1783 matches found
[SECURITY] [DLA 790-1] mapserver security update
Package : mapserver Version : 6.0.1-3.2+deb7u4 CVE ID : CVE-2017-5522 It was discovered that mapserver, a CGI-based framework for Internet map services, was vulnerable to a stack-based overflow. This issue allowed a remote user to crash the service, or potentially execute arbitrary code. For Debi...
[SECURITY] [DLA 789-1] icoutils security update
Package : icoutils Version : 0.29.1-5deb7u1 CVE ID : CVE-2017-5208 CVE-2017-5331 CVE-2017-5332 CVE-2017-5333 Debian Bug : 850017 Brief introduction CVE-2017-5208 Choongwoo Han reported0 an exploitable crash in wrestool from icoutils. The command line tools is e.g. used in KDEs metadataparsing...
Debian DLA-788-1 : pdns-recursor security update
Florian Heinz and Martin Kluge reported that pdns-recursor, a recursive DNS server, parses all records present in a query regardless of whether they are needed or even legitimate, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the pdns server, resulting in a...
Debian DLA-782-1 : icedove security update
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail client: Multiple vulnerabilities may lead to the execution of arbitrary code, data leakage or bypass of the content security policy. For Debian 7 'Wheezy', these problems have been fixed in versi...
Debian DLA-783-1 : xen security update
Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2016-10013 xsa-204 Xen mishandles SYSCALL singlestep during emulation which can lead to privilege escalation. The vulnerability is only...
Debian DLA-784-1 : gcc-mozilla new package
GCC 4.8 has been packaged as gcc-mozilla for Debian 7. This package will be needed for future updates to firefox-esr and icedove, and possibly other packages that require new versions of GCC. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA securi...
Debian DLA-780-1 : libav security update
Multiple vulnerabilities have been found in libav : CVE-2016-7424 The putnorndpixels8xy2mmx function in x86/rndtemplate.c in libav 11.7 and earlier allows remote attackers to cause a denial of service NULL pointer dereference and crash via a crafted MP3 file. No CVE assigned The h264 codec is...
Debian DLA-781-2 : asterisk regression update
Brad Barnett found that the recent security update of Asterisk could cause immediate SIP termination due to an incomplete fix for CVE-2014-2287. For Debian 7 'Wheezy', these problems have been fixed in version 1:1.8.13.1dfsg1-3+deb7u6. We recommend that you upgrade your asterisk packages. NOTE:...
[SECURITY] [DLA 779-1] tomcat7 security update
Package : tomcat7 Version : 7.0.28-4+deb7u9 CVE ID : CVE-2016-8745 Debian Bug : 849949 A bug in the error handling of the send file code for the NIO HTTP connector resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processo...
[SECURITY] [DLA 773-2] python-crypto regression update
Package : python-crypto Version : 2.6-4+deb7u5 CVE ID : CVE-2013-7459 Debian Bug : 849495, 850025, 850077 It was discovered that there was a regression in the recent update to python-crypto, a cryptographic algorithms and protocols for Python. We now raise a warning not an error on invalid input ...
Debian DLA-777-1 : libvncserver security update
It was discovered that there were two vulnerabilities in libvncserver, a library to create/embed a VNC server : - CVE-2016-9941: Fix a heap-based buffer overflow that allows remote servers to cause a denial of service via a crafted FramebufferUpdate message containing a subrectangle outside of th...
[SECURITY] [DLA 771-1] hdf5 security update
Package : hdf5 Version : 1.8.8-9+deb7u1 CVE ID : CVE-2016-4330 CVE-2016-4331 CVE-2016-4332 CVE-2016-4333 Debian Bug : 845301 Cisco Talos discovered that hdf5, a file format and library for storing scientific data, contained several vulnerabilities that could lead to arbitrary code execution when...
DLA-685-2 libxi - regression update
Bulletin has no description...
Debian DLA-765-1 : qemu-kvm security update
Multiple vulnerabilities have been found in qemu-kvm : CVE-2016-9911 qemu-kvm built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehciinittransfer'. A guest user/process could use this issue to leak host memory,...
Debian DLA-764-1 : qemu security update
Multiple vulnerabilities have been found in QEMU : CVE-2016-9911 Quick Emulator Qemu built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehciinittransfer'. A guest user/ process could use this issue to leak host memory...
Debian DLA-763-1 : squid3 security update
Saulius Lapinskas from Lithuanian State Social Insurance Fund Board discovered that Squid3, a fully featured web proxy cache, does not properly process responses to If-None-Modified HTTP conditional requests, leading to client-specific Cookie data being leaked to other clients. A remote attacker...
Debian DLA-759-1 : nss security update
Franziskus Kiefer reported that the existing mitigations for some timing side-channel attacks were insufficient: https://www.mozilla.org/en-US/security/advisories/mfsa2016-90/CVE-201 6-9074 For Debian 7 'Wheezy', these problems have been fixed in version 2:3.26-1+debu7u2. We recommend that you...
Debian DLA-761-2 : python-bottle regression update
The update for python-bottle issued as DLA 761-1 would cause a crash if a unicode string was used in a header. Updated packages are now available to correct this issue. For Debian 7 'Wheezy', these problems have been fixed in version 0.10.11-1+deb7u3. We recommend that you upgrade your...