[SECURITY] [DSA 3683-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3683-1 [email protected] https://www.debian.org/security/ Michael Gilbert October 02, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3681-2] wordpress regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3681-2 [email protected] https://www.debian.org/security/ Yves-Alexis Perez October 01, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3682-1] c-ares security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3682-1 [email protected] https://www.debian.org/security/ Florian Weimer September 30, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 636-2] firefox-esr regression update

Package : firefox-esr Version : 45.4.0esr-1deb7u2 The update of firefox-esr to 45.4.0esr-1deb7u1 caused build failure on armel and armhf architectures. For Debian 7 "Wheezy", these problems have been fixed in version 45.4.0esr-1deb7u2. We recommend that you upgrade your firefox-esr packages...

[SECURITY] [DLA 643-1] chicken security update

Package : chicken Version : 4.7.0-1+deb7u1 CVE ID : CVE-2016-6830 CVE-2016-6831 Multiple vulnerabilities have been found in the CHICKEN Scheme compiler: CVE-2016-6830 Buffer overrun in CHICKEN Schemes "process-execute" and "process-spawn" procedures from the posix unit CVE-2016-6831 Memory leak i...

[SECURITY] [DLA 642-1] ruby-activerecord-3.2 security update

Package : ruby-activerecord-3.2 Version : 3.2.6-5+deb7u3 CVE ID : CVE-2016-0753 Active Record in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended...

[SECURITY] [DLA 641-1] ruby-activesupport-3.2 security update

Package : ruby-activesupport-3.2 Version : 3.23.2.6-6+deb7u3 CVE ID : CVE-2016-0753 Active Support in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass...

[SECURITY] [DLA 640-1] icedove security update

Package : icedove Version : 1:45.3.0-1deb7u1 CVE ID : CVE-2016-2836 Multiple security issues have been found in Icedove, Debians version of the Mozilla Thunderbird mail client: Multiple memory safety errors may lead to the execution of arbitrary code or denial of service. For Debian 7 "Wheezy",...

[SECURITY] [DSA 3681-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3681-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez September 29, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3680-1] bind9 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3680-1 [email protected] https://www.debian.org/security/ Florian Weimer September 27, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 636-1] firefox-esr security update

Package : firefox-esr Version : 45.4.0esr-1deb7u1 CVE ID : CVE-2016-5250 CVE-2016-5257 CVE-2016-5261 CVE-2016-5270 CVE-2016-5272 CVE-2016-5274 CVE-2016-5276 CVE-2016-5277 CVE-2016-5278 CVE-2016-5280 CVE-2016-5281 CVE-2016-5284 Multiple security issues have been found in the Mozilla Firefox web...

[SECURITY] [DSA 3679-1] jackrabbit security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3679-1 [email protected] https://www.debian.org/security/ Florian Weimer September 27, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3678-1] python-django security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3678-1 [email protected] https://www.debian.org/security/ Florian Weimer September 26, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 639-1] mactelnet security update

Package : mactelnet Version : 0.3.4-1+deb7u1 CVE ID : CVE-2016-7115 CVE-2016-7115 Buffer overflow in the handlepacket function in mactelnet.c in the client in MAC-Telnet 0.4.3 and earlier allows remote TELNET servers to execute arbitrary code via a long string in an MTCPTYPEENCRYPTIONKEY control...

[SECURITY] [DLA 638-1] policycoreutils security update

Package : policycoreutils Version : 2.1.10-9+deb7u1 CVE ID : CVE-2016-7545 Debian Bug : 838599 It was discovered that there was a sandbox escape via the "TIOCSTI" ioctl in policycoreutils, a set of programs required for the basic operation of an SELinux-based system. For Debian 7 "Wheezy", this...

[SECURITY] [DLA 637-1] openssl security update

Package : openssl Version : 1.0.1t-1+deb7u1 CVE ID : CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2180 CVE-2016-2181 CVE-2016-2182 CVE-2016-6302 CVE-2016-6303 CVE-2016-6304 CVE-2016-6306 Several vulnerabilities were discovered in OpenSSL: CVE-2016-2177 Guido Vranken discovered that OpenSSL...

[SECURITY] [DSA 3677-1] libarchive security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3677-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 25, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3677-1] libarchive security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3677-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 25, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3676-1] unadf security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3676-1 [email protected] https://www.debian.org/security/ Luciano Bello September 24, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3676-1] unadf security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3676-1 [email protected] https://www.debian.org/security/ Luciano Bello September 24, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 635-1] dwarfutils security update

Package : dwarfutils Version : 20120410-2+deb7u1 CVE IDs : CVE-2016-7510 CVE-2016-7511 It was discovered that there were out-of-bounds read issues in dwarfutils, a library to consume and produce DWARF debug information. For Debian 7 "Wheezy", this issue has been fixed in dwarfutils version...

[SECURITY] [DSA 3673-2] openssl regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3673-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 23, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3673-2] openssl regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3673-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 23, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3675-1] imagemagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3675-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 23, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 634-1] dropbear security update

Package : dropbear Version : 2012.55-1.3+deb7u1 CVE IDs : CVE-2016-7406 CVE-2016-7407 It was discovered that there were two issues in dropbear, a lightweight SSH2 server and client: - CVE-2016-7406: Potential issues in exit message formatting. - CVE-2016-7407: Overflows when parsing OpenSSHs ASN....

[SECURITY] [DLA 633-1] wordpress security update

Package : wordpress Version : 3.6.1+dfsg-1deb7u12 CVE ID : CVE-2015-8834 CVE-2016-4029 CVE-2016-5836 CVE-2016-6634 CVE-2016-6635 CVE-2016-7168 CVE-2016-7169 Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the...

[SECURITY] [DSA 3674-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3674-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 22, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3673-1] openssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3673-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 22, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3672-1] irssi security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3672-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 21, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3672-1] irssi security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3672-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 21, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 632-1] wireshark security update

Package : wireshark Version : 1.12.1+g01b65bf-4+deb8u6deb7u4 CVE ID : CVE-2016-7176 CVE-2016-7177 CVE-2016-7178 CVE-2016-7179 CVE-2016-7180 Multiple vulnerabilities were discovered in the dissectors for H.225, Catapult DCT2000, UMTS FP and IPMI, which could result in denial of service or the...

[SECURITY] [DLA 631-1] unadf security update

Package : unadf Version : 0.7.11a-3+deb7u1 CVE IDs : CVE-2016-1243 CVE-2016-1244 Debian Bug : 838248 It was discovered that there were two vulnerabilities in unadf, a tool to extract files from an Amiga Disk File dump .adf: - - CVE-2016-1243: stack buffer overflow caused by blindly trusting on...

[SECURITY] [DSA 3671-1] mutt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3671-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 20, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 630-1] zookeeper security update

Package : zookeeper Version : 3.3.5+dfsg1-2+deb7u1 CVE ID : CVE-2016-5017 Lyon Yang discovered that the C client shells clist and climt of Apache Zookeeper, a high-performance coordination service for distributed applications, were affected by a buffer overflow vulnerability associated with parsi...

[SECURITY] [DLA 629-1] jackrabbit security update

Package : jackrabbit Version : 2.3.6-1+deb7u2 CVE ID : CVE-2016-6801 Debian Bug : 838204 Lukas Reschke discovered that Apache Jackrabbit, a content repository implementation for Java, was vulnerable to Cross-Site-Request-Forgery in Jackrabbits webdav module. The CSRF content-type check for POST...

[SECURITY] [DLA 628-1] php5 security update

Package : php5 Version : 5.4.45-0+deb7u5 CVE ID : CVE-2016-4473 CVE-2016-4538 CVE-2016-5114 CVE-2016-5399 CVE-2016-5768 CVE-2016-5769 CVE-2016-5770 CVE-2016-5771 CVE-2016-5772 CVE-2016-5773 CVE-2016-6289 CVE-2016-6290 CVE-2016-6291 CVE-2016-6292 CVE-2016-6294 CVE-2016-6295 CVE-2016-6296...

[SECURITY] [DLA 627-1] pdns security update

Package : pdns Version : 3.1-4.1+deb7u2 CVE ID : CVE-2016-5426 CVE-2016-5427 CVE-2016-6172 Debian Bug : 830808 Multiple vulnerabilities have been discovered in pdns, an authoritative DNS server. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-5426 /...

[SECURITY] [DLA 626-1] phpmyadmin security update

Package : phpmyadmin Version : 3.4.11.1-2+deb7u6 CVE ID : CVE-2016-6606 CVE-2016-6607 CVE-2016-6609 CVE-2016-6611 CVE-2016-6612 CVE-2016-6613 CVE-2016-6614 CVE-2016-6620 CVE-2016-6622 CVE-2016-6623 CVE-2016-6624 CVE-2016-6630 CVE-2016-6631 Phpmyadmin, a web administration tool for MySQL, had...

[SECURITY] [DLA 625-1] curl security update

Package : curl Version : 7.26.0-1+wheezy16 CVE ID : CVE-2016-7167 Debian Bug : 837945 It was discovered that the four four libcurl functions curlescape, curleasyescape, curlunescape and curleasyunescape accepted negative sting length inputs. For Debian 7 "Wheezy", these problems have been fixed i...

[SECURITY] [DLA 624-1] mysql-5.5 security update

Package : mysql-5.5 Version : 5.5.52-0+deb7u1 CVE ID : CVE-2016-6662 Dawid Golunski discovered that the mysqldsafe wrapper provided by the MySQL database server insufficiently restricted the load path for custom malloc implementations, which could result in privilege escalation. The vulnerability...

[SECURITY] [DSA 3670-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3670-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 15, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3669-1] tomcat7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3669-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 15, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 623-1] tomcat7 security update

Package : tomcat7 Version : 7.0.28-4+deb7u6 CVE ID : CVE-2016-1240 Dawid Golunski from legalhackers.com discovered that Debians version of Tomcat 7 was vulnerable to a local privilege escalation. Local attackers who have gained access to the server in the context of the tomcat7 user through a...

[SECURITY] [DLA 622-1] tomcat6 security update

Package : tomcat6 Version : 6.0.45+dfsg-1deb7u2 CVE ID : CVE-2016-1240 Dawid Golunski from legalhackers.com discovered that Debians version of Tomcat 6 was vulnerable to a local privilege escalation. Local attackers who have gained access to the server in the context of the tomcat6 user through a...

[SECURITY] [DSA 3668-1] mailman security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3668-1 [email protected] https://www.debian.org/security/ Thijs Kinkhorst September 15, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 621-1] autotrace security update

Package : autotrace Version : 0.31.1-16+deb7u1 CVE ID : CVE-2016-7392 Autotrace is a program for converting bitmaps to vector graphics. It had a bug that caused an out-of-bounds write. This was caused by not allocating sufficient memory to store the terminating NULL pointer in an array. For Debia...

[SECURITY] [DSA 3667-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3667-1 [email protected] https://www.debian.org/security/ Michael Gilbert September 15, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3667-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3667-1 [email protected] https://www.debian.org/security/ Michael Gilbert September 15, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3666-1] mysql-5.5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3666-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 14, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3666-1] mysql-5.5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3666-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 14, 2016 https://www.debian.org/security/faq -...