[SECURITY] [DSA 3579-1] xerces-c security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3579-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 16, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 475-1] python-tornado security update

Package : python-tornado Version : 2.3-2+deb7u1 CVE ID : CVE-2014-9720 It was discovered that python-tornado, a Python web framework and asynchronous networking library, was susceptible for the BREACH attack. The XSRF token is now encoded with a random mask on each request. This makes it safe to...

[SECURITY] [DLA 474-1] dosfstools security update

Package : dosfstools Version : 3.0.13-1+deb7u1 CVE IDs : CVE-2015-8872 CVE-2016-4804 It was discovered that there was an invalid memory and heap overflow vulnerability in dosfstools, a collection of utilities for making and checking MS-DOS FAT filesystems. For Debian 7 "Wheezy", this issue has be...

[SECURITY] [DLA 473-1] wpa security update

Package : wpa Version : 1.0-3+deb7u4 CVE ID : CVE-2016-4476 CVE-2016-4477 Debian Bug : 823411 A vulnerability was found in how hostapd and wpasupplicant writes the configuration file update for the WPA/WPA2 passphrase parameter. If this parameter has been updated to include control characters...

[SECURITY] [DSA 3578-1] libidn security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3578-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini May 14, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3577-1] jansson security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3577-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini May 14, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 472-1] icedove security update

Package : icedove Version : 38.8.0-1deb7u1 CVE ID : CVE-2016-1979 CVE-2016-2805 CVE-2016-2807 Multiple security issues have been found in Icedove, Debians version of the Mozilla Thunderbird mail client. Multiple memory safety errors may lead to the execution of arbitrary code or denial of service...

[SECURITY] [DSA 3576-1] icedove security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3576-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 13, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 471-1] jansson security update

Package : jansson Version : 2.3.1-2+deb7u1 CVE ID : CVE-2016-4425 Debian Bug : 823238 Applications that depend on Jansson, a C library for encoding, decoding and manipulating JSON data, could crash due to stack exhaustion while parsing a JSON file. This was caused due to an unlimited parsing dept...

[SECURITY] [DLA 470-1] libksba security update

Package : libksba Version : 1.2.0-2+deb7u2 CVE ID : CVE-2016-4579 It was discovered that there was a possible read access beyond a buffer vulnerability in libksba, a X.509 and CMS certificate support library. The returned length of the object from ksbaberparsetl ti.length was not always checked...

[SECURITY] [DSA 3575-1] libxstream-java security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3575-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 12, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 468-1] libuser security update

Package : libuser Version : 1:0.56.9.dfsg.1-1.2+deb7u1 CVE ID : CVE-2015-3245 CVE-2015-3246 Debian Bug : 793465 Two security vulnerabilities were discovered in libuser, a library that implements a standardized interface for manipulating and administering user and group accounts, that could lead t...

[SECURITY] [DLA 469-1] libgwenhywfar security update

Package : libgwenhywfar Version : 4.3.3-1+deb7u1 CVE ID : CVE-2015-7542 Debian Bug : 748955 It was discovered that libgwenhywfar an OS abstraction layer that allows porting of software to different operating systems like Linux, BSD, Windows etc. used an outdated CA certificate bundle. For Debian ...

[SECURITY] [DLA 467-1] xerces-c security update

Package : xerces-c Version : 3.1.1-3+deb7u3 CVE ID : CVE-2016-2099 Debian Bug : 823863 XMLReader class can raise an exception if an invalid character is encountered, and the exception crosses stack frames in an unsafe way that causes a higher level exception handler to access an already-freed...

[SECURITY] [DLA 466-1] ocaml security update

Package : ocaml Version : 3.12.1-4+deb7u1 CVE ID : CVE-2015-8869 OCaml versions 4.02.3 and earlier have a runtime bug that, on 64-bit platforms, causes sizes arguments to an internal memmove call to be sign-extended from 32 to 64-bits before being passed to the memmove function. This leads...

[SECURITY] [DSA 3565-2] monotone ovito pdns qtcreator softhsm regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3565-2 [email protected] https://www.debian.org/security/ Sebastien Delafond May 11, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3565-2] monotone ovito pdns qtcreator softhsm regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3565-2 [email protected] https://www.debian.org/security/ Sebastien Delafond May 11, 2016 https://www.debian.org/security/faq -...

[BSA-110] Security Update for wordpress

Craig Small [email protected] uploaded new packages for wordpress which fixed the following securty problems: CVE-2016-4566 Reflected XSS in PLupload and mediaelement For the jessie-backports distribution the problems have been fixed in version 4.5.2+dfsg-1bpo8+1 Craig Small @smallsees...

[SECURITY] [DLA 465-1] debian-security-support update

Package : debian-security-support Version : 2016.05.09+nmu1deb7u1 It is not feasible to fully support some Debian packages through the releases life cycle. The debian-security-support package provides the check-support-status tool that helps to warn the administrator about installed packages whos...

[SECURITY] [DSA 3574-1] libarchive security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3574-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 10, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3574-1] libarchive security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3574-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 10, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 449-2] botan1.10 regression update

Package : botan1.10 Version : 1.10.5-1+deb7u1 Debian Bug : 823297 The security update for botan1.10 caused a regression in monotone due to a ABI change. In order to fix this issue all reverse-dependencies of botan1.10 have been rebuilt. For Debian 7 "Wheezy", these problems have been fixed in...

[SECURITY] [DLA 464-1] libav security update

Package : libav Version : 6:0.8.17-2+deb7u1 CVE ID : CVE-2014-9676 It was discovered that there was a use-after free vulnerability in libav, a multimedia player, server, encoder and transcoder library. The segwritepacket function in libavformat/segment.c in ffmpeg 2.1.4 and earlier does not free...

[SECURITY] [DLA 463-1] ikiwiki security update

Package : ikiwiki Version : 3.20120629.2+deb7u1 CVE ID : CVE-2016-4561 Simon McVittie discovered a cross-site scripting vulnerability in the error reporting of Ikiwiki, a wiki compiler. This update also hardens ikiwikis use of imagemagick in the img plugin. For Debian 7 "Wheezy", this problem has...

[SECURITY] [DSA 3573-1] qemu security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3573-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 09, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3573-1] qemu security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3573-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 09, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 462-1] websvn security update

Package : websvn Version : 2.3.3-1.1+deb7u3 CVE ID : CVE-2016-1236 Nitin Venkatesh discovered that websvn, a web viewer for Subversion repositories, is susceptible to cross-site scripting attacks via specially crafted file and directory names in repositories...

[SECURITY] [DSA 3572-1] websvn security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3572-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 09, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3572-1] websvn security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3572-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 09, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3571-1] ikiwiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3571-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 08, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 461-1] nagios3 security update

Package : nagios3 Version : 3.4.1-3+deb7u2 CVE ID : CVE-2014-1878 A stack-based buffer overflow in the cmdsubmitf function in cgi/cmd.c in Nagios, a monitoring and management system for hosts, services and networks, allowed remote attackers to cause a denial of service segmentation fault via a lo...

[SECURITY] [DLA 460-1] file security update

Package : file Version : 5.11-2+deb7u9 CVE ID : CVE-2015-8865 A malformed magic file could trigger a segmentation fault and thus crash applications due to a buffer over-write in the filecheckmem function. For Debian 7 "Wheezy", this problem has been fixed in version 5.11-2+deb7u9. We recommend th...

[SECURITY] [DLA 459-1] mercurial security update

Package : mercurial Version : 2.2.2-4+deb7u3 CVE ID : CVE-2016-3105 Blake Burkhart discovered an arbitrary code execution flaw in Mercurial, a distributed version control system, when using the convert extension on Git repositories with specially crafted names. This flaw in particular affects...

[SECURITY] [DSA 3570-1] mercurial security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3570-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 05, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3570-1] mercurial security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3570-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 05, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 458-1] mplayer2 security update

Package : mplayer2 Version : 2.0-554-gf63dbad-1+deb7u1 CVE ID : CVE-2016-4352 Mplayer2 is crashing when playing a fuzzed gif file. The gif demuxes assumes in many places that widthheight is = INTMAX; this might not be true. Fixed by validating the picture size...

[SECURITY] [DSA 3569-1] openafs security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3569-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 05, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3569-1] openafs security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3569-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 05, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3568-1] libtasn1-6 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3568-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 05, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3568-1] libtasn1-6 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3568-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 05, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 457-1] mplayer security update

Package : mplayer Version : 2:1.0rc4.dfsg1+svn34540-1+deb7u2 CVE ID : CVE-2016-4352 Mplayer is crashing when playing a fuzzed gif file. The gif demuxes assumes in many places that widthheight is = INTMAX; this might not be true. Fixed by validating the picture size...

[SECURITY] [DSA 3567-1] libpam-sshauth security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3567-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 04, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3567-1] libpam-sshauth security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3567-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 04, 2016 https://www.debian.org/security/faq -...

[SECURITY] default-java switch to OpenJDK 7 and java-common update

Package : java-common Version : 0.47+deb7u1 In preparation for the upcoming default-java switch to OpenJDK 7 on 26 June 2016, the java-common package was updated to inform users about the intended change. The news will be automatically shown, if apt-listchanges has been installed on the system...

[SECURITY] default-java switch to OpenJDK 7 and java-common update

Package : java-common Version : 0.47+deb7u1 In preparation for the upcoming default-java switch to OpenJDK 7 on 26 June 2016, the java-common package was updated to inform users about the intended change. The news will be automatically shown, if apt-listchanges has been installed on the system...

[SECURITY] [DLA 456-1] openssl security update

Package : openssl Version : 1.0.1e-2+deb7u21 CVE ID : CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2108 CVE-2016-2109 CVE-2016-2176 Several vulnerabilities were discovered in OpenSSL, a Secure Socket Layer toolkit. CVE-2016-2105 Guido Vranken discovered that an overflow can occur in the...

[SECURITY] [DLA 455-1] asterisk security update

Package : asterisk Version : 1:1.8.13.1dfsg1-3+deb7u4 CVE ID : CVE-2014-2286 CVE-2014-4046 CVE-2014-6610 CVE-2014-8412 CVE-2014-8418 CVE-2015-3008 Debian Bug : 741313 762164 771463 782411 CVE-2014-6610 Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6...

[SECURITY] [DLA 454-1] minissdpd security update

Package : minissdpd Version : 1.1.20120121-1+deb7u1 CVE ID : CVE-2016-3178 CVE-2016-3179 The minissdpd daemon contains a improper validation of array index vulnerability CWE-129 when processing requests sent to the Unix socket at /var/run/minissdpd.sock the Unix socket can be accessed by an...

[SECURITY] [DLA 453-1] extplorer security update

Package : extplorer Version : 2.1.0b6+dfsg.3-4+deb7u2 CVE ID : CVE-2015-0896 Debian Bug : 783231 Multiple cross-site scripting XSS vulnerabilities in eXtplorer before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

[SECURITY] [DSA 3566-1] openssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3566-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini May 03, 2016 https://www.debian.org/security/faq -...