[SECURITY] [DSA 3036-1] mediawiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3036-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst September 26, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 63-1] bash security update

Package : bash Version : 4.1-3+deb6u2 CVE ID : CVE-2014-7169 Debian Bug : 762760 762761 Tavis Ormandy discovered that the patch applied to fix CVE-2014-6271 released in DSA-3032-1 for bash, the GNU Bourne-Again Shell, was incomplete and could still allow some characters to be injected into anothe...

[SECURITY] [DSA 3035-1] bash security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3035-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 25, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3035-1] bash security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3035-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 25, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 62-1] nss security update

Package : nss Version : 3.12.8-1+squeeze9 CVE ID : CVE-2014-1568 Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS the Mozilla Network Security Service library was parsing ASN.1 data used in signatures, making it vulnerable to a signature forgery attack. An attacker could craf...

[SECURITY] [DSA 3034-1] iceweasel security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3034-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez September 25, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3033-1] nss security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3033-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez September 25, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 61-1] libplack-perl security update

Package : libplack-perl Version : 0.9941-1+deb6u1 CVE ID : CVE-2014-5269 Apply fix for CVE-2014-5269: Plack::App::File would previously strip trailing slashes off provided paths. This could under specific circumstances lead to the unintended delivery of files. For details see...

[SECURITY] [DLA 60-1] icinga security update

Package : icinga Version : 1.0.2-2+squeeze2 CVE ID : CVE-2013-7108 CVE-2014-1878 Two fixes for the Classic UI: - fix off-by-one memory access in processcgivars CVE-2013-7108 - prevent possible buffer overflows in cmd.cgi CVE-2014-1878...

[SECURITY] [email protected]

Package : bash Version : 4.1-3+deb6u1 CVE ID : CVE-2014-6271 Stephane Chazelas discovered a vulnerability in bash, the GNU Bourne-Again Shell, related to how environment variables are processed. In many common configurations, this vulnerability is exploitable over the network, especially if bash...

[SECURITY] [email protected]

Package : bash Version : 4.1-3+deb6u1 CVE ID : CVE-2014-6271 Stephane Chazelas discovered a vulnerability in bash, the GNU Bourne-Again Shell, related to how environment variables are processed. In many common configurations, this vulnerability is exploitable over the network, especially if bash...

[SECURITY] [DSA 3032-1] bash security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3032-1 [email protected] http://www.debian.org/security/ Florian Weimer September 24, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 58-1] apt security update

Package : apt Version : 0.8.10.3+squeeze5 CVE ID : CVE-2014-6273 The Google Security Team discovered a buffer overflow vulnerability in the HTTP transport code in apt-get. An attacker able to man-in-the-middle a HTTP request to an apt repository can trigger the buffer overflow, leading to a crash...

[SECURITY] [DSA 3031-1] apt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3031-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 23, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3031-1] apt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3031-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 23, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3030-1] mantis security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3030-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff September 20, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3029-1] nginx security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3029-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 20, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3029-1] nginx security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3029-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 20, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3025-2] apt regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3025-2 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 18, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3025-2] apt regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3025-2 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 18, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3028-1] icedove security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3028-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff September 17, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3027-1] libav security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3027-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff September 17, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 57-1] libstruts1.2-java security update

Package : libstruts1.2-java Version : 1.2.9-4+deb6u1 CVE ID : CVE-2014-0114 It was discovered that missing access checks in the Struts ActionForm object could result in the execution of arbitrary code. This update fixes this problem...

[SECURITY] [DLA 56-1] wordpress security update

Package : wordpress Version : 3.6.1+dfsg-1deb6u5 CVE ID : CVE-2014-2053 CVE-2014-5204 CVE-2014-5205 CVE-2014-5240 CVE-2014-5265 CVE-2014-5266 Multiple security issues have been discovered in Wordpress, a web blogging tool, resulting in denial of service or information disclosure. More information...

[SECURITY] [DLA 49-1] acpi-support security update

Package : acpi-support Version : 0.137-5+deb6u2 CVE ID : CVE-2014-0484 During a review for EDF, Raphael Geissert discovered that the acpi-support package did not properly handle data obtained from a users environment...

[SECURITY] [DLA 55-1] nginx security update

Package : nginx Version : 0.7.67-3+squeeze4 CVE ID : CVE-2014-3616 Antoine Delignat-Lavaud discovered that it was possible to reuse SSL sessions in unrelated contexts if a shared SSL session cache or the same TLS session ticket key was used for multiple "server" blocks...

[SECURITY] [DSA 3026-1] dbus security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3026-1 [email protected] http://www.debian.org/security/ Florian Weimer September 16, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 53-1] apt security update

Package : apt Version : 0.8.10.3+squeeze3 CVE ID : CVE-2014-0487 CVE-2014-0488 CVE-2014-0489 It was discovered that APT, the high level package manager, does not properly invalidate unauthenticated data CVE-2014-0488, performs incorrect verification of 304 replies CVE-2014-0487 and does not perfo...

[SECURITY] [DSA 3025-1] apt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3025-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 16, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3025-1] apt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3025-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 16, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 53-1] gnupg security update

Package : gnupg Version : 1.4.10-4+squeeze6 CVE ID : CVE-2014-5270 Genkin, Pipman and Tromer discovered a side-channel attack on Elgamal encryption subkeys CVE-2014-5270. In addition, this update hardens GnuPGs behaviour when treating keyserver responses; GnuPG now filters keyserver responses to...

[SECURITY] [DLA 52-1] ia32-libs security update

Package : ia32-libs, ia32-libs-gtk Version : 20140911 The ia32-libs and ia32-libs-gtk packages contain 32 bit versions of various libraries for use on 64 bit systems. This update rolls in all security fixes made to these libraries since the start of Squeeze LTS...

[SECURITY] [DSA 3023-1] bind9 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3023-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 11, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3023-1] bind9 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3023-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 11, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3024-1] gnupg security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3024-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst September 11, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 51-1] gnupg2 security update

Package : gnupg2 Version : 2.0.14-2+squeeze3 CVE ID : CVE-2014-4617 Debian Bug : 752498 Jean-Rene Reinhard, Olivier Levillain and Florian Maury reported that GnuPG, the GNU Privacy Guard, did not properly parse certain garbled compressed data packets. A remote attacker could use this flaw to moun...

[SECURITY] [DSA 3021-2] file regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3021-2 [email protected] http://www.debian.org/security/ Luciano Bello September 10, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3022-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3022-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez September 10, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 50-1] file security update

Package : file Version : 5.04-5+squeeze7 CVE ID : CVE-2014-3538 CVE-2014-3587 Debian Bug : - CVE-2014-3538 file does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service CPU consumption. CVE-2014-3587 Integer overflow in t...

[SECURITY] [DSA 3020-1] acpi-support security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3020-1 [email protected] http://www.debian.org/security/ Raphael Geissert September 10, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3021-1] file security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3021-1 [email protected] http://www.debian.org/security/ Luciano Bello September 09, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 48-1] bind9 security update

Package : bind9 Version : 9.7.3.dfsg-1squeeze12 CVE ID : CVE-2014-0591 Debian Bug : 735190 Fix denial of service attack when processing NSEC3-signed zone queries, fixed by not calling memcpy with overlapping ranges in bin/named/query.c. - patch backported from 9.8.6-P2 by Marc Deslauriers from th...

[SECURITY] [DLA 47-1] lua5.1 security update

Package : lua5.1 Version : 5.1.4-5+deb6u1 CVE ID : CVE-2014-5461 Fix stack overflow in vararg functions...

[SECURITY] [DLA-46-1] procmail update

Debian Security Advisory DLA-0023-1 https://wiki.debian.org/LTS Package : procmail Version : 3.22-19+deb6u1 CVE ID : CVE-2014-3618 Debian Bug : 704675 760443 Boris pi Piwinger and Tavis Ormandy reported a heap overflow vulnerability in procmails formail utility when processing specially-crafted...

[SECURITY] [DSA 3019-1] procmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3019-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 04, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3019-1] procmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3019-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 04, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 45-1] squid3 security update

Package : squid3 Version : 3.1.6-1.2+squeeze4 CVE ID : CVE-2014-3609 CVE-2014-3609: Denial of Service in Range header processing. Ignore Range headers with unidentifiable byte-range values. If squid is unable to determine the byte value for ranges, treat the header as invalid...

[SECURITY] [DLA 44-1] libwpd security update

Package : libwpd Version : 0.8.14-1+deb6u1 CVE ID : CVE-2012-2149 Fix arbitrary code execution by remote attackers via crafted Wordperfect .WPD documents...

[SECURITY] [DSA 3018-1] iceweasel security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3018-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff September 03, 2014 http://www.debian.org/security/faq -...

[DLA 43-1] eglibc security update

Package : eglibc Version : 2.11.3-4+deb6u1 CVE ID : CVE-2014-0475 CVE-2014-5119 CVE-2014-0475 Stephane Chazelas discovered that the GNU C library, glibc, processed ".." path segments in locale-related environment variables, possibly allowing attackers to circumvent intended restrictions, such as...