[SECURITY] [DSA 3620-1] pidgin security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3620-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 15, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3620-1] pidgin security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3620-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 15, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 549-1] ruby-eventmachine security update

Package : ruby-eventmachine Version : 0.12.10-3+deb7u1 Debian Bug : 678512 696015 EventMachine, a Ruby network engine could be crashed by opening a high number of parallel connections = 1024 towards a server using the EventMachine engine. The crash happens due to the file descriptors overwriting...

[SECURITY] [DSA 3619-1] libgd2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3619-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 15, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3619-1] libgd2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3619-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 15, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 550-1] drupal7 security update

Package : drupal7 Version : 7.14-2+deb7u14 CVE ID : CVE-2016-6211 It was discovered that there was a vulnerability existed in the user module in drupal7, a content management framework. If some specific contributed or custom code triggers a rebuild of the user profile form, a registered user can ...

[SECURITY] [DLA 546-2] clamav version update

Package : clamav Version : 0.99.2+dfsg-0+deb7u2 DLA 546-1 was incorrectly released before updated clamav packages were available and there were subsequent issues with the acceptance of the package which have since been corrected. Updates are now available for all supported LTS architectures. We...

[SECURITY] [DSA 3618-1] php5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3618-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 14, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 548-1] drupal7 security update

Package : drupal7 Version : 7.14-2+deb7u13 CVE ID : CVE-2015-7943 It was discovered that there was an open redirect vulnerability in drupal7, a content management framework. The "Overlay" module in Drupal core displays administrative pages as a layer over the current page using JavaScript rather...

[SECURITY] [DLA 574-1] graphicsmagick security update

Package : graphicsmagick Version : 1.3.16-1.1+deb7u3 CVE IDs : 2016-5240 2016-5241 It was discovered that there were two denial of service vulnerabilities in graphicsmagick, a collection of image processing tools: CVE-2016-5240: Prevent denial-of-service by detecting and rejecting negative...

[SECURITY] [DLA 546-1] clamav version update

Package : clamav Version : 0.99.2+dfsg-0+deb7u1 We recommend that you upgrade your clamav packages. Upstream published version 0.99.2. This update updates wheezy-lts to the latest upstream release in line with the approach used for other Debian releases. The changes are not strictly required for...

[SECURITY] [DLA 545-1] icu security update

Package : icu Version : 4.8.1.1-12+deb7u4 CVE ID : CVE-2015-2632 CVE-2015-4844 CVE-2016-0494 Several security issues have been identified and corrected in ICU, the International Components for Unicode C and C++ library, in Debian Wheezy. CVE-2015-2632 Buffer overflow vulnerability. CVE-2015-4844...

[SECURITY] [DLA 544-1] tcpreplay security update

Package : tcpreplay Version : 3.4.3-2+wheezy2 CVE ID : CVE-2016-6160 Debian Bug : 829350 The tcprewrite program, part of the tcpreplay suite, does not check the size of the frames it processes. Huge frames may trigger a segmentation fault, and such frames occur when caputuring packets on interfac...

[SECURITY] [DSA 3617-1] horizon security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3617-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 06, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 543-1] sqlite3 security update

Package : sqlite3 Version : 3.7.13-1+deb7u3 CVE ID : CVE-2016-6153 It was discovered that sqlite3, a C library that implements a SQL database engine, would reject a temporary directory e.g., as specified by the TMPDIR environment variable to which the executing user did not have read permissions...

[SECURITY] [DLA 542-1] pidgin security update

Package : pidgin Version : 2.10.10-1deb7u2 CVE ID : CVE-2016-2365 CVE-2016-2366 CVE-2016-2367 CVE-2016-2368 CVE-2016-2369 CVE-2016-2370 CVE-2016-2371 CVE-2016-2372 CVE-2016-2373 CVE-2016-2374 CVE-2016-2375 CVE-2016-2376 CVE-2016-2377 CVE-2016-2378 CVE-2016-2380 CVE-2016-4323 Numerous security...

[SECURITY] [DSA 3616-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3616-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 04, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3616-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3616-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 04, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3614-1] tomcat7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3614-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 02, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3614-1] tomcat7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3614-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 02, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3615-1] wireshark security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3615-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 02, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3613-1] libvirt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3613-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 02, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3613-1] libvirt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3613-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 02, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3612-1] gimp security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3612-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 01, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3612-1] gimp security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3612-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 01, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 540-1] qemu security update

Package : qemu Version : 1.1.2+dfsg-6a+deb7u13 CVE ID : CVE-2016-3710 CVE-2016-3712 Debian Bug : 823830 Several vulnerabilities were discovered in qemu, a fast processor emulator. CVE-2016-3710 Wei Xiao and Qinghao Tang of 360.cn Inc discovered an out-of-bounds read and write flaw in the QEMU VGA...

[SECURITY] [DLA 541-1] libvirt security update

Package : libvirt Version : 0.9.12.3-1+deb7u2 CVE ID : CVE-2016-5008 It was discovered that there was a password policy issue in libvirt, a library for interfacing with different virtualization systems. Setting an empty graphics password is documented as a way to disable VNC/SPICE access, but QEM...

[SECURITY] [DLA 539-1] qemu-kvm security update

Package : qemu-kvm Version : 1.1.2+dfsg-6+deb7u13 CVE ID : CVE-2016-3710 CVE-2016-3712 Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution for Linux hosts on x86 hardware with x86 guests. CVE-2016-3710 Wei Xiao and Qinghao Tang of 360.cn Inc discovered an...

[SECURITY] [DLA 538-1] wireshark security update

Package : wireshark Version : 1.12.1+g01b65bf-4+deb8u6deb7u2 CVE ID : CVE-2016-5350 CVE-2016-5351 CVE-2016-5353 CVE-2016-5354 CVE-2016-5355 CVE-2016-5356 CVE-2016-5357 CVE-2016-5359 The following vulnerabilities have been discovered in the Wheezys Wireshark version: CVE-2016-5350 The SPOOLS...

[SECURITY] [DLA 537-1] roundcube security update

Package : roundcube Version : 0.7.2-9+deb7u3 CVE ID : CVE-2015-8864 Roundcube, a webmail solution for IMAP servers, was susceptible to cross-site-scripting XSS vulnerabilities when handling SVG images. When right-clicking on the download link of an attached image, it was possible that embedded...

[SECURITY] [DLA 536-1] wget security update

Package : wget Version : 1.13.4-3+deb7u3 CVE ID : CVE-2016-4971 Debian Bug : 827003 On a server redirect from HTTP to a FTP resource, wget would trust the HTTP server and uses the name in the redirected URL as the destination filename. This behaviour was changed and now it works similarly as a...

[SECURITY] [DSA 3611-1] libcommons-fileupload-java security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3611-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 30, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3611-1] libcommons-fileupload-java security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3611-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 30, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 535-1] xerces-c security update

Package : xerces-c Version : 3.1.1-3+deb7u4 CVE ID : CVE-2016-4463 Debian Bug : 828990 Brandon Perry discovered that xerces-c, a validating XML parser library for C++, fails to successfully parse a DTD that is deeply nested, causing a stack overflow. A remote unauthenticated attacker can take...

[SECURITY] [DLA 534-1] libgd2 security update

Package : libgd2 Version : 2.0.36rc1dfsg-6.1+deb7u4 CVE ID : CVE-2016-5766 CVE-2016-5766 Integer Overflow in gd2GetHeader resulting in heap overflow. For Debian 7 "Wheezy", these problems have been fixed in version 2.0.36rc1dfsg-6.1+deb7u4. We recommend that you upgrade your libgd2 packages...

[SECURITY] [DSA 3610-1] xerces-c security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3610-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 29, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3610-1] xerces-c security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3610-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 29, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3609-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3609-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 29, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3608-1] libreoffice security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3608-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 29, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 533-1] php5 security update

Package : php5 Version : 5.4.45-0+deb7u4 CVE ID : CVE-2016-5093 CVE-2016-5094 CVE-2016-5095 CVE-2016-5096 PHP bugs : 70661 70728 70741 70480 CVE-2016-5093.patch Absence of null character causes unexpected zendstring length and leaks heap memory. The test script uses localegetprimarylanguage to...

[SECURITY] [DSA 3607-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3607-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 28, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3607-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3607-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 28, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 531-1] spice security update

Package : spice Version : 0.11.0-1+deb7u3 CVE ID : CVE-2016-2150 Debian Bug : 826584 A vulnerability has been found in the Simple Protocol for Independent Computing Environments, SPICE. Frediano Ziglio from Red Hat discovered that SPICE allowed local guest OS users to read from or write to...

[SECURITY] [DLA 532-1] movabletype-opensource security update

Package : movabletype-opensource Version : 5.1.4+dfsg-4+deb7u4 CVE ID : CVE-2016-5742 It was discovered that there was a SQL injection vulnerability in the XML-RPC interface in MovableType, a blogging engine. For Debian 7 "Wheezy", this issue has been fixed in movabletype-opensource version...

[SECURITY] [DLA 530-1] java-common security update

Package : java-common Version : 0.47+deb7u2 As previously announced 12, the default Java implementation has been switched from OpenJDK 6 to OpenJDK 7. We strongly recommend to remove the unsupported OpenJDK 6 packages which will receive no further security updates. 1...

[SECURITY] [DLA 529-1] tomcat7 security update

Package : tomcat7 Version : 7.0.28-4+deb7u5 CVE ID : CVE-2016-3092 A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer 4096 bytes used to read the uploaded file. This caused the file...

[SECURITY] [DLA 528-1] libcommons-fileupload-java security update

Package : libcommons-fileupload-java Version : 1.2.2-1+deb7u3 CVE ID : CVE-2016-3092 A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer 4096 bytes used to read the uploaded file. This...

[SECURITY] [DLA 527-1] nss security update

Package : nss Version : 2:3.14.5-1+deb7u8 CVE ID : CVE-2016-2834 Four moderate rated networking security issues were found in NSS. For Debian 7 "Wheezy", these problems have been fixed in version 2:3.14.5-1+deb7u8. We recommend that you upgrade your nss packages and restart any applications that...

[SECURITY] [DLA 526-1] mysql-connector-java security update

Package : mysql-connector-java Version : 5.1.39-1deb7u1 CVE ID : CVE-2015-2575 A vulnerability in the MySQL Connectors component of Oracle MySQL subcomponent: Connector/J has been discovered that may result in unauthorized update, insert or delete access to some MySQL Connectors accessible data a...

[SECURITY] [DLA 525-1] gimp security update

Package : gimp Version : 2.8.2-2+deb7u2 CVE ID : CVE-2016-4994 It was discovered that there was a use-after-free vulnerability in the channel and layer properties parsing process in Gimp, the GNU Image Manipulation Program. For Debian 7 "Wheezy", this issue has been fixed in gimp version...