[SECURITY] [DLA 1837-2] rdesktop regression update

Package : rdesktop Version : 1.8.6-0+deb8u2 Debian Bug : 930511 The update for rdesktop released as 1.8.6-0+deb8u1 introduced a regression which broke RDP protocol negotiation. Updated rdesktop packages are now available to correct this issue. For Debian 8 "Jessie", this problem has been fixed in...

[SECURITY] [DSA 4377-1] rssh security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4377-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 30, 2019 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1605-1] firefox-esr security update

Package : firefox-esr Version : 60.4.0esr-1deb8u1 CVE ID : CVE-2018-12405 CVE-2018-17466 CVE-2018-18492 CVE-2018-18493 CVE-2018-18494 CVE-2018-18498 Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or...

[SECURITY] [DLA 1515-1] hylafax security update

Package : hylafax Version : 3:6.0.6-6+deb8u1 CVE ID : CVE-2018-17141 Luis Merino, Markus Vervier and Eric Sesterhenn discovered that missing input sanitising in the Hylafax fax software could potentially result in the execution of arbitrary code via a malformed fax message. For Debian 8 "Jessie",...

[SECURITY] [DSA 4293-1] discount security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4293-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini September 14, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1433-1] openjpeg2 security update

Package : openjpeg2 Version : 2.1.0-2+deb8u4 CVE ID : CVE-2015-1239 CVE-2016-5139 CVE-2015-1239 Fix for denial of service process crash via a crafted PDF. CVE-2016-5139 Fix for integer overflows, allowing a denial of service heap-based buffer overflow or possibly have unspecified other impact via...

[SECURITY] [DLA 1395-1] php-horde-image security update

Package : php-horde-image Version : 2.1.0-4+deb8u1 CVE IDs : CVE-2017-9774 CVE-2017-14650 Debian Bugs : 865505 876400 It was discovered that there were two remote code execution vulnerabilities in php-horde-image, the image processing library for the Horde https://www.horde.org/ groupware tool:...

[SECURITY] [DSA 4107-1] django-anymail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4107-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 07, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4024-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4024-1 [email protected] https://www.debian.org/security/ Michael Gilbert November 08, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4003-1] libvirt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4003-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 19, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3967-1] mbedtls security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3967-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 08, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3953-1] aodh security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3953-1 [email protected] https://www.debian.org/security/ Luciano Bello August 23, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3943-1] gajim security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3943-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 14, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1049-1] libsndfile security update

Package : libsndfile Version : 1.0.25-9.1+deb7u4 CVE ID : CVE-2017-12562 Debian Bug : 869166 It was discovered that there was a heap buffer overflow attack in libsndfile, a library for reading/writing audio files. An attacker could cause a remote denial of service attack by tricking the function...

[SECURITY] [DSA 3899-1] vlc security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3899-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 27, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3896-1] apache2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3896-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 22, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3883-1] rt-authen-externalauth security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3883-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 15, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3861-1] libtasn1-6 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3861-1 [email protected] https://www.debian.org/security/ Sebastien Delafond May 24, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 944-1] openvpn security update

Package : openvpn Version : 2.2.1-8+deb7u4 CVE ID : CVE-2017-7479 Denial of Service due to Exhaustion of Packet-ID counter An authenticated client can cause the servers the packet-id counter to roll over, which would lead the server process to hit an ASSERT and stop running. To make the server hi...

[SECURITY] [DLA 939-1] qemu-kvm security update

Package : qemu-kvm Version : 1.1.2+dfsg-6+deb7u21 CVE ID : CVE-2016-9603 CVE-2017-7718 CVE-2017-7980 Multiple vulnerabilities have been discovered in qemu-kvm, a full virtualization solution on x86 hardware based on Quick EmulatorQemu. The Common Vulnerabilities and Exposures project identifies t...

[SECURITY] [DLA 882-1] tryton-server security update

Package : tryton-server Version : 2.2.4-1+deb7u4 CVE ID : CVE-2017-0360 It was discovered that there was a path suffix injection attack in tryton-server, a general purpose application platform. For Debian 7 "Wheezy", this issue has been fixed in tryton-server version 2.2.4-1+deb7u4. We recommend...

[SECURITY] [DLA 808-1] ruby-archive-tar-minitar security update

Package : ruby-archive-tar-minitar Version : 0.5.2-2+deb7u1 CVE ID : CVE-2016-10173 Debian Bug : 853249 It has been found that rubygem archive-tar-minitar allows attackers to overwrite arbitrary files during archive extraction via a .. dot dot in an extracted filename. For Debian 7 "Wheezy", thes...

[SECURITY] [DLA 790-1] mapserver security update

Package : mapserver Version : 6.0.1-3.2+deb7u4 CVE ID : CVE-2017-5522 It was discovered that mapserver, a CGI-based framework for Internet map services, was vulnerable to a stack-based overflow. This issue allowed a remote user to crash the service, or potentially execute arbitrary code. For Debi...

[SECURITY] [DLA 788-1] pdns-recursor security update

Package : pdns-recursor Version : 3.3-3+deb7u2 CVE ID : CVE-2016-9139 Florian Heinz and Martin Kluge reported that pdns-recursor, a recursive DNS server, parses all records present in a query regardless of whether they are needed or even legitimate, allowing a remote, unauthenticated attacker to...

[SECURITY] [DSA 3755-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3755-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 08, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 761-1] python-bottle security update

Package : python-bottle Version : 0.10.11-1+deb7u2 CVE ID : CVE-2016-9964 Debian Bug : 848392 It was discovered that bottle, a WSGI-framework for the Python programming language, did not properly filter "\r\n" sequences when handling redirections. This allowed an attacker to perform CRLF attacks...

[SECURITY] [DLA 729-1] tomcat7 security update

Package : tomcat7 Version : 7.0.28-4+deb7u7 CVE ID : CVE-2016-0762 CVE-2016-5018 CVE-2016-6794 CVE-2016-6796 CVE-2016-6797 CVE-2016-6816 CVE-2016-8735 Debian Bug : 841655 842662 842663 842664 842665 842666 845385 Multiple security vulnerabilities have been discovered in the Tomcat servlet and JSP...

[SECURITY] [DLA 728-1] tomcat6 security update

Package : tomcat6 Version : 6.0.45+dfsg-1deb7u3 CVE ID : CVE-2016-0762 CVE-2016-5018 CVE-2016-6794 CVE-2016-6796 CVE-2016-6797 CVE-2016-6816 CVE-2016-8735 Debian Bug : 841655 842662 842663 842664 842665 842666 845385 Multiple security vulnerabilities have been discovered in the Tomcat servlet and...

[SECURITY] [DLA 477-1] librsvg security update

Package : librsvg Version : 2.36.1-2+deb7u2 CVE ID : CVE-2015-7558 CVE-2016-4347 CVE-2016-4348 Note CVE-2016-4347 is a duplicate of CVE-2015-7558 Two DoS in librsvg 2.40.2 parsing SVGs with circular definitions were found they will produce stack exhaustion by Gustavo Grieco. The version in wheezy...

[SECURITY] [DSA 3579-1] xerces-c security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3579-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 16, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 382-1] sudo security update

Package : sudo Version : 1.7.4p4-2.squeeze.6 CVE ID : CVE-2015-5602 Debian Bug : 804149 When sudo is configured to allow a user to edit files under a directory that they can already write to without using sudo, they can actually edit read and write arbitrary files. Daniel...

[SECURITY] [DLA 324-1] binutils security update

Package : binutils Version : 2.20.1-16+deb6u2 CVE ID : CVE-2012-3509 Debian Bug : 688951 This update fixes several issues as described below. PR ld/12613 no CVE assigned Niranjan Hasabnis discovered that passing an malformed linker script to GNU ld, part of binutils, may result in a stack buffer...

[SECURITY] [DLA 234-1] ipsec-tools security update

Package : ipsec-tools Version : 1:0.7.3-12+deb6u1 CVE ID : CVE-2015-4047 Debian Bug : 785778 Javantea discovered a NULL pointer dereference flaw in racoon, the Internet Key Exchange daemon of ipsec-tools. A remote attacker can use this flaw to cause the IKE daemon to crash via specially crafted U...

[SECURITY] [DLA 198-1] wireshark security update

Package : wireshark Version : 1.8.2-5wheezy15deb6u1 CVE ID : CVE-2015-2191 CVE-2015-2188 CVE-2015-0564 CVE-2015-0562 CVE-2014-8714 CVE-2014-8713 CVE-2014-8712 CVE-2014-8711 CVE-2014-8710 CVE-2014-6432 CVE-2014-6431 CVE-2014-6430 CVE-2014-6429 CVE-2014-6428 CVE-2014-6423 CVE-2014-6422 The followin...

[SECURITY] [DLA 176-1] mono security update

Package : mono Version : 2.6.7-5.1+deb6u1 CVE ID : CVE-2015-2318 CVE-2015-2319 CVE-2015-2320 Debian Bug : 780751 Three issues with Monos TLS stack are addressed. CVE-2015-2318 Monos implementation of the SSL/TLS stack failed to check the order of the handshake messages. Which would allow various...

[SECURITY] [DSA 3190-1] putty security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3190-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff March 15, 2015 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3163-1] libreoffice security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3163-1 [email protected] http://www.debian.org/security/ Alessandro Ghedini February 19, 2015 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3079-1] ppp security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3079-1 [email protected] http://www.debian.org/security/ Sebastien Delafond November 28, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2989-1] apache2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2989-1 [email protected] http://www.debian.org/security/ Stefan Fritsch July 24, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2969-1] libemail-address-perl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2969-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso June 27, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2920-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2920-1 [email protected] http://www.debian.org/security/ Michael Gilbert May 03, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2824-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2824-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso December 19, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2765-1] davfs2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2765-1 [email protected] http://www.debian.org/security/ Luciano Bello September 26, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2717-1] xml-security-c security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2717-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso June 28, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2702-1] telepathy-gabble security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2702-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso June 03, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2610-1] ganglia security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2610-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez January 21, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2544-1] xen security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2544-1 [email protected] http://www.debian.org/security/ Raphael Geissert September 08, 2012 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2530-1] rssh security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2530-1 [email protected] http://www.debian.org/security/ Florian Weimer August 15, 2012 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2452-1] apache2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2452-1 [email protected] http://www.debian.org/security/ Stefan Fritsch April 15, 2012 http://www.debian.org/security/faq -...

[BSA-046] Security Update for icedove

Christoph Göhre uploaded new packages for icedove which fixed the following security problems: CVE-2011-0084 "regenrecht" discovered that incorrect pointer handling in the SVG processing code could lead to the execution of arbitrary code. CVE-2011-2378 "regenrecht" discovered that incorrect memor...