[SECURITY] [DLA 912-1] tiff3 security update

Package : tiff3 Version : 3.9.6-11+deb7u5 CVE ID : CVE-2017-7593 CVE-2017-7594 CVE-2017-7595 CVE-2017-7596 CVE-2017-7597 CVE-2017-7599 CVE-2017-7600 CVE-2017-7601 Debian Bug : 860000 860001 860003 Multiple security issues have been found in the tiff3 image library that may allow remote attackers ...

[SECURITY] [DLA 914-1] minicom security update

Package : minicom Version : 2.6.1-1+deb7u1 CVE ID : CVE-2017-7467 Debian Bug : 860940 CVE-2017-7467 Out of bounds write in vt100.c For Debian 7 "Wheezy", these problems have been fixed in version 2.6.1-1+deb7u1. We recommend that you upgrade your minicom packages. Further information about Debian...

[SECURITY] [DLA 911-1] tiff security update

Package : tiff Version : 4.0.2-6+deb7u12 CVE ID : CVE-2017-7592 CVE-2017-7593 CVE-2017-7594 CVE-2017-7595 CVE-2017-7596 CVE-2017-7597 CVE-2017-7598 CVE-2017-7599 CVE-2017-7600 CVE-2017-7601 CVE-2017-7602 Debian Bug : 859998 860000 860001 860003 Multiple security issues have been found in the tiff...

[SECURITY] [DLA 910-1] libreoffice security update

Package : libreoffice Version : 1:3.5.4+dfsg2-0+deb7u9 CVE ID : CVE-2017-3157 CVE-2017-7870 CVE-2017-3157 Ben Hayak discovered that objects embedded in Writer and Calc documents may result in information disclosure. Please see https://www.libreoffice.org/about-us/security/advisories/cve-2017-3157...

[SECURITY] [DLA 909-1] libcroco security update

Package : libcroco Version : 0.6.6-2+deb7u1 CVE ID : CVE-2017-7960 CVE-2017-7961 Debian Bug : 860961 CVE-2017-7960 A heap-based buffer over-read vulnerability could be triggered remotely via a crafted CSS file to cause a denial of service. CVE-2017-7961 An "outside the range of representable valu...

[SECURITY] [DLA 908-1] chicken security update

Package : chicken Version : 4.7.0-1+deb7u2 CVE ID : CVE-2017-6949 Debian Bug : 858057 It was found that CHICKEN did not sanitize the size argument when allocating SRFI-4 vectors, which could lead to segfaults or buffer overflows with some sizes. For Debian 7 "Wheezy", these problems have been fix...

[SECURITY] [DLA 907-1] xen security update

Package : xen Version : 4.1.6.lts1-6 CVE ID : CVE-2017-7228 Debian Bug : 859560 CVE-2017-7228 XSA-212 An insufficient check on XENMEMexchange may allow PV guests to access all of system memory. For Debian 7 "Wheezy", these problems have been fixed in version 4.1.6.lts1-6. We recommend that you...

[SECURITY] [DLA 906-1] firefox-esr security update

Package : firefox-esr Version : 45.9.0esr-1deb7u1 CVE ID : CVE-2017-5429 CVE-2017-5432 CVE-2017-5433 CVE-2017-5434 CVE-2017-5435 CVE-2017-5436 CVE-2017-5438 CVE-2017-5439 CVE-2017-5440 CVE-2017-5441 CVE-2017-5442 CVE-2017-5443 CVE-2017-5444 CVE-2017-5445 CVE-2017-5446 CVE-2017-5447 CVE-2017-5448...

[SECURITY] [DSA 3832-1] icedove security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3832-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 20, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 905-1] ghostscript security update

Package : ghostscript Version : 9.05dfsg-6.3+deb7u5 CVE ID : CVE-2016-10219 CVE-2016-10220 CVE-2017-5951 ghostscript is vulnerable to multiple issues that can lead to denial of service when processing untrusted content. CVE-2016-10219 Application crash with division by 0 in scan conversion code...

[SECURITY] [DLA 904-1] uzbek-wordlist update

Package : uzbek-wordlist Version : 0.6-3.2+deb7u1 The dictionary provided by this package had an unnecessary unversioned conflict against the thunderbird package which recently got reintroduced into Wheezy. For Debian 7 "Wheezy", this problem has been fixed in version 0.6-3.2+deb7u1. We recommend...

[SECURITY] [DLA 903-1] hunspell-en-us update

Package : hunspell-en-us Version : 20070829-6+deb7u1 The dictionary provided by this package had an unnecessary unversioned conflict against the thunderbird package which recently got reintroduced into Wheezy. For Debian 7 "Wheezy", this problem has been fixed in version 20070829-6+deb7u1. We...

[SECURITY] [DSA 3831-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3831-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 20, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3830-1] icu security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3830-1 [email protected] https://www.debian.org/security/ Sebastien Delafond April 19, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3830-1] icu security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3830-1 [email protected] https://www.debian.org/security/ Sebastien Delafond April 19, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 896-1] icedove/thunderbird security update

Package : icedove Version : 1:45.8.0-3deb7u1 CVE ID : CVE-2017-5373 CVE-2017-5375 CVE-2017-5376 CVE-2017-5378 CVE-2017-5380 CVE-2017-5383 CVE-2017-5390 CVE-2017-5396 CVE-2017-5398 CVE-2017-5400 CVE-2017-5401 CVE-2017-5402 CVE-2017-5404 CVE-2017-5405 CVE-2017-5407 CVE-2017-5408 CVE-2017-5410...

[SECURITY] [DLA 902-1] imagemagick security update

Package : imagemagick Version : 8:6.7.7.10-5+deb7u13 CVE ID : CVE-2017-7606 CVE-2017-7619 Debian Bug : 859771 859769 Two security vulnerabilities were discovered in imagemagick that allow remote attackers to cause a denial of service application crash and infinite loop or possibly other unspecifi...

[SECURITY] [DLA 901-1] radare2 security update

Package : radare2 Version : 0.9-3+deb7u2 CVE ID : CVE-2017-6448 CVE-2017-6448 The dalvikdisassemble function in libr/asm/p/asmdalvik.c in radare2 1.2.1 allows remote attackers to cause a denial of service stack-based buffer overflow and application crash or possibly have unspecified other impact...

[SECURITY] [DLA 900-1] freetype security update

Package : freetype Version : 2.4.9-1.1+deb7u5 CVE ID : CVE-2016-10328 Debian Bug : 860303 The Freetype 2 font engine was vulnerable to an out-of-bounds write caused by a heap-based buffer overflow in the cffparserrun function in cff/cffparse.c. For Debian 7 "Wheezy", these problems have been fixe...

[SECURITY] [DLA 899-1] feh security update

Package : feh Version : 2.3-2+deb7u1 CVE ID : CVE-2017-7875 Debian Bug : 860367 Tobias Stoeckmann discovered it was possible to trigger an out-of-boundary heap write with the image viewer feh while receiving an IPC message. For Debian 7 "Wheezy", these problems have been fixed in version...

[SECURITY] [DLA 898-1] libosip2 security update

Package : libosip2 Version : 3.6.0-4+deb7u1 CVE ID : CVE-2016-10324 CVE-2016-10325 CVE-2016-10326 CVE-2017-7853 CVE-2016-10324 In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osipclrncpy function defined in osipparser2/osipport.c. CVE-2016-10325 In...

[SECURITY] [DLA 897-1] qbittorrent security update

Package : qbittorrent Version : 2.9.8-1+deb7u1 CVE ID : CVE-2017-6503 CVE-2017-6504 CVE-2017-6503 WebUI in qBittorrent before 3.3.11 did not escape many values, which could potentially lead to XSS. CVE-2017-6504 WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which coul...

[SECURITY] [DLA 895-1] openoffice.org-dictionaries update

Package : openoffice.org-dictionaries Version : 3.3.0rc10-4+deb7u1 Debian Bug : 646693 The dictionaries provided by this package had an unversioned conflict against the thunderbird package which so far was not part of wheezy. Since the next update of Icedove introduces a thunderbird package the...

[SECURITY] [DSA 3829-1] bouncycastle security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3829-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 11, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 894-1] samba security update

Package : samba Version : 2:3.6.6-6+deb7u12 CVE ID : CVE-2017-2619 Jann Horn of Google discovered a time-of-check, time-of-use race condition in Samba, a SMB/CIFS file, print, and login server for Unix. A malicious client can take advantage of this flaw by exploting a symlink race to access areas...

[SECURITY] [DSA 3828-2] dovecot regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3828-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 11, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3828-2] dovecot regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3828-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 11, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3828-1] dovecot security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3828-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 10, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3828-1] dovecot security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3828-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 10, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 893-1] bouncycastle security update

Package : bouncycastle Version : 1.44+dfsg-3.1+deb7u2 CVE ID : CVE-2015-6644 An information disclosure vulnerability was discovered in Bouncy Castle, a Java library which consists of various cryptographic algorithms. The Galois/Counter mode GCM implementation was missing a boundary check that cou...

[SECURITY] [DLA 891-1] libnl security update

Package : libnl Version : 1.1-7+deb7u1 CVE ID : CVE-2017-0553 Debian Bug : It was discovered that there was a FIXME in libnl, a FIXME... For Debian 7 "Wheezy", this issue has been fixed in libnl version 1.1-7+deb7u1. We recommend that you upgrade your libnl packages. Regards, - -- ,. : : : Chris...

[SECURITY] [DLA 892-1] libnl3 security update

Package : libnl3 Version : 3.2.7-4+deb7u1 CVE ID : CVE-2017-0553 Debian Bug : 859948 It was discovered that there was an integer overflow in libnl3, a library for dealing with netlink sockets. A missing check in nlmsgreserve could have allowed a malicious application to execute arbitrary code...

[SECURITY] [DLA 890-1] ming security update

Package : ming Version : 1:0.4.4-1.1+deb7u2 CVE ID : CVE-2017-7578 It was discovered that there were multiple heap-based buffer overflows in ming, a library to generate SWF Flash files. The updated packages prevent a crash in the "listswf" utility due to a heap-based buffer overflow in the...

[SECURITY] [DLA 889-1] potrace security update

Package : potrace Version : 1.10-1+deb7u2 CVE ID : CVE-2016-8685 Debian Bug : 843861 It was discovered that potrace, an utility to transform bitmaps into vector graphics, was affected by an integer overflow in the findnext function, allowing remote attackers to cause a denial of service invalid...

[SECURITY] [DLA 888-1] logback security update

Package : logback Version : 1:1.0.4-1+deb7u1 CVE ID : CVE-2017-5929 Debian Bug : 857343 It was discovered that logback, a flexible logging library for Java, would deserialize data from untrusted sockets which may lead to the execution of arbitrary code. This issue has been resolved by adding a...

[SECURITY] [DSA 3827-1] jasper security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3827-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 07, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 887-1] libdatetime-timezone-perl new upstream version

Package : libdatetime-timezone-perl Version : 1:1.58-1+2017b This update includes the changes in tzdata 2017b for the Perl bindings. For the list of changes, see DLA-886-1. For Debian 7 "Wheezy", these problems have been fixed in version 1:1.58-1+2017b. We recommend that you upgrade your...

[SECURITY] [DLA 886-1] tzdata new upstream version

Package : tzdata Version : 2017b-0+deb7u1 This update includes the changes in tzdata 2017b. Notable changes are: - Haiti resumed observance of DST in 2017. For Debian 7 "Wheezy", these problems have been fixed in version 2017b-0+deb7u1. We recommend that you upgrade your tzdata packages. Further...

[SECURITY] [DLA 885-1] python-django security update

Package : python-django Version : 1.4.22-1+deb7u3 CVE ID : CVE-2017-7233, CVE-2017-7234 Debian Bug : 859515, 859516 It was discovered that there were two vulnerabilities in python-django, a high-level Python web development framework. CVE-2017-7233 859515: Open redirect and possible XSS attack vi...

[SECURITY] [DSA 3826-1] tryton-server security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3826-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 04, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3826-1] tryton-server security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3826-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 04, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 884-1] collectd security update

Package : collectd Version : 5.1.0-3+deb7u3 CVE ID : CVE-2017-7401 Debian Bug : 859494 It was discovered that there was an infinite loop vulnerability in collectd, a statistics collection and monitoring daemon. When a correct "Signature part" is received by an instance configured without the...

[SECURITY] [DLA 883-1] curl security update

Package : curl Version : 7.26.0-1+wheezy18+deb7u1 CVE ID : CVE-2017-7407 It was discovered that there was a buffer read overrun vulnerability in curl, a tool for downloading files from the internet, etc. If a "%" ended the --write-out parameter, the strings trailing NUL would be skipped and memor...

[SECURITY] [DLA 882-1] tryton-server security update

Package : tryton-server Version : 2.2.4-1+deb7u4 CVE ID : CVE-2017-0360 It was discovered that there was a path suffix injection attack in tryton-server, a general purpose application platform. For Debian 7 "Wheezy", this issue has been fixed in tryton-server version 2.2.4-1+deb7u4. We recommend...

[SECURITY] [DSA 3816-2] samba regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3816-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 02, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3816-2] samba regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3816-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 02, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 881-1] ejabberd security update

Package : ejabberd Version : 2.1.10-4+deb7u2 CVE ID : CVE-2014-8760 Debian Bug : 767521 767535 It was found that ejabberd does not enforce the starttlsrequired setting when compression is used, which causes clients to establish connections without encryption. For Debian 7 "Wheezy", this problem h...

[SECURITY] [DSA 3825-1] jhead security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3825-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 31, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3825-1] jhead security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3825-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 31, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 880-1] tiff3 security update

Package : tiff3 Version : 3.9.6-11+deb7u4 CVE ID : CVE-2015-8781 CVE-2015-8782 CVE-2015-8783 CVE-2015-8784 CVE-2016-9533 CVE-2016-9534 CVE-2016-9535 tiff3 is affected by multiple issues that can result at least in denial of services of applications using libtiff4. Crafted TIFF files can be provid...