121. openjdk-7 has now been updated to the full 7u121 version, which includes extra bug fixes and other improvements. For Debian 7 "Wheezy", these problems have been fixed in versi...

[SECURITY] [DLA 799-1] ming security update

Package : ming Version : 1:0.4.4-1.1+deb7u1 CVE ID : CVE-2016-9264 CVE-2016-9265 CVE-2016-9266 CVE-2016-9827 CVE-2016-9828 CVE-2016-9829 CVE-2016-9831 Debian Bug : 843928 Multiple security issues have been found in Ming. They may lead to the execution of arbitrary code or causing application cras...

Debian DLA-791-1 : libav security update

Multiple integer overflows have been discovered in libav 11.8 and earlier, allowing remote attackers to cause a crash via a crafted MP3 file. For Debian 7 'Wheezy', these problems have been fixed in version 6:0.8.20-0+deb7u1. We recommend that you upgrade your libav packages. NOTE: Tenable Networ...

Debian DLA-792-1 : libphp-swiftmailer security update

Dawid Golunski from legalhackers-com 1 discovered that the mail transport in Swift Mailer allowed remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a ' backslash double quote in a crafted e-mail address in the From, ReturnPath, or Sender...