[SECURITY] [DSA 3882-1] request-tracker4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3882-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 15, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3882-1] request-tracker4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3882-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 15, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 985-1] libsndfile security update

Package : libsndfile Version : 1.0.25-9.1+deb7u3 CVE ID : CVE-2017-6892 Debian Bug : 864704 It was discovered that there was a vulnerability in libsndfile, a library for reading/writing audio files. A specially-crafted AIFF "Audio Interchange File Format" file could result in an out-of-bounds...

[SECURITY] [DSA 3881-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3881-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 14, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3880-1] libgcrypt20 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3880-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 14, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3880-1] libgcrypt20 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3880-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 14, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3879-1] libosip2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3879-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 13, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 984-1] tiff security update

Package : tiff Version : 4.0.2-6+deb7u14 CVE ID : CVE-2016-10095 CVE-2017-9147 CVE-2017-9403 CVE-2017-9404 Debian Bug : 863185 850316 tiff was affected by multiple memory leaks CVE-2017-9403, CVE-2017-9404 that could result in denial of service. Furthermore, while the current version in Debian wa...

[SECURITY] [DLA 983-1] tiff3 security update

Package : tiff3 Version : 3.9.6-11+deb7u6 CVE ID : CVE-2016-10095 CVE-2017-9147 CVE-2017-9403 CVE-2017-9404 tiff3 was affected by multiple memory leaks CVE-2017-9403, CVE-2017-9404 that could result in denial of service. Furthermore, while the current version in Debian was already patched for...

[SECURITY] [DSA 3878-1] zziplib security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3878-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 12, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 982-1] tor security update

Package : tor Version : 0.2.4.29-1 CVE ID : CVE-2017-0376 Debian Bug : 864424 It has been discovered that Tor, a connection-based low-latency anonymous communication system, contains a flaw in the hidden service code. A remote attacker can take advantage of this flaw to cause a hidden service to...

[SECURITY] [DSA 3877-1] tor security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3877-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 10, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3877-1] tor security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3877-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 10, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3876-1] otrs2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3876-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 09, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3875-1] libmwaw security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3875-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 09, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3874-1] ettercap security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3874-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 09, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3874-1] ettercap security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3874-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 09, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 979-1] debian-security-support update

Package : debian-security-support Version : 2017.06.02+deb7u1 Besides bringing the package up to date regarding translations this update marks several packages as no longer supported by wheezy-lts: autotrace, inspircd, ioquake3, kfreebsd-8, kfreebsd-9, matrixssl, teeworlds and trn For the reasoni...

[SECURITY] [DLA 981-1] apng2gif security update

Package : apng2gif Version : 1.5-1+deb7u1 CVE ID : CVE-2017-6960 Debian Bug : 854367 It was discovered that apng2gif was vulnerable to an integer overflow resulting in a heap-based buffer over-read/write. A remote attacker could use this flaw to cause a denial of service application crash via a...

[SECURITY] [DLA 980-1] ming security update

Package : ming Version : 1:0.4.4-1.1+deb7u3 CVE ID : CVE-2017-8782 It was found that ming, a library to parse and generate SWF Flash files, is susceptible to an integer overflow that would lead into out of bound memory writes via a maliciously crafted file. For Debian 7 "Wheezy", these problems...

[SECURITY] [DLA 978-1] perl security update

Package : perl Version : 5.14.2-21+deb7u5 CVE ID : CVE-2017-6512 Debian Bug : 863870 The cPanel Security Team reported a time of check to time of use TOCTTOU race condition flaw in File::Path, a core module from Perl to create or remove directory trees. An attacker can take advantage of this flaw...

[SECURITY] [DLA 976-1] yodl security update

Package : yodl Version : 3.00.0-6+deb7u1 CVE ID : CVE-2016-10375 Hanno Bock discovered that there was a buffer over-read vulnerability in the yodl "Your Own Document Language" document processor. For Debian 7 "Wheezy", this issue has been fixed in yodl version 3.00.0-6+deb7u1. We recommend that y...

[SECURITY] [DLA 977-1] freeradius security update

Package : freeradius Version : 2.1.12+dfsg-1.2+deb7u1 CVE ID : CVE-2014-2015 CVE-2015-4680 CVE-2017-9148 Debian Bug : 742820 789623 863673 Several issues were discovered in FreeRADIUS, a high-performance and highly configurable RADIUS server. CVE-2014-2015 A stack-based buffer overflow was found ...

[SECURITY] [DSA 3873-1] perl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3873-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 05, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3873-1] perl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3873-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 05, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 975-1] wordpress security update

Package : wordpress Version : 3.6.1+dfsg-1deb7u15 CVE ID : CVE-2017-8295 CVE-2017-9061 CVE-2017-9062 CVE-2017-9063 CVE-2017-9064 CVE-2017-9065 Debian Bug : 862053 862816 Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project...

[SECURITY] [DLA 972-1] openldap security update

Package : openldap Version : 2.4.31-2+deb7u3 CVE ID : CVE-2017-9287 Debian Bug : 863563 It was discovered that there was a double-free vulnerability in the "openldap" LDAP server. A user with access to search the directory could crash slapd by issuing a search requesting a "Paged Results" value s...

[SECURITY] [DLA 974-1] picocom security update

Package : picocom Version : 1.7-1+deb7u1 CVE ID : CVE-2015-9059 Debian Bug : 863671 It was discovered that there was a command injection vulnerability in picocom, a dumb-terminal emulation program. For Debian 7 "Wheezy", this issue has been fixed in picocom version 1.7-1+deb7u1. We recommend that...

[SECURITY] [DSA 3872-1] nss security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3872-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 01, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3871-1] zookeeper security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3871-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 01, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 973-1] strongswan security update

Package : strongswan Version : 4.5.2-1.5+deb7u9 CVE ID : CVE-2017-9022 CVE-2017-9023 Two denial of service vulnerabilities were identified in strongSwan, an IKE/IPsec suite, using Googles OSS-Fuzz fuzzing project. CVE-2017-9022 RSA public keys passed to the gmp plugin arent validated sufficiently...

[SECURITY] [DLA 964-1] xen security update

Package : xen Version : 4.1.6.lts1-8 CVE ID : CVE-2016-9932 CVE-2017-7995 CVE-2017-8903 CVE-2017-8904 CVE-2017-8905 Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-9932 XSA-200...

[SECURITY] [DSA 3870-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3870-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 01, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3870-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3870-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 01, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3869-1] tnef security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3869-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 01, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3869-1] tnef security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3869-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 01, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 971-1] nss security update

Package : nss Version : 2:3.26-1+debu7u4 CVE ID : CVE-2017-7502 Debian Bug : 863839 CVE-2017-7502 A null pointer dereference vulnerability in NSS was found when server receives empty SSLv2 messages. This issue was introduced with the recent removal of SSLv2 protocol from upstream code in 3.24.0 a...

[SECURITY] [DLA 965-1] qemu-kvm security update

Package : qemu-kvm Version : 1.1.2+dfsg-6+deb7u22 CVE ID : CVE-2016-9602 CVE-2017-7377 CVE-2017-7471 CVE-2017-7493 CVE-2017-8086 Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution for Linux hosts on x86 hardware with x86 guests based on the Quick EmulatorQemu...

[SECURITY] [DLA 970-1] sudo security update

Package : sudo Version : 1.8.5p2-1+nmu3+deb7u3 CVE ID : CVE-2017-1000367 Debian Bug : 863731 The Qualys Security team discovered that sudo, a program designed to provide limited super user privileges to specific users, does not properly parse "/proc/pid/stat" to read the device number of the tty...

[SECURITY] [DLA 969-1] tiff security update

Package : tiff Version : 4.0.2-6+deb7u13 CVE ID : CVE-2016-3658 CVE-2016-10371 Debian Bug : 862929 Two vulnerabilities have been discovered in libtiff, a library providing support for the Tag Image File Format, which may result in denial of service out-of-bounds read or assertion failure via a...

[SECURITY] [DSA 3868-1] openldap security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3868-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 30, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 968-1] libpodofo security update

Package : libpodofo Version : 0.9.0-1.1+deb7u2 CVE ID : CVE-2017-6840 CVE-2017-6842 CVE-2017-6843 CVE-2017-6847 CVE-2017-6848 CVE-2017-7378 CVE-2017-7380 CVE-2017-7381 CVE-2017-7382 CVE-2017-7383 Debian Bug : 861557 861564 859330 859329 Several heap-based buffer overflows and NULL pointer...

[SECURITY] [DLA 967-1] gajim security update

Package : gajim Version : 0.15.1-4.1+deb7u3 CVE ID : CVE-2016-10376 Debian Bug : 863445 Gajim implements XEP-0146, an XMPP extension to run commands remotely from another client. However it was found that malicious servers can trigger commands, which could lead to leaking private conversations fr...

[SECURITY] [DLA 966-1] pngquant security update

Package : pngquant Version : 1.0-4.1+deb7u1 CVE ID : CVE-2016-5735 Debian Bug : 863469 It was found that pngquant is susceptible to a buffer overflow write issue triggered by a maliciously crafted png image, which could lead into denial of service or other issues. For Debian 7 "Wheezy", these...

[SECURITY] [DSA 3867-1] sudo security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3867-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 30, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3867-1] sudo security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3867-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 30, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3866-1] strongswan security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3866-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez May 30, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 961-1] mosquitto security update

Package : mosquitto Version : 0.15-2+deb7u1 CVE ID : CVE-2017-7650 Debian Bug : CVE-2017-7650: Pattern based ACLs can be bypassed by clients that set their username/client id to ‘’ or ‘+’. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The...

[SECURITY] [DLA 963-1] exiv2 security update

Package : exiv2 Version : 0.23-1+deb7u1 CVE ID : CVE-2017-9239 Debian Bug : 863410 It was discovered that the exiv2 library fails to parse some crafted tiff images, leading to denial of service via application crash. For Debian 7 "Wheezy", these problems have been fixed in version 0.23-1+deb7u1. ...

[SECURITY] [DSA 3865-1] mosquitto security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3865-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 29, 2017 https://www.debian.org/security/faq -...