[SECURITY] [DLA 501-1] gdk-pixbuf security update

Package : gdk-pixbuf Version : 2.26.1-1+deb7u5 CVE ID : CVE-2015-7552 It was discovered that the original fix for CVE-2015-7552 DLA-450-1 was incomplete. A heap-based buffer overflow in gdk-pixbuf, a library for image loading and saving facilities, fast scaling and compositing of pixbufs, allows...

[SECURITY] [DSA 3592-1] nginx security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3592-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 01, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3591-1] imagemagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3591-1 [email protected] https://www.debian.org/security/ Luciano Bello June 01, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3591-1] imagemagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3591-1 [email protected] https://www.debian.org/security/ Luciano Bello June 01, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3590-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3590-1 [email protected] https://www.debian.org/security/ Michael Gilbert June 01, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3590-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3590-1 [email protected] https://www.debian.org/security/ Michael Gilbert June 01, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 499-1] php5 security update

Package : php5 Version : 5.4.45-0+deb7u3 CVE ID : CVE-2015-8865 CVE-2015-8866 CVE-2015-8878 CVE-2015-8879 CVE-2016-4070 CVE-2016-4071 CVE-2016-4072 CVE-2016-4073 CVE-2016-4343 CVE-2016-4537 CVE-2016-4539 CVE-2016-4540 CVE-2016-4541 CVE-2016-4542 CVE-2016-4543 CVE-2016-4544 CVE-2015-8865 The...

[SECURITY] [DLA 498-1] ruby-activemodel-3.2 security update

Package : ruby-activemodel-3.2 Version : 3.23.2.6-3+deb7u1 CVE ID : CVE-2016-0753 Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intende...

[SECURITY] [DLA 497-1] wireshark security update

Package : wireshark Version : 1.12.1+g01b65bf-4+deb8u6deb7u1 CVE ID : CVE-2012-6052 CVE-2012-6053 CVE-2012-6054 CVE-2012-6055 CVE-2012-6056 CVE-2012-6057 CVE-2012-6058 CVE-2012-6059 CVE-2012-6060 CVE-2012-6061 CVE-2012-6062 CVE-2013-1572 CVE-2013-1573 CVE-2013-1574 CVE-2013-1575 CVE-2013-1576...

[SECURITY] [DLA 496-1] ruby-activerecord-3.2 security update

Package : ruby-activerecord-3.2 Version : 3.2.6-5+deb7u2 CVE ID : CVE-2015-7577 Debian Bug : N/A CVE-2015-7577 activerecord/lib/activerecord/nestedattributes.rb in Active Record does not properly implement a certain destroy option, which allows remote attackers to bypass intended change...

[SECURITY] [DLA 495-1] libtasn1-3 security update

Package : libtasn1-3 Version : 2.13-2+deb7u3 CVE ID : CVE-2016-4008 CVE-2016-4008: infinite loop while parsing DER certificates The asn1extractderoctet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1DECODEFLAGSTRICTDER flag, allows remote attackers to cause a...

[SECURITY] [DLA 481-2] phpmyadmin regression update

Package : phpmyadmin Version : 4:3.4.11.1-2+deb7u4 CVE ID : CVE-2016-1927 CVE-2016-2038 CVE-2016-2039 CVE-2016-2040 CVE-2016-2041 CVE-2016-2045 CVE-2016-2560 Debian Bug : 825301 The previous security upload broke the search pages in phpMyAdmin. This was caused by a broken patch applied to fix...

[SECURITY] [DSA 3589-1] gdk-pixbuf security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3589-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 30, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3589-1] gdk-pixbuf security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3589-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 30, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 494-1] eglibc security update

Package : eglibc Version : 2.13-38+deb7u11 CVE ID : CVE-2016-1234 CVE-2016-3075 CVE-2016-3706 Several vulnerabilities have been fixed in the Debian GNU C Library, eglibc: CVE-2016-1234 Alexander Cherepanov discovered that the glibcs glob implementation suffered from a stack-based buffer overflow...

[SECURITY] [DSA 3588-1] symfony security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3588-1 [email protected] https://www.debian.org/security/ Luciano Bello May 29, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3588-1] symfony security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3588-1 [email protected] https://www.debian.org/security/ Luciano Bello May 29, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 492-1] pdns security update

Package : pdns Version : 3.1-4.1+deb7u1 CVE ID : CVE-2014-7210 It was discovered that the maintainer scripts of pdns-backend-mysql grant too wide database permissions for the pdns user. Other backends are not affected. For Debian 7 "Wheezy", these problems have been fixed in version 3.1-4.1+deb7u...

[SECURITY] [DLA 493-1] openafs security update

Package : openafs Version : 1.6.1-3+deb7u6 CVE ID : CVE-2015-8312 CVE-2016-2860 CVE-2016-4536 CVE-2015-8312: Off-by-one error in afspioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service memory overwrite and system crash via a pioctl with an input buffer size of 40...

[SECURITY] [DLA 491-1] postgresql-9.1 bugfix update

Package : postgresql-9.1 Version : 9.1.22-0+deb7u1 The PostgreSQL project released a new version of the PostgreSQL 9.1 branch: Clear the OpenSSL error queue before OpenSSL calls, rather than assuming its clear already; and make sure we leave it clear afterwards Peter Geoghegan, Dave Vitek, Peter...

[SECURITY] [DSA 3587-1] libgd2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3587-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 27, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3587-1] libgd2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3587-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 27, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 490-1] bozohttpd security update

Package : bozohttpd Version : 20111118-1+deb7u1 CVE ID : CVE-2014-5015 CVE-2015-8212 Debian Bug : 755197 Two security vulnerabilities have been discovered in bozohttpd, a small HTTP server. CVE-2014-5015 Bozotic HTTP server aka bozohttpd before 201407081 truncates paths when checking .htpasswd...

[SECURITY] [DLA 487-1] debian-security-support - Long term security support update

Package : debian-security-support Version : 2016.05.24deb7u1 The Debian Long Term Support LTS Team is unable to continue supporting different packages in the extended life cycle of Wheezy LTS. The debian-security-support package provides the check-support-status tool that helps to warn the...

[SECURITY] [DLA 489-1] ruby-mail security update

Package : ruby-mail Version : 2.4.4-2+deb7u1 CVE ID : N/A Debian Bug : N/A This security update fixes a security issue in ruby-mail. We recommend you upgrade your ruby-mail package. Takeshi Terada Mitsui Bussan Secure Directions, Inc. released a whitepaper entitled "SMTP Injection via recipient...

[SECURITY] [DLA 488-1] xymon security update

Package : xymon Version : 4.3.0beta2.dfsg-9.1+deb7u1 CVE ID : CVE-2016-2054 CVE-2016-2055 CVE-2016-2056 CVE-2016-2058 Markus Krell discovered that Xymon formerly known as Hobbit, a network- and applications-monitoring system, was vulnerable to the following security issues: CVE-2016-2054 The...

[SECURITY] [DSA 3586-1] atheme-services security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3586-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 23, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 486-1] imagemagick security update

Package : imagemagick Version : 8:6.7.7.10-5+deb7u5 CVE ID : CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717 CVE-2016-3718 Debian Bug : 823542 Nikolay Ermishkin from the Mail.Ru Security Team and Stewie discovered several vulnerabilities in ImageMagick, a program suite for image...

[SECURITY] [DSA 3585-1] wireshark security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3585-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 22, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 485-1] extplorer security update

Package : extplorer Version : 2.1.0b6+dfsg.3-4+deb7u3 CVE ID : CVE-2015-5660 This security update fixes a security issue in extplorer. We recommend you upgrade your extplorer package. CVE-2015-5660 Cross-site request forgery CSRF vulnerability allows remote attackers to hijack the authentication ...

[SECURITY] [DLA 484-1] graphicsmagick security update

Version : 1.3.16-1.1+deb7u1 CVE ID : CVE-2015-8808 CVE-2016-2317 CVE-2016-2318 CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717 CVE-2016-3718 Debian Bug : 814732 Several security vulnerabilities were discovered in graphicsmagick a tool to manipulate image files. GraphicsMagick is a fork of...

[SECURITY] [DLA 483-1] expat security update

Package : expat Version : 2.1.0-1+deb7u3 CVE ID : CVE-2016-0718 Gustavo Grieco discovered that Expat, a XML parsing C library, does not properly handle certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. A remote attacker can take...

[SECURITY] [DSA 3584-1] librsvg security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3584-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 19, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3584-1] librsvg security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3584-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 19, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 482-1] libgd2 security update

Package : libgd2 Version : 2.0.36rc1dfsg-6.1+deb7u3 CVE ID : CVE-2015-8874 Debian Bug : 824627 It was discovered that there was a stack consumption vulnerability in the libgd2 graphics library which allowed remote attackers to cause a denial of service via a crafted imagefilltoborder call. For...

[SECURITY] [DSA 3583-1] swift-plugin-s3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3583-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 18, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 472-2] icedove regression update

Package : icedove Version : 31.8.0-1deb7u1.1 CVE ID : CVE-2016-1979 CVE-2016-2805 CVE-2016-2807 Debian Bug : 823430 The security update for icedove did not build on armhf. This is resolved by this upload. The text of the original DLA follows: Multiple security issues have been found in Icedove,...

[SECURITY] [DLA 481-1] phpmyadmin security update

Package : phpmyadmin Version : 4:3.4.11.1-2+deb7u3 CVE ID : CVE-2016-1927 CVE-2016-2038 CVE-2016-2039 CVE-2016-2040 CVE-2016-2041 CVE-2016-2045 CVE-2016-2560 This security update fixes a number of security issues in phpMyAdmin. We recommend you upgrade your phpmyadmin packages. CVE-2016-1927...

[SECURITY] [DLA 480-1] nss security update

Package : nss Version : 3.14.5-1+deb7u6 CVE ID : CVE-2015-7181 CVE-2015-7182 CVE-2016-1938 CVE-2016-1950 CVE-2016-1978 CVE-2016-1979 This security update fixes serious security issues in NSS including arbitrary code execution and remote denial service attacks. For Debian 7 "wheezy", these problem...

[SECURITY] [DSA 3582-1] expat security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3582-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 18, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3582-1] expat security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3582-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 18, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 479-1] xen security update

Package : xen Version : 4.1.6.1-1+deb7u1 CVE ID : CVE-2015-2752 CVE-2015-2756 CVE-2015-5165 CVE-2015-5307 CVE-2015-7969 CVE-2015-7970 CVE-2015-7971 CVE-2015-7972 CVE-2015-8104 CVE-2015-8339 CVE-2015-8340 CVE-2015-8550 CVE-2015-8554 CVE-2015-8555 CVE-2015-8615 CVE-2016-1570 CVE-2016-1571...

[SECURITY] [DLA 477-1] librsvg security update

Package : librsvg Version : 2.36.1-2+deb7u2 CVE ID : CVE-2015-7558 CVE-2016-4347 CVE-2016-4348 Note CVE-2016-4347 is a duplicate of CVE-2015-7558 Two DoS in librsvg 2.40.2 parsing SVGs with circular definitions were found they will produce stack exhaustion by Gustavo Grieco. The version in wheezy...

[SECURITY] [DLA 476-1] libidn security update

Package : libidn Version : 1.25-2+deb7u1 CVE ID : CVE-2015-2059 It was discovered that libidn, the GNU library for Internationalized Domain Names IDNs, did not correctly handle invalid UTF-8 input, causing an out-of-bounds read. This could allow attackers to disclose sensitive information from an...

[SECURITY] [DSA 3581-1] libndp security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3581-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 17, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3581-1] libndp security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3581-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 17, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3580-1] imagemagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3580-1 [email protected] https://www.debian.org/security/ Luciano Bello May 16, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3580-1] imagemagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3580-1 [email protected] https://www.debian.org/security/ Luciano Bello May 16, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 478-1] squid3 security update

Package : squid3 Version : 3.1.20-2.2+deb7u5 CVE ID : CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054 CVE-2016-4554 CVE-2016-4555 CVE-2016-4556 Debian Bug : 823968 Several security issues have been discovered in the Squid caching proxy. CVE-2016-4051 CESG and Yuriy M. Kaminskiy discovered...

[SECURITY] [DSA 3579-1] xerces-c security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3579-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 16, 2016 https://www.debian.org/security/faq -...