[SECURITY] [DLA-2530-1] drupal7 security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2530-1 [email protected] https://www.debian.org/lts/security/ Gunnar Wolf January 21, 2021 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2516-1] gssproxy security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2516-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb January 04, 2021 https://wiki.debian.org/LTS -...

[SECURITY] [DSA 4819-1] kitty security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4819-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 26, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DLA 2505-1] spip security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2505-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA December 23, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2482-1] debian-security-support security update

Debian LTS Advisory DLA-2482-1 [email protected] https://www.debian.org/lts/security/ Holger Levsen December 04, 2020 https://wiki.debian.org/LTS Package : debian-security-support Version : 1:9+2020.12.04 debian-security-support, the Debian security support coverage checker, has been...

[SECURITY] [DSA 4788-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4788-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 10, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DLA 2397-1] php7.0 security update

Debian LTS Advisory DLA-2397-1 [email protected] https://www.debian.org/lts/security/ Roberto C. Sánchez October 06, 2020 https://wiki.debian.org/LTS Package : php7.0 Version : 7.0.33-0+deb9u10 CVE ID : CVE-2020-7070 A vulnerability was discovered in PHP, a server-side, HTML-embedded...

[SECURITY] [DLA 2377-1] qt4-x11 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2377-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk September 21, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2348-1] php-horde-core security update

Debian LTS Advisory DLA-2348-1 [email protected] https://www.debian.org/lts/security/ Mike Gabriel August 29, 2020 https://wiki.debian.org/LTS Package : php-horde-core Version : 2.27.6+debian1-2+deb9u1 CVE ID : CVE-2017-16907 Debian Bug : 909800 In Horde Groupware, there has been an XSS...

[SECURITY] [DLA 2109-1] netty security update

Package : netty Version : 1:3.2.6.Final-2+deb8u2 CVE ID : CVE-2019-20444 CVE-2019-20445 CVE-2020-7238 Debian Bug : 950966 950967 Several vulnerabilities were discovered in the HTTP server provided by Netty, a Java NIO client/server socket framework: CVE-2019-20444 HttpObjectDecoder.java allows an...

[SECURITY] [DLA 1995-1] angular.js security update

Package : angular.js Version : 1.2.26-1+deb8u1 CVE ID : CVE-2019-14863 Earlier versions of this package package were vulnerable to Cross-site Scripting XSS due to no proper sanitization of xlink:href attributes. For Debian 8 "Jessie", this problem has been fixed in version 1.2.26-1+deb8u1. We...

[SECURITY] [DSA 4544-1] unbound security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4544-1 [email protected] https://www.debian.org/security/ Sebastien Delafond October 16, 2019 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1953-1] clamav security update

Package : clamav Version : 0.101.4+dfsg-0+deb8u1 CVE ID : CVE-2019-12625 CVE-2019-12900 Debian Bug : 34359 It was discovered that clamav, the open source antivirus engine, is affected by the following security vulnerabilities: CVE-2019-12625 Denial of Service DoS vulnerability, resulting from...

[SECURITY] [DSA 4499-1] ghostscript security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4499-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 12, 2019 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1774-1] otrs2 security update

Package : otrs2 Version : 3.3.18-1+deb8u9 CVE ID : CVE-2019-9892 A flaw was discovered in OTRS, the Open Ticket Request System. An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading o...

[SECURITY] [DLA 1605-1] firefox-esr security update

Package : firefox-esr Version : 60.4.0esr-1deb8u1 CVE ID : CVE-2018-12405 CVE-2018-17466 CVE-2018-18492 CVE-2018-18493 CVE-2018-18494 CVE-2018-18498 Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or...

[SECURITY] [DLA 1604-1] lxml security update

Package : lxml Version : 3.4.0-1+deb8u1 CVE ID : CVE-2018-19787 It was discovered that there was a XSS injection vulnerability in the LXML HTML/XSS manipulation library for Python. LXML did not remove "javascript:" URLs that used escaping such as "j a v a s c r i p t". This is a similar issue to...

[SECURITY] [DLA 1527-1] ghostscript security update

Package : ghostscript Version : 9.06dfsg-2+deb8u9 CVE ID : CVE-2018-16543 CVE-2018-17183 Debian Bug : 908303 Tavis Ormandy discovered multiple vulnerabilities in Ghostscript, an interpreter for the PostScript language, which could result in denial of service, the creation of files or the executio...

[SECURITY] [DSA 4293-1] discount security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4293-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini September 14, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4288-1] ghostscript security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4288-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 07, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1440-1] libarchive-zip-perl security update

Package : libarchive-zip-perl Version : 1.39-1+deb8u1 CVE ID : CVE-2018-10860 Debian Bug : 902882 The libarchive-zip-perl package is vulnerable to a directory traversal attack in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An...

[SECURITY] [DLA 1433-1] openjpeg2 security update

Package : openjpeg2 Version : 2.1.0-2+deb8u4 CVE ID : CVE-2015-1239 CVE-2016-5139 CVE-2015-1239 Fix for denial of service process crash via a crafted PDF. CVE-2016-5139 Fix for integer overflows, allowing a denial of service heap-based buffer overflow or possibly have unspecified other impact via...

[SECURITY] [DSA 4193-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4193-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 05, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1349-1] linux-tools security update

Package : linux-tools Version : 3.2.101-1 Debian Bug : 693667 696957 708994 This update doesnt fix a vulnerability in linux-tools, but provides support for building Linux kernel modules with the "retpoline" mitigation for CVE-2017-5715 Spectre variant 2. This update also includes bug fixes from t...

[SECURITY] [DSA 4168-1] squirrelmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4168-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 08, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1289-1] irssi security update

Package : irssi Version : 0.8.15-5+deb7u5 CVE IDs : CVE-2018-7050 CVE-2018-7051 CVE-2018-7052 Debian Bugs : 890676, 890677, 890678 It was discovered that there where a number of vulnerabilities in irssi, the terminal based IRC client: - CVE-2018-7050: Null pointer dereference for an "empty" nick....

[SECURITY] [DSA 4119-1] libav security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4119-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 19, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4076-1] asterisk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4076-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 30, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4046-1] libspring-ldap-java security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4046-1 [email protected] https://www.debian.org/security/ Sebastien Delafond November 22, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1182-1] ldns security update

Package : ldns Version : 1.6.13-1+deb7u2 CVE ID : CVE-2017-1000231 Debian Bug : 882015 A security vulnerability has been discovered in ldns, a library and collection of utilities for DNS programming. CVE-2017-1000231 The generic parser contained a double-free vulnerability which resulted in an...

[SECURITY] [DLA 1166-1] tomcat7 security update

Package : tomcat7 Version : 7.0.28-4+deb7u16 CVE ID : CVE-2017-12617 A remote code execution vulnerability has been discovered in tomcat7. When HTTP PUT was enabled e.g., via setting the readonly initialization parameter of the Default servlet to false it was possible to upload a JSP file to the...

[SECURITY] [DSA 4014-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4014-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 01, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4009-1] shadowsocks-libev security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4009-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 29, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4003-1] libvirt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4003-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 19, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3982-1] perl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3982-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 21, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3978-1] gdk-pixbuf security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3978-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 18, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1097-1] tcpdump security update

Package : tcpdump Version : 4.9.2-1deb7u1 CVE ID : CVE-2017-12894 CVE-2017-12895 CVE-2017-12896 CVE-2017-12897 CVE-2017-12898 CVE-2017-12899 CVE-2017-12900 CVE-2017-12901 CVE-2017-12902 CVE-2017-12985 CVE-2017-12986 CVE-2017-12987 CVE-2017-12988 CVE-2017-12989 CVE-2017-12990 CVE-2017-12991...

[SECURITY] [DSA 3952-1] libxml2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3952-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 23, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3919-1] openjdk-8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3919-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 25, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3896-1] apache2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3896-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 22, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3877-1] tor security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3877-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 10, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 919-1] weechat security update

Package : weechat Version : 0.3.8-1+deb7u2 CVE ID : CVE-2017-8073 Debian Bug : 861121 WeeChat before allows a remote crash by sending a filename via DCC to the IRC plugin. For Debian 7 "Wheezy", these problems have been fixed in version 0.3.8-1+deb7u2. We recommend that you upgrade your weechat...

[SECURITY] [DLA 918-1] freetype security update

Package : freetype Version : 2.4.9-1.1+deb7u6 CVE ID : CVE-2017-8105 Debian Bug : 861220 860303 It was found that an out of bounds write caused by a heap-based buffer overflow could be triggered in freetype via a crafted font. This update also reverts the fix for CVE-2016-10328, as it was...

[SECURITY] [DLA 902-1] imagemagick security update

Package : imagemagick Version : 8:6.7.7.10-5+deb7u13 CVE ID : CVE-2017-7606 CVE-2017-7619 Debian Bug : 859771 859769 Two security vulnerabilities were discovered in imagemagick that allow remote attackers to cause a denial of service application crash and infinite loop or possibly other unspecifi...

[SECURITY] [DLA 898-1] libosip2 security update

Package : libosip2 Version : 3.6.0-4+deb7u1 CVE ID : CVE-2016-10324 CVE-2016-10325 CVE-2016-10326 CVE-2017-7853 CVE-2016-10324 In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osipclrncpy function defined in osipparser2/osipport.c. CVE-2016-10325 In...

[SECURITY] [DSA 3803-1] texlive-base security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3803-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 08, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3782-1] openjdk-7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3782-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 08, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 768-1] pgpdump security update

Package : pgpdump Version : 0.27-1+deb7u1 CVE ID : CVE-2016-4021 Debian Bug : 773747 The readbinary function in buffer.c in pgpdump, a PGP packet visualizer, allows context-dependent attackers to cause a denial of service infinite loop and CPU consumption via crafted input. This was assigned...

[SECURITY] [DLA 761-1] python-bottle security update

Package : python-bottle Version : 0.10.11-1+deb7u2 CVE ID : CVE-2016-9964 Debian Bug : 848392 It was discovered that bottle, a WSGI-framework for the Python programming language, did not properly filter "\r\n" sequences when handling redirections. This allowed an attacker to perform CRLF attacks...

[SECURITY] [DSA 3730-1] icedove security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3730-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 11, 2016 https://www.debian.org/security/faq -...