[SECURITY] [DSA 4111-1] libreoffice security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4111-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 11, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1275-1] uwsgi security update

Package : uwsgi Version : 1.2.3+dfsg-5+deb7u2 CVE ID : CVE-2018-6758 Debian Bug : 889753 It was discovered that the uwsgiexpandpath function in utils.c in Unbit uWSGI, an application container server, has a stack-based buffer overflow via a large directory length that can cause a denial-of-servic...

[SECURITY] [DLA 1274-1] exim4 security update

Package : exim4 Version : 4.80-7+deb7u6 CVE ID : CVE-2018-6789 Debian Bug : 890000 Meh Chang discovered a buffer overflow flaw in a utility function used in the SMTP listener of Exim, a mail transport agent. A remote attacker can take advantage of this flaw to cause a denial of service, or...

[SECURITY] [DSA 4110-1] exim4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4110-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 10, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4110-1] exim4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4110-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 10, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4109-1] ruby-omniauth security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4109-1 [email protected] https://www.debian.org/security/ February 09, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DSA 4109-1] ruby-omniauth security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4109-1 [email protected] https://www.debian.org/security/ February 09, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DSA 4108-1] mailman security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4108-1 [email protected] https://www.debian.org/security/ Thijs Kinkhorst February 09, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4108-1] mailman security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4108-1 [email protected] https://www.debian.org/security/ Thijs Kinkhorst February 09, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1273-1] simplesamlphp security update

Package : simplesamlphp Version : 1.9.2-1+deb7u2 CVE ID : CVE-2017-18121 CVE-2017-18122 CVE-2018-6521 Debian Bug : 889286 simplesamlphp, an authentication and federation application has been found vulnerable to Cross Site Scripting XSS, signature validation byepass and using insecure connection...

[SECURITY] [DLA 1272-1] mailman security update

Package : mailman Version : 1:2.1.15-1+deb7u3 CVE ID : CVE-2018-5950 Debian Bug : 888201 The mailman package has a Cross-site scripting XSS vulnerability in the web UI before 2.1.26 which allows remote attackers to inject arbitrary web script or HTML via a user-options URL For Debian 7 "Wheezy",...

[SECURITY] [DSA 4105-2] mpv security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4105-2 [email protected] https://www.debian.org/security/ February 08, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DSA 4105-2] mpv security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4105-2 [email protected] https://www.debian.org/security/ February 08, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DSA 4107-1] django-anymail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4107-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 07, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4107-1] django-anymail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4107-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 07, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA-1271-1] postgresql-9.1 security update

Package : postgresql-9.1 Version : 9.1.24lts2-0+deb7u2 CVE ID : CVE-2018-1053 A vulnerabilities has been found in the PostgreSQL database system: CVE-2018-1053 Tom Lane discovered that pgupgrade, a tool used to upgrade PostgreSQL database clusters, creates temporary files containing password hash...

[SECURITY] [DSA 4106-1] libtasn1-6 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4106-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 07, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4106-1] libtasn1-6 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4106-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 07, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4105-1] mpv security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4105-1 [email protected] https://www.debian.org/security/ February 06, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DSA 4105-1] mpv security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4105-1 [email protected] https://www.debian.org/security/ February 06, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DLA 1270-1] xen security update

Package : xen Version : 4.1.6.lts1-12 CVE ID : CVE-2016-9603 CVE-2016-9637 CVE-2017-2620 Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation. For Debian 7 "Wheezy", these problems have been fixed in version 4.1.6.lts1-12. We recommend th...

[SECURITY] [DSA 4104-1] p7zip security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4104-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 04, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4104-1] p7zip security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4104-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 04, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1269-1] dokuwiki security update

Package : dokuwiki Version : 0.0.20120125b-2+deb7u2 CVE ID : CVE-2017-18123 Debian Bug : 889281 It was discovered that an XHR/AJAX call did not properly encode user input in the "dokuwiki" wiki platform. This resulted in a reflected file download vulnerability. For Debian 7 "Wheezy", this issue h...

[SECURITY] [DLA 1268-1] p7zip security update

Package : p7zip Version : 9.20.1dfsg.1-4+deb7u3 CVE ID : CVE-2017-17969 Debian Bug : 888297 The p7zip package has a heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip which allows remote attackers to cause a denial of service out-of-bounds write or potentiall...

[SECURITY] [DLA 1267-1] squid security update

Package : squid Version : 2.7.STABLE9-4.1+deb7u3 CVE ID : CVE-2018-1000027 Debian Bug : 888720 Squid, a high-performance proxy caching server for web clients, has been found vulnerable to denial of service attacks associated with ESI response processing and intermediate CA certificate downloading...

[SECURITY] [DLA 1266-1] squid3 security update

Package : squid3 Version : 3.1.20-2.2+deb7u8 CVE ID : CVE-2018-1000024 CVE-2018-1000027 Debian Bug : 888719 888720 Squid, a high-performance proxy caching server for web clients, has been found vulnerable to denial of service attacks associated with ESI response processing and intermediate CA...

[SECURITY] [DLA 1249-2] smarty3 regression update

Package : smarty3 Version : 3.1.10-2+deb7u3 CVE ID : CVE-2017-1000480 Debian Bug : 886460 It was previously discovered that there was a code-injection vulnerability in smarty3, a PHP template engine. A via specially-crafted filename in comments could result in arbitrary code execution. However, t...

[SECURITY] [DSA 4103-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4103-1 [email protected] https://www.debian.org/security/ Michael Gilbert January 31, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1265-1] krb5 security update

Package : krb5 Version : 1.10.1+dfsg-5+deb7u9 CVE ID : CVE-2013-1418 CVE-2014-5351 CVE-2014-5353 CVE-2014-5355 CVE-2016-3119 CVE-2016-3120 Debian Bug : 728845 762479 773226 778647 819468 832572 Kerberos, a system for authenticating users and services on a network, was affected by several...

[SECURITY] [DSA 4102-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4102-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 30, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4094-2] smarty3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4094-2 [email protected] https://www.debian.org/security/ January 30, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DSA 4094-2] smarty3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4094-2 [email protected] https://www.debian.org/security/ January 30, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DLA 1264-1] unbound security update

Package : unbound Version : 1.4.17-3+deb7u3 CVE ID : CVE-2017-15105 Debian Bug : 887733 Ralph Dolmans and Karst Koymans found a flaw in the way unbound validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence NXDOMAIN answe...

[SECURITY] [DLA 1263-1] curl security update

Package : curl Version : 7.26.0-1+wheezy24 CVE ID : CVE-2018-1000007 Craig de Stigter discovered that authentication data might be leaked to third parties when following HTTP redirects. For Debian 7 "Wheezy", these problems have been fixed in version 7.26.0-1+wheezy24. We recommend that you upgra...

[SECURITY] [DLA 1263-1] debian-security-support update

Package : debian-security-support Version : 2018.01.29deb7u1 This update marks several packages as no longer supported by wheezy-lts: teamspeak-server, teamspeak-client, libstruts1.2-java, nvidia-graphics-drivers, glassfish, jbossas4, libnet-ping-external-perl, mp3gain, tor, jasperreports. For th...

[SECURITY] [DLA 1262-1] thunderbird security update

Package : thunderbird Version : 1:52.6.0-1deb7u1 CVE ID : CVE-2018-5089 CVE-2018-5095 CVE-2018-5096 CVE-2018-5097 CVE-2018-5098 CVE-2018-5099 CVE-2018-5102 CVE-2018-5103 CVE-2018-5104 CVE-2018-5117 Debian Bug : 885157 885158 887766 Multiple security issues have been found in the Mozilla Thunderbi...

[SECURITY] [DSA 4101-1] wireshark security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4101-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 28, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1261-1] clamav security update

Package : clamav Version : 0.99.2+dfsg-0+deb7u4 CVE ID : CVE-2017-12374 CVE-2017-12375 CVE-2017-12376 CVE-2017-12377 CVE-2017-12378 CVE-2017-12379 CVE-2017-12380 Debian Bug : 888484 824196 Multiple vulnerabilities have been discovered in clamav, the ClamAV AntiVirus toolkit for Unix. Effects rang...

[SECURITY] [DLA 1260-1] tiff3 security update

Package : tiff3 Version : 3.9.6-11+deb7u9 CVE ID : CVE-2017-18013 Debian Bug : 885985 A vulnerability has been discovered in the libtiff image processing library which may result in an application crash and denial of service. CVE-2017-18013 NULL pointer dereference via crafted TIFF image For Debi...

[SECURITY] [DLA 1259-1] tiff security update

Package : tiff Version : 4.0.2-6+deb7u18 CVE ID : CVE-2017-18013 Debian Bug : 885985 A vulnerability has been discovered in the libtiff image processing library which may result in an application crash and denial of service. CVE-2017-18013 NULL pointer dereference via crafted TIFF image For Debia...

[SECURITY] [DSA 4100-1] tiff security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4100-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 27, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4099-1] ffmpeg security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4099-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 27, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1258-1] wireshark security update

Package : wireshark Version : 1.12.1+g01b65bf-4+deb8u6deb7u9 CVE ID : CVE-2018-5334 CVE-2018-5335 CVE-2018-5336 Kamil Frankowicz and Young found that several parsers of wireshark could be crashed by malformed packets. For Debian 7 "Wheezy", these problems have been fixed in version...

[SECURITY] [DLA 1257-1] openssh security update

Package : openssh Version : 1:6.0p1-4+deb7u7 CVE ID : CVE-2016-10708 OpenSSH was found to be vulnerable to out of order NEWKEYS messages which could crash the daemon, resulting in a denial of service attack. For Debian 7 "Wheezy", these problems have been fixed in version 1:6.0p1-4+deb7u7. We...

[SECURITY] [DSA 4098-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4098-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini January 26, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4097-1] poppler security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4097-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 25, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4096-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4096-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 25, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1256-1] firefox-esr security update

Package : firefox-esr Version : 52.6.0esr-1deb7u1 CVE ID : CVE-2018-5089 CVE-2018-5091 CVE-2018-5095 CVE-2018-5096 CVE-2018-5097 CVE-2018-5098 CVE-2018-5099 CVE-2018-5102 CVE-2018-5103 CVE-2018-5104 CVE-2018-5117 Several security issues have been found in the Mozilla Firefox web browser: Multiple...

[SECURITY] [DSA 4095-1] gcab security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4095-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 24, 2018 https://www.debian.org/security/faq -...