[SECURITY] [DLA 1435-1] dnsmasq regression update

Package : dnsmasq Version : 2.72-3+deb8u3 Debian Bug : 860064 The dns-root-data update to 2017072601deb8u2 broke dnsmasqs init script, making dnsmasq no longer start when dns-root-data was installed. This update fixes dnsmasqs parsing of dns-root-data. For Debian 8 "Jessie", this problem has been...

[SECURITY] [DLA 1434-1] linux-base update

Package : linux-base Version : 4.5deb8u1 Debian Bug : 702482 761614 The linux-base package has been updated to support the package of Linux 4.9 that was recently added to Debian 8. This resolves a dependency that was not satisfiable by the jessie and jessie-security suites. This update also fixes...

[SECURITY] [DLA 1433-1] openjpeg2 security update

Package : openjpeg2 Version : 2.1.0-2+deb8u4 CVE ID : CVE-2015-1239 CVE-2016-5139 CVE-2015-1239 Fix for denial of service process crash via a crafted PDF. CVE-2016-5139 Fix for integer overflows, allowing a denial of service heap-based buffer overflow or possibly have unspecified other impact via...

[SECURITY] [DLA 1432-1] gpac security update

Package : gpac Version : 0.5.0+svn5324dfsg1-1+deb8u1 CVE ID : CVE-2018-13005 CVE-2018-13006 Debian Bug : 902782 Two heap buffer over read conditions were found in gpac. CVE-2018-13005 Due to an error in a while loop condition, the function urnRead in isomedia/boxcodebase.c has a heap-based buffer...

[SECURITY] [DLA 1431-1] ant security update

Package : ant Version : 1.9.4-3+deb8u1 CVE ID : CVE-2018-10886 unzip and untar target tasks in ant allows the extraction of files outside the target directory. A crafted zip or tar file submitted to an Ant build could create or overwrite arbitrary files with the privileges of the user running Ant...

[SECURITY] [DSA 4252-1] znc security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4252-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 18, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4251-1] vlc security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4251-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 18, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1430-1] taglib security update

Package : taglib Version : 1.9.1-2.1+deb8u1 CVE ID : CVE-2018-11439 CVE-2018-11439 Fix for a heap-based buffer over-read via a crafted audio file. For Debian 8 "Jessie", these problems have been fixed in version 1.9.1-2.1+deb8u1. We recommend that you upgrade your taglib packages. Further...

[SECURITY] [DLA 1424-1] linux-latest-4.9 new package

Package : linux-latest-4.9 Version : 80+deb9u5deb8u1 Linux 4.9 has been packaged for Debian 8 as linux-4.9. This provides a supported upgrade path for systems that currently use kernel packages from the "jessie-backports" suite. However, "apt full-upgrade" will not automatically install the updat...

[SECURITY] [DLA 1423-1] linux-4.9 new package

Package : linux-4.9 Version : 4.9.110-1deb8u1 CVE ID : CVE-2017-5753 CVE-2017-18255 CVE-2018-1118 CVE-2018-1120 CVE-2018-1130 CVE-2018-3639 CVE-2018-5814 CVE-2018-10021 CVE-2018-10087 CVE-2018-10124 CVE-2018-10853 CVE-2018-10876 CVE-2018-10877 CVE-2018-10878 CVE-2018-10879 CVE-2018-10880...

[SECURITY] [DSA 4250-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4250-1 [email protected] https://www.debian.org/security/ Sebastien Delafond July 18, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4250-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4250-1 [email protected] https://www.debian.org/security/ Sebastien Delafond July 18, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4249-1] ffmpeg security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4249-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 17, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4248-1] blender security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4248-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 17, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4247-1] ruby-rack-protection security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4247-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 16, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1429-1] sssd security update

Package : sssd Version : 1.11.7-3+deb8u1 CVE ID : CVE-2018-10852 Debian Bug : 902860 The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD us...

[SECURITY] [DLA 1428-1] 389-ds-base security update

Package : 389-ds-base Version : 1.3.3.5-4+deb8u1 CVE ID : CVE-2015-1854 CVE-2017-15134 CVE-2018-1054 CVE-2018-1089 CVE-2018-10850 CVE-2015-1854 A flaw was found while doing authorization of modrdn operations. An unauthenticated attacker able to issue an ldapmodrdn call to the directory server cou...

[SECURITY] [DSA 4246-1] mailman security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4246-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 15, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4246-1] mailman security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4246-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 15, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA-1427-1] znc security update

Package : znc Version : 1.4-2+deb8u1 CVE IDs : CVE-2018-14055 CVE-2018-14056 Debian Bugs : 903787 903788 It was discovered that there were two issues in znc, a modular IRC bouncer: There was insufficient validation of lines coming from the network allowing a non-admin user to escalate his privile...

[SECURITY] [DLA 1422-2] linux security update

Package : linux Version : 3.16.57-2 CVE ID : CVE-2017-5715 CVE-2017-5753 CVE-2018-1066 CVE-2018-1093 CVE-2018-1130 CVE-2018-3665 CVE-2018-5814 CVE-2018-9422 CVE-2018-10853 CVE-2018-10940 CVE-2018-11506 CVE-2018-12233 CVE-2018-1000204 Debian Bug : 898165 The previous update to linux failed to buil...

[SECURITY] [DLA 1422-1] linux security update

Package : linux Version : 3.16.57-1 CVE ID : CVE-2017-5715 CVE-2017-5753 CVE-2018-1066 CVE-2018-1093 CVE-2018-1130 CVE-2018-3665 CVE-2018-5814 CVE-2018-9422 CVE-2018-10853 CVE-2018-10940 CVE-2018-11506 CVE-2018-12233 CVE-2018-1000204 Debian Bug : 898165 Several vulnerabilities have been discovere...

[SECURITY] [DSA 4245-1] imagemagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4245-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 14, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1426-1] cups security update

Package : cups Version : 1.7.5-11+deb8u4 CVE ID : CVE-2018-4180 CVE-2018-4181 CVE-2018-6553 Several vulnerabilities were discovered in CUPS, the Common UNIX Printing System. These issues have been identified with the following CVE ids: CVE-2018-4180 Dan Bastone of Gotham Digital Science discovere...

[SECURITY] [DLA 1425-1] thunderbird security update

Package : thunderbird Version : 1:52.9.1-1deb8u1 CVE ID : CVE-2018-5188 CVE-2018-12359 CVE-2018-12360 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 CVE-2018-12366 CVE-2018-12372 CVE-2018-12373 CVE-2018-12374 Multiple security issues have been found in Thunderbird, which may lead to...

[SECURITY] [DLA 1421-1] ruby2.1 security update

Package : ruby2.1 Version : 2.1.5-2+deb8u4 CVE ID : CVE-2015-9096 CVE-2016-2339 CVE-2016-7798 CVE-2017-0898 CVE-2017-0899 CVE-2017-0900 CVE-2017-0901 CVE-2017-0902 CVE-2017-0903 CVE-2017-10784 CVE-2017-14033 CVE-2017-14064 CVE-2017-17405 CVE-2017-17742 CVE-2017-17790 CVE-2018-6914 CVE-2018-8777...

[SECURITY] [DSA 4244-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4244-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 13, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA-1420-1] cinnamon security update

Package : cinnamon Version : 2.2.16-5+deb8u1 CVE ID : CVE-2018-13054 Debian Bug : 903201 It was discovered that there was a symlink attack in the Cinnamon desktop environment. An attacker could overwrite an arbitrary file on the filesystem via a $HOME/.face icon file as the...

[SECURITY] [DLA-1419-1] ruby-sprockets security update

Package : ruby-sprockets Version : 2.12.3-1+deb8u1 CVE IDs : CVE-2018-3760 Debian Bug : 901913 It was discovered that there was a discovered a path traversal flaw in ruby-sprockets, a Rack-based asset packaging system. A remote attacker could take advantage of this flaw to read arbitrary files...

[SECURITY] [DSA 4243-1] cups security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4243-1 [email protected] https://www.debian.org/security/ Luciano Bello July 11, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4243-1] cups security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4243-1 [email protected] https://www.debian.org/security/ Luciano Bello July 11, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4242-1] ruby-sprockets security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4242-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 09, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4242-1] ruby-sprockets security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4242-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 09, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1418-1] bouncycastle security update

Package : bouncycastle Version : 1.49+dfsg-3+deb8u3 CVE ID : CVE-2016-1000338 CVE-2016-1000339 CVE-2016-1000341 CVE-2016-1000342 CVE-2016-1000343 CVE-2016-1000345 CVE-2016-1000346 Several security vulnerabilities were found in Bouncy Castle, a Java implementation of cryptographic algorithms...

[SECURITY] [DLA-1417-1] ca-certificates security update

Package : ca-certificates Version : 20141019+deb8u4 Debian Bugs : 858064 858539 867461 894070 There have been a number of updates to the set of Certificate Authority CA certificates that are considered "valid" or otherwise should be trusted. For Debian 8 "Jessie", these issues have been fixed in...

[SECURITY] [DLA 1416-1] libsoup2.4 security update

Package : libsoup2.4 Version : 2.48.0-1+deb8u2 CVE ID : CVE-2018-12910 It was discovered that the Soup HTTP library performed insuffient validation of cookie requests which could result in an out-of-bounds memory read. For Debian 8 "Jessie", these problems have been fixed in version...

[SECURITY] [DLA 1415-1] phpmyadmin security update

Package : phpmyadmin Version : 4:4.2.12-2+deb8u3 CVE ID : CVE-2016-6609 CVE-2016-6614 CVE-2016-6615 CVE-2016-6616 CVE-2016-6618 CVE-2016-6619 CVE-2016-6620 CVE-2016-6621 CVE-2016-6622 CVE-2016-9865 CVE-2017-18264 Several vulnerabilities were found in phpMyAdmin, the web-based MySQL administration...

[SECURITY] [DLA 1414-1] mercurial security update

Package : mercurial Version : 3.1.2-2+deb8u5 CVE ID : CVE-2017-9462 CVE-2017-17458 CVE-2018-1000132 Debian Bug : 861243 892964 901050 Some security vulnerabilities were found in Mercurial which allow authenticated users to trigger arbitrary code execution and unauthorized data access in certain...

[SECURITY] [DSA 4241-1] libsoup2.4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4241-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 05, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4240-1] php7.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4240-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 05, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1413-1] dokuwiki security update

Package : dokuwiki Version : 0.0.20140505.a+dfsg-4+deb8u1 CVE ID : CVE-2017-18123 Debian Bug : 889281 The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which leads to a reflected file download vulnerability, and allows remote attackers to...

[SECURITY] [DSA 4239-1] gosa security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4239-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 03, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4238-1] exiv2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4238-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 03, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1412-1] cups security update

Package : cups Version : 1.7.5-11+deb8u3 CVE ID : CVE-2017-18190 CVE-2017-18248 Two vulnerabilities affecting the cups printing server were found which can lead to arbitrary IPP command execution and denial of service. CVE-2017-18190 A localhost.localdomain whitelist entry in validhost in...

[SECURITY] [DLA 1411-1] tiff security update

Package : tiff Version : 4.0.3-12.3+deb8u6 CVE ID : CVE-2017-11613 CVE-2018-5784 CVE-2018-7456 CVE-2018-8905 CVE-2018-10963 Debian Bug : 869823 898348 890441 891288 893806 Several issues were discovered in TIFF, the Tag Image File Format library, that allowed remote attackers to cause a...

[SECURITY] [DLA 1400-2] tomcat7 regression update

Package : tomcat7 Version : 7.0.56-3+really7.0.88-2 Debian Bug : 902670 The security update of Tomcat 7 announced as DLA-1400-1 introduced a regression for applications that make use of the Equinox OSGi framework. The MANIFEST file of tomcat-jdbc.jar in libtomcat7-java contains an invalid version...

[SECURITY] [DLA 1410-1] python-pysaml2 security update

Package : python-pysaml2 Version : 2.0.0-1+deb8u2 CVE ID : CVE-2017-1000433 Debian Bug : 886423 Pysaml2, a Python implementation of the Security Assertion Markup Language, would accept any password when run with Python optimizations enabled. This allows attackers to log in as any user without...

[SECURITY] [DSA 4237-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4237-1 [email protected] https://www.debian.org/security/ Michael Gilbert June 30, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4237-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4237-1 [email protected] https://www.debian.org/security/ Michael Gilbert June 30, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1409-1] mosquitto security update

Package : mosquitto Version : 1.3.4-2+deb8u2 CVE ID : CVE-2017-7651 CVE-2017-7652 CVE-2017-7651 fix to avoid extraordinary memory consumption by crafted CONNECT packet from unauthenticated client CVE-2017-7652 in case all sockets/file descriptors are exhausted, this is a fix to avoid default conf...