[SECURITY] [DSA 3886-2] linux regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3886-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 27, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3886-2] linux regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3886-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 27, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 993-2] linux regression update

Package : linux Version : 3.2.89-2 Debian Bug : 865303 The security update announced as DLA-993-1 caused regressions for some applications using Java - including jsvc, LibreOffice and Scilab - due to the fix for CVE-2017-1000364. Updated packages are now available to correct this issue. For...

[SECURITY] [DSA 3899-1] vlc security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3899-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 27, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3899-1] vlc security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3899-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 27, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1003-1] unrar-nonfree security update

Package : unrar-nonfree Version : 1:4.1.4-1+deb7u2 CVE ID : CVE-2012-6706 Debian Bug : 865461 It was reported that unrar fixed a VMSFDELTA memory corruption issue in their latest version unrarsrc-5.5.5.tar.gz. This problem was reported to Sophos AV in 2012 but never reach upstream rar. For Debian...

[SECURITY] [DLA 1002-1] smb4k security update

Package : smb4k Version : 1.2.1-2deb7u1 CVE ID : CVE-2017-8849 Debian Bug : 862505 Sebastian Krahmer from SUSE discovered that smb4k, a Samba SMB share advanced browser, contains a logic flaw in which the mount helper binary does not properly verify the mount command it is being asked to run. Thi...

[SECURITY] [DSA 3898-1] expat security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3898-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 25, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3898-1] expat security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3898-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 25, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1001-1] exim4 security update

Package : exim4 Version : 4.80-7+deb7u5 CVE ID : CVE-2017-1000369 Exim supports the use of multiple "-p" command line arguments which are malloced and never freeed, used in conjunction with other issues allows attackers to cause arbitrary code execution. For Debian 7 "Wheezy", these problems have...

[SECURITY] [DLA 1000-1] imagemagick security update

Package : imagemagick Version : 8:6.7.7.10-5+deb7u15 CVE ID : CVE-2017-9261 CVE-2017-9262 CVE-2017-9405 CVE-2017-9407 CVE-2017-9409 CVE-2017-9439 CVE-2017-9500 CVE-2017-9501 Debian Bug : 863833 863834 864087 864089 864090 864274 This update fixes several vulnerabilities in imagemagick: Various...

[SECURITY] [DSA 3897-1] drupal7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3897-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 24, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3897-1] drupal7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3897-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 24, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 999-1] openvpn security update

Package : openvpn Version : 2.2.1-8+deb7u5 CVE ID : CVE-2017-7520 Debian Bug : 865480 It was discovered that there were multiple out-of-bounds memory read vulnerabilities in openvpn, a popular virtual private network VPN daemon. If clients used a HTTP proxy with NTLM authentication, a...

[SECURITY] [DLA 998-1] c-ares security update

Package : c-ares Version : 1.9.1-3+deb7u2 CVE ID : CVE-2017-1000381 CVE-2017-1000381 The c-ares function aresparsenaptrreply, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a...

[SECURITY] [DSA 3896-1] apache2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3896-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 22, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3896-1] apache2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3896-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 22, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3895-1] flatpak security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3895-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 22, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3894-1] graphite2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3894-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 22, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3893-1] jython security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3893-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 22, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3893-1] jython security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3893-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 22, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3892-1] tomcat7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3892-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 22, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3892-1] tomcat7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3892-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 22, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3891-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3891-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 22, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3891-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3891-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 22, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3890-1] spip security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3890-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 21, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3890-1] spip security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3890-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 21, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 997-1] libffi security update

Package : libffi Version : 3.0.10-3+deb7u1 CVE ID : CVE-2017-1000376 libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. For Debian 7 "Wheezy", these proble...

[SECURITY] [DLA 996-1] tomcat7 security update

Package : tomcat7 Version : 7.0.28-4+deb7u14 CVE ID : CVE-2017-5664 Debian Bug : 864447 The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to th...

[SECURITY] [DLA 995-1] swftools security update

Package : swftools Version : 0.9.2+ds1-3+deb7u1 CVE ID : CVE-2017-8400 CVE-2017-8401 CVE-2017-8400 In SWFTools 0.9.2, an out-of-bounds write of heap data can occur in the function pngload in lib/png.c:755. This issue can be triggered by a malformed PNG file that is mishandled by png2swf. Attacker...

[SECURITY] [DLA 994-1] zziplib security update

Package : zziplib Version : 0.13.56-1.1+deb7u1 CVE ID : CVE-2017-5974 CVE-2017-5975 CVE-2017-5976 CVE-2017-5978 CVE-2017-5979 CVE-2017-5980 CVE-2017-5981 CVE-2017-5974 Heap-based buffer overflow in the zzipget32 function in fetch.c in zziplib allows remote attackers to cause a denial of service...

[SECURITY] [DLA 993-1] linux security update

Package : linux Version : 3.2.89-1 CVE ID : CVE-2017-0605 CVE-2017-7487 CVE-2017-7645 CVE-2017-7895 CVE-2017-8890 CVE-2017-8924 CVE-2017-8925 CVE-2017-9074 CVE-2017-9075 CVE-2017-9076 CVE-2017-9077 CVE-2017-9242 CVE-2017-1000364 Several vulnerabilities have been discovered in the Linux kernel tha...

[SECURITY] [DLA 992-1] eglibc security update

Package : eglibc Version : 2.13-38+deb7u12 CVE ID : CVE-2017-1000366 The Qualys Research Labs discovered various problems in the dynamic linker of the GNU C Library which allow local privilege escalation by clashing the stack. For the full details, please refer to their advisory published at:...

[SECURITY] [DSA 3889-1] libffi security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3889-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez June 19, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3886-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3886-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 19, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3886-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3886-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 19, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3888-1] exim4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3888-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 19, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3887-1] glibc security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3887-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 19, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 989-1] jython security update

Package : jython Version : 2.5.2-1+deb7u1 CVE ID : CVE-2016-4000 Debian Bug : 864859 Alvaro Munoz and Christian Schneider discovered that Jython, an implementation of the Python language seamlessly integrated with Java, would execute arbitrary code when deserializing objects. For Debian 7 "Wheezy...

[SECURITY] [DLA 991-1] firefox-esr security update

Package : firefox-esr Version : 52.2.0esr-1deb7u1 CVE ID : CVE-2017-5470 CVE-2017-5472 CVE-2017-7749 CVE-2017-7750 CVE-2017-7751 CVE-2017-7752 CVE-2017-7754 CVE-2017-7756 CVE-2017-7757 CVE-2017-7758 CVE-2017-7764 CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774 CVE-2017-7775 CVE-2017-7776...

[SECURITY] [DSA 3885-1] irssi security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3885-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 18, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3885-1] irssi security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3885-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 18, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 990-1] expat security update

Package : expat Version : 2.1.0-1+deb7u5 CVE ID : CVE-2017-9233 It was discovered that there was an infinite loop vulnerability in expat, a XML parsing C library: https://libexpat.github.io/doc/cve-2017-9233/ For Debian 7 "Wheezy", this issue has been fixed in expat version 2.1.0-1+deb7u5. We...

[SECURITY] [DSA 3884-1] gnutls28 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3884-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 16, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3884-1] gnutls28 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3884-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 16, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 988-1] rt-authen-externalauth security update

Package : rt-authen-externalauth Version : 0.10-4+deb7u1 CVE ID : CVE-2017-5361 It was discovered that RT::Authen::ExternalAuth, an external authentication module for Request Tracker, is vulnerable to timing side-channel attacks for user passwords. Only ExternalAuth in DBI database mode is...

[SECURITY] [DLA 987-1] request-tracker4 security update

Package : request-tracker4 Version : 4.0.7-5+deb7u5 CVE ID : CVE-2016-6127 CVE-2017-5361 CVE-2017-5943 CVE-2017-5944 Multiple vulnerabilities have been discovered in Request Tracker, an extensible trouble-ticket tracking system. The Common Vulnerabilities and Exposures project identifies the...

[SECURITY] [DLA 986-1] zookeeper security update

Package : zookeeper Version : 3.4.5+dfsg-2+deb7u1 CVE ID : CVE-2017-5637 Debian Bug : 863811 It was discovered that Zookeeper, a service for maintaining configuration information, didnt restrict access to the computationally expensive wchp/wchc commands which could result in denial of service by...

[SECURITY] [DSA 3883-1] rt-authen-externalauth security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3883-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 15, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3883-1] rt-authen-externalauth security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3883-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 15, 2017 https://www.debian.org/security/faq -...