[SECURITY] [DLA 620-1] libphp-adodb security update

Package : libphp-adodb Version : 5.15-1+deb7u1 Debian Bugs : 837211, 837418 It was discovered that there was a SQL injection vulnerability in libphp-adodb, PHP database abstraction layer library. For Debian 7 "Wheezy", this issue has been fixed in libphp-adodb version 5.15-1+deb7u1. We recommend...

[SECURITY] [DSA 3665-1] openjpeg2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3665-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 11, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 619-1] qemu-kvm security update

Package : qemu-kvm Version : 1.1.2+dfsg-6+deb7u15 CVE ID : CVE-2016-7116 qemu-kvm built with the VirtFS, host directory sharing via Plan 9 File System 9pfs support, is vulnerable to a directory/path traversal issue. It could occur while creating or accessing files on a shared host directory. A...

[SECURITY] [DLA 618-1] qemu security update

Package : qemu Version : 1.1.2+dfsg-6+deb7u15 CVE ID : CVE-2016-7116 Debian Bug : 836502 Quick EmulatorQemu built with the VirtFS, host directory sharing via Plan 9 File System9pfs support, is vulnerable to a directory/path traversal issue. It could occur while creating or accessing files on a...

[SECURITY] [DLA 617-1] libarchive security update

Package : libarchive Version : 3.0.4-3+wheezy3 CVE ID : CVE-2015-8915 CVE-2016-7166 Debian Bug : 784213 Several security vulnerabilities have been discovered in libarchive, a multi-format archive and compression library. An attacker could take advantage of these flaws to cause an out of bounds re...

[SECURITY] [DSA 3664-1] pdns security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3664-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 10, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3664-1] pdns security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3664-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 10, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 616-1] curl security update

Package : curl Version : 7.26.0-1+wheezy15 CVE ID : CVE-2016-7141 Debian Bug : 836918 It was discovered that libcurl built on top of NSS Network Security Services incorrectly re-used client certificates if a certificate from file was used for one TLS connection but no certificate set for a...

[SECURITY] [DLA 614-1] xen security update

Package : xen Version : 4.1.6.lts1-2 CVE ID : CVE-2016-7092 CVE-2016-7094 Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-7092 XSA-185 Jeremie Boutoille of Quarkslab and Shangcong Lua...

[SECURITY] [DSA 3663-1] xen security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3663-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 09, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3663-1] xen security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3663-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 09, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3662-1] inspircd security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3662-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 08, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 615-1] icu security update

Package : icu Version : 4.8.1.1-12+deb7u5 CVE ID : CVE-2016-6293 This update fixes a buffer overflow in the ulocacceptLanguageFromHTTP function in ICU, the International Components for Unicode C and C++ library, in Debian Wheezy For Debian 7 "Wheezy", these problems have been fixed in version...

[SECURITY] [DLA 613-1] roundcube security update

Package : roundcube Version : 0.7.2-9+deb7u4 CVE ID : CVE-2014-9587 CVE-2015-1433 CVE-2016-4069 Debian Bug : 822333 775576 776700 Multiple CSRF and XSS issues allow remote attackers to hijack the authentication and execute roundcube operations without the consent of the user. In some cases, this...

[SECURITY] [DLA 612-1] libtomcrypt security update

Package : libtomcrypt Version : 1.17-3.2+deb7u1 CVE ID : CVE-2016-6129 It was discovered that the implementation of RSA signature verification in libtomcrypt is vulnerable to the Bleichenbacher signature attack. If an RSA key with exponent 3 is used it may be possible to forge a PKCS1 v1.5...

[SECURITY] [DSA 3661-1] charybdis security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3661-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 06, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3660-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3660-1 [email protected] https://www.debian.org/security/ Michael Gilbert September 05, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3660-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3660-1 [email protected] https://www.debian.org/security/ Michael Gilbert September 05, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 611-1] jsch security update

Package : jsch Version : 0.1.42-2+deb7u1 CVE ID : CVE-2016-5725 It was discovered that there was a path traversal vulnerability in jsch, a pure Java implementation of the SSH2 protocol. For Debian 7 "Wheezy", this issue has been fixed in jsch version 0.1.42-2+deb7u1. We recommend that you upgrade...

[SECURITY] [DLA 610-1] tiff3 security update

Package : tiff3 Version : 3.9.6-11+deb7u1 CVE ID : CVE-2010-2596 CVE-2013-1961 CVE-2014-8128 CVE-2014-8129 CVE-2014-9655 CVE-2015-1547 CVE-2015-8665 CVE-2015-8683 CVE-2016-3186 CVE-2016-3623 CVE-2016-3945 CVE-2016-3990 CVE-2016-3991 CVE-2016-5314 CVE-2016-5315 CVE-2016-5316 CVE-2016-5317...

[SECURITY] [DSA 3659-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3659-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 04, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3659-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3659-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 04, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3653-2] flex security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3653-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 04, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3653-2] flex security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3653-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 04, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 609-1] linux security update

Package : linux Version : 3.2.81-2 CVE ID : CVE-2016-3857 CVE-2016-4470 CVE-2016-5696 CVE-2016-5829 CVE-2016-6136 CVE-2016-6480 CVE-2016-6828 CVE-2016-7118 Debian Bug : 827561 This update fixes the CVEs described below. CVE-2016-3857 Chiachih Wu reported two bugs in the ARM OABI compatibility lay...

[SECURITY] [DLA 608-1] mailman security update

Package : mailman Version : 1:2.1.15-1+deb7u2 CVE ID : CVE-2016-6893 Debian Bug : 835970 It was discovered that there was a CSRF vulnerability in mailman, a web-based mailing list manager, which could allow an attacker to obtain a users password. For Debian 7 "Wheezy", this issue has been fixed i...

[SECURITY] [DSA 3658-1] libidn security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3658-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 01, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3658-1] libidn security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3658-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 01, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 560-2] cacti regression update

Package : cacti Version : 0.8.8a+dfsg-5+deb7u10 The fix for CVE-2016-2313 did not take into account guest users. This update fixes it. For Debian 7 "Wheezy", these problems have been fixed in version 0.8.8a+dfsg-5+deb7u10. We recommend that you upgrade your cacti packages. Further information abo...

[SECURITY] [DLA 606-1] tiff security update

Package : tiff Version : 4.0.2-6+deb7u6 CVE ID : CVE-2016-3991 CVE-2016-5314 CVE-2016-5315 CVE-2016-5316 CVE-2016-5317 CVE-2016-5320 CVE-2016-5321 CVE-2016-5322 CVE-2016-5323 CVE-2016-5875 Several vulnerabilities were found in the tiff library, potentially causing denial of services to applicatio...

[SECURITY] [DSA 3657-1] libarchive security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3657-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 30, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3656-1] tryton-server security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3656-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 30, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 602-1] gnupg security and hardening update

Package : gnupg Version : 1.4.12-7+deb7u8 CVE ID : CVE-2016-6313 Debian Bug : 834893 CVE-2016-6313 Felix Doerre and Vladimir Klebanov from the Karlsruhe Institute of Technology discovered a flaw in the mixing functions of GnuPGs random number generator. An attacker who obtains 4640 bits from the...

[SECURITY] [DLA 605-1] eog security update

Package : eog Version : 3.4.2-1+build1+deb7u1 CVE ID : CVE-2016-6855 It was discovered that Eye of GNOME incorrectly handled certain invalid UTF-8 strings. If a user were tricked into opening a specially-crafted image, a remote attacker could use this issue to cause Eye of GNOME to crash, resulti...

[SECURITY] [DLA 604-1] ruby-actionpack-3.2 security update

Package : ruby-actionpack-3.2 Version : 3.2.6-6+deb7u3 CVE ID : CVE-2015-7576 CVE-2016-0751 CVE-2016-0752 CVE-2016-2097 CVE-2016-2098 CVE-2016-6316 Multiple vulnerabilities have been discovered in ruby-actionpack-3.2, a web-flow and rendering framework and part of Rails: CVE-2015-7576 A flaw was...

[SECURITY] [DLA 603-1] ruby-activesupport-3.2 security update

Package : ruby-activesupport-3.2 Version : 3.2.6-6+deb7u2 CVE ID : CVE-2015-3227 The support and utility classes used by the Rails 3.2 framework allow remote attackers to cause a denial of service SystemStackError via a large XML document depth. For Debian 7 "Wheezy", these problems have been fix...

[SECURITY] [DLA 601-1] quagga security update

Package : quagga Version : 0.99.22.4-1+wheezy3 CVE ID : CVE-2016-4036 CVE-2016-4049 Debian Bug : 835223, 822787 The quagga package installs world readable sensitive files in /etc/quagga, and might be subject to denial of service because of lacking packet size checks. CVE-2016-4036 The quagga...

[SECURITY] [DSA 3655-1] mupdf security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3655-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 26, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3655-1] mupdf security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3655-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 26, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3654-1] quagga security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3654-1 [email protected] https://www.debian.org/security/ Sebastien Delafond August 26, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3654-1] quagga security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3654-1 [email protected] https://www.debian.org/security/ Sebastien Delafond August 26, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3653-1] flex security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3653-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 25, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3652-1] imagemagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3652-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 25, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3651-1] rails security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3651-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 25, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3651-1] rails security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3651-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 25, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 600-1] libgcrypt11 security update

Package : libgcrypt11 Version : 1.5.0-5+deb7u5 CVE ID : CVE-2016-6313 The crypto library libgcrypt11 has a weakness in the random number generator. CVE-2016-6313 Felix Dörre and Vladimir Klebanov from the Karlsruhe Institute of Technology found a bug in the mixing functions of Libgcrypts random...

[SECURITY] [DLA 599-1] cracklib2 security update

Package : cracklib2 Version : 2.8.19-3+deb7u1 CVE ID : CVE-2016-6318 Debian Bug : 834502 It was discovered that there was a stack-based buffer overflow when parsing large GECOS fields in cracklib2, a pro-active password checker library. For Debian 7 "Wheezy", this issue has been fixed in cracklib...

[SECURITY] [DLA 598-1] suckless-tools security update

Package : suckless-tools Version : 38-2+deb7u1 CVE ID : CVE-2016-6866 It was discovered that the slock screen locking tool would segfault when the users account had been disabled. slock called crypt3 and used the return value for strcmp3 without checking to see if the return value of crypt3 was a...

[SECURITY] [DLA 597-1] libupnp security update

Package : libupnp Version : 1.6.17-1.2+deb7u1 CVE ID : CVE-2016-6255 Debian Bug : 831857 It has been discovered that libupnps default behaviour allows anyone to write to the filesystem of the system running a libupnp-based server application. For Debian 7 "Wheezy", these problems have been fixed ...

[SECURITY] [DSA 3650-1] libgcrypt20 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3650-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 17, 2016 https://www.debian.org/security/faq -...