[SECURITY] [DLA 1163-1] apr-util security update

Package : apr-util Version : 1.4.1-3+deb7u1 CVE ID : CVE-2017-12618 Debian Bug : 879996 It was discovered that there was an out-of-bounds read access in apr-util, a support/portability library used by many applications. A local user with write access to the database could have made a process usin...

[SECURITY] [DLA 1162-1] apr security update

Package : apr Version : 1.4.6-3+deb7u2 CVE ID : CVE-2017-12613 Debian Bug : 879708 It was discovered that there was an out-of-bounds memory vulnerability in apr, a support/portability library for various applications. When the aprexptime or aprosexptime functions were invoked with an invalid mont...

[SECURITY] [DSA 4019-1] imagemagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4019-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 05, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1161-1] redis security update

Package : redis Version : 2:2.4.14-1+deb7u2 CVE ID : CVE-2016-1051 It was discovered that there was a "Cross Protocol Scripting" attack in the Redis key-value database. "POST" and "Host:" command strings which are not valid in the Redis protocol were not immediately rejected when an attacker make...

[SECURITY] [DLA 1160-1] wordpress security update

Package : wordpress Version : 3.6.1+dfsg-1deb7u18 CVE ID : CVE-2017-16510 Debian Bug : 880528 WordPress, a web blogging tool, was affected by an issue where $wpdb-prepare can create unexpected and unsafe queries leading to potential SQL injection SQLi in plugins and themes, as demonstrated by a...

[SECURITY] [DSA 4018-1] openssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4018-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 04, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4018-1] openssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4018-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 04, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4017-1] openssl1.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4017-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 03, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4017-1] openssl1.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4017-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 03, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1159-1] graphicsmagick security update

Package : graphicsmagick Version : 1.3.16-1.1+deb7u13 CVE ID : CVE-2017-16352 CVE-2017-16353 Maor Shwartz, Jeremy Heng and Terry Chia discovered two security vulnerabilities in Graphicsmagick, a collection of image processing tool s. CVE-2017-16352 Graphicsmagick was vulnerable to a heap-based...

[SECURITY] [DSA 4016-1] irssi security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4016-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 03, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4016-1] irssi security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4016-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 03, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1158-1] bchunk security update

Package : bchunk Version : 1.2.0-12+deb7u1 CVE ID : CVE-2017-15953 CVE-2017-15954 CVE-2017-15955 Debian Bug : 880116 Several vulnerabilities were discovered in bchunk, a tool to convert a CD image in .bin/.cue format into a set of .iso and .cdr/.wav tracks. It was possible to trigger a heap-based...

[SECURITY] [DSA 4015-1] openjdk-8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4015-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 02, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4014-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4014-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 01, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1153-1] icedove/thunderbird security update

Package : thunderbird Version : 1:52.4.0-1deb7u1 CVE ID : CVE-2017-7793 CVE-2017-7805 CVE-2017-7810 CVE-2017-7814 CVE-2017-7818 CVE-2017-7819 CVE-2017-7823 CVE-2017-7824 CVE-2017-7825 Multiple security issues have been found in the Mozilla Thunderbird mail client: Multiple memory safety errors,...

[SECURITY] [DSA 4013-1] openjpeg2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4013-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 31, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1156-1] libdatetime-timezone-perl new upstream version

Package : libdatetime-timezone-perl Version : 1:1.58-1+2017c This update includes the changes in tzdata 2017c for the Perl bindings. For the list of changes, see DLA-1156-1. For Debian 7 "Wheezy", these problems have been fixed in version 1:1.58-1+2017c. We recommend that you upgrade your...

[SECURITY] [DLA 1155-1] tzdata new upstream version

Package : tzdata Version : 2017c-0+deb7u1 This update includes the changes in tzdata 2017b. Notable changes are: - Northern Cyprus resumed EU rules starting 2017-10-29. - Namibia will switch from +01 with DST to +02 all year, affecting UT offsets starting 2018-04-01. - Sudan will switch from +03 ...

[SECURITY] [DLA 1154-1] graphicsmagick security update

Package : graphicsmagick Version : 1.3.16-1.1+deb7u12 CVE ID : CVE-2017-14103 CVE-2017-14314 CVE-2017-14504 CVE-2017-14733 CVE-2017-14994 CVE-2017-14997 CVE-2017-15930 Debian Bug : 879999 Multiple vulnerabilities were found in graphicsmagick. CVE-2017-14103 The ReadJNGImage and ReadOneJNGImage...

[SECURITY] [DLA 1151-1] wordpress security update

Package : wordpress Version : 3.6.1+dfsg-1deb7u17 CVE ID : CVE-2016-9263 CVE-2017-14718 CVE-2017-14719 CVE-2017-14720 CVE-2017-14721 CVE-2017-14722 CVE-2017-14723 CVE-2017-14725 CVE-2017-14990 Debian Bug : 876274 877629 Several vulnerabilities were discovered in wordpress, a web blogging tool. Th...

[SECURITY] [DLA 1152-1] quagga security update

Package : quagga Version : quagga0.99.22.4-1+wheezy3+deb7u2 CVE ID : CVE-2017-16227 Debian Bug : 879474 It was discovered that the bgpd daemon in the Quagga routing suite does not properly calculate the length of multi-segment ASPATH UPDATE messages, causing bgpd to drop a session and potentially...

[SECURITY] [DLA 1150-1] wpa security update

Package : wpa Version : 1.0-3+deb7u5 CVE ID : CVE-2017-13077 CVE-2017-13078 CVE-2017-13079 CVE-2017-13080 CVE-2017-13081 CVE-2017-13082 CVE-2017-13086 CVE-2017-13087 CVE-2017-13088 A vulnerability was found in how WPA code can be triggered to reconfigure WPA/WPA2/RSN keys TK, GTK, or IGTK by...

[SECURITY] [DSA 4012-1] libav security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4012-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 31, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4011-1] quagga security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4011-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 30, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4011-1] quagga security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4011-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 30, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4010-1] git-annex security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4010-1 [email protected] https://www.debian.org/security/ Sebastien Delafond October 30, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4010-1] git-annex security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4010-1 [email protected] https://www.debian.org/security/ Sebastien Delafond October 30, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4009-1] shadowsocks-libev security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4009-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 29, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4008-1] wget security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4008-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 28, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1149-1] wget security update

Package : wget Version : 1.13.4-3+deb7u5 CVE ID : CVE-2017-13089 CVE-2017-13090 CVE-2017-13089 Fix stack overflow in HTTP protocol handling. CVE-2017-13090 Fix heap overflow in HTTP protocol handling. For Debian 7 "Wheezy", these problems have been fixed in version 1.13.4-3+deb7u5. We recommend...

[SECURITY] [DSA 4007-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4007-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini October 27, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1148-1] golang security update

Package : golang Version : 2:1.0.2-1.1+deb7u2 CVE ID : CVE-2017-15041 Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points...

[SECURITY] [DLA 1144-1] git-annex security update

Package : git-annex Version : 3.20120629+deb7u1 CVE ID : CVE-2017-12976 Debian Bug : 873088 git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related...

[SECURITY] [DLA 1147-1] exiv2 security update

Package : exiv2 Version : 0.23-1+deb7u2 CVE ID : CVE-2017-11591 CVE-2017-11683 CVE-2017-14859 CVE-2017-14862 CVE-2017-14864 Debian Bug : 876893 The exiv2 library is vulnerable to multiple issues that can all lead to denial of service of the applications relying on the library to parse images...

[SECURITY] [DLA 1145-1] zoneminder security update

Package : zoneminder Version : 1.25.0-4+deb7u2 CVE ID : CVE-2017-5595 Multiple vulnerabilities have been found in zoneminder. This update fixes only a serious file disclosure vulnerability CVE-2017-5595. The application has been found to suffer from many other problems such as SQL injection...

[SECURITY] [DLA 1146-1] mosquitto security update

Package : mosquitto Version : 0.15-2+deb7u2 CVE ID : CVE-2017-9868 Debian Bug : 865959 mosquittos persistence file mosquitto.db was created in a world-readable way thus allowing local users to obtain sensitive MQTT topic information. While the application has been fixed to set proper permissions ...

[SECURITY] [DLA 1143-1] curl security update

Package : curl Version : 7.26.0-1+wheezy22 CVE ID : CVE-2017-1000257 Brian Carpenter, Geeknik Labs, 0xd34db347, and independently reported by the OSS-Fuzz project, detected a out of bounds read during IMAP FETCH response. For Debian 7 "Wheezy", this problem has been fixed in version...

[SECURITY] [DSA 4006-1] mupdf security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4006-1 [email protected] https://www.debian.org/security/ October 24, 2017 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DSA 4006-1] mupdf security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4006-1 [email protected] https://www.debian.org/security/ October 24, 2017 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DLA 1142-1] libav security update

Package : libav Version : 6:0.8.21-0+deb7u1 CVE ID : CVE-2015-8365 CVE-2017-7208 CVE-2017-7862 CVE-2017-9992 Multiple vulnerabilities have been found in libav: CVE-2015-8365 The smkadecodeframe function in libavcodec/smacker.c does not verify that the data size is consistent with the number of...

[SECURITY] [DLA 1133-1] ming security update

Package : ming Version : 1:0.4.4-1.1+deb7u4 CVE ID : CVE-2017-11704 CVE-2017-11728 CVE-2017-11729 CVE-2017-11730 CVE-2017-11731 CVE-2017-11734 Multiple vulnerabilities have been discovered in Ming: CVE-2017-11704 Heap-based buffer over-read in the function decompileIF in util/decompile.c in Ming ...

[SECURITY] [DSA 4005-1] openjfx security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4005-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 20, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4004-1] jackson-databind security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4004-1 [email protected] https://www.debian.org/security/ Sebastien Delafond October 20, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4004-1] jackson-databind security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4004-1 [email protected] https://www.debian.org/security/ Sebastien Delafond October 20, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4003-1] libvirt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4003-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 19, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4003-1] libvirt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4003-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 19, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1141-1] mysql-5.5 security update

Package : mysql-5.5 Version : 5.5.58-0+deb7u1 CVE ID : CVE-2017-10268 CVE-2017-10378 CVE-2017-10379 CVE-2017-10384 Debian Bug : 878402 Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.58, which...

[SECURITY] [DSA 4002-1] mysql-5.5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4002-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 19, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4002-1] mysql-5.5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4002-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 19, 2017 https://www.debian.org/security/faq -...