[SECURITY] [DLA ] xchat security update

Package : xchat Version : 2.8.8-7.1+deb7u1 CVE ID : CVE-2016-2087 Debian Bug : 852275 It was discovered that there was a directory traversal vulnerability in the xchat IRC client which allowed remote IRC servers to read or modify arbitrary files via a ".." in the server name. For Debian 7 "Wheezy...

[SECURITY] [DSA 3930-1] freeradius security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3930-1 [email protected] https://www.debian.org/security/ Sebastien Delafond August 10, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3930-1] freeradius security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3930-1 [email protected] https://www.debian.org/security/ Sebastien Delafond August 10, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3929-1] libsoup2.4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3929-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 10, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3929-1] libsoup2.4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3929-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 10, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3928-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3928-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 10, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1049-1] libsndfile security update

Package : libsndfile Version : 1.0.25-9.1+deb7u4 CVE ID : CVE-2017-12562 Debian Bug : 869166 It was discovered that there was a heap buffer overflow attack in libsndfile, a library for reading/writing audio files. An attacker could cause a remote denial of service attack by tricking the function...

[SECURITY] [DSA 3927-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3927-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 07, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3927-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3927-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 07, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3926-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3926-1 [email protected] https://www.debian.org/security/ Michael Gilbert August 04, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3926-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3926-1 [email protected] https://www.debian.org/security/ Michael Gilbert August 04, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3925-1] qemu security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3925-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 04, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3924-1] varnish security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3924-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 02, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3924-1] varnish security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3924-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 02, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1048-1] ghostscript security update

Package : ghostscript Version : 9.05dfsg-6.3+deb7u7 CVE ID : CVE-2017-7207 CVE-2017-9611 CVE-2017-9612 CVE-2017-9726 CVE-2017-9727 CVE-2017-9739 CVE-2017-9835 CVE-2017-11714 Debian Bug : 858350 869977 869907 869910 869913 869915 869916 869917 Several issues were found in Ghostscript, the GPL...

[SECURITY] [DSA 3923-1] freerdp security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3923-1 [email protected] https://www.debian.org/security/ Sebastien Delafond August 01, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3923-1] freerdp security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3923-1 [email protected] https://www.debian.org/security/ Sebastien Delafond August 01, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1047-1] supervisor security update

Package : supervisor Version : 3.0a8-1.1+deb7u2 CVE ID : CVE-2017-11610 Debian Bug : 870187 A vulnerability has been found in supervisor, a system for controlling process state, where an authenticated client can send a malicious XML-RPC request to supervisord that will run arbitrary shell command...

[SECURITY] [DLA 1045-1] graphicsmagick security update

Package : graphicsmagick Version : 1.3.16-1.1+deb7u8 CVE ID : CVE-2017-10799 CVE-2017-11102 CVE-2017-11140 CVE-2017-11403 CVE-2017-11636 CVE-2017-11637 CVE-2017-11638 CVE-2017-11641 CVE-2017-11642 CVE-2017-11643 Debian Bug : 867077 867746 870149 Multiple security vulnerabilities, NULL pointer...

[SECURITY] [DLA 1046-1] lucene-solr security update

Package : lucene-solr Version : 3.6.0+dfsg-1+deb7u2 CVE ID : CVE-2017-3163 Debian Bug : 867712 lucene-solr handler supports an HTTP API /replication?command=filecontent&file=filename which is vulnerable to path traversal attack. Specifically, this API does not perform any validation of the user...

[SECURITY] [DLA 1044-1] ipsec-tools security update

Package : ipsec-tools Version : 1:0.8.0-14+deb7u1 CVE ID : CVE-2016-10396 Debian Bug : 867986 The racoon daemon in IPsec-Tools 0.8.2 and earlier contains a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragments. The implementation permits a remote attacker ...

[SECURITY] [DLA 841-2] apache2 regression update

Package : apache2 Version : 2.2.22-13+deb7u11 CVE ID : CVE-2015-0253 CVE-2016-8743 Debian Bug : 858373 The fix for CVE-2016-8743 introduced a regression which would segfault apache workers under certain conditions 858373, an issue similar to previously fixed CVE-2015-0253. The issue was introduce...

[SECURITY] [DLA 1043-1] mysql-5.5 security update

Package : mysql-5.5 Version : 5.5.57-0+deb7u1 CVE ID : CVE-2017-3635 CVE-2017-3636 CVE-2017-3641 CVE-2017-3648. CVE-2017-3651 CVE-2017-3652 CVE-2017-3653 Debian Bug : 868788 Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to t...

[SECURITY] [DSA 3922-1] mysql-5.5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3922-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 28, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3922-1] mysql-5.5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3922-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 28, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1042-1] libquicktime security update

Package : libquicktime Version : 2:1.2.4-3+deb7u2 CVE ID : CVE-2017-9122 CVE-2017-9123 CVE-2017-9124 CVE-2017-9125 CVE-2017-9126 CVE-2017-9127 CVE-2017-9128 Debian Bug : 864664 CVE-2017-9122 The quicktimereadmoov function in moov.c in libquicktime 1.2.4 allows remote attackers to cause a denial o...

[SECURITY] [DLA 1041-1] nasm security update

Package : nasm Version : 2.10.01-1+deb7u1 CVE ID : CVE-2017-10686 CVE-2017-11111 CVE-2017-10686 In Netwide Assembler NASM 2.14rc0, there are multiple heap use after free vulnerabilities in the tool nasm. The related heap is allocated in the token function and freed in the detoken function called ...

[SECURITY] [DSA 3921-1] enigmail update

------------------------------------------------------------------------- Debian Security Advisory DSA-3921-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 28, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 613-2] roundcube regression update

Package : roundcube Version : 0.7.2-9+deb7u8 Debian Bug : 843795 851214 The security update announced as DLA-613-1 caused a regression. A missing null parameter set the $task variable in the rcmailurl function to a boolean value which led to service not available errors when viewing attached...

[SECURITY] [DLA 1040-1] resiprocate security update

Package : resiprocate Version : 1.8.5-4+deb7u1 CVE ID : CVE-2017-11521 CVE-2017-11521 The SdpContents::Session::Medium::parse function in resip/stack/SdpContents.cxx in reSIProcate 1.10.2 allows remote attackers to cause a denial of service memory consumption by triggering many media connections...

[SECURITY] [DLA 1039-1] rkhunter security update

Package : rkhunter Version : 1.4.0-1+deb7u1 CVE ID : CVE-2017-7480 CVE-2017-7480 The original patch introduces new regex to better check for allowed download URLs. Other versions of the package in Jessie, Stretch and Sid dont apply that patch but just disable the download of everything by default...

[SECURITY] [DSA 3920-1] qemu security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3920-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 25, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3919-1] openjdk-8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3919-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 25, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3918-1] icedove/thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3918-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 25, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1025-2] bind9 regression update

Package : bind9 The security update announced as DLA-1025-1 in bind9 introduced a regression. The fix for CVE-2017-3142 broke verification of TSIG signed TCP message sequences where not all the messages contain TSIG records. This is conform to the spec and may be used in AXFR and IXFR response. F...

[SECURITY] [DLA 1037-1] catdoc security update

Package : catdoc Version : 0.94.4-1.1+deb7u1 CVE ID : CVE-2017-11110 Debian Bug : 867717 A heap-based buffer underflow flaw was discovered in catdoc, a text extractor for MS-Office files, which may lead to denial of service application crash or have unspecified other impact, if a specially crafte...

[SECURITY] [DLA 1038-1] libtasn1-3 security update

Package : libtasn1-3 Version : 2.13-2+deb7u5 CVE ID : CVE-2017-10790 CVE-2017-10790 The asn1checkidentifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1node structure. It may le...

[SECURITY] [DLA 1036-1] gsoap security update

Package : gsoap Version : 2.8.7-2+deb7u1 CVE ID : CVE-2017-9765 A vulnerability was discovered in gsoap, a library for the development of SOAP web services and clients, that may be exposed with a large and specific XML message over 2 GB in size. After receiving this 2 GB message, a buffer overflo...

[SECURITY] [DSA 3904-2] bind9 regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3904-2 [email protected] https://www.debian.org/security/ Yves-Alexis Perez July 23, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3917-1] catdoc security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3917-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 23, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3917-1] catdoc security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3917-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 23, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3916-1] atril security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3916-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 21, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3916-1] atril security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3916-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 21, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1035-1] qemu security update

Package : qemu Version : 1.1.2+dfsg-6+deb7u22 CVE ID : CVE-2016-9602 CVE-2016-9603 CVE-2017-7377 CVE-2017-7471 CVE-2017-7493 CVE-2017-7718 CVE-2017-7980 CVE-2017-8086 Several vulnerabilities were discovered in qemu, a fast processor emulator. The Common Vulnerabilities and Exposures project...

[SECURITY] [DLA 1034-1] php5 security update

Package : php5 Version : 5.4.45-0+deb7u9 CVE ID : CVE-2016-10397 CVE-2017-11143 CVE-2017-11144 CVE-2017-11145 CVE-2017-11147 Several issues have been discovered in PHP recursive acronym for PHP: Hypertext Preprocessor, a widely-used open source general-purpose scripting language that is especiall...

[SECURITY] [DSA 3915-1] ruby-mixlib-archive security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3915-1 [email protected] https://www.debian.org/security/ Sebastien Delafond July 20, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3915-1] ruby-mixlib-archive security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3915-1 [email protected] https://www.debian.org/security/ Sebastien Delafond July 20, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1033-1] memcached security update

Package : memcached Version : 1.4.13-0.2+deb7u3 CVE ID : CVE-2017-9951 Debian Bug : 868701 It was discovered that there was a remote denial-of-service DoS vulnerability in memcached, a high-performance memory object caching system. The tryreadcommand function allowed remote attackers to cause a D...

[SECURITY] [DLA 1032-1] unattended-upgrades regression update

Package : unattended-upgrades Version : 0.79.5+wheezy3 Debian Bug : 867169 Since the release of the last Debian stable release "stretch", Debian LTS "wheezy" has been renamed "oldoldstable", which broke the unattended-upgrades package as described in bug 867169. Updates would simply not be...

[SECURITY] [DLA 1030-1] vim security update

Package : vim Version : 2:7.3.547-7+deb7u4 CVE ID : CVE-2017-11109 Debian Bug : 867720 Vim 8.0 allows attackers to cause a denial of service invalid free or possibly have unspecified other impact via a crafted source aka -S file. For Debian 7 "Wheezy", these problems have been fixed in version...