[SECURITY] [DSA 3454-1] virtualbox security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3454-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 27, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 403-1] radicale security update

Package : radicale Version : 0.3-2+deb6u1 CVE ID : CVE-2015-8747 CVE-2015-8748 Debian Bug : 809920 Several issues have been discovered by Unrud in Radicale, a calendar and addressbook server. A remote attacker could exploit these vulnerabilities and call arbitrary functions by sending crafted HTT...

[SECURITY] [DLA 402-1] tiff security update

Package : tiff Version : 3.9.4-5+squeeze13 CVE ID : CVE-2015-8665 CVE-2015-8683 Debian Bug : 809021 808968 Two security flaws have been found and solved in libtiff, library that provides support for handling Tag Image File Format TIFF. These flaws concern out of bounds reads in the TIFFRGBAImage...

[SECURITY] [DSA 3453-1] mariadb-10.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3453-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 25, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3453-1] mariadb-10.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3453-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 25, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 401-1] imlib2 security update

Package : imlib2 Version : 1.4.2-8+deb6u1 CVE ID : CVE-2014-9762 CVE-2014-9763 CVE-2014-9764 CVE-2014-9762 GIF loader: Fix segv on images without colormap CVE-2014-9763 Prevent division-by-zero crashes CVE-2014-9764 Fix segfault when opening input/queue/id:000007,src:000000,op:flip1,pos:51 with f...

[SECURITY] [DLA 400-1] pound security update

Package : pound Version : 2.6-1+deb6u1 CVE ID : CVE-2009-3555 CVE-2011-3389 CVE-2012-4929 CVE-2014-3566 This update fixes certain known vulnerabilities in pound in squeeze-lts by backporting the version in wheezy. CVE-2009-3555 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as...

[SECURITY] [DLA 399-1] foomatic-filters security update

Package : foomatic-filters Version : 4.0.5-6+squeeze2+deb6u13 CVE ID : not yet assigned cups-filters contains multiple buffer overflows caused by lack of size checks when copying from environment variables to local buffers strcpy as well on string concatenation operations strcat...

[SECURITY] [DLA 398-1] privoxy security update

Package : privoxy Version : 3.0.16-1+deb6u1 CVE ID : CVE-2016-1982 CVE-2016-1983 CVE-2016-1982 Prevent invalid reads in case of corrupt chunk-encoded content CVE-2016-1983 Remove empty Host headers in client requests; resulting in invalid reads...

[SECURITY] [DSA 3452-1] claws-mail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3452-1 [email protected] https://www.debian.org/security/ Ben Hutchings January 23, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3452-1] claws-mail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3452-1 [email protected] https://www.debian.org/security/ Ben Hutchings January 23, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3451-1] fuse security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3451-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez January 20, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 397-1] ecryptfs-utils security update

Package : ecryptfs-utils Version : 83-4+squeeze2 CVE ID : CVE-2016-1572 Jann Horn discovered that the setuid-root mount.ecryptfsprivate helper in the ecryptfs-utils would mount over any target directory that the user owns, including a directory in procfs. A local attacker could use this flaw to...

[SECURITY] [DSA 3450-1] ecryptfs-utils security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3450-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 20, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3450-1] ecryptfs-utils security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3450-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 20, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 396-1] bind9 security update

Package : bind9 Version : 1:9.7.3.dfsg-1squeeze19 CVE ID : CVE-2015-8704 It was discovered that specific APL RR data could trigger an INSIST failure in apl42.c and cause the BIND DNS server to exit, leading to a denial-of-service...

[SECURITY] [DLA 395-1] librsvg security update

Package : librsvg Version : 2.26.3-1+deb6u3 CVE ID : CVE-2015-7557 A vulnerability was found in LibRSVG, a library to render SVG graphics. Librsvg was susceptible to an out-of-bounds heap read when parsing SVG files. For Debian 6 "Squeeze", this issue has been fixed in librsvg version...

[SECURITY] [DSA 3449-1] bind9 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3449-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 19, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3449-1] bind9 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3449-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 19, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3448-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3448-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 19, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3448-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3448-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 19, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 385-2] isc-dhcp regression update

Package : isc-dhcp Version : 4.1.1-P1-15+squeeze10 CVE ID : CVE-2015-8605 Debian Bug : 810875 With the previous upload of the isc-dhcp package to Debian Squeeze LTS two issues got introduced into LTS that are resolved by this upload. 1 CVE-2015-8605 had only been resolved for the LDAP variant of...

[SECURITY] [DLA 394-1] passenger security update

Package : passenger Version : 2.2.11debian-2+deb6u1 CVE ID : CVE-2015-7519 agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof heade...

[SECURITY] [DLA 393-1] srtp security update

Package : srtp Version : 1.4.4dfsg-6+deb6u2 CVE ID : CVE-2015-6360 Prevent potential DoS attack due to lack of bounds checking on RTP header CSRC count and extension header length. Credit goes to Randell Jesup and the Firefox team for reporting this issue. As there is no aead mode available in th...

[SECURITY] [DLA 392-1] roundcube security update

Package : roundcube Version : 0.3.1-6+deb6u1 CVE ID : CVE-2015-8770 High-Tech Bridge Security Research Lab discovered a path traversal vulnerability in a popular webmail client Roundcube. Vulnerability can be exploited to gain access to sensitive information and under certain circumstances to...

[SECURITY] [DSA 3447-1] tomcat7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3447-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 17, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3447-1] tomcat7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3447-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 17, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 391-1] prosody security update

Package : prosody Version : 0.7.0-1squeeze1+deb6u1 CVE ID : CVE-2016-1232 It was discovered that in prosody, a Lightweight Jabber/XMPP server, used a weak PRNG in the moddialback module. For Debian 6 Squeeze, this issue has been fixed in prosody version 0.7.0-1squeeze1+deb6u1. Regards, - -- ,. : ...

[SECURITY] [DLA 390-1] dbconfig-common security update

Package : dbconfig-common Version : 1.8.46+squeeze.1 CVE ID : NA Debian Bug : 805638 It was discovered that dbconfig-common could, depending on the local umask, make PostgreSQL database backups that were readable by other users than the database owner. The issue is fixed in version...

[SECURITY] [DLA 389-1] giflib security update

Package : giflib Version : 4.1.6-9+deb6u1 CVE ID : CVE-2015-7555 Debian Bug : 808704 It was discovered that a maliciously crafted GIF can crash the giffix utility which is part of giflib-tools. We recommend that you upgrade your giflib-tools package to version 4.1.6-9+deb6u1 Debian squeeze LTS...

[SECURITY] [DLA 388-1] dwarfutils security update

Package : dwarfutils Version : 20100214-1+deb6u1 CVE ID : CVE-2015-8750 It was discovered that there was a NULL deference in dwarfutils, a tool to dump DWARF debug information from ELF objects. For Debian 6 Squeeze, this issue has been fixed in dwarfutils version 20100214-1+deb6u1. Regards, - -- ...

[SECURITY] [DLA 385-1] isc-dhcp security update

Package : isc-dhcp Version : 4.1.1-P1-15+squeeze9 CVE ID : CVE-2015-8605 Debian Bug : 810875 It was discovered that a maliciously crafted packet can crash any of the isc-dhcp applications. This includes the DHCP client, relay, and server application. Only IPv4 setups are affected. We recommend th...

[SECURITY] [DSA 3431-2] ganeti regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3431-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 14, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3431-2] ganeti regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3431-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 14, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 387-1] openssh security update

Package : openssh Version : 5.5p1-6+squeeze8 CVE ID : CVE-2016-0777 CVE-2016-0778 Debian Bug : 810984 The Qualys Security team discovered two vulnerabilities in the roaming code of the OpenSSH client an implementation of the SSH protocol suite. SSH roaming enables a client, in case an SSH...

[SECURITY] [DSA 3446-1] openssh security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3446-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez January 14, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 386-1] cacti security update

Package : cacti Version : 0.8.7g-1+squeeze9+deb6u14 CVE ID : CVE-2015-8604 It was discovered that there was another SQL injection vulnerability in cacti, a web interface for graphing monitoring systems. For Debian 6 Squeeze, this issue has been fixed in cacti version 0.8.7g-1+squeeze9+deb6u14...

[SECURITY] [DSA 3445-1] pygments security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3445-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 13, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3445-1] pygments security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3445-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 13, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3444-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3444-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 13, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3444-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3444-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 13, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 384-1] inspircd security and regression update

Package : inspircd Version : 1.1.22+dfsg-4+squeeze3 CVE ID : CVE-2015-8702 Debian Bug : 668253 It was discovered that InspIRCd did not validate the names in DNS responses before using them in inter-server communication. A remote attacker controlling the reverse DNS server...

[SECURITY] [DSA 3443-1] libpng security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3443-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 13, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3443-1] libpng security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3443-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 13, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3442-1] isc-dhcp security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3442-1 [email protected] https://www.debian.org/security/ Michael Gilbert January 13, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3442-1] isc-dhcp security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3442-1 [email protected] https://www.debian.org/security/ Michael Gilbert January 13, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DLA 383-1] claws-mail security update

Package : claws-mail Version : 3.7.6-4+squeeze2 CVE ID : CVE-2015-8614 CVE-2015-8708 "DrWhax" of the Tails project reported that Claws Mail is missing range checks in some text conversion functions. A remote attacker could exploit this to run arbitrary code under the account...

[SECURITY] [DSA 3441-1] perl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3441-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 11, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3441-1] perl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3441-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 11, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3440-1] sudo security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3440-1 [email protected] https://www.debian.org/security/ Ben Hutchings January 11, 2016 https://www.debian.org/security/faq -...