[SECURITY] [DSA 3914-1] imagemagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3914-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 18, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1031-1] evince security update

Package : evince Version : 3.4.0-3.1+deb7u1 CVE ID : CVE-2017-1000083 Debian Bug : 868500 from the Google Security Team discovered that the Evince document viewer made insecure use of tar when opening tar comic book archives CBT. Opening a malicious CBT archive could result in the execution of...

[SECURITY] [DSA 3913-1] apache2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3913-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 18, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3913-1] apache2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3913-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 18, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1029-1] libmtp security update

Package : libmtp Version : 1.1.3-35-g0ece104-5+deb7u1 CVE ID : CVE-2017-9831 CVE-2017-9832 libmtp, a library for communicating with MTP aware devices like cellular phones and audio players, was found to be vulnerable to several integer overflow vulnerabilities, which allowed malicious devices to...

[SECURITY] [DLA 1028-1] apache2 security update

Package : apache2 Version : 2.2.22-13+deb7u10 CVE ID : CVE-2017-9788 Debian Bug : 868467 Robert Święcki discovered that the value placeholder in Proxy-Authorization Digest headers were not initialized or reset before or between successive key=value assignments in Apache 2s modauthdigest module...

[SECURITY] [DSA 3912-1] heimdal security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3912-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 16, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3912-1] heimdal security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3912-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 16, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3910-1] knot security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3910-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez July 14, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3911-1] evince security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3911-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 14, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1027-1] heimdal security update

Package : heimdal Version : 1.6git20120403+dfsg1-2+deb7u1 CVE ID : CVE-2017-11103 Debian Bug : 868208 Jeffrey Altman, Viktor Duchovni and Nico Williams identified a mutual authentication bypass vulnerability in Heimdal Kerberos. Also known as Orpheus Lyre, this vulnerability could be used by an...

[SECURITY] [DLA 1026-1] xorg-server security update

Package : xorg-server Version : 2:1.12.4-6+deb7u7 CVE ID : CVE-2017-10971 CVE-2017-10972 Debian Bug : 867492 867492 CVE-2017-10971 A user authenticated to an X Session could crash or execute code in the context of the X Server by exploiting a stack overflow in the endianness conversion of X Event...

[SECURITY] [DSA 3909-1] samba security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3909-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez July 14, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1025-1] bind9 security update

Package : bind9 Version : 1:9.8.4.dfsg.P1-6+nmu2+deb7u17 CVE ID : CVE-2017-3142 CVE-2017-3143 CVE-2017-3142 An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR...

[SECURITY] [DLA 1024-1] nginx security update

Package : nginx Version : 1.2.1-2.2+wheezy4+deb7u1 CVE ID : CVE-2017-7529 Debian Bug : 868109 It was discovered that there was vulnerability in the range filter of nginx, a web/proxy server. A specially crafted request might result in an integer overflow and incorrect processing of HTTP ranges,...

[SECURITY] [DSA 3908-1] nginx security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3908-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 12, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3907-1] spice security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3907-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 11, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3906-1] undertow security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3906-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 11, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1023-1] tiff3 security update

Package : tiff3 Version : 3.9.6-11+deb7u7 CVE ID : CVE-2017-9936 Debian Bug : 866113 A vulnerabilitie has been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code. CVE-2017-9936 A crafted TIFF document can lead to a...

[SECURITY] [DLA 1022-1] tiff security update

Package : tiff Version : 4.0.2-6+deb7u15 CVE ID : CVE-2017-9936 CVE-2017-10688 Debian Bug : 866113 866611 Two vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code. CVE-2017-9936 A crafted TIFF...

[SECURITY] [DLA 1021-1] jetty8 security update

Package : jetty8 Version : 8.1.3-4+deb7u1 CVE ID : CVE-2017-9735 Debian Bug : 864898 It was discovered that Jetty8, a Java servlet engine and webserver, was vulnerable to a timing attack which might reveal cryptographic credentials such as passwords to a local user. For Debian 7 "Wheezy", these...

[SECURITY] [DLA 1020-1] jetty security update

Package : jetty Version : 6.1.26-1+deb7u1 CVE ID : CVE-2017-9735 Debian Bug : 864898 It was discovered that Jetty, a Java servlet engine and webserver, was vulnerable to a timing attack which might reveal cryptographic credentials such as passwords to a local user. For Debian 7 "Wheezy", these...

[SECURITY] [DSA 3905-1] xorg-server security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3905-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 09, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1019-1] phpldapadmin security update

Package : phpldapadmin Version : 1.2.2-5+deb7u1 CVE ID : CVE-2017-11107 Debian Bug : 867719 It was discovered that there was a cross-site scripting XSS vulnerability in phpldapadmin, a web-based interface for administering LDAP servers. For Debian 7 "Wheezy", this issue has been fixed in...

[SECURITY] [DLA 1018-1] sqlite3 security update

Package : sqlite3 Version : 3.7.13-1+deb7u4 CVE ID : CVE-2017-10989 Debian Bug : 867618 It was discovered that there was a heap-based buffer over-read vulnerability in SQLite, a lightweight database engine. The getNodeSize function in ext/rtree/rtree.c mishandled undersized RTree blobs in a...

[SECURITY] [DSA 3904-1] bind9 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3904-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez July 08, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1017-1] mpg123 security update

Package : mpg123 Version : 1.14.4-1+deb7u2 CVE ID : CVE-2017-10683 Debian Bug : 866860 It was discovered that there was a remote denial of service vulnerability in the mpg123 audio library/player. This was caused by a heap-based buffer over-read in the "convertlatin1" function. For Debian 7...

[SECURITY] [DLA 1016-1] radare2 security update

Package : radare2 Version : 0.9-3+deb7u3 CVE ID : CVE-2017-10929 Debian Bug : 867369 It was discovered that there was a heap-based buffer overflow in radare2, a reverse-engineering framework. The grubmemmove function allowed attackers to cause a remote denial of service. For Debian 7 "Wheezy", th...

[SECURITY] [DLA 1015-1] libgcrypt11 security update

Package : libgcrypt11 Version : 1.5.0-5+deb7u6 CVE ID : CVE-2017-7526 It was discovered that there was a key disclosure vulnerability in libgcrypt11 a library of cryptographic routines: It is well known that constant-time implementations of modular exponentiation cannot use sliding windows...

[SECURITY] [DLA 1014-1] libclamunrar security update

Package : libclamunrar Version : 0.99-0+deb7u2 CVE ID : CVE-2017-7520 Debian Bug : 867223 It was discovered that there was an arbitrary code execution vulnerability in libcamunrar, a library to add unrar support to the Clam anti-virus software. This was caused by an integer overflow resulting in ...

[SECURITY] [DSA 3903-1] tiff security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3903-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 05, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3902-1] jabberd2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3902-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 05, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3902-1] jabberd2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3902-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 05, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1013-1] graphite2 security update

Package : graphite2 Version : 1.3.10-1deb7u1 CVE ID : CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774 CVE-2017-7775 CVE-2017-7776 CVE-2017-7777 CVE-2017-7778 Multiple vulnerabilities have been found in the Graphite font rendering engine which might result in denial of service or the...

Security Update for salt

Al Nikolov uploaded new package for salt which fixed the following security problem: CVE-2017-8109 The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on...

[BSA-116] Security Update for openvpn

Bernhard Schmidt uploaded new packages for openvpn which fixed the following security problems: CVE-2017-7479 It was discovered that openvpn did not properly handle the rollover of packet identifiers. This would allow an authenticated remote attacker to cause a denial-of-service via application...

Security Update for salt

Al Nikolov uploaded new package for salt which fixed the following security problem: CVE-2017-8109 The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on...

[SECURITY] [DLA 1011-1] sudo security update

Package : sudo Version : 1.8.5p2-1+nmu3+deb7u4 CVE ID : CVE-2017-1000368 Debian Bug : 863897 Todd Millers sudo version 1.8.20p1 and earlier is vulnerable to an input validation embedded newlines in the getprocessttyname function resulting in information disclosure and command execution. The...

[SECURITY] [DLA 1012-1] puppet security update

Package : puppet Version : 2.7.23-1deb7u4 CVE ID : CVE-2017-2295 Debian Bug : 863212 Versions of Puppet prior to 4.10.1 will deserialize data off the wire from the agent to the server, in this case with a attacker-specified format. This could be used to force YAML deserialization in an unsafe...

[SECURITY] [DLA 1010-1] vorbis-tools security update

Package : vorbis-tools Version : 1.4.0-1+deb7u1 CVE ID : CVE-2014-9638 CVE-2014-9639 CVE-2014-9640 CVE-2015-6749 Debian Bug : 797461 776086 771363 vorbis-tools is vulnerable to multiple issues that can result in denial of service. CVE-2014-9638 Divide by zero error in oggenc with a WAV file whose...

[SECURITY] [DLA 1007-1] icedove/thunderbird security update

Package : icedove Version : 1:52.2.1-1deb7u1 CVE ID : CVE-2017-5470 CVE-2017-5472 CVE-2017-7749 CVE-2017-7750 CVE-2017-7751 CVE-2017-7752 CVE-2017-7754 CVE-2017-7756 CVE-2017-7757 CVE-2017-7758 CVE-2017-7764 CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774 CVE-2017-7775 CVE-2017-7776...

[SECURITY] [DSA 3901-1] libgcrypt20 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3901-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 02, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3901-1] libgcrypt20 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3901-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 02, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1009-1] apache2 security update

Package : apache2 Version : 2.2.22-13+deb7u9 CVE ID : CVE-2017-3167 CVE-2017-3169 CVE-2017-7668 CVE-2017-7679 Several vulnerabilities have been found in the Apache HTTPD server. CVE-2017-3167 Emmanuel Dreyfus reported that the use of apgetbasicauthpw by third-party modules outside of the...

[SECURITY] [DLA 1008-1] libxml2 security update

Package : libxml2 Version : 2.8.0+dfsg1-7+wheezy8 CVE ID : CVE-2017-7375 CVE-2017-9047 CVE-2017-9048 CVE-2017-9049 CVE-2017-9050 CVE-2017-7375 Missing validation for external entities in xmlParsePEReference CVE-2017-9047 CVE-2017-9048 A buffer overflow was discovered in libxml2...

[SECURITY] [DLA 1006-1] libarchive security update

Package : libarchive Version : 3.0.4-3+wheezy6 CVE ID : CVE-2016-10209 CVE-2016-10349 CVE-2016-10350 Debian Bug : 859456 861609 Multiple denial of services vulnerabilities have been identified in libarchive when manipulating specially crafted archives. CVE-2016-10209 NULL pointer dereference and...

[SECURITY] [DLA 1005-1] mercurial security update

Package : mercurial Version : 2.2.2-4+deb7u4 CVE ID : CVE-2017-9462 Debian Bug : 861243 In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name. For Debian 7...

[SECURITY] [DLA 1004-1] drupal7 security update

Package : drupal7 Version : 7.14-2+deb7u16 CVE ID : CVE-2017-6922 Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not...

[SECURITY] [DSA 3900-1] openvpn security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3900-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 27, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3900-1] openvpn security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3900-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 27, 2017 https://www.debian.org/security/faq -...