[SECURITY] [DSA 4095-1] gcab security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4095-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 24, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4094-1] smarty3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4094-1 [email protected] https://www.debian.org/security/ January 22, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DSA 4094-1] smarty3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4094-1 [email protected] https://www.debian.org/security/ January 22, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DSA 4093-1] openocd security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4093-1 [email protected] https://www.debian.org/security/ January 21, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DSA 4093-1] openocd security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4093-1 [email protected] https://www.debian.org/security/ January 21, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DLA 1255-1] bind9 security update

Package : bind9 Version : 1:9.8.4.dfsg.P1-6+nmu2+deb7u19 CVE ID : CVE-2017-3145 Jayachandran Palanisamy of Cygate AB reported that BIND, a DNS server implementation, was improperly sequencing cleanup operations, leading in some cases to a use-after-free error, triggering an assertion failure and...

[SECURITY] [DLA 1254-1] lucene-solr security update

Package : lucene-solr Version : 3.6.0+dfsg-1+deb7u3 CVE ID : CVE-2017-12629 Michael Stepankin and Olga Barinova discovered a remote code execution vulnerability in Apache Solr by exploiting XML External Entity processing XXE in conjunction with use of a Config API add-listener command to reach th...

[SECURITY] [DLA 1253-1] openocd security update

Package : openocd Version : 0.5.0-1+deb7u1 CVE ID : CVE-2018-5704 Debian Bug : 887488 OpenOCD, an on-chip JTAG debug solution for ARM and MIPS systems, does not block attempts to use HTTP POST for sending data to localhost, which allows remote attackers to conduct cross-protocol scripting attacks...

[SECURITY] [DLA 1252-1] couchdb security update

Package : couchdb Version : 1.2.0-5+deb7u1 CVE ID : CVE-2017-12635 CVE-2017-12636 CVE-2017-12635 Prevent non-admin users to give themselves admin privileges. CVE-2017-12636 Blacklist some configuration options to prevent execution of arbitrary shell commands as the CouchDB user For Debian 7...

[SECURITY] [DLA 1251-1] php5 security update

Package : php5 Version : 5.4.45-0+deb7u12 CVE ID : CVE-2018-5712 It was discovered that PHP5 was vulnerable to a reflected cross-site scripting XSS attack on the PHAR 404 error page by manipulating the URI of a request for a .phar file. This issue is only exploitable if the web server is configur...

[SECURITY] [DLA 1250-1] mysql-5.5 security update

Package : mysql-5.5 Version : 5.5.59-0+deb7u1 CVE ID : CVE-2018-2562 CVE-2018-2622 CVE-2018-2640 CVE-2018-2665 CVE-2018-2668 Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.59, which includes...

[SECURITY] [DLA 1249-1] smarty3 security update

Package : smarty3 Version : 3.1.10-2+deb7u2 CVE ID : CVE-2017-1000480 Debian Bug : 886460 It was discovered that there was a code-injection vulnerability in smarty3, a PHP template engine. A via specially-crafted filename in comments could result in arbitray code execution. Thanks to Mike Gabriel...

[SECURITY] [DSA 4092-1] awstats security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4092-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 19, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4092-1] awstats security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4092-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 19, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1248-1] libgd2 security update

Package : libgd2 Version : 2.0.36rc1dfsg-6.1+deb7u11 CVE ID : CVE-2018-5711 Debian Bug : 887485 It was discovered that there was a denial-of-service attack in the libgd2 image library. A corrupt file could have exploited a signedness confusion leading to an infinite loop. For Debian 7 "Wheezy",...

[SECURITY] [DLA 1247-1] rsync security update

Package : rsync Version : 3.0.9-4+deb7u2 CVE ID : CVE-2018-5764 Debian Bug : 887588 It was discovered that there was an injection vulnerability in the rsync file-copying tool. For Debian 7 "Wheezy", this issue has been fixed in rsync version 3.0.9-4+deb7u2. We recommend that you upgrade your rsyn...

[SECURITY] [DLA 1246-1] transmission security update

Package : transmission Version : 2.52-3+nmu3 CVE ID : CVE-2018-5702 Debian Bug : 886990 Tavis Ormandy discovered a vulnerability in the Transmission BitTorrent client; insecure RPC handling between the Transmission daemon and the client interfaces may result in the execution of arbitrary code if ...

[SECURITY] [DSA 4091-1] mysql-5.5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4091-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 18, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4091-1] mysql-5.5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4091-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 18, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4090-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4090-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 17, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4090-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4090-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 17, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4089-1] bind9 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4089-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 16, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4089-1] bind9 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4089-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 16, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1243-1] xbmc security update

Package : xbmc Version : 2:11.0git20120510.82388d5-1+deb7u1 CVE ID : CVE-2017-8314 Debian Bug : 863230 The Check Point Research Team discovered that the XBMC media center allows arbitrary file write when a malicious subtitle file is downloaded in zip format. This update requires the new dependenc...

[SECURITY] [DLA 1245-1] graphicsmagick security update

Package : graphicsmagick Version : 1.3.16-1.1+deb7u17 CVE ID : CVE-2018-5685 Debian Bug : 887158 A vulnerability has been discovered in GraphicsMagick, a collection of image processing tools, which may result in a denial of service. CVE-2018-5685: An infinite loop and application hang has been...

[SECURITY] [DLA 1244-1] ca-certificates update

Package : ca-certificates Version : 20130119+deb7u2 Debian Bug : 858064 858539 This release does a complete update of the CA list. This includes removing the StartCom and WoSign certificates to as they are now untrusted by the major browser vendors. This includes 1024-bit root certificates 858064...

[SECURITY] [DSA 4088-1] gdk-pixbuf security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4088-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 15, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1242-1] xmltooling security update

Package : xmltooling Version : 1.4.2-5+deb7u2 CVE ID : CVE-2018-0486 Philip Huppert discovered the Shibboleth service provider is vulnerable to impersonation attacks and information disclosure due to mishandling of DTDs in the XMLTooling XML parsing library. For additional details please refer to...

[SECURITY] [DSA 4087-1] transmission security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4087-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 14, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1241-1] libkohana2-php security update

Package : libkohana2-php Version : 2.3.4-2+deb7u1 CVE ID : CVE-2016-10510 David Sopas discovered that Kohana, a PHP framework, was vulnerable to a Cross-site scripting XSS attack that allowed remote attackers to inject arbitrary web script or HTML by bypassing the stripimagetags protection...

[SECURITY] [DSA 4086-1] libxml2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4086-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 13, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4086-1] libxml2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4086-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 13, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4085-1] xmltooling security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4085-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 12, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4084-1] gifsicle security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4084-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 12, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4084-1] gifsicle security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4084-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 12, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1240-1] ming security update

Package : ming Version : 1:0.4.4-1.1+deb7u6 CVE ID : CVE-2017-11732 CVE-2017-16883 CVE-2017-16898 Multiple vulnerabilities have been discovered in Ming: CVE-2017-11732 heap-based buffer overflow vulnerability in the function dcputs util/decompile.c in Ming = 0.4.8, which allows attackers to cause...

[SECURITY] [DSA 4083-1] poco security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4083-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 11, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4083-1] poco security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4083-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 11, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1239-1] poco security update

Package : poco Version : 1.3.6p1-4+deb7u1 CVE ID : CVE-2017-1000472...

[SECURITY] [DLA 1238-1] awstats security update

Package : awstats Version : 7.0dfsg-7+deb7u1 CVE ID : CVE-2017-1000501 Debian Bug : 885835 Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution. For Debian 7 "Wheezy", the...

[SECURITY] [DLA 1237-1] plexus-utils2 security update

Package : plexus-utils2 Version : 2.0.5-1+deb7u1 CVE ID : CVE-2017-1000487 Charles Duffy discovered that the Commandline class in plexus-utils2, a collection of components used by Apache Maven, does not correctly quote the contents of double-quoted strings. An attacker may use this flaw to inject...

[SECURITY] [DLA 1236-1] plexus-utils security update

Package : plexus-utils Version : 1:1.5.15-4+deb7u1 CVE ID : CVE-2017-1000487 Charles Duffy discovered that the Commandline class in plexus-utils, a collection of components used by Apache Maven, does not correctly quote the contents of double-quoted strings. An attacker may use this flaw to injec...

[SECURITY] [DLA 1234-2] gdk-pixbuf regression update

Package : gdk-pixbuf Version : 2.26.1-1+deb7u8 Debian Bug : 886721 The patch introduced in DLA-1234-1 had a problem that caused gdk-pixbufs gif module to fail to load. For Debian 7 "Wheezy", these problems have been fixed in version 2.26.1-1+deb7u8. We recommend that you upgrade your gdk-pixbuf...

[SECURITY] [DSA 4082-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4082-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 09, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4082-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4082-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 09, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4081-1] php5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4081-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 08, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4080-1] php7.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4080-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 08, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1235-1] opencv security update

Package : opencv Version : 2.3.1-11+deb7u3 CVE ID : CVE-2017-17760 CVE-2017-1000450 Opencv 3.3 and earlier has problems while reading data, which might result in either buffer overflows or integer overflows. For Debian 7 "Wheezy", these problems have been fixed in version 2.3.1-11+deb7u3. We...

[SECURITY] [DLA 1234-1] gdk-pixbuf security update

Package : gdk-pixbuf Version : 2.26.1-1+deb7u7 CVE ID : CVE-2017-1000422 It was discovered that there were several integer overflows in gdk-pixbuf, a library to manipulate images for the GTK graphics toolkit. This could have led to memory corruption and potential code execution. For Debian 7...

[SECURITY] [DLA 1233-1] gifsicle security update

Package : gifsicle Version : 1.67-1.1deb7u1 CVE ID : CVE-2017-1000421 It was discovered that there was a use-after-free vulnerability in gifsicle, a command-line tool for manipulating GIF images. For Debian 7 "Wheezy", this issue has been fixed in gifsicle version 1.67-1.1deb7u1. We recommend tha...