[SECURITY] [DLA 1364-1] openslp-dfsg security update

Package : openslp-dfsg Version : 1.2.1-9+deb7u2 CVE ID : CVE-2017-17833 CVE-2017-17833 An issue has been found in openslp that is related to heap memory corruption, which may result in a denial-of-service or remote code execution. For Debian 7 "Wheezy", these problems have been fixed in version...

[SECURITY] [DSA 4180-1] drupal7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4180-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 25, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4180-1] drupal7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4180-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 25, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1363-1] ghostscript security update

Package : ghostscript Version : 9.05dfsg-6.3+deb7u8 CVE ID : CVE-2018-10194 Debian Bug : 896069 It was discovered that the settextdistance function in base/gdevpdts.c in the pdfwrite component in Ghostscript does not prevent overflows in text-positioning calculation, which allows remote attackers...

[SECURITY] [DLA 1362-1] gcc-4.9-backport new package

Package : gcc-4.9-backport Version : 4.9.2-10+deb7u1 GCC 4.9 has been packaged as gcc-4.9-backport for Debian 7. This package will be needed by future updates to linux, and possibly other packages, to implement the "retpoline" mitigation for CVE-2017-5715 Spectre variant 2. Further information...

[SECURITY] [DLA 1361-1] psensor security update

Package : psensor Version : 0.6.2.17-2+deb7u1 CVE ID : CVE-2014-10073 Debian Bug : 896195 It was discovered that psensor, a server for monitoring hardware sensors remotely, was prone to a directory traversal vulnerability because the createresponse function in server/server.c lacks a check for...

[SECURITY] [DLA 1360-1] lucene-solr security update

Package : lucene-solr Version : 3.6.0+dfsg-1+deb7u4 CVE ID : CVE-2018-1308 Debian Bug : 896604 It was discovered that there was an XML external entity expansion XXE vulnerability in lucene-solr, a search engine library for Java. It could be exploited to read arbitrary local files from the Solr...

[SECURITY] [DSA 4179-1] linux-tools security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4179-1 [email protected] https://www.debian.org/security/ Ben Hutchings April 24, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4179-1] linux-tools security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4179-1 [email protected] https://www.debian.org/security/ Ben Hutchings April 24, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1359-1] ruby1.8 security update

Package : ruby1.8 Version : 1.8.7.358-7.1+deb7u6 CVE ID : CVE-2017-17742 CVE-2018-6914 CVE-2018-8777 CVE-2018-8778 CVE-2018-8779 CVE-2018-8780 Multiple vulnerabilities were found in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following...

[SECURITY] [DLA 1358-1] ruby1.9.1 security update

Package : ruby1.9.1 Version : 1.9.3.194-8.1+deb7u8 CVE ID : CVE-2017-17742 CVE-2018-6914 CVE-2018-8777 CVE-2018-8778 CVE-2018-8779 CVE-2018-8780 CVE-2018-1000075 CVE-2018-1000076 CVE-2018-1000077 CVE-2018-1000078 Multiple vulnerabilities were found in the interpreter for the Ruby language. The...

[SECURITY] [DLA 1357-1] gunicorn security update

Package : gunicorn Version : 0.14.5-3+deb7u2 CVE ID : CVE-2018-1000164 Debian Bug : 896548 It was discovered that there was an issue in the gunicorn HTTP server for Python applicatons where CRLF sequences could result in an attacker tricking the server into returning arbitrary headers. For more...

[SECURITY] [DSA 4178-1] libreoffice security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4178-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 20, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4177-1] libsdl2-image security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4177-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 20, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4176-1] mysql-5.5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4176-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 20, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4176-1] mysql-5.5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4176-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 20, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1356-1] libreoffice security update

Package : libreoffice Version : 1:3.5.4+dfsg2-0+deb7u11 CVE ID : CVE-2018-10119 CVE-2018-10120 Fuzzing by the OSS-Fuzz project found two memory safety issues in LibreOffice, which could result in an application crash or possibly other unspecified impact. For Debian 7 "Wheezy", these problems have...

[SECURITY] [DLA 1355-1] mysql-5.5 security update

Package : mysql-5.5 Version : 5.5.60-0+deb7u1 CVE ID : CVE-2018-2755 CVE-2018-2761 CVE-2018-2771 CVE-2018-2773 CVE-2018-2781 CVE-2018-2813 CVE-2018-2817 CVE-2018-2818 CVE-2018-2819 Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MyS...

[SECURITY] [DLA 1354-1] opencv security update

Package : opencv Version : 2.3.1-11+deb7u4 CVE ID : CVE-2018-5268 CVE-2018-5269 Debian Bug : 886674 886675 Two vulnerabilities were found in OpenCV, the "Open Computer Vision Library". CVE-2018-5268 In OpenCV 3.3.1, a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in...

[SECURITY] [DLA 1353-1] wireshark security update

Package : wireshark Version : 1.12.1+g01b65bf-4+deb8u6deb7u10 CVE ID : CVE-2018-7322 CVE-2018-7323 CVE-2018-7324 CVE-2018-7332 CVE-2018-7334 CVE-2018-7335 CVE-2018-7336 CVE-2018-7337 CVE-2018-7417 CVE-2018-7418 CVE-2018-7419 CVE-2018-7420 It was discovered that wireshark, a network protocol...

[SECURITY] [DSA 4175-1] freeplane security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4175-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 18, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4175-1] freeplane security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4175-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 18, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1352-1] jruby security update

Package : jruby Version : 1.5.6-5+deb7u2 CVE ID : CVE-2018-1000074 An unsafe object deserialization vulnerability was found in jruby, a 100% pure-Java implementation of Ruby. An attacker can use this flaw to run arbitrary code when gem owner is run on a specially crafted YAML file. For Debian 7...

[SECURITY] [DLA 1351-1] qemu security update

Package : qemu Version : 1.1.2+dfsg-6+deb7u25 CVE ID : CVE-2018-7550 Debian Bug : 892041 The loadmultiboot function in hw/i386/multiboot.c in Quick Emulator aka QEMU allows local guest OS users to execute arbitrary code on the QEMU host via a mhloadendaddr value greater than mhbssendaddr, which...

[SECURITY] [DLA 1350-1] qemu-kvm security update

Package : qemu-kvm Version : 1.1.2+dfsg-6+deb7u25 CVE ID : CVE-2018-7550 Debian Bug : 892041 The loadmultiboot function in hw/i386/multiboot.c in Quick Emulator aka QEMU allows local guest OS users to execute arbitrary code on the QEMU host via a mhloadendaddr value greater than mhbssendaddr, whi...

[SECURITY] [DSA 4174-1] corosync security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4174-1 [email protected] https://www.debian.org/security/ Sebastien Delafond April 17, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4174-1] corosync security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4174-1 [email protected] https://www.debian.org/security/ Sebastien Delafond April 17, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1349-1] linux-tools security update

Package : linux-tools Version : 3.2.101-1 Debian Bug : 693667 696957 708994 This update doesnt fix a vulnerability in linux-tools, but provides support for building Linux kernel modules with the "retpoline" mitigation for CVE-2017-5715 Spectre variant 2. This update also includes bug fixes from t...

[SECURITY] [DSA 4173-1] r-cran-readxl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4173-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 16, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1348-1] patch security update

Package : patch Version : 2.6.1-3+deb7u1 CVE ID : CVE-2018-1000156 Debian Bug : 894993 It was discovered that there was an input validation vulnerability in the patch1 utility where an ed1 script embedded in a regular input file could result in arbitrary code execution. This was reported by Rache...

[SECURITY] [DLA 1344-1] squirrelmail security update

Package : squirrelmail Version : 2:1.4.23svn20120406-2+deb7u2 CVE ID : CVE-2018-8741 Debian Bug : 893202 Florian Grunow and Birk Kauer of ERNW discovered a path traversal vulnerability in SquirrelMail, a webmail application, allowing an authenticated remote attacker to retrieve or delete arbitrar...

[SECURITY] [DLA 1347-1] tiff3 security update

Package : tiff3 Version : 3.9.6-11+deb7u10 CVE ID : CVE-2018-7456 Debian Bug : 891288 A NULL Pointer Dereference was discovered in the TIFFPrintDirectory function tifprint.c when using the tiffinfo tool to print crafted TIFF information. This vulnerability could be leveraged by remote attackers t...

[SECURITY] [DLA 1346-1] tiff security update

Package : tiff Version : 4.0.2-6+deb7u19 CVE ID : CVE-2018-7456 Debian Bug : 891288 A NULL Pointer Dereference was discovered in the TIFFPrintDirectory function tifprint.c when using the tiffinfo tool to print crafted TIFF information. This vulnerability could be leveraged by remote attackers to...

[SECURITY] [DLA 1345-1] perl security update

Package : perl Version : 5.14.2-21+deb7u6 CVE ID : CVE-2018-6913 GwanYeong Kim reported that pack could cause a heap buffer write overflow with a large item count. For Debian 7 "Wheezy", these problems have been fixed in version 5.14.2-21+deb7u6. We recommend that you upgrade your perl packages...

[SECURITY] [DSA 4172-1] perl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4172-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 14, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4172-1] perl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4172-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 14, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4171-1] ruby-loofah security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4171-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 13, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4171-1] ruby-loofah security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4171-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 13, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4079-2] poppler regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-4079-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 12, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4079-2] poppler regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-4079-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 12, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4169-1] pcs security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4169-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez April 11, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4170-1] pjproject security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4170-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 09, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1343-1] ming security update

Package : ming Version : 0.4.4-1.1+deb7u8 CVE ID : CVE-2018-6358 CVE-2018-7867 CVE-2018-7868 CVE-2018-7870 CVE-2018-7871 CVE-2018-7872 CVE-2018-7875 CVE-2018-9165 Multiple vulnerabilities have been discovered in Ming: CVE-2018-6358 Heap-based buffer overflow vulnerability in the printDefineFont2...

[SECURITY] [DLA 1342-1] ldap-account-manager security update

Package : ldap-account-manager Version : 3.7-2+deb7u1 CVE ID : CVE-2018-8763 Michal Kedzior found two vulnerabilities in LDAP Account Manager, a web front-end for LDAP directories. CVE-2018-8763 The found Reflected Cross Site Scripting XSS vulnerability might allow an attacker to execute JavaScri...

[SECURITY] [DLA 1283-2] python-crypto security update

Package : python-crypto Version : 2.6-4+deb7u8 This is an update to DLA-1283-1. In DLA-1283-1 it is claimed that the issue described in CVE-2018-6594 is fixed. It turns out that the fix is partial and upstream has decided not to fix the issue as it would break compatibility and that ElGamal...

[SECURITY] [DSA 4168-1] squirrelmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4168-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 08, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4168-1] squirrelmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4168-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 08, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1341-1] sdl-image1.2 security update

Package : sdl-image1.2 Version : 1.2.12-2+deb7u2 CVE ID : CVE-2017-12122 CVE-2017-14440 CVE-2017-14441 CVE-2017-14442 CVE-2017-14448 CVE-2017-14450 Lilith of Cisco Talos discovered several buffer overflow vulnerabilities in the SDL Image library which can be leveraged by attackers to execute...

[SECURITY] [DLA 1340-1] sam2p security update

Package : sam2p Version : 0.49.1-1+deb7u3 CVE ID : CVE-2018-7487 CVE-2018-7551 CVE-2018-7552 CVE-2018-7553 CVE-2018-7554 Multiple invalid frees and buffer-overflow vulnerabilities were discovered in sam2p, a utility to convert raster images and other image formats, that may lead to a...

[SECURITY] [DSA 4167-1] sharutils security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4167-1 [email protected] https://www.debian.org/security/ Luciano Bello April 05, 2018 https://www.debian.org/security/faq -...