[SECURITY] [DSA 3751-1] libgd2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3751-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 01, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3751-1] libgd2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3751-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 01, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 773-1] python-crypto security update

Package : python-crypto Version : 2.6-4+deb7u4 CVE ID : CVE-2013-7459 Debian Bug : 849495 It was discovered that there was a vulnerability in python-crypto, a library of cryptographic algorithms and protocols for Python. Calling AES.new with an invalid parameter could crash the Python interpreter...

[SECURITY] [DLA 771-1] hdf5 security update

Package : hdf5 Version : 1.8.8-9+deb7u1 CVE ID : CVE-2016-4330 CVE-2016-4331 CVE-2016-4332 CVE-2016-4333 Debian Bug : 845301 Cisco Talos discovered that hdf5, a file format and library for storing scientific data, contained several vulnerabilities that could lead to arbitrary code execution when...

[SECURITY] [DLA 770-1] libphp-phpmailer security update

Package : libphp-phpmailer Version : 5.1-1.2 CVE ID : CVE-2016-10033 Debian Bug : 849365 Dawid Golunski discovered that PHPMailer, a popular library to send email from PHP applications, allowed a remote attacker to execute code if they were able to provide a crafted Sender address. Note that for...

[SECURITY] [DSA 3750-1] libphp-phpmailer security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3750-1 [email protected] https://www.debian.org/security/ Thijs Kinkhorst December 31, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 769-1] shutter security update

Package : shutter Version : 0.88.3-1+deb7u1 CVE ID : CVE-2015-0854 Debian Bug : 798862 The feature-rich screenshot program shutter uses the system call in an unsafe way. This allows an attacker to execute arbitrary programs via crafted directory names. For Debian 7 "Wheezy", this problem has been...

[SECURITY] [DLA 768-1] pgpdump security update

Package : pgpdump Version : 0.27-1+deb7u1 CVE ID : CVE-2016-4021 Debian Bug : 773747 The readbinary function in buffer.c in pgpdump, a PGP packet visualizer, allows context-dependent attackers to cause a denial of service infinite loop and CPU consumption via crafted input. This was assigned...

[SECURITY] [DLA 767-1] curl security update

Package : curl Version : 7.26.0-1+wheezy18 CVE ID : CVE-2016-9586 Debian Bug : 848958 It was discovered that libcurls implementation of the printf functions triggers a buffer overflow when doing a large floating point output. The bug occurs when the conversion outputs more than 255 bytes. The fla...

[SECURITY] [DLA 685-2] libxi regression update

Package : libxi Version : 2:1.6.1-1+deb7u3 Debian Bug : 849026 A regression was found in the previous libxi update. An uninitialized pointer could be freed, causing crashes. For Debian 7 "Wheezy", these problems have been fixed in version 2:1.6.1-1+deb7u3. We recommend that you upgrade your libxi...

[SECURITY] [DSA 3749-1] dcmtk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3749-1 [email protected] https://www.debian.org/security/ Sebastien Delafond December 29, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3749-1] dcmtk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3749-1 [email protected] https://www.debian.org/security/ Sebastien Delafond December 29, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 766-1] libcrypto++ security update

Package : libcrypto++ Version : 5.6.1-6+deb7u3 CVE ID : CVE-2016-9939 Debian Bug : 848009 Gergely Gábor Nagy from Tresorit discovered that libcrypto++, a C++ cryptographic library, contained a bug in several ASN.1 parsing routines. This would allow an attacker to remotely cause a denial of servic...

[SECURITY] [DLA 765-1] qemu-kvm security update

Package : qemu-kvm Version : 1.1.2+dfsg-6+deb7u19 CVE ID : CVE-2016-9911 CVE-2016-9921 CVE-2016-9922 Multiple vulnerabilities have been found in qemu-kvm: CVE-2016-9911 qemu-kvm built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing pack...

[SECURITY] [DLA 764-1] qemu security update

Package : qemu Version : 1.1.2+dfsg-6+deb7u19 CVE ID : CVE-2016-9911 CVE-2016-9921 CVE-2016-9922 Multiple vulnerabilities have been found in QEMU: CVE-2016-9911 Quick Emulator Qemu built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing...

[SECURITY] [DSA 3748-1] libcrypto++ security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3748-1 [email protected] https://www.debian.org/security/ Sebastien Delafond December 26, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3748-1] libcrypto++ security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3748-1 [email protected] https://www.debian.org/security/ Sebastien Delafond December 26, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 763-1] squid3 security update

Package : squid3 Version : 3.1.20-2.2+deb7u7 CVE ID : CVE-2016-10002 Debian Bug : 848493 Saulius Lapinskas from Lithuanian State Social Insurance Fund Board discovered that Squid3, a fully featured web proxy cache, does not properly process responses to If-None-Modified HTTP conditional requests,...

[SECURITY] [DLA 762-1] exim4 security update

Package : exim4 Version : 4.80-7+deb7u4 CVE ID : CVE-2016-9963 Bjoern Jacke discovered that Exim, Debians default mail transfer agent, may leak the private DKIM signing key to the log files if specific configuration options are met. For Debian 7 "Wheezy", these problems have been fixed in version...

[SECURITY] [DSA 3747-1] exim4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3747-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 25, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3747-1] exim4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3747-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 25, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 760-1] spip security update

Package : spip Version : 2.1.17-1+deb7u8 CVE ID : CVE-2016-9997 CVE-2016-9998 Debian Bug : 848641 Multiple reflected cross-site scripting XSS vulnerabilities have been discovered in SPIP, a website publishing engine written in PHP. CVE-2016-9997 It was discovered that the id parameter to the...

[SECURITY] [DLA 757-1] phpmyadmin security update

Package : phpmyadmin Version : 4:3.4.11.1-2+deb7u7 CVE ID : CVE-2016-4412 CVE-2016-6626 CVE-2016-9849 CVE-2016-9850 CVE-2016-9861 CVE-2016-9864 CVE-2016-9865 Various security issues where found and fixed in phpmyadmin in wheezy. CVE-2016-4412 / PMASA-2016-57 A user can be tricked in following a...

[SECURITY] [DSA 3746-1] graphicsmagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3746-1 [email protected] https://www.debian.org/security/ Luciano Bello December 24, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3746-1] graphicsmagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3746-1 [email protected] https://www.debian.org/security/ Luciano Bello December 24, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 761-1] python-bottle security update

Package : python-bottle Version : 0.10.11-1+deb7u2 CVE ID : CVE-2016-9964 Debian Bug : 848392 It was discovered that bottle, a WSGI-framework for the Python programming language, did not properly filter "\r\n" sequences when handling redirections. This allowed an attacker to perform CRLF attacks...

[SECURITY] [DSA 3745-1] squid3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3745-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 24, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3745-1] squid3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3745-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 24, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3744-1] libxml2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3744-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 23, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3744-1] libxml2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3744-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 23, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 759-1] nss security update

Package : nss Version : 2:3.26-1+debu7u2 CVE ID : CVE-2016-9074 Franziskus Kiefer reported that the existing mitigations for some timing side-channel attacks were insufficient: https://www.mozilla.org/en-US/security/advisories/mfsa2016-90/CVE-2016-9074 For Debian 7 "Wheezy", these problems have...

[SECURITY] [DLA 758-1] libgd2 security update

Package : libgd2 Version : 2.0.36rc1dfsg-6.1+deb7u7 CVE ID : CVE-2016-9933 Debian Bug : 849038 It was discovered that invalid color causes stack exhaustion by recursive call to function gdImageFillToBorder when the image used is truecolor. The vulnerability can be exploited through php5 which use...

[SECURITY] [DLA 756-1] imagemagick security update

Package : imagemagick Version : 8:6.7.7.10-5+deb7u10 CVE ID : CVE-2016-7799 CVE-2016-8707 CVE-2016-8862 CVE-2016-8866 CVE-2016-9556 Debian Bug : 840437 845206 848139 845634 845242 845243 845195 845196 845198 845202 845212 845213 845241 845244 845246 Numerous vulnerabilities were discovered in...

[SECURITY] [DSA 3732-2] php-ssh2 regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3732-2 [email protected] https://www.debian.org/security/ Sebastien Delafond December 21, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3732-2] php-ssh2 regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3732-2 [email protected] https://www.debian.org/security/ Sebastien Delafond December 21, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 755-1] dcmtk security update

Package : dcmtk Version : 3.6.0-12+deb7u1 CVE ID : CVE-2015-8979 Debian Bug : 848830 At several places in the code a wrong length of ACSE data structures received over the network can cause overflows or underflows when processing those data structures. Related checks have been added at various...

[SECURITY] [DSA 3743-1] python-bottle security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3743-1 [email protected] https://www.debian.org/security/ Sebastien Delafond December 20, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3743-1] python-bottle security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3743-1 [email protected] https://www.debian.org/security/ Sebastien Delafond December 20, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3742-1] flightgear security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3742-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 20, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 754-1] tor security update

Package : tor Version : 0.2.4.27-3 CVE ID : CVE-2016-1254 Debian Bug : 848847 It was discovered that Tor, a connection-based low-latency anonymous communication system, may read one byte past a buffer when parsing hidden service descriptors. This issue may enable a hostile hidden service to crash...

[SECURITY] [DSA 3741-1] tor security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3741-1 [email protected] https://www.debian.org/security/ Sebastien Delafond December 20, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3741-1] tor security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3741-1 [email protected] https://www.debian.org/security/ Sebastien Delafond December 20, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3740-1] samba security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3740-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 19, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3740-1] samba security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3740-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 19, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 753-1] tomcat7 security update

Package : tomcat7 Version : 7.0.28-4+deb7u8 CVE ID : CVE-2016-9774 Debian Bug : 845393 845425 846298 Paul Szabo discovered a potential privilege escalation that could be exploited in the situation envisaged in DLA-622-1. This update also addresses several regressions stemming from incomplete fixe...

[SECURITY] [DSA 3739-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3739-1 [email protected] https://www.debian.org/security/ Sebastien Delafond December 18, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3739-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3739-1 [email protected] https://www.debian.org/security/ Sebastien Delafond December 18, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3738-1] tomcat7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3738-1 [email protected] https://www.debian.org/security/ Sebastien Delafond December 18, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3738-1] tomcat7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3738-1 [email protected] https://www.debian.org/security/ Sebastien Delafond December 18, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 746-2] tomcat6 regression update

Package : tomcat6 Version : 6.0.45+dfsg-1deb7u5 Debian Bug : 848492 The last security update introduced a regression due to the use of StringManager in the ResourceLinkFactory class. The code was removed again since it is not strictly required to resolve CVE-2016-6797. For Debian 7 "Wheezy", thes...