[SECURITY] [DLA 1231-1] graphicsmagick security update

Package : graphicsmagick Version : 1.3.16-1.1+deb7u16 CVE ID : CVE-2017-17498 CVE-2017-17500 CVE-2017-17501 CVE-2017-17502 CVE-2017-17503 CVE-2017-17782 CVE-2017-17912 CVE-2017-17915 Debian Bug : 884905 The NSFocus Security Team discovered multiple security issues in Graphicsmagick, a collection ...

[SECURITY] [DLA 1232-1] linux security update

Package : linux Version : 3.2.96-3 CVE ID : CVE-2017-5754 CVE-2017-17558 CVE-2017-17741 CVE-2017-17805 CVE-2017-17806 CVE-2017-17807 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2017-5754...

[SECURITY] [DSA 4079-1] poppler security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4079-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 07, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1230-1] xen security update

Package : xen Version : 4.1.6.lts1-11 CVE ID : CVE-2017-17044 CVE-2017-17045 CVE-2017-17563 CVE-2017-17564 CVE-2017-17565 CVE-2017-17566 Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, information leaks, privilege escalation or the...

[SECURITY] [DSA 4078-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4078-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez January 04, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1229-1] imagemagick security update

Package : imagemagick Version : 8:6.7.7.10-5+deb7u20 CVE ID : CVE-2017-1000445, CVE-2017-1000476 Debian Bug : 886281 It was discovered that there were two vulnerabilities in the imagemagick image manipulation program: CVE-2017-1000445: A null pointer dereference in the MagickCore component which...

[SECURITY] [DLA 1228-1] poppler security update

Package : poppler Version : 0.18.4-6+deb7u5 CVE ID : CVE-2017-1000456 Jason Crain discovered a overflow vulnerability in the poppler PDF rendering library. For Debian 7 "Wheezy", this issue has been fixed in poppler version 0.18.4-6+deb7u5. We recommend that you upgrade your poppler packages...

[SECURITY] [DLA 1227-1] imagemagick security update

Package : imagemagick Version : 8:6.7.7.10-5+deb7u19 CVE ID : CVE-2017-17504 CVE-2017-17682 CVE-2017-17879 CVE-2017-17914 Debian Bug : 885340 885942 885125 Several security vulnerabilities were discovered in ImageMagick, an image manipulation program, that allow remote attackers to cause a denial...

[SECURITY] [DLA 1226-1] wireshark security update

Package : wireshark Version : 1.12.1+g01b65bf-4+deb8u6deb7u8 CVE ID : CVE-2017-11408 CVE-2017-17083 CVE-2017-17084 CVE-2017-17085 It was discovered that wireshark, a network protocol analyzer, contained several vulnerabilities in the dissectors for CIP Safety, IWARPMPA, NetBIOS, Profinet I/O and...

[SECURITY] [DLA 1225-1] asterisk security update

Package : asterisk Version : 1:1.8.13.1dfsg1-3+deb7u8 CVE ID : CVE-2017-17090 Debian Bug : 883342 A vulnerability has been discovered in Asterisk, an open source PBX and telephony toolkit, which may result in resource exhaustion and denial of service. CVE-2017-17090: memory leak from chanskinny. ...

[SECURITY] [DSA 4077-1] gimp security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4077-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 30, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4076-1] asterisk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4076-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 30, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4075-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4075-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 29, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1224-1] mercurial security update

Package : mercurial Version : 2.2.2-4+deb7u6 CVE ID : CVE-2017-17458 A vulnerability was found in the Mercurial version control system which could lead to remote arbitrary code execution. CVE-2017-17458 A specially malformed Mercurial repository could cause Git subrepositories to run arbitrary co...

[SECURITY] [DSA 4074-1] imagemagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4074-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 28, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1223-1] thunderbird security update

Package : thunderbird Version : 1:52.5.2-1deb7u1 CVE ID : CVE-2017-7829 CVE-2017-7846 CVE-2017-7847 CVE-2017-7848 Multiple security issues have been found in the Mozilla Thunderbird mail client including information leaks, unintended JavaScript execution and sender address spoofing. For Debian 7...

[SECURITY] [DLA 1221-1] ruby1.9.1 security update

Package : ruby1.9.1 Version : 1.9.3.194-8.1+deb7u7 CVE ID : CVE-2017-17405 CVE-2017-17790 Several vulnerabilities have been discovered in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2017-17405 A command injection...

[SECURITY] [DLA 1222-1] ruby1.8 security update

Package : ruby1.8 Version : 1.8.7.358-7.1+deb7u5 CVE ID : CVE-2017-17405 CVE-2017-17790 Several vulnerabilities have been discovered in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2017-17405 A command injection...

[SECURITY] [DSA 4073-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4073-1 [email protected] https://www.debian.org/security/ Ben Hutchings December 23, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1220-1] gimp security update

Package : gimp Version : 2.8.2-2+deb7u3 CVE ID : CVE-2017-17784 CVE-2017-17785 CVE-2017-17786 CVE-2017-17787 CVE-2017-17788 CVE-2017-17789 Hanno Böck found several buffer overflows in GIMP, the GNU Image Manipulation Program, which could lead to application crash or other unspecified behaviour if...

[SECURITY] [DLA 1217-1] irssi security update

Package : irssi Version : 0.8.15-5+deb7u4 CVE ID : CVE-2017-5193 CVE-2017-5194 CVE-2017-5356 CVE-2017-15227 CVE-2017-15228 CVE-2017-15721 CVE-2017-15722 Debian Bug : 879521 Multiple vulnerabilities have been discovered in Irssi, a terminal based IRC client, which may lead to denial of service or...

[SECURITY] [DLA 1219-1] enigmail security update

Package : enigmail Version : 2:1.9.9-1deb7u1 CVE ID : CVE-2017-17843 CVE-2017-17844 CVE-2017-17845 CVE-2017-17846 CVE-2017-17847 CVE-2017-17848 Multiple vulnerabilities were discovered in Enigmail, an OpenPGP extension for Thunderbird, which could result in a loss of confidentiality, faked...

[SECURITY] [DLA 1218-1] rsync security update

Package : rsync Version : 3.0.9-4+deb7u1 CVE ID : CVE-2017-16548 CVE-2017-17433 CVE-2017-17434 Several vulnerabilities were discovered in rsync, a fast, versatile, remote and local file-copying tool, allowing a remote attacker to bypass intended access restrictions or cause a denial of service. F...

[SECURITY] [DSA 4072-1] bouncycastle security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4072-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 21, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4071-1] sensible-utils security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4071-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 21, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1216-1] wordpress security update

Package : wordpress Version : 3.6.1+dfsg-1deb7u20 CVE ID : CVE-2017-17091 CVE-2017-17092 CVE-2017-17093 CVE-2017-17094 Debian Bug : 883314 Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following issues...

[SECURITY] [DSA 4070-1] enigmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4070-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 21, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1215-1] otrs2 security update

Package : otrs2 Version : 3.3.18-1deb7u3 CVE ID : CVE-2017-17476 Debian Bug : 884801 Francesco Sirocco discovered a flaw in otrs2, the Open Ticket Request System, which could result in session information disclosure when cookie support is disabled. A remote attacker can take advantage of this fla...

[SECURITY] [DLA 1214-1] libreoffice security update

Package : libreoffice Version : 1:3.5.4+dfsg2-0+deb7u10 CVE ID : CVE-2017-12607 CVE-2017-12608 Marcin Noga discovered two vulnerabilities in LibreOffice, which could result in the execution of arbitrary code if a malformed PPT or DOC document is opened. For Debian 7 "Wheezy", these problems have...

[SECURITY] [DSA 4069-1] otrs2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4069-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 20, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1213-1] openafs security update

Package : openafs Version : 1.6.1-3+deb7u8 CVE ID : CVE-2017-17432 CVE-2017-17432 It was discovered that malformed jumbogram packets could result in denial of service against OpenAFS, an implementation of the Andrew distributed file system. For Debian 7 "Wheezy", these problems have been fixed in...

[SECURITY] [DLA 1212-1] otrs2 security update

Package : otrs2 Version : 3.3.18-1deb7u2 CVE ID : CVE-2017-15864 CVE-2017-16664 CVE-2017-16854 CVE-2017-16921 Four vulnerabilities were discovered in the Open Ticket Request System which could result in information disclosure or the execution of arbitrary shell commands by logged-in agents. For...

[SECURITY] [DLA 1211-1] libxml2 security update

Package : libxml2 Version : 2.8.0+dfsg1-7+wheezy12 CVE ID : CVE-2017-15412 CVE-2017-15412 It was detected that some function calls in the XPath extensions functions could result in memory corruption due to "use after free". For Debian 7 "Wheezy", these problems have been fixed in version...

[SECURITY] [DSA 4068-1] rsync security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4068-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 17, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4067-1] openafs security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4067-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 17, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4066-1] otrs2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4066-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 17, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4065-1] openssl1.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4065-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 17, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1210-1] kildclient security update

Package : kildclient Version : 2.11.1-1+deb7u1 CVE ID : CVE-2017-17511 It was discovered that there was a command-injection vulnerability in kildclient, a "MUD" multiplayer real-time virtual world game. For Debian 7 "Wheezy", this issue has been fixed in kildclient version 2.11.1-1+deb7u1. Thanks...

[SECURITY] [DLA 1209-1] sensible-utils security update

Package : sensible-utils Version : 0.0.7+deb7u1 CVE ID : CVE-2017-17512 Debian Bug : 881767 It was discovered that there was a vulnerability in sensible-browser, a utility to start the most suitable web browser based on your environment or configuration. Remote attackers could conduct...

[SECURITY] [DLA 1208-1] reportbug update

Package : reportbug Version : 6.4.4+deb7u2 Debian Bug : 878088 Reportbug, a tool designed to make the reporting of bugs in Debian easier, was further enhanced to automatically detect bug reports for potential regressions caused by a security update. After user confirmation an additional email wit...

[SECURITY] [DLA 1207-1] erlang security update

Package : erlang Version : 15.b.1-dfsg-4+deb7u2 CVE ID : CVE-2017-1000385 An erlang TLS server configured with cipher suites using RSA key exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack against RSA, which when exploited, may result in plaintext...

[SECURITY] [DLA 1203-2] xrdp regression update

Package : xrdp Version : 0.5.0-2+deb7u3 A regression was added by the patch introduced in version 0.5.0-2+deb7u2 to fix CVE-2017-16927: xrdp-sesman started to segfault in libscp. For Debian 7 "Wheezy", these problems have been fixed in version 0.5.0-2+deb7u3. We recommend that you upgrade your xr...

[SECURITY] [DLA 1206-1] tiff security update

Package : tiff Version : 4.0.2-6+deb7u17 CVE ID : CVE-2017-9935 Debian Bug : 866109 In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2pwritepdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an...

[SECURITY] [DSA 4064-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4064-1 [email protected] https://www.debian.org/security/ Michael Gilbert December 12, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1205-1] simplesamlphp security update

Package : simplesamlphp Version : 1.9.2-1+deb7u1 CVE ID : CVE-2017-12867 CVE-2017-12868 CVE-2017-12869 CVE-2017-12872 CVE-2017-12873 CVE-2017-12874 The simplesamlphp package in wheezy is vulnerable to multiple attacks on authentication-related code, leading to unauthorized access and information...

[SECURITY] [DSA 4063-1] pdns-recursor security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4063-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 11, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1204-1] evince security update

Package : evince Version : 3.4.0-3.1+deb7u2 CVE ID : CVE-2017-1000159 It was discovered that there was an arbitrary command injection in the evince PDF viewer. A specially-crafted embedded DVI filename could be exploited to run commands as the current user when "printing" to PDF. For Debian 7...

[SECURITY] [DLA 1203-1] xrdp security update

Package : xrdp Version : 0.5.0-2+deb7u2 CVE ID : CVE-2017-16927 The scpv0saccept function in sesman/libscp/libscpv0.c in the session manager in xrdp uses an untrusted integer as a write length, which allows local users to cause a denial of service buffer overflow and application crash or possibly...

[SECURITY] [DLA 1200-1] linux security update

Package : linux Version : 3.2.96-2 CVE ID : CVE-2016-10208 CVE-2017-8824 CVE-2017-8831 CVE-2017-12190 CVE-2017-13080 CVE-2017-14051 CVE-2017-15115 CVE-2017-15265 CVE-2017-15299 CVE-2017-15649 CVE-2017-15868 CVE-2017-16525 CVE-2017-16527 CVE-2017-16529 CVE-2017-16531 CVE-2017-16532 CVE-2017-16533...

[SECURITY] [DSA 4062-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4062-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 10, 2017 https://www.debian.org/security/faq -...