[SECURITY] [DSA 5632-1] composer security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5632-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond February 26, 2024 https://www.debian.org/security/faq - - Package: composer CVE ID : CVE-2024-24821 Debian Bug : 1063603 It was discovered that composer, a dependency manager for the PHP language, processed files in the local working directory. This could lead to local privilege escalation or malicious code execution. Due to a technical issue this email was not sent on 2024-02-26 like it should have. For the oldstable distribution (bullseye), this problem has been fixed in version 2.0.9-2+deb11u2. For the stable distribution (bookworm), this problem has been fixed in version 2.5.5-1+deb12u1. We recommend that you upgrade your composer packages. For the detailed security status of composer please refer to its security tracker page at: https://security-tracker.debian.org/tracker/composer Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmX0DyUACgkQEL6Jg/PV nWSBoggAmRdaBN8p7agJH0S2fvEJWuF+gFAAY4112EeOzbHwk/Bm6EuTY9VcGTtj HlW8X3t/H1+NW5xejcm1gEaXIE2HHIc1KTaG3ui/kKC2T3ybx0cmnqYWu/TJWmw+ nbaneBK74PkXukzFvjuYaOy7a6EgnpNcMhc0b2tc/IqIUOYiePKbg4lio8u6q5rP 5uFIJydeqI0IXja6H4N0ub/zOAn6I6C3ToKMa0WnfllmrMaj/JnBbgam3VrT06n6 3NoW6xZepdMDP3QofOVWWP5HshF/0CH1BGEcKS6AtAaIgARalFMgbP6SU8NDsgNF Q3UCiuR+sTjZc2YA0muIpmBGSPVyAw== =y4my -END PGP SIGNATURE-
[SECURITY] [DSA 5601-1] php-phpseclib3 security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5601-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond January 12, 2024 https://www.debian.org/security/faq - - Package: php-phpseclib3 CVE ID : CVE-2023-48795 Fabian Baeumer, Marcus Brinkmann and Joerg Schwenk discovered that the SSH protocol is prone to a prefix truncation attack, known as the "Terrapin attack". This attack allows a MITM attacker to effect a limited break of the integrity of the early encrypted SSH transport protocol by sending extra messages prior to the commencement of encryption, and deleting an equal number of consecutive messages immediately after encryption starts. Details can be found at https://terrapin-attack.com/ For the stable distribution (bookworm), this problem has been fixed in version 3.0.19-1+deb12u2. We recommend that you upgrade your php-phpseclib3 packages. For the detailed security status of php-phpseclib3 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/php-phpseclib3 Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmWg5QQACgkQEL6Jg/PV nWRUKwf/QGg/4t/cvkkj4MAEJs5GLxmT/UpIUdhEMjVtpVZk6k6m9K/OK3/3EXuT XYtNhIyByOiWpLt5kMBrG9I5tz6/ffErfiPYYJso7fWyAaWKopFp0qsYGe8FDq0a VSKo51b+SHPDtMxCxahTdkegaSCpjaEFiWZNd0/h4ZvS3ZNuOFQXcPor+mTIHqJT PkkpsMm9Qg7skmDrrlENLvDRgXn8HuJa0h2+vhNnSwfC/cTDKPICeOozB4qMWu4Q YzlMSKC/mLJIVlqmVufQndnHLYlKLexusiCCckn/B/irOS5FRrOkXqfPmOtgpC9e DLhP7y/CkMhwhR6Ty/oOR/62zhhZpg== =/Vah -END PGP SIGNATURE-
[SECURITY] [DSA 5600-1] php-phpseclib security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5600-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond January 12, 2024 https://www.debian.org/security/faq - - Package: php-phpseclib CVE ID : CVE-2023-48795 Fabian Baeumer, Marcus Brinkmann and Joerg Schwenk discovered that the SSH protocol is prone to a prefix truncation attack, known as the "Terrapin attack". This attack allows a MITM attacker to effect a limited break of the integrity of the early encrypted SSH transport protocol by sending extra messages prior to the commencement of encryption, and deleting an equal number of consecutive messages immediately after encryption starts. Details can be found at https://terrapin-attack.com/ For the oldstable distribution (bullseye), this problem has been fixed in version 2.0.30-2+deb11u1. For the stable distribution (bookworm), this problem has been fixed in version 2.0.42-1+deb12u1. We recommend that you upgrade your php-phpseclib packages. For the detailed security status of php-phpseclib please refer to its security tracker page at: https://security-tracker.debian.org/tracker/php-phpseclib Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmWg5P4ACgkQEL6Jg/PV nWTO8Qf+MjlqXFJ0p865PgV30sQmWeJmc8UiX/lOO9ayLUZ13Dj4z74H40XxAz0M rHDnpfs3hvtgTkdRkE+k2FvrMgau+EpN1eGwgrHURHN/Kdz9Z6YLQX/T8LZq97SZ VVu/X/+xkiZng0J+UXZx5BWQFf/vGz5vLiPA3JUSgS3KjwOYiZKIaSf+/7SF48he QTucpa7nC/7ew4dgLLNTa9PQWK8C616cJ6iZZaowi8k3QmUQGkyhuXS0EUHHRkxq EEf7HccwpwYbPAAkh5cIckEoXEC2gUkl2UmpzCFNdJl/xqz02xOfcgoDxM/1bYy2 Bn3cNLe681fmEd7ShPdNTYtqz6YvwQ== =ZVcV -END PGP SIGNATURE-
[SECURITY] [DSA 5599-1] phpseclib security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5599-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond January 12, 2024 https://www.debian.org/security/faq - - Package: phpseclib CVE ID : CVE-2023-48795 Fabian Baeumer, Marcus Brinkmann and Joerg Schwenk discovered that the SSH protocol is prone to a prefix truncation attack, known as the "Terrapin attack". This attack allows a MITM attacker to effect a limited break of the integrity of the early encrypted SSH transport protocol by sending extra messages prior to the commencement of encryption, and deleting an equal number of consecutive messages immediately after encryption starts. Details can be found at https://terrapin-attack.com/ For the oldstable distribution (bullseye), this problem has been fixed in version 1.0.19-3+deb11u1. For the stable distribution (bookworm), this problem has been fixed in version 1.0.20-1+deb12u1. We recommend that you upgrade your phpseclib packages. For the detailed security status of phpseclib please refer to its security tracker page at: https://security-tracker.debian.org/tracker/phpseclib Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmWg5PMACgkQEL6Jg/PV nWS6iwgAgCFsThzoeNHG05PouaajhL6LvGsrj+cwed14VEnr0TGpChD6y2Z/deZX HW86VXSHRZvqNTt7+UQvKUwrmvbNRZL3TQoTp9l+VKtn3wT/0Q6Zf1jsn4G+yffX dredHf2pXgJh9poEy2DUTunVF+vpZdp9fS2QY8xp24kNbk8kk6itJeOGueWoFwrZ p1B5q2hnQdFtM8mhbXDzViqbiu6zVZOmSXri1jShAKRDl0kpRQvfP1mKE+j5RMoJ kBGFGuWnIXvxtwQEYDvobgKk5Ie0yzwqnD6m3WXMeS9x4Zi+HvV3hXvEu0UvvQXC 1z8VX31cFffkLLDFpO3cE9dQlyABBA== =Rz3N -END PGP SIGNATURE-
[SECURITY] [DSA 5572-1] roundcube security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5572-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond December 04, 2023 https://www.debian.org/security/faq - - Package: roundcube CVE ID : CVE-2023-47272 Debian Bug : 1055421 Rene Rehme discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, did not properly set headers when handling attachments. This would allow an attacker to load arbitrary JavaScript code. For the oldstable distribution (bullseye), this problem has been fixed in version 1.4.15+dfsg.1-1~deb11u2. For the stable distribution (bookworm), this problem has been fixed in version 1.6.5+dfsg-1~deb12u1. We recommend that you upgrade your roundcube packages. For the detailed security status of roundcube please refer to its security tracker page at: https://security-tracker.debian.org/tracker/roundcube Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmVtkOQACgkQEL6Jg/PV nWTxhQgAimG1yVgg/Ic84EQIqpB014hb/ev5RzapM+xJ5Dwwb1Xs7HMNsvqYBBeX LNIbXgNKkSGF38k3MP2A9aBwyKMV256SVEtKUkiAzCQhX3xsUB5EkpNMXv0GRs9k sjjj/ATwChVVlz5OusTtuDpog44RYGH8CXJTuAVemK2GusdgkrsMu1EvGr7JhtMv jiFW5uYFjI+ADp5KcoIl3AtLCdYhDHz/p687Ze1vJQ0v18jiS2mUMvF7zd8SmwA4 uLPAcLIJ+KCyd8A+LYzyWbHVxbxIqMxmuAjQ7TrOH3oE5Be5jN9ShKJv1pj50P2i 5/g4H+e5fQ6gQm8oF1CMVJubS1NpIg== =KGev -END PGP SIGNATURE-
[SECURITY] [DSA 5531-1] roundcube security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5531-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond October 23, 2023 https://www.debian.org/security/faq - - Package: roundcube CVE ID : CVE-2023-5631 Debian Bug : 1054079 It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, did not properly sanitize HTML messages. This would allow an attacker to load arbitrary JavaScript code. For the oldstable distribution (bullseye), this problem has been fixed in version 1.4.15+dfsg.1-1~deb11u1. For the stable distribution (bookworm), this problem has been fixed in version 1.6.4+dfsg-1~deb12u1. We recommend that you upgrade your roundcube packages. For the detailed security status of roundcube please refer to its security tracker page at: https://security-tracker.debian.org/tracker/roundcube Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmU2FhEACgkQEL6Jg/PV nWTgbQf/T08r3SQ/NFUpzs1/8k+euPOyysNFnW7JZ1LcI+ug5iF8RrdEVVuURZHK 7i/SuRNomgEQbUyVpgSb9rb6z5qkc0k6gbfh2+KMRk0ViHhG1+tuEe1O99abXt+5 LUQNtXWVMAniWWdbtdQeCBHWgxMpstarWq4akgCnx1Dj7Tj8PyX05+bYFpR79WMq CKypX4lz1kP8U3U5c0tPDi/zjuzGT1IvVSyWPesaNHzmD4ZMr9A/dcDBtxQ+kTaP N3GVPJoDG9TVOcHQTqcb2MmTQY5FtvQswVCXiEsugbmgOQ4wiUYlV90C8s4ALSxB Biv+mOUCKZH/mNNjNeHKADW+nOkOeg== =TSzb -END PGP SIGNATURE-
[SECURITY] [DSA 5399-1] odoo security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5399-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond May 05, 2023 https://www.debian.org/security/faq - - Package: odoo CVE ID : CVE-2021-23166 CVE-2021-23176 CVE-2021-23178 CVE-2021-23186 CVE-2021-23203 CVE-2021-26263 CVE-2021-26947 CVE-2021-44476 CVE-2021-44775 CVE-2021-45071 CVE-2021-45111 Several vulnerabilities were discovered in odoo, a suite of web based open source business apps. CVE-2021-44775, CVE-2021-26947, CVE-2021-45071, CVE-2021-26263: XSS allowing remote attacker to inject arbitrary commands. CVE-2021-45111: Incorrect access control allowing authenticated remote user to create user accounts and access restricted data. CVE-2021-44476, CVE-2021-23166: Incorrect access control allowing authenticated remote administrator to access local files on the server. CVE-2021-23186: Incorrect access control allowing authenticated remote administrator to modify database contents of other tenants. CVE-2021-23178: Incorrect access control allowing authenticated remote user to use another user's payment method. CVE-2021-23176: Incorrect access control allowing authenticated remote user to access accounting information. CVE-2021-23203: Incorrect access control allowing authenticated remote user to access arbitrary documents via PDF exports. For the stable distribution (bullseye), these problems have been fixed in version 14.0.0+dfsg.2-7+deb11u1. We recommend that you upgrade your odoo packages. For the detailed security status of odoo please refer to its security tracker page at: https://security-tracker.debian.org/tracker/odoo Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmRU7kEACgkQEL6Jg/PV nWTQrAf+K6CpxmFeKM/7G70xafsw+lLu4UlaoLYUh55rgsFd9/YHUuwCHiCmoP1P 4GnVJkNu6qj8rW1EReUtKZ76XQTLsD9ZxgM6tFBGA9EDi0hPjR4KEI7jtdXjx9ro 8LOyu51xeqoraKTmkPw+EnUCWCjutH78l8y9ywqHORQI0WM9Q2Zh0fHJz1c+2uzd HqFvo1brOgu7zkI3luH8IjEHpCHpUVbe8rTnY0g2PSrZott/k0fIZ8qNSzyfG7ah R5auoI5y+z5TusByKWnQ48jQCbU8WeqXaQUqT/pGtjGz9ljClTwDkmqqv/6BNnyF Et5uV+Yn6UWsxXUcz6u9CwOzkrpVxA== =KDFV -END PGP SIGNATURE-
[SECURITY] [DSA 5367-1] spip security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5367-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond March 02, 2023https://www.debian.org/security/faq - - Package: spip CVE ID : CVE-2023-27372 It was discovered that SPIP, a website engine for publishing, would allow a malicious user to execute arbitrary code. For the stable distribution (bullseye), this problem has been fixed in version 3.2.11-3+deb11u7. We recommend that you upgrade your spip packages. For the detailed security status of spip please refer to its security tracker page at: https://security-tracker.debian.org/tracker/spip Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmQAP4QACgkQEL6Jg/PV nWSHawgAm8iQlTcFT98cMImGBx8XTO70YPcgzIMK87mvmQn3NR30/dM9icfBVVu3 l9Ks2mPa0yYIT0DTeXghTclf8hnJtOM2T4buRPD6po6ZyEgX5AlwN6xaZPAkYxiz +7GXiqYZAHAMShIZhhMr1CcIDsE093TC8dLdZFosSVtI7sylxTgbSlJl1xafhe6/ 6fhI2DcDr4ov7MrkfcjCT2BY9um/pH/L2lIKTDcHahgoxGf9wcurANtwHwHQsBNR 3R5nxScH/1wTI53am6rPCYFuLGlGEcY6c2HyJPR3j3o+sUFYca+4fGNbmwuS8fOh hOgz19DTow374IwJU1qnoZjvrbB58g== =CcjC -END PGP SIGNATURE-
[SECURITY] [DSA 5325-1] spip security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5325-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond January 24, 2023 https://www.debian.org/security/faq - - Package: spip It was discovered that SPIP, a website engine for publishing, would allow a malicious user to SQL injection attacks, or bypass authorization access. For the stable distribution (bullseye), this problem has been fixed in version 3.2.11-3+deb11u6. We recommend that you upgrade your spip packages. For the detailed security status of spip please refer to its security tracker page at: https://security-tracker.debian.org/tracker/spip Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmPPpdYACgkQEL6Jg/PV nWT7GQgAgemz9C/cvulSLwEuV38WAaZwy8RFC3CGw3DirFLf2tVeC6KDI+tGs/u4 XSY7M45xEr4y1TR3NMfovrnX6iR/JgPU/3ZJsFquq8O5Z9WCeZFe2YCkmuqP9hQv txXfOoL4c9b1hfgtv4nVcqLyCFFJhfqLiAy8Eb18vzuggjLVYKa1kioa8wAGk/YB B9rvoKNN1bBfow7A7704Gk2bJMfcxIC9P4anHm6u0OZ4HgC0GYpVYZXegfrFICs7 fylqgcg6Ub+HH+6e3wEDN1oqnj0IQDy09lFj4kCT5xQjhQM8oMZChExndWdmRRI2 iEmUN/gg7RVhdUfNvv8VTy1lo+wd4g== =XA3L -END PGP SIGNATURE-
[SECURITY] [DSA 5279-2] wordpress security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5279-2 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond November 17, 2022 https://www.debian.org/security/faq - - Package: wordpress Debian Bug : 1007005 1018863 1022575 1024249 The wordpress package released in DSA-5279-1 had incorrect dependencies that could not be satisfied in Debian stable: this update corrects the problem. For reference, the original advisory text is provided here again: Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform SQL injection, create open redirects, bypass authorization access, or perform Cross-Site Request Forgery (CSRF) or Cross-Site Scripting (XSS) attacks. For the stable distribution (bullseye), this problem has been fixed in version 5.7.8+dfsg1-0+deb11u2. We recommend that you upgrade your wordpress packages. For the detailed security status of wordpress please refer to its security tracker page at: https://security-tracker.debian.org/tracker/wordpress Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmN13KoACgkQEL6Jg/PV nWSnyggAvAS8Crzgp8xW8FvZ20pEz0uXm8oW+5sUR7U+c6vsUPXBa2yT+pLNyCGn Ss9ffvl+IVnfZEHK70PvK61thKS9yhtse0fy25HljMnsBBSzMtjZEwZOHGpERNRW Yf7Cm5ubIlKumKLodGh+Ecun01DRawfG/W4V+sBnDZWGdn9+B9K6q7vYLRDowshi sdJczvrRn2vr88V+LLzbgVDv3M1WcM+dbyEOOtxY29ELuHODgafZNIiMyjxpy3RI iZg5c2uS4RxojN61TxKpD2ewdSRrqAy51SspUSMZIV9l2hQkhMfOm/8x1MLAWVO0 v/PaS8NsyR1P454NCwhRRmNbJ5252w== =hTKc -END PGP SIGNATURE-
[SECURITY] [DSA 5279-1] wordpress security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5279-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond November 15, 2022 https://www.debian.org/security/faq - - Package: wordpress Debian Bug : 1007005 1018863 1022575 Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform SQL injection, create open redirects, bypass authorization access, or perform Cross-Site Request Forgery (CSRF) or Cross-Site Scripting (XSS) attacks. For the stable distribution (bullseye), this problem has been fixed in version 5.7.8+dfsg1-0+deb11u1. We recommend that you upgrade your wordpress packages. For the detailed security status of wordpress please refer to its security tracker page at: https://security-tracker.debian.org/tracker/wordpress Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmNzzVQACgkQEL6Jg/PV nWQM0wf/e4a7tlCxa11letnmRkSODUvOyq1/7DrzEX75Jne/PlhjeNPTgBSk5Wlz JlQ/enK93HDu7Sy4IrVHio24s48wZs9rP+Vo2z53K6bmEsDdIkBSRlJ1YuMlNIxm oaNKhNcy+JumXcS7u35ok7T7tIO1TBkpBZgIiEDg3MoeYN4v6E6mG6F7zTZ96Nyq wFRHwv3huca5ptmQq1tpofVuF1hlskwiGyFKlZ9SgcIibOqKz+sNjE0Ei//ZjEX5 vHnexoBk6Mf67veB8DktFCECXK65PDuXCvbSROr1cfVzI848sY6PwgYgFSvBf5vL F4ojg/qDFj08o5J978YeKHs0SX4bmg== =U6JF -END PGP SIGNATURE-
[SECURITY] [DSA 5246-1] php-twig security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5246-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond October 04, 2022 https://www.debian.org/security/faq - - Package: php-twig CVE ID : CVE-2022-39261 Debian Bug : 1020991 Marlon Starkloff discovered that twig, a template engine for PHP, did not correctly enforce sandboxing. This would allow a malicious user to execute arbitrary code. For the stable distribution (bullseye), this problem has been fixed in version 2.14.3-1+deb11u2. We recommend that you upgrade your php-twig packages. For the detailed security status of php-twig please refer to its security tracker page at: https://security-tracker.debian.org/tracker/php-twig Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmM9FmYACgkQEL6Jg/PV nWSFYwgAoCAOajgv28W7jI5bDu/XCf3h/kmFfniaes3oEQd8H26pIHOOjLm5F4hc w1c6soR6UyuxkkpiIMucgqcRXXzWEgWg6fLb2PHe7Msot8aiDdH/u/KQfCwhJtQI alGalArG5IG73A/wSAo8GcH/f04u5wM8lOn/p821k9n0e4/9DgMA225KWeNYSrZJ 1FG5Q5pVl4+BEsyz2OEvSjgc/XcNOimQAk4Xauajab6eTMGCGdAnz7Tak4CDg7Q/ oCvu1sA2l+MS7G3fBu+nrK05EmQ2kmv57WgVHsqCli25crTbC13Y/k558DeoXp04 ocIzEOC1Bj/D9tKW+VONeJLutOluIA== =ZL2h -END PGP SIGNATURE-
[SECURITY] [DSA 5152-1] spip security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5152-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond May 30, 2022 https://www.debian.org/security/faq - - Package: spip It was discovered that SPIP, a website engine for publishing, would allow a malicious user to perform cross-site scripting attacks. For the oldstable distribution (buster), this problem has been fixed in version 3.2.4-1+deb10u8. For the stable distribution (bullseye), this problem has been fixed in version 3.2.11-3+deb11u4. We recommend that you upgrade your spip packages. For the detailed security status of spip please refer to its security tracker page at: https://security-tracker.debian.org/tracker/spip Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmKUyKkACgkQEL6Jg/PV nWTbkgf+J37VfIWXY24URdU6ql2hCwQIEy7liMvtPk5Mu7tYdTR716q0tMZ2nglj NGFQg2mJjppcKYAMM8Z9JI/KFgAT9qI+U0gAdvlbx7wS8yuIoi9cptSPpctP5esB Xjq9Xj4lHc50CH7hVEhZZIhCMsa4frgC/QMBhopfVIzOlRBGX5MTjonYmkQKKplG JkBP3YhT5rRkWCcOFOjQoeH/995tDj/PssJeYPY/giyvOvgO1OKupfmHXalZdTko cptwCNXqN2vElcwY+1cTatTTQZZBqen22QViHTgqZNrdGg25iBKrOhW5t63810NX 0X1hWCaJJrY3PSL+BmQR6xJkgbngmQ== =IRRI -END PGP SIGNATURE-
[SECURITY] [DSA 5107-1] php-twig security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5107-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond March 24, 2022https://www.debian.org/security/faq - - Package: php-twig CVE ID : CVE-2022-23614 Marlon Starkloff discovered that twig, a template engine for PHP, did not correctly enforce sandboxing. This would allow a malicious user to execute arbitrary code. For the stable distribution (bullseye), this problem has been fixed in version 2.14.3-1+deb11u1. We recommend that you upgrade your php-twig packages. For the detailed security status of php-twig please refer to its security tracker page at: https://security-tracker.debian.org/tracker/php-twig Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmI8C+YACgkQEL6Jg/PV nWRKJwf/eM74S/zXlGgnwglxC0SVvCUJ9ECfSaar019cj0SxUmc3wQHIw9XRzRQj 6HYXlQTq5EiqyrZK4MGGOIfgnbHXzOhIYsEPf8LRZ4KObre6fugC7SrrDaT3Q0wt vDad/cPHIZZU6EOfDAIjj421lFxBQrq6N8ymxeTTEwRT3hXCGBj+L/V8nCcXdLye A3mq+Rgwzo/Thl9skjbGkx1mPOQNCCeCO6aypoEtz53MkhLVNIb2GTIZ1D7xHgX9 9SuS76HoZVeDz7MGfJLT+OQsIYy4WoqaNCeoImo1dDnhQPh86RWTUEdb4rlaQl4I qOstysTI81KlEFauCSddaryGi2limQ== =h+PK -END PGP SIGNATURE-
[SECURITY] [DSA 5093-1] spip security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5093-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond March 08, 2022https://www.debian.org/security/faq - - Package: spip It was discovered that SPIP, a website engine for publishing, would allow a malicious user to execute arbitrary code. For the oldstable distribution (buster), this problem has been fixed in version 3.2.4-1+deb10u7. For the stable distribution (bullseye), this problem has been fixed in version 3.2.11-3+deb11u3. We recommend that you upgrade your spip packages. For the detailed security status of spip please refer to its security tracker page at: https://security-tracker.debian.org/tracker/spip Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmIneEMACgkQEL6Jg/PV nWTmtwf/elvZeq4j7byfvYbUCBPgrtv6qJEmuqD6pYAd3F2siK5RH0mn9LRnzsp2 VpFlhbEHtC5YD73ulqaUQk4SRX2AXfmYDxvj3H1xxhK/wCPrE+UajMGYo2/d4Ig+ 2SUg1oeVqB3X6S5ePKmTafdTfMDTQmH7gOTW6f80ZhgbAbMz/832rGvjH7arYprW 8v0dokNWq37zo0TH6du+J30jrKGeoMuMHY0ACNr+4BlZLBcXYJPDvZsRv0tzLewK trP4t/FqSh/Dr2v0+6o/f3Gk7J/f1VOv1plOf2PGh5xz7GRRR6cFPhw12Hvli+hY A+rjnaDUUklXvQFWW45+T6uokfY8zQ== =k7Wq -END PGP SIGNATURE-
[SECURITY] [DSA 5078-1] zsh security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5078-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond February 16, 2022 https://www.debian.org/security/faq - - Package: zsh CVE ID : CVE-2021-45444 It was discovered that zsh, a powerful shell and scripting language, did not prevent recursive prompt expansion. This would allow an attacker to execute arbitrary commands into a user's shell, for instance by tricking a vcs_info user into checking out a git branch with a specially crafted name. For the oldstable distribution (buster), this problem has been fixed in version 5.7.1-1+deb10u1. For the stable distribution (bullseye), this problem has been fixed in version 5.8-6+deb11u1. We recommend that you upgrade your zsh packages. For the detailed security status of zsh please refer to its security tracker page at: https://security-tracker.debian.org/tracker/zsh Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmIM+lsACgkQEL6Jg/PV nWSdbwgAnFfNdi+FHSZ01O4ecnKII5d9/BAZWhEcbKTZY7Yz8h1JyKNoSkm46VG2 BuTdN6sGMtkcZ+0+DmQBfLvfaZ2Eelt6UaaHkwg21XyLabrd+xfEdG++bLg55rGg arUTN+mIRG+L+2UQXMSYoXPSubTPA/ZaR4BIyWQpK+xN+nyG0cm2WKE4OZl/ahnn zdqnhncaJ2l4L4Q4IttK3c1Zhqb/OwMFaad/C45gBb85doNFnImf9iZNa52Mt807 XIXcK+OYPQ82Au4reftBrjAiccGua0emkY2XI0X5Zhu/R/VNTB0MIz9PubOKMNNg SFwWrhmbuO0OY9jI51TvmFG43OHHSg== =mhTR -END PGP SIGNATURE-
[SECURITY] [DSA 5049-1] flatpak security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5049-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond January 20, 2022 https://www.debian.org/security/faq - - Package: flatpak CVE ID : CVE-2021-43860 CVE-2022-21682 Several vulnerabilities were discovered in Flatpak, an application deployment framework for desktop apps. CVE-2021-43860 Ryan Gonzalez discovered that Flatpak didn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime. Malicious apps could therefore grant themselves permissions without the consent of the user. CVE-2022-21682 Flatpak didn't always prevent a malicious flatpak-builder user from writing to the local filesystem. For the stable distribution (bullseye), these problems have been fixed in version 1.10.7-0+deb11u1. Please note that flatpak-builder also needed an update for compatibility, and is now at version 1.0.12-1+deb11u1 in bullseye. We recommend that you upgrade your flatpak and flatpak-builder packages. For the detailed security status of flatpak please refer to its security tracker page at: https://security-tracker.debian.org/tracker/flatpak Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmHpgJoACgkQEL6Jg/PV nWRyUQgAu1+LB+AIijfPxQvVTzAY2yjOGG1vycEOaPr2U1k5PA+zygYxvGDZzPqs 5cenbSA/aXacL4dwXlA7VJ+xgRi7ZgqEZN9qiO9cyt381RnIVTppkhpfJv0IEf0a MywZjPp4LzSHD8v8oTfJFcXbjbOr9zEPCh8Yn4zcLShEeQYzMLQLO5yJLcLWqbf5 OV9zWlLFhEdb8tZFVMzpHk1WZBv2/Bp5v7nQXBWuDfBZXmorzLkq5epNgjkvi0Lc uYGhJx620eALeCvimXlGc7O9yhvjMNfWf1niQ5hkBcii3uLpaCtcfBBYzg2jlbcl V3yYN2wjXy3SvLKK13ZONM0QQxjW9Q== =UXE7 -END PGP SIGNATURE-
[SECURITY] [DSA 5039-1] wordpress security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5039-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond January 11, 2022 https://www.debian.org/security/faq - - Package: wordpress CVE ID : CVE-2022-21661 CVE-2022-21662 CVE-2022-21663 CVE-2022-21664 Debian Bug : 1003243 Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform SQL injection, run unchecked SQL queries, bypass hardening, or perform Cross-Site Scripting (XSS) attacks. For the oldstable distribution (buster), these problems have been fixed in version 5.0.15+dfsg1-0+deb10u1. For the stable distribution (bullseye), these problems have been fixed in version 5.7.5+dfsg1-0+deb11u1. We recommend that you upgrade your wordpress packages. For the detailed security status of wordpress please refer to its security tracker page at: https://security-tracker.debian.org/tracker/wordpress Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmHdSCUACgkQEL6Jg/PV nWTjaAgAw5g913TqTXAvlzsCDGfFItlDFx/wGhAwyMdrHsapmXBQiUixjKuINAzh UaRgcH1DGvDu68QVupg9dtV8cvcIRocsofw9DMsjZdFjYakQULsooaff+IE8f0Oa PqQcQYo5c+3CYQ2gMFEeaS8QH8fMc5g/OrDfltEzqWjratk7pbOCTruASW5XO8+j Jf/qJ1buGdNJK7UskXLqoeQ0y2bMsXbDd5Hk6ktzw13WJbwT/0D26e/MK7y8F7ZH 4R6PFYnzwhHklxaU+sJwreWgVOiK/bsGONhtgWQcYYVsOEZGKO3IKiniSIuaydKf nYf5qUFDxoSGsj1YtFx2WWQVfi2Jhw== =whm3 -END PGP SIGNATURE-
[SECURITY] [DSA 5037-1] roundcube security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5037-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond January 08, 2022 https://www.debian.org/security/faq - - Package: roundcube CVE ID : CVE-2021-46144 Debian Bug : 1003027 It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, did not properly sanitize HTML messages. This would allow an attacker to perform Cross-Side Scripting (XSS) attacks. For the oldstable distribution (buster), this problem has been fixed in version 1.3.17+dfsg.1-1~deb10u2. For the stable distribution (bullseye), this problem has been fixed in version 1.4.13+dfsg.1-1~deb11u1. We recommend that you upgrade your roundcube packages. For the detailed security status of roundcube please refer to its security tracker page at: https://security-tracker.debian.org/tracker/roundcube Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmHZX6wACgkQEL6Jg/PV nWSYVQf9EFHhiq/2vslud8iQ2SqygR3IDJnqhgxlR4AVX/digxTcx1JZJPQ+RtYY bTvlwEQnOq7bHioQ+r3kcPzyH+VhC6e6F7gQVxtrkSPWl2vifaII+k0lRC3+nuJ8 8FEFF1k2dX0F6Q4IJIhiZaIYpHS1Jlu6BHjr9ZsHlY8ZqqENSZ8OCF02GtOVxWqi SEG5At8QTuOgRVUxjn+LDpDzasDug4Ogx7Yp3yqAOz90EmoX99FTmAfDf+HfnTEn ikXjjvC8efSCAnRRcax59pFCGOKnP35/o+DiT6eXFNrV0E5n5usO2wyzpkb1aiaN kMDkZHfYMZuTR6yeBGjiPaCf1S0PxQ== =uY/N -END PGP SIGNATURE-
[SECURITY] [DSA 5028-1] spip security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5028-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond December 22, 2021 https://www.debian.org/security/faq - - Package: spip It was discovered that SPIP, a website engine for publishing, would allow a malicious user to perform cross-site scripting and SQL injection attacks, or execute arbitrary code. For the oldstable distribution (buster), this problem has been fixed in version 3.2.4-1+deb10u5. For the stable distribution (bullseye), this problem has been fixed in version 3.2.11-3+deb11u1. We recommend that you upgrade your spip packages. For the detailed security status of spip please refer to its security tracker page at: https://security-tracker.debian.org/tracker/spip Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmHC17MACgkQEL6Jg/PV nWSTCgf+Nnp2PRp1FvvagyvH02s9aGygJnBFzD4NVvJCpiO9YnXnMm1F1U2LLQCA usXjnMFG5Y45+8FSQQVW3IeQzUVWlHUXmON+F2rT32+JByqNwlsUEjGwNYvgO+EB jYnPqGRgqgq48POx9Csp4rZW/e0/HX7YSrSqgPQnNQh+LJPlIuN6KkJoNwJZiM8/ ZiedEtvNfyUmWSgHXytnpcqsHbb4Nyyquqxr42DEL83cd4++3/nwNtRwHInJYL/2 Jk1GxuOoJr1ogQyepOdsDpmM0Vxeh6uZWIrPaBWWhraLvwQ0f8z7V/V2rU82tz0g R4WR2hk3968GnkNOaRqSDDwquDQtYg== =3W1N -END PGP SIGNATURE-
[SECURITY] [DSA 5013-1] roundcube security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5013-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond November 27, 2021 https://www.debian.org/security/faq - - Package: roundcube CVE ID : CVE-2021-44025 CVE-2021-44026 Debian Bug : 1000156 It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, did not properly sanitize requests and mail messages. This would allow an attacker to perform Cross-Side Scripting (XSS) or SQL injection attacks. For the oldstable distribution (buster), these problems have been fixed in version 1.3.17+dfsg.1-1~deb10u1. For the stable distribution (bullseye), these problems have been fixed in version 1.4.12+dfsg.1-1~deb11u1. We recommend that you upgrade your roundcube packages. For the detailed security status of roundcube please refer to its security tracker page at: https://security-tracker.debian.org/tracker/roundcube Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmGh/gYACgkQEL6Jg/PV nWSv2gf9FLo2Qe4coRsW42ZmZXKnzpxKUpZC1TwFe758FhUl/2906yP1f4rKi5Ut XE87aetT292vsM+STtlw87ZFbD1yQn2b4RfBF12+G84Qln5KGBlmjtfniU1vWafw YrN8ZoSG879IY35oxQcLZcBMZanhjNsqVAuJiGPg8cKi0Un17shn8znf4u4D2hD6 7WyVEnYhBP2xXjA+U+FVGh+SiTDrd482iSl4gq/cJH4ig11L/qaWdCW0BPZT/Ppc 0FrZxW2R4W+54R6WFbA1qftQfMHNACi9XUlJTIwOi/7VfD1eM7dE+zw0lSB5JOMv oNs9n1iAGWIBCB1Zf1kXOXbvyf5XXg== =5tqH -END PGP SIGNATURE-
[SECURITY] [DSA 4985-1] wordpress security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4985-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond October 14, 2021 https://www.debian.org/security/faq - - Package: wordpress CVE ID : CVE-2021-39200 CVE-2021-39201 Debian Bug : 994059 994060 Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform Cross-Site Scripting (XSS) attacks or impersonate other users. For the oldstable distribution (buster), these problems have been fixed in version 5.0.14+dfsg1-0+deb10u1. For the stable distribution (bullseye), these problems have been fixed in version 5.7.3+dfsg1-0+deb11u1. We recommend that you upgrade your wordpress packages. For the detailed security status of wordpress please refer to its security tracker page at: https://security-tracker.debian.org/tracker/wordpress Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmFoP20ACgkQEL6Jg/PV nWQGCwf+M9e2+WroFur6XdYPJejF6VQAFRwobyLFZOvy3c0HXNlFugNd8pP2eMT9 X1wHpv4fEbOCqsUepuJ5N30oBlJj5oEgOX4R0yNIwsB7xWlzzEamrpqcpjc9IklJ Z7k9WPTEf1Clo6yIXHhRT3FlGM9lYlu0yuYwtLJf6vXOn3Ap3fUVbv5Xv4tCqqEl 33bmYbt7rFSkM5RN5tWAjtWS2rtxQR5xbZ7Y+303uGGwVfFWHPFuJo0hWWOx0JM3 qndCNkukwA4O2JAQcPtv3oN70kBiWbTKuQOvur4903qfMb4YUo5ga6lX4vwMDnEJ PyGZe7XmsXJXRgK9GLXFzQeyygzuvw== =Dh7P -END PGP SIGNATURE-
[SECURITY] [DSA 4907-1] composer security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4907-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond April 29, 2021https://www.debian.org/security/faq - - Package: composer CVE ID : CVE-2021-29472 It was discovered that composer, a dependency manager for PHP, did not properly sanitize Mercurial URLs, which could lead to arbitrary code execution. For the stable distribution (buster), this problem has been fixed in version 1.8.4-1+deb10u1. We recommend that you upgrade your composer packages. For the detailed security status of composer please refer to its security tracker page at: https://security-tracker.debian.org/tracker/composer Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmCK4LkACgkQEL6Jg/PV nWQhBwgArIovQUUooqTS91bHsjuqtP5cXvbbeSbLml9cRug6U83QJEeDOnLz/ljd K0gZLZIHAi7B9iMX/oeSA73VYmSyfEp1DhSaluGSMkbvzptONDt6j/wKc23Zr/A8 C8/wcD1k4rIC3VmyEWNKtO/qZZ+nt/WX6Fpq4PrlOdhO3ea/hctzlz3UacVoThwD HSHBHn5pWQygHQYdWva/HNeeEtwE81gBaQ3BYYJ+NWgZilfHW2pU5ilhWi2jur3z nwgpqIKVhfhC3jG4552n15E5i5T28LR8IXfijtHr91b4Q2ZtVdKQdSYs8UO0+jA8 Lz0xVj6CyVNsrmXe3fMzkIVeIzA04g== =2MWQ -END PGP SIGNATURE-
[SECURITY] [DSA 4896-1] wordpress security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4896-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond April 22, 2021https://www.debian.org/security/faq - - Package: wordpress CVE ID : CVE-2021-29447 CVE-2021-29450 Debian Bug : 987065 Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform XML External Entity (XXE) attacks, and access private content. For the stable distribution (buster), these problems have been fixed in version 5.0.12+dfsg1-0+deb10u1. We recommend that you upgrade your wordpress packages. For the detailed security status of wordpress please refer to its security tracker page at: https://security-tracker.debian.org/tracker/wordpress Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmCBDxMACgkQEL6Jg/PV nWRHgAf+OMDCwkCIXn+tu7zdgvIDRQqGdXExm77wvoZRpJ2GFtNpQER9pFqdO1lZ +TXN61DzEwMHt4ABeKrJp8mMjsIALdlKwZY4qnIGooTOwMDM2RXxCGzgIMLaLcZf Qd3wyCCe51NiBNvA9UpUJQoakbhahxYhKAfn4HgAC9kEtC2DUPl3Br7YyCwyKK4r m3LBVwkSgNBhtkLw7iAggVmiNTNEpO0j9Z7jNsE1c2hwFqh8Q9/U5N4C1y4XFDsz U+tjzcA9VR51XDH/zIE7z8uWQRGMgNpN4/1n5F6uIRChdU0tbnRK3KmRoiHjIBWH rLCg3cd0aLfQ/57wlIyzxu7ILlh2/A== =odD4 -END PGP SIGNATURE-
[SECURITY] [DSA 4880-1] lxml security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4880-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond March 29, 2021https://www.debian.org/security/faq - - Package: lxml CVE ID : CVE-2021-28957 Debian Bug : 985643 Kevin Chung discovered that lxml, a Python binding for the libxml2 and libxslt libraries, did not properly sanitize its input. This would allow a malicious user to mount a cross-site scripting attack. For the stable distribution (buster), this problem has been fixed in version 4.3.2-1+deb10u3. We recommend that you upgrade your lxml packages. For the detailed security status of lxml please refer to its security tracker page at: https://security-tracker.debian.org/tracker/lxml Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmBh/jUACgkQEL6Jg/PV nWT4yQf/aLxTPSFTtdAjpJXH0yTcBTt5dIsodWLXwmWAzsOxA2ivUV44NL7oduQq P20TQCtIUHqXrP7N9q4rCm+T9fIIdOFJckATWQkYUuk7/RQB4xi4npe2Jj1vgvjj ELMtjoURYHhGvnJDLHqTgfsdIly+gnwKfyPAFpfbOQEb+2W3Ds3YjHF9toCtVc0W 6q5S7bTfkisLVWU3wWWwH1vTlA3XS9dgozUEIoV5TjGakQicnx6ZBA/zhEs4OJUf Vr5W52nFrZRh0448htdKT+4ex+IEI8sOKegH/ecYmK4WBGrrMgYCxeWgB+tUEawz 68g5R3mwr9FtfkbLGBFlBk68Y1Ei5w== =g+pG -END PGP SIGNATURE-
[SECURITY] [DSA 4859-1] libzstd security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4859-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond February 20, 2021 https://www.debian.org/security/faq - - Package: libzstd Debian Bug : 982519 It was discovered that zstd, a compression utility, was vulnerable to a race condition: it temporarily exposed, during a very short timeframe, a world-readable version of its input even if the original file had restrictive permissions. For the stable distribution (buster), this problem has been fixed in version 1.3.8+dfsg-3+deb10u2. We recommend that you upgrade your libzstd packages. For the detailed security status of libzstd please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libzstd Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmAwxgIACgkQEL6Jg/PV nWRqcgf+OvA7eeLqYuHuwtSD8e5xD5NIGGrOwcKkIRm/FtQx/ezBFwPwHzLT6MIx snzDop6ANxRg5X6b1/6ARioYH6YdHQorcENZ7laO9wXujEThhPnkVNG8UK7HGK76 hWqgLbnr/LF3jc6aiFeX5zKMw8mbMzhCzouQnp5P4hVKchUuyuwyPx41XGFfUvXR GeWKl9jlFuFdS8WDjhbGltheqjQUjQ25LnXkGOsc/XrjCvO+q3n7qP+0HLbkDnhe Dqe9n7iQwvRLGNf6MXUL05zAzV8sAf5pbJGt00fS3O7zu9k/x5W5bJ8HsXMKUvVx eRQUIpAJXVDe/1dmIZiUDccC6H1bhw== =p1vr -END PGP SIGNATURE-
[SECURITY] [DSA 4853-1] spip security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4853-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond February 16, 2021 https://www.debian.org/security/faq - - Package: spip It was discovered that SPIP, a website engine for publishing, would allow a malicious user to perform cross-site scripting attacks, access sensitive information, or execute arbitrary code. For the stable distribution (buster), this problem has been fixed in version 3.2.4-1+deb10u4. We recommend that you upgrade your spip packages. For the detailed security status of spip please refer to its security tracker page at: https://security-tracker.debian.org/tracker/spip Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmArtRcACgkQEL6Jg/PV nWSwTgf/ZeebxmE8OnnCc1UxE/2Ukwr0lLVB3AfX5JcDT5eaFY3jipacdcdAVfnn FfDBIc/S8dLHH8xqq/wLOgVtrKMwGXOILItRe4rDmA2ENCJc/f6OVAvtx7o3I4ar /e1MxMLb+ZK5bgnIfm5J3GiHTMWQ69PodZ1Jd/Hu4plLXVLvO75GGRIOVwdhnLtm MWxc7591tjcdgJetL6HXdqJnljWy5LLIA05vrkKbJWrqax2J0EnwIzGuENkwxqIP VesQyes3sf5BV9dBaoE3wafRLbh7UpwlXfaoRk8wwR27dQ/OXRLhJhe/Of5apgR4 fYLTLN1bwl59vBYhqVHXE2vik/4R8A== =Y96V -END PGP SIGNATURE-
[SECURITY] [DSA 4852-1] openvswitch security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4852-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond February 15, 2021 https://www.debian.org/security/faq - - Package: openvswitch CVE ID : CVE-2020-35498 Debian Bug : 982493 Joakim Hindersson discovered that Open vSwitch, a software-based Ethernet virtual switch, allowed a malicious user to cause a denial-of-service by sending a specially crafted packet. For the stable distribution (buster), this problem has been fixed in version 2.10.7+ds1-0+deb10u1. We recommend that you upgrade your openvswitch packages. For the detailed security status of openvswitch please refer to its security tracker page at: https://security-tracker.debian.org/tracker/openvswitch Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmAqZqIACgkQEL6Jg/PV nWSxAwf9Fs4AJekINCdGzSqrz3bBP3hpZj5otk9mVDcW6UC2yNcz+BUyxg81YB3m 0Fc8KGCaxp7bm5B3o/j8vzhs9JSBXdI9qZr72/5W7nWL5zqUdtptv4On4bChPq+6 MFn5Akaekkx/Fz25i33J859LHmn/8h9FXk/ADLRUdz+/iMintWG9mne39OXk8D3C 8Tp1zESGtitNbbq8YH7c4DsXA2kercBb22AqcE+2HClCaCGYaFi+xkLxwMpfbIVg E0WjhmeqWFZuLzRAwnKlL+MaQT19IlDMump95VZbJ7wzp4I0FSgWsAJ0JpFPu5xX btwIDA8LaoeZ7tnjYfQ/0bpx8dV9bA== =mPSj -END PGP SIGNATURE-
[SECURITY] [DSA 4850-1] libzstd security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4850-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond February 10, 2021 https://www.debian.org/security/faq - - Package: libzstd Debian Bug : 981404 It was discovered that zstd, a compression utility, temporarily exposed a world-readable version of its input even if the original file had restrictive permissions. For the stable distribution (buster), this problem has been fixed in version 1.3.8+dfsg-3+deb10u1. We recommend that you upgrade your libzstd packages. For the detailed security status of libzstd please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libzstd Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmAjhKUACgkQEL6Jg/PV nWSAPwf/ZV2EwzbnFKmdKqgIJRLghLQtO8hEt9e31sParY5AXk1vZ36UAhWKGaEu Thu16wsnzmmyk/Fbc+B3E0LKzhaQMDFeO8cIl+jNSoWvfI++YJ/C/4M13JlM7oiq PLsdjbQ5OjXDNeghFXb/jaa0zAJDB8m+0zHLZ9rP+YzCd1JMjd5/Tjius6CdDx6c NFBEjwIMj9qmUzkNkjltQ5HBIWkM3WL1achZKG0nlInyLBTIio3kUY16A46PcusX J7vrrJhfiBXalO+D0vNl2uUTYfcCBo8PrBGoTl1w25vJ21hNhFwuA4PLwhCVuMkk RydYSQZruMXuhVSH56osGC0QK58hYg== =5cdk -END PGP SIGNATURE-
[SECURITY] [DSA 4844-1] dnsmasq security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4844-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond February 02, 2021 https://www.debian.org/security/faq - - Package: dnsmasq CVE ID : CVE-2020-25681 CVE-2020-25682 CVE-2020-25683 CVE-2020-25684 CVE-2020-25685 CVE-2020-25686 CVE-2020-25687 Moshe Kol and Shlomi Oberman of JSOF discovered several vulnerabilities in dnsmasq, a small caching DNS proxy and DHCP/TFTP server. They could result in denial of service, cache poisoning or the execution of arbitrary code. For the stable distribution (buster), these problems have been fixed in version 2.80-1+deb10u1. We recommend that you upgrade your dnsmasq packages. For the detailed security status of dnsmasq please refer to its security tracker page at: https://security-tracker.debian.org/tracker/dnsmasq Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmAZVA4ACgkQEL6Jg/PV nWQYKAgAgVwonRAgXSliaFh0n44OPOz9wf4KibG7otcnAx4V4XqFAeXsHd/hIX/K IC313F3I+8WzvjKBhvt2KnGG9SnoTnq4roBIa1nz//vNX0hyfDm5xPlxQOExzC+c YS8kGt++SvC2wgOsrZEjyk0ecKqDJmZSwW31zXG9/2kTzCbKjuDp+i4TTADqabPC AgbmEGVKBR2Fk7K9Prct27oWoj7LHMaH+Ttb8uQGnG7OgJs9KyRI+2qIu+VaRCGf yfRj+XayPYHV1Amf5dLIKcLMMp/FnkNFoO2YIAZkWVPjXD2uPKUykJJ1GRl8R+0q qtNhPTNNuD6WnYzC8yP0KIQ2tsbg9Q== =j5Ka -END PGP SIGNATURE-
[SECURITY] [DSA 4831-1] ruby-redcarpet security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4831-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond January 15, 2021 https://www.debian.org/security/faq - - Package: ruby-redcarpet CVE ID : CVE-2020-26298 Debian Bug : 980057 Johan Smits discovered that ruby-redcarpet, a markdown parser, did not properly validate its input. This would allow an attacker to mount a cross-site scripting attack. For the stable distribution (buster), this problem has been fixed in version 3.4.0-4+deb10u1. We recommend that you upgrade your ruby-redcarpet packages. For the detailed security status of ruby-redcarpet please refer to its security tracker page at: https://security-tracker.debian.org/tracker/ruby-redcarpet Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmABkzwACgkQEL6Jg/PV nWSUJAf/S5a13rCfo6KGpWr3h1YAyuUlH8pFdM3zytlvX7tLDZMIQon1OL0fKecP lPDVE90EJoLBUUxdF1rSYWSQDS4fbCvSVuzcUqGrwgWvmEjL3rUTqaK189KB32sE 1wmGfqz0MS0ZBSAkPWLqkuMgRhP4SL2H78W9nssdLlC/eZ9G0kM1gTVOzQlrRVrc BNKX73zMfwP2LREWXpjMCpu6IxfNHaIWQHjWbDwWb92qbz0LAnujExo0PoKWGsvR 5DSYS+rasHfUr8VWGopKMZQp4AfFBKH+oAG2qpPpwGwRda9bI88yfT6hXtctpfDz kn5ERoIrC6OgXOEO9LnbLAUsEtCSSg== =D3qU -END PGP SIGNATURE-
[SECURITY] [DSA 4814-1] xerces-c security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4814-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond December 17, 2020 https://www.debian.org/security/faq - - Package: xerces-c CVE ID : CVE-2018-1311 Debian Bug : 947431 It was discovered that xerces-c, a validating XML parser library for C++, did not correctly scan DTDs. The use-after-free vulnerability resulting from this issue would allow a remote attacker to leverage a specially crafted XML file in order to crash the application or potentially execute arbitrary code. Please note that the patch fixing this issue comes at the expense of a newly introduced memory leak. For the stable distribution (buster), this problem has been fixed in version 3.2.2+debian-1+deb10u1. We recommend that you upgrade your xerces-c packages. For the detailed security status of xerces-c please refer to its security tracker page at: https://security-tracker.debian.org/tracker/xerces-c Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl/bBZQACgkQEL6Jg/PV nWQAVQgAidQ0lluHvaQwVsE82NY+pWaYDIBH+T23VKAhecLUmUJkB6SZy77FkG4f 36nHuZYm2W+a62OFTwRy3833+OZqgSw9Jdzr4756u5XDBiDRpOaDW99Ra68VJjZl gh4svlRKUy9LWxeJxgZWoH5HitxOMp56EtsofHk/gdIRP7rRqG6k+mTNSnjjY+GR wrYqfcuvyP3frP8KJGvm8bX4zlhg14w5WNbnj3pzbgUv0taCXonV/g3TFY/egEdj wdiXo/5jhCwTAHuhMO+HWIWKuBPRIzYi0lrw1vCJL7YHgbwULYkqyMV1FEVp1FPB H+HvGCQ7azQ4fAC2GH1x1UzqgxTKpw== =/MaF -END PGP SIGNATURE-
[SECURITY] [DSA 4798-1] spip security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4798-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond November 25, 2020 https://www.debian.org/security/faq - - Package: spip CVE ID : CVE-2020-28984 It was discovered that SPIP, a website engine for publishing, did not correctly validate its input. This would allow authenticated users to execute arbitrary code. For the stable distribution (buster), this problem has been fixed in version 3.2.4-1+deb10u3. We recommend that you upgrade your spip packages. For the detailed security status of spip please refer to its security tracker page at: https://security-tracker.debian.org/tracker/spip Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl++DaEACgkQEL6Jg/PV nWRStwgAmZChNL7iGrRO5UAyAbws/zbEcP+WGF1JeaftlRPbY8+/ZSc4p07EVAcH C8qRHkv1Oor+UFa4LFxdIbof5Q5IgnBAz1l2ts5PWv3OxO5CGPi9/l0rpZDWsPFw uv+WmFvdEOF1hwq5CsPfc7SKA1ZX2pZs/q+uXAbiHGO8n+r/HR5Pv1gWd7kIESA9 qhSlDchTEtBKi+YLuAtaO2xMFOFdAxRydDjdqSOwHBYIXwgUOrqVBJKn/mMqjdUv zO+0NpZNU14mB5jL5/f6HFwUVwSIio5BsGk3kVqcnzO3z+ikfQuWkoGTf4nSZmLN 2GSpLYNS2oCzHnCeDcHCXjyERRGf0Q== =69gM -END PGP SIGNATURE-
[SECURITY] [DSA 4784-1] wordpress security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4784-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond November 06, 2020 https://www.debian.org/security/faq - - Package: wordpress CVE ID : CVE-2020-28032 CVE-2020-28033 CVE-2020-28034 CVE-2020-28035 CVE-2020-28036 CVE-2020-28037 CVE-2020-28038 CVE-2020-28039 CVE-2020-28040 Debian Bug : 971914 973562 Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to run insecure deserialization, embed spam, perform various Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF) attacks, escalate privileges, run arbitrary code, and delete arbitrary files. For the stable distribution (buster), these problems have been fixed in version 5.0.11+dfsg1-0+deb10u1. We recommend that you upgrade your wordpress packages. For the detailed security status of wordpress please refer to its security tracker page at: https://security-tracker.debian.org/tracker/wordpress Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl+lSYUACgkQEL6Jg/PV nWStuwgAoDBZA5FLY+lIr5ioN46PD2SzjnNwBsyyBHHdu81Lbrid976RVFUfUsex AtTQGIbDG3lr3DSL0lzwQKikgRnTHDO42PwP+dATpK3yH0sjr8xSSr3rqVITz+iB qQVWc2UqHR+zUUbxoa6/W2V9y+zqVmm1BDvkIlbHw4x2m8/ErhrEo8FR9C3105I0 DdzQXxSFEEK6l/090I7gGtXIFHa9izk8AQ8pgytBTUAveWE/sLWdF1vHDfQhb3FY HSPs/uzVvbLBDDfwr8xRWVjkL8kyism5ynmRwqtE+AiMqDWSVGlADdcZtcsyUeDt WpOwXIdWwNIPrpalNbLeO/Bu2apvWw== =Jo4W -END PGP SIGNATURE-
[SECURITY] [DSA 4720-1] roundcube security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4720-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond July 08, 2020 https://www.debian.org/security/faq - - Package: roundcube CVE ID : CVE-2020-15562 Debian Bug : 964355 It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, did not properly sanitize incoming mail messages. This would allow a remote attacker to perform a Cross-Side Scripting (XSS) attack. For the stable distribution (buster), this problem has been fixed in version 1.3.14+dfsg.1-1~deb10u1. We recommend that you upgrade your roundcube packages. For the detailed security status of roundcube please refer to its security tracker page at: https://security-tracker.debian.org/tracker/roundcube Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl8FVgUACgkQEL6Jg/PV nWQvaAf/Uvl0F1+NiavrKStZYhfeCcMI2VkAIJZvB4RDHwK5lJFnnVTMopk4eMWB tqmCcHXEwmo1Knt7uFWgmjcCxLj1N0q9Vnmed6GuLbxrQxLik/8K7SMfb4RlVtC7 SwRGYiQ8uaP04q3GAyd5Fqvn5gw/Ypo3bMo5+sZdiRWFM7+S0V8vS9pnB4jTK7b5 5CSdPhhDOlANzmGILD/+OvXtIYqN0DP+FuKpcXY7b2ZeOLSGj0CjsgThPH+ZEA6p e5XgCODlbo2HCQe/4nicpfHiqZUHDKsCyD3/pvil7mnAs/Tw6pvKqYqZsk6x6w5f yMdcuowe7kRl6Q0Tzbnc6M+iR1dn8w== =CMjd -END PGP SIGNATURE-
[SECURITY] [DSA 4709-1] wordpress security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4709-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond June 23, 2020 https://www.debian.org/security/faq - - Package: wordpress CVE ID : CVE-2020-4046 CVE-2020-4047 CVE-2020-4048 CVE-2020-4049 CVE-2020-4050 Debian Bug : 962685 Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) attacks, create open redirects, escalate privileges, and bypass authorization access. For the stable distribution (buster), these problems have been fixed in version 5.0.10+dfsg1-0+deb10u1. We recommend that you upgrade your wordpress packages. For the detailed security status of wordpress please refer to its security tracker page at: https://security-tracker.debian.org/tracker/wordpress Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl7yDbQACgkQEL6Jg/PV nWTZXAf+PZSkdoSO/XhkZQBbyPAnd6FCh4e07gATBVe9RCThA0rAlQjnJRXyXO10 Q2BMm2kq/5HoNODsY2sasEQJTmNVEFPEF44sMEjpSbuIU3Nskj5eMEp7ggBftkd+ mW+hnIoY4iKHroitrUjKcy/skUBOxvP8B6Saa4k+DCj6fMCCKlvivFiVt+fS6GDt 4hxMcylcPu7sCOJZh/UBgxNlUTRisWN4KZbBjRhoHaXwsZM17F58UaKnzfIIZfOz xA+AJUxiknUszEsSbUFDZRtPrLIYNUXXRyD8KQgn5EnASzppn9gqcwS7DpvfaO2U TY4mtso8d4eKc9Do64UR7fdHQZf31Q== =DmH5 -END PGP SIGNATURE-
[SECURITY] [DSA 4705-1] python-django security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4705-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond June 18, 2020 https://www.debian.org/security/faq - - Package: python-django CVE ID : CVE-2020-9402 CVE-2020-13254 CVE-2020-13596 It was discovered that Django, a high-level Python web development framework, did not properly sanitize input. This would allow a remote attacker to perform SQL injection attacks, Cross-Site Scripting (XSS) attacks, or leak sensitive information. For the oldstable distribution (stretch), these problems have been fixed in version 1:1.10.7-2+deb9u9. For the stable distribution (buster), these problems have been fixed in version 1:1.11.29-1~deb10u1. We recommend that you upgrade your python-django packages. For the detailed security status of python-django please refer to its security tracker page at: https://security-tracker.debian.org/tracker/python-django Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl7rKgsACgkQEL6Jg/PV nWQUpQf/a6ouTulgXuSAegdWfc6ehpmZVgKb8Ln6K9lqvHsvYQyNQVjI3Loj+Squ Jw5n0gXf/n3uW9/gKlMC/gKVie/ED7STZFgFr5k4xMvFcXiTE1V9ljv2eIQjCh9o YtT40NCCM1oTfVemsaoyUJ5rtr5nFznY3R8yf9Rdlq7I5SZGw5BdYHaUbSKutwIp OnrjL+VscoMBffgtaJY6/tQyMwOPiu+xynUCKEfaMHRuwwHl1+rj7gr+HRImQhTX 7FezQOxpvLPrh/tj/4DdQ6VMG1ClOCPvISGuZ1mhnMHcHy2KzA5OtoWRnVks7udG h/WYma9kPi3CSSYNWzEVTknN/wQwxA== =7/E0 -END PGP SIGNATURE-
[SECURITY] [DSA 4700-1] roundcube security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4700-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond June 11, 2020 https://www.debian.org/security/faq - - Package: roundcube CVE ID : CVE-2020-13964 CVE-2020-13965 Debian Bug : 962123 962124 Matei Badanoiu and LoRexxar@knownsec discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, did not correctly process and sanitize requests. This would allow a remote attacker to perform a Cross-Side Scripting (XSS) attack leading to the execution of arbitrary code. For the oldstable distribution (stretch), these problems have been fixed in version 1.2.3+dfsg.1-4+deb9u5. For the stable distribution (buster), these problems have been fixed in version 1.3.13+dfsg.1-1~deb10u1. We recommend that you upgrade your roundcube packages. For the detailed security status of roundcube please refer to its security tracker page at: https://security-tracker.debian.org/tracker/roundcube Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl7hzMIACgkQEL6Jg/PV nWR6HggAmeyPEJAP2BZGXhDCYvEPYERHrJ48bIINNS03qmlkdqfsnfVuwHRzcouR QzlcPAs3vk1dCbzQYy2Jke9F4ihKersDN9Y919/EZSuaaTq0h5zm9M9Qkib+AqV+ rKTbG/LmLDCPU4krZTYUseZZBpsUcRn0lshfALUigCUKOIwvTsoUjaOy5bdRGG7t qsKPXYq52gKZWGH0vDuXdcFzgS31OCLtXNNEManR3jzuTxZtqSOzOsKUHzzs1raO 9o7/vn4bg00BFrN6Lzysk6U3DFFf9MMhhSVFFnbY91P5s60wGGuo3osIBWQlw0PJ ++3+RHCsV7bjZut2RBzOiocVeCXSBA== =wJd6 -END PGP SIGNATURE-
[SECURITY] [DSA 4677-1] wordpress security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4677-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond May 06, 2020 https://www.debian.org/security/faq - - Package: wordpress CVE ID : CVE-2019-9787 CVE-2019-16217 CVE-2019-16218 CVE-2019-16219 CVE-2019-16220 CVE-2019-16221 CVE-2019-16222 CVE-2019-16223 CVE-2019-16780 CVE-2019-16781 CVE-2019-17669 CVE-2019-17671 CVE-2019-17672 CVE-2019-17673 CVE-2019-17674 CVE-2019-17675 CVE-2019-20041 CVE-2019-20042 CVE-2019-20043 CVE-2020-11025 CVE-2020-11026 CVE-2020-11027 CVE-2020-11028 CVE-2020-11029 CVE-2020-11030 Debian Bug : 924546 939543 942459 946905 959391 Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create files on the server, disclose private information, create open redirects, poison cache, and bypass authorization access and input sanitation. For the oldstable distribution (stretch), these problems have been fixed in version 4.7.5+dfsg-2+deb9u6. For the stable distribution (buster), these problems have been fixed in version 5.0.4+dfsg1-1+deb10u2. We recommend that you upgrade your wordpress packages. For the detailed security status of wordpress please refer to its security tracker page at: https://security-tracker.debian.org/tracker/wordpress Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl6yWNIACgkQEL6Jg/PV nWQnpQgAtGmkFfRTwb2uDsBuHilQxyPcVXVzZZ8AZM3oWxblTP2NNHRTAm4cRLwB M7OnCtl2+0fcsPS/bVJioogwoaqQvFHUUl5cR8jCYUS+hSWwBzd6o70Q4ENXqHEz 5eaF9fhevs03YbZw4F07dN3b1rcc0NrVUqBR39zJVKZyD9syK3auNzLtuyM7vKI3 /03MojNXB5UvQeRGj571fKr6kS+eE0Bd2ojcBzGLvzjRgILAahc7dfyNoaBbvq73 j0/PKTBHtfEanpFsp02FkAX5ScY3D8ixymV/W0eEoq7xYdG36Tv7pJAAMAEJLouN axH8DQPpff2Y+6EQnOrfWBa8IHm99A== =itB2 -END PGP SIGNATURE-
[SECURITY] [DSA 4674-1] roundcube security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4674-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond May 05, 2020 https://www.debian.org/security/faq - - Package: roundcube CVE ID : CVE-2020-12625 CVE-2020-12626 Debian Bug : 959140 959142 It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, did not correctly process and sanitize requests. This would allow a remote attacker to perform either a Cross-Site Request Forgery (CSRF) forcing an authenticated user to be logged out, or a Cross-Side Scripting (XSS) leading to execution of arbitrary code. For the oldstable distribution (stretch), these problems have been fixed in version 1.2.3+dfsg.1-4+deb9u4. For the stable distribution (buster), these problems have been fixed in version 1.3.11+dfsg.1-1~deb10u1. We recommend that you upgrade your roundcube packages. For the detailed security status of roundcube please refer to its security tracker page at: https://security-tracker.debian.org/tracker/roundcube Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl6xabwACgkQEL6Jg/PV nWTu0AgAzQr+2TTSuGf66vYe+mLC/iZnpoVI8LwZHgoR0L48TQpcQJ95g+SkeEfy tqoGy4o5aMMY5tnN2StKq4E/CH2RNjUie9lajTkrZIOQpxX3yOZd+VvkPSZxDEJw 8Tr5a22iQwo2WmAkYAMrfVeAXTw3XOufNRQm0PuTFGkx66vpwLgsE28rlbv4DRaX mHUxpPhj/PpNBpGc/Zhpj61qTgTUNaMUUIf8z5Qg1f4Kx6aLfmmRyaF8BBtPpIaQ gBuOr6P77ZlAOurdB6keV0HiBdVZLEgbUk28Ll/g/h1dtCOmIlHxeqlaNwQ5oonO 3+6hq2VdoicnWweisEBFGwwRJWtCwA== =exy5 -END PGP SIGNATURE-
[SECURITY] [DSA 4660-1] awl security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4660-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond April 21, 2020https://www.debian.org/security/faq - - Package: awl CVE ID : CVE-2020-11728 CVE-2020-11729 Debian Bug : 956650 Andrew Bartlett discovered that awl, DAViCal Andrew's Web Libraries, did not properly handle session management: this would allow a malicious user to impersonate other sessions or users. For the oldstable distribution (stretch), these problems have been fixed in version 0.57-1+deb9u1. For the stable distribution (buster), these problems have been fixed in version 0.60-1+deb10u1. We recommend that you upgrade your awl packages. For the detailed security status of awl please refer to its security tracker page at: https://security-tracker.debian.org/tracker/awl Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl6e23sACgkQEL6Jg/PV nWQCzwf/WQHLwG1K3u69Y0zAMKUyN7/aAaMKXvejPG/ufJ/bkNLNpkMSHYa0viM8 C27bAE04UzHcpd+xERqjJPZsqBhQB80BBH/Cf0hXlw5dzBYubVwUlJ8JymHR9gA0 yAnT53N+0QhAEU2xuo8Q25M/0mq371bTPoVmplBEIvJkL22Gv0fnyEmOvNnAMHu1 CAJuDiqB/Uw5qcmYiQCJakyMxL7qPeZvzgmrr+9EZPz1+yVAGAUo52FfMJpVkEMn Tfxx2APvPOzz84AZ5M7s/sei+jDNI2HuGHoYnFfygtxQSLAKKdL0TIGGtcbl5f5B xNdI4ZFotRkGXwwc/ookymwqDFULfQ== =BTC4 -END PGP SIGNATURE-
[SECURITY] [DSA 4649-1] haproxy security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4649-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond April 02, 2020https://www.debian.org/security/faq - - Package: haproxy CVE ID : CVE-2020-11100 Felix Wilhelm of Google Project Zero discovered that HAProxy, a TCP/HTTP reverse proxy, did not properly handle HTTP/2 headers. This would allow an attacker to write arbitrary bytes around a certain location on the heap, resulting in denial-of-service or potential arbitrary code execution. For the stable distribution (buster), this problem has been fixed in version 1.8.19-1+deb10u2. We recommend that you upgrade your haproxy packages. For the detailed security status of haproxy please refer to its security tracker page at: https://security-tracker.debian.org/tracker/haproxy Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl6F5I0ACgkQEL6Jg/PV nWQPtAgAlebr3o7KaSYcMAfJCsEzCJKPT5tqk+tpcELkDjm3XJgXh8o8+pUfz4x8 I/cz/+sDy6CsSLUrR0699PH9c1EYwhfkyeqxaPg0+BrjSarIAkkJVGIjdSS9in51 ws+JwEUEncLku26MnZO81Ju6HM/tsw+2FitOMYwyU34qrwyaggtD6JBlZjfqk/7M 71YQmYASrWxUwYh3GSLlHC8u3BDyTD/aU8xbgn85LIwX6uXYl/V4iI9DzR3pk5cr 7Flylu15T/W4+7iQ0QSmGgMVPJp4G6Koi2Lj0LiorGIc4L8iq8EpGvjU3t9sBig6 q9nPtEOTeL7QSky9m1sKFjcLgSfGoA== =31YW -END PGP SIGNATURE-
[SECURITY] [DSA 4629-1] python-django security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4629-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond February 19, 2020 https://www.debian.org/security/faq - - Package: python-django CVE ID : CVE-2020-7471 Debian Bug : 950581 Simon Charette discovered that Django, a high-level Python web development framework, did not properly handle input in its PostgreSQL module. A remote attacker could leverage this to perform SQL injection attacks. For the oldstable distribution (stretch), this problem has been fixed in version 1:1.10.7-2+deb9u8. For the stable distribution (buster), this problem has been fixed in version 1:1.11.28-1~deb10u1. We recommend that you upgrade your python-django packages. For the detailed security status of python-django please refer to its security tracker page at: https://security-tracker.debian.org/tracker/python-django Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl5M7iIACgkQEL6Jg/PV nWSJnQgAx6apWFroZ90PoqfwIGZOFIwZBOmQqkUEBDXWr7i/mVA8m2G+rrj3nFem 71EK+b+T/CUgku1DmtANB0d/e8Kb8HVFjd1N9B6tyoB90xGGLbOFJTQn+owdgsCs nJb4mZUYCsZ2Kk8cyJvsk2x1uMo9bAGGqZs5shqG2VsyfjifC3BUGeB+9KTR+bXP wBFcq00ZFgFWiKsxl/CwiYQCn5uk+24Hd/FCuhp4v3yr/HmOtwnfMS9I0+u0c9ep ThM64NRH/FKyXfcGgiJFi4ifD2gFWkgJhe9326ZHf4ruGW1/rtPv8rl7+2lg5AMX RKkXSLkv8Sd+GG3QK+1dHHwoQ3Ey9A== =f5GS -END PGP SIGNATURE-
[SECURITY] [DSA 4599-1] wordpress security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4599-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond January 08, 2020 https://www.debian.org/security/faq - - Package: wordpress CVE ID : CVE-2019-16217 CVE-2019-16218 CVE-2019-16219 CVE-2019-16220 CVE-2019-16221 CVE-2019-16222 CVE-2019-16223 CVE-2019-16780 CVE-2019-16781 CVE-2019-17669 CVE-2019-17671 CVE-2019-17672 CVE-2019-17673 CVE-2019-17674 CVE-2019-17675 CVE-2019-20041 CVE-2019-20042 CVE-2019-20043 Debian Bug : 939543 942459 946905 Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create open redirects, poison cache, and bypass authorization access and input sanitation. For the stable distribution (buster), these problems have been fixed in version 5.0.4+dfsg1-1+deb10u1. We recommend that you upgrade your wordpress packages. For the detailed security status of wordpress please refer to its security tracker page at: https://security-tracker.debian.org/tracker/wordpress Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl4VbEIACgkQEL6Jg/PV nWQ02gf+J2wZhdpxWUvi8VXLjIlfT5maSOGgBDNzzmXcrBoS09uteLz+6MJ2RrLt 2AkmKzHHwjkHcrksBPai6pKxPl8kGMNvfoq3myZZSLANIpvUSIJP4ZyVFwpho8lZ KGyKqtOehDeQOo4tRZoVuGGXuPePZ69FLhsQ0o1V27t6UFHLap7vWCDquRZvMeer kZ0emVISeQeVGZyjmZ+o9V+n2BcgRFidWLw49OqRjdPb7rac/3PmunelsOkvb3a+ OvpzAvjb+78CBAl6VsX6LHKXQvjseRXtTHRRea+cxgJYreLc/M/G/NCojHkw9L8I H0nJEe6KUU+jVW4X6GKkAm01eeomTw== =wSuy -END PGP SIGNATURE-
[SECURITY] [DSA 4588-1] python-ecdsa security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4588-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond December 17, 2019 https://www.debian.org/security/faq - - Package: python-ecdsa CVE ID : CVE-2019-14853 CVE-2019-14859 It was discovered that python-ecdsa, a cryptographic signature library for Python, incorrectly handled certain signatures. A remote attacker could use this issue to cause python-ecdsa to either not warn about incorrect signatures, or generate exceptions resulting in a denial-of-service. For the oldstable distribution (stretch), these problems have been fixed in version 0.13-2+deb9u1. For the stable distribution (buster), these problems have been fixed in version 0.13-3+deb10u1. We recommend that you upgrade your python-ecdsa packages. For the detailed security status of python-ecdsa please refer to its security tracker page at: https://security-tracker.debian.org/tracker/python-ecdsa Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl34+5QACgkQEL6Jg/PV nWThYAf+PH/Het1sH5n/p+JnC9ys9BjbJw/bUrXl0RYx812cWlVo4wWkAyjS9xD/ q0tR8Gx2wqAEauGa8Vy8H2hP8iW82+lCGlOoWNMqpVE+x1fwTLA8GCwH6f/UBrPC 5UJv06X6WYtrp3l3NKnq5IOR4QmWIVg3+gmrlm+6wC5NELwOCg0eH79vy+qtbc0w 7LaEI4IOi7yz11sXo7O0vu31S70EiwzRW6kyjlLfOrPN2OigiKYOkdAbWUocnSkR Uy/LlLCYZry60wbUu9adOz/MOib2Bc9ARzskPrTPUQ0JgrZT1kiUIFU18mmVW9ym qD3fYFLisZQT0hcu1C1D+UDfAVrpQQ== =CvMQ -END PGP SIGNATURE-
[SECURITY] [DSA 4577-1] haproxy security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4577-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond November 28, 2019 https://www.debian.org/security/faq - - Package: haproxy CVE ID : CVE-2019-19330 Tim Düsterhus discovered that haproxy, a TCP/HTTP reverse proxy, did not properly sanitize HTTP headers when converting from HTTP/2 to HTTP/1. This would allow a remote user to perform CRLF injections. For the stable distribution (buster), this problem has been fixed in version 1.8.19-1+deb10u1. We recommend that you upgrade your haproxy packages. For the detailed security status of haproxy please refer to its security tracker page at: https://security-tracker.debian.org/tracker/haproxy Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl3fgqMACgkQEL6Jg/PV nWTypwf+P8rTp1L2+ARcbZM3Q54m1k4CL3lsMLMA6lcaCGZzyYKjXco59yESQUAz lZw8hhAB1Th6UWFtHv8HeJsn7ltPFZc/vqpyhqpYqXLTNEJedx720Wf6bq5QTdSQ XpIGc/epahu7z7rgCNS26DB7HPIXiHVMKTMC0+kTlIHhos1n8JustEjXt/QthVSN NQdjCPD63k6Fp0fFboJ9+5PEpklqJBN/B63QiIKKWF+8BlPY/oN1INybOD11mPu6 mhO7/0ZgaElGHbtcaNse0PA7ukPgS3Pgzctykg676RKFvwiWD7qanAgIwY9qEx3u LF4ifS25LWF3bz+owGLTccFuuRg+hA== =J7cs -END PGP SIGNATURE-
[SECURITY] [DSA 4544-1] unbound security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4544-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond October 16, 2019 https://www.debian.org/security/faq - - Package: unbound CVE ID : CVE-2019-16866 Debian Bug : 941692 X41 D-Sec discovered that unbound, a validating, recursive, and caching DNS resolver, did not correctly process some NOTIFY queries. This could lead to remote denial-of-service by application crash. For the stable distribution (buster), this problem has been fixed in version 1.9.0-2+deb10u1. We recommend that you upgrade your unbound packages. For the detailed security status of unbound please refer to its security tracker page at: https://security-tracker.debian.org/tracker/unbound Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl2mqfsACgkQEL6Jg/PV nWQBsgf/c6HwDSoTktM6V9P3xQ2jD73LNJBryf9W2enfZhFhsU2n4k72XjjBQlK4 N0aMNU5GW8NK9gQCi1rZMhinfORdiZc+Dq8rHfkvoTIOZRoqSrowKdXysjj677Pu XzGALAc1Zwjhbtj4p+DCbtn9hr+RAq7GVRWMRxsjGTxEzGQe1bawq4McVVUSuV/p HP8axuA4w8MtbyZ247q/IMBfVjmQjataBj22xyQ2nr8pM1rhwaw59y6toMg3l9+U 2ktJ4VzabkegRuzdIhpnK2K0wueU0DQT9dNh5hPg5rNTq8FOAxSUO2GKixMQeS1/ UIv3zV/9j9Yng1qaBciHq7KZNudjzA== =OdTA -END PGP SIGNATURE-
[SECURITY] [DSA 4542-1] jackson-databind security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4542-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond October 06, 2019 https://www.debian.org/security/faq - - Package: jackson-databind CVE ID : CVE-2019-12384 CVE-2019-14439 CVE-2019-14540 CVE-2019-16335 CVE-2019-16942 CVE-2019-16943 Debian Bug : 941530 940498 933393 930750 It was discovered that jackson-databind, a Java library used to parse JSON and other data formats, did not properly validate user input before attempting deserialization. This allowed an attacker providing maliciously crafted input to perform code execution, or read arbitrary files on the server. For the oldstable distribution (stretch), these problems have been fixed in version 2.8.6-1+deb9u6. For the stable distribution (buster), these problems have been fixed in version 2.9.8-3+deb10u1. We recommend that you upgrade your jackson-databind packages. For the detailed security status of jackson-databind please refer to its security tracker page at: https://security-tracker.debian.org/tracker/jackson-databind Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl2ZpPgACgkQEL6Jg/PV nWTg1QgArRk3fUf/k14rPha6GlJnWtRu2tZli07NzxtebAI2Ra8vKHkv1F3xSBjx tnauaRmJXonoU7t1TU51O/F7xkxX10NXym3YyrJ4+5ac6OtGmstSkMW1CmEiS8Z7 RaQQqY8GTJe5VTjiPon+lvdxyoFIDbp3nUGj8sshrULtKQX3Bjc9dotXyu0M3/7o QjsFAOLpytx/nMS1O93rqHuO381plbaAi5EYgAPv737tV8lVH3li56FYTKRMVjEg BkBpkaDGWhqoYvTu4WviyCyon0V5PgtHuD8SkN/39QqiYoDCzfa0xPjZ3a44G0kR C6qF8E4WIw465wLrRLCuuybG6/ZrzA== =Gifd -END PGP SIGNATURE-
[SECURITY] [DSA 4498-1] python-django security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4498-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond August 12, 2019 https://www.debian.org/security/faq - - Package: python-django CVE ID : CVE-2019-14232 CVE-2019-14233 CVE-2019-14234 CVE-2019-14235 Debian Bug : 934026 Several vulnerabilities were discovered in python-django, a web development framework. They could lead to remote denial-of-service or SQL injection, For the oldstable distribution (stretch), these problems have been fixed in version 1:1.10.7-2+deb9u6. For the stable distribution (buster), these problems have been fixed in version 1.11.23-1~deb10u1. We recommend that you upgrade your python-django packages. For the detailed security status of python-django please refer to its security tracker page at: https://security-tracker.debian.org/tracker/python-django Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl1RKSsACgkQEL6Jg/PV nWSP1wf+Ik+YEcDwjJeK/QW060xu3WA4Y+TE2PYFkgtJSL9+wkDDPA2U82aHpVD3 hn253cl//sBYsTTFC/UwpW+y6yP+FmczdxQt+jTLyeKzq/tOZlhkutLHwrrw4OEB e8XE0BhrwSFWInnkLxjjtCscHr6AA1Jt2GuVnhe6isZpbmvxHDNUDPHXRcVU7reX l0INrcv43XIqcxYzNAQFLQKWzv6PzJcUsQJgvnbtW90pQCxp7UwW01H/Wx7FVfBn 78qbXWp+wRewGsJPv7Kjy6keUSck2I/ew0+X6efYAez/X1vgakp3/NGWMh2VzM8d DdW2RhKU/PTEFe9t+1gTXhR1ZbOXZg== =tCmt -END PGP SIGNATURE-
[SECURITY] [DSA 4441-1] symfony security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4441-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond May 10, 2019 https://www.debian.org/security/faq - - Package: symfony CVE ID : CVE-2018-14773 CVE-2018-19789 CVE-2018-19790 CVE-2019-10909 CVE-2019-10910 CVE-2019-10911 CVE-2019-10912 CVE-2019-10913 Multiple vulnerabilities were discovered in the Symfony PHP framework which could lead to cache bypass, authentication bypass, information disclosure, open redirect, cross-site request forgery, deletion of arbitrary files, or arbitrary code execution. For the stable distribution (stretch), these problems have been fixed in version 2.8.7+dfsg-1.3+deb9u2. We recommend that you upgrade your symfony packages. For the detailed security status of symfony please refer to its security tracker page at: https://security-tracker.debian.org/tracker/symfony Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlzVGW0ACgkQEL6Jg/PV nWR+Swf/XR9Ub4ALHbkYsZGArd1oOOr0nAWmI718ZyTNQGj9Hl5gl0NoNjRgkeD6 nY9a+H/6+aJSgVTugGbJ4CavJ0ecaHlBawdW+DvscTN3z9tqiE21/TpEaQWq95F9 o1sUhM5dlWkRwAHVPIuQyzrGJ3aLz+F4HBV7Z9WMU6AADHq/Q2AKysNXbxnvObsA SUBWr5iExXxsXXE+ftZXde13frMIB4MZDYGkYO0FMV5333T9QiPWHr3g4S7Lvlir D7IzOU3A1miIAafDdhCmDvTJMToL2dj4+coP1sQwUNz0WT5TDS0Tv8neJ5cUwEQO RkaysBU+O9U0VxHrkhP3nRgvMuYVdQ== =0n6N -END PGP SIGNATURE-
[SECURITY] [DSA 4429-1] spip security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4429-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond April 10, 2019https://www.debian.org/security/faq - - Package: spip Debian Bug : 926764 It was discovered that SPIP, a website engine for publishing, did not properly sanitize its user input. This would allow an authenticated user to perform arbitrary command execution. For the stable distribution (stretch), this problem has been fixed in version 3.1.4-4~deb9u2. We recommend that you upgrade your spip packages. For the detailed security status of spip please refer to its security tracker page at: https://security-tracker.debian.org/tracker/spip Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlyt4CQACgkQEL6Jg/PV nWTphwf+MnTEngHeGlCl5zusQHd1uYBcrdQeujBcUejnIjIYmdp8RHS68JhyAi4n XyKnVVMP7FCrZ6AmVOkAO03ci/gp4m5S8gS+1o5oEJzgdEQYthzmaxJcDysMIRcQ qw/vheQeEulozifpM7aM1lFmr1tXoj06iyPp8/4c4zajiLI/dVYI4SI8Ft+Or+UD TDK2NPZeS4kd6awuzqtTsXV0L3Li1mR6zYW7jAaWTG3OYlzRf4N+5ycCWs91ug01 VBtlI/DrsMhNZzg0MWNONMjdylJts66MEjVyXiDQEw+3gscEh0s+f+Q8z1NmE5kt eLHakSNknXhpI9jvEq2nlMX/535iBA== =fQ0j -END PGP SIGNATURE-
[SECURITY] [DSA 4427-1] samba security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4427-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond April 08, 2019https://www.debian.org/security/faq - - Package: samba CVE ID : CVE-2019-3880 Michael Hanselmann discovered that Samba, a SMB/CIFS file, print, and login server for Unix, was vulnerable to a symlink traversal attack. It would allow remote authenticated users with write permission to either write or detect files outside of Samba shares. For the stable distribution (stretch), this problem has been fixed in version 2:4.5.16+dfsg-1+deb9u1. We recommend that you upgrade your samba packages. For the detailed security status of samba please refer to its security tracker page at: https://security-tracker.debian.org/tracker/samba Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlyrA9kACgkQEL6Jg/PV nWSvLQf+Mce+c49AVUGwYVjnVN3TgXbrgVI2lmWDwGIBdh/Kygg9Va3v66nW5pwH RyjmOOIn9nTgxMFPeO7gdk3ui8mL7lJ+KEKPySAXpGy3BlruB8qBSdpSnNOzjyQA K0cLbOrARly5q/HYgNx5CM5E/cqX5xFnJidmwbwwccvy/f1cgAmnZfSkCHTAri01 7X0xZRm2nlfFAGWZEOEkyEKRPxNeP5WpCikdC+z6+5H6ezVPr57lO/1IhI8i9de+ KpGGx9LSbEAfKAyuv1BVlSugsQ4mGYB7oEiTCEU6tS46Tyb7kG2gaouRUBXqBjFZ sG4By7dtaEc+jwQVK3MZriMrePZOeA== =6GCj -END PGP SIGNATURE-
[SECURITY] [DSA 4424-1] pdns security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4424-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond April 04, 2019https://www.debian.org/security/faq - - Package: pdns CVE ID : CVE-2019-3871 Debian Bug : 924966 Adam Dobrawy, Frederico Silva and Gregory Brzeski from HyperOne.com discovered that pdns, an authoritative DNS server, did not properly validate user-supplied data when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend. This would allow a remote user to cause either a denial-of-service, or information disclosure. For the stable distribution (stretch), this problem has been fixed in version 4.0.3-1+deb9u4. We recommend that you upgrade your pdns packages. For the detailed security status of pdns please refer to its security tracker page at: https://security-tracker.debian.org/tracker/pdns Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlymLHkACgkQEL6Jg/PV nWTsFQf/RvbsyjaPK20oiJxitB+O3GFU2ucUrmnjQ62lJqhDcoK/rnSpRAISvTKA TjnbAu59/RcwnDzJMTInYrdeSq1r2sV528xV8DzpYVW21xCGGcSHA4cvWL5OVG3z gnc/9TfkxWQkVy9o+rQukko7o2sU0vI6JUgxbA9llAhoxcII5+TmwLNEDQTL8gi4 1ljyIhTJnRMx5Uhtljp2Cr/uqZiJQTsSxqMuF+XIC62o5kSK2wCeuoRhwvWJHn4R Xvt5ENd6rnWnuVjazG0eSAyfasNXepYmtED/crjITS2PxhV07UJqJHvxyov9QyWD ZsnS4+Q5jwamwxGyMMtmMaiRn9Dr7g== =Ieqy -END PGP SIGNATURE-
[SECURITY] [DSA 4401-1] wordpress security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4401-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond March 01, 2019https://www.debian.org/security/faq - - Package: wordpress CVE ID : CVE-2018-20147 CVE-2018-20148 CVE-2018-20149 CVE-2018-20150 CVE-2018-20151 CVE-2018-20152 CVE-2018-20153 CVE-2019-8942 Debian Bug : 916403 Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and PHP injections attacks, delete files, leak potentially sensitive data, create posts of unauthorized types, or cause denial-of-service by application crash. For the stable distribution (stretch), these problems have been fixed in version 4.7.5+dfsg-2+deb9u5. We recommend that you upgrade your wordpress packages. For the detailed security status of wordpress please refer to its security tracker page at: https://security-tracker.debian.org/tracker/wordpress Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlx41ugACgkQEL6Jg/PV nWS2yAgAxfm5TQM+zRiBgU9XSyAnWRCR2pTaAkZkuIggFOiBUa5/QNy8LgG9l2rX fCrymLvKR6c9MP/via6hvB8JW6Hos6KgoSOON2zZ/1XnYawNQFWGkUudkX4QFx/w DIdsBmnVfjTELJYQDJsdfOefngkMFX7vSiaAOf0ya5Qtj5sD4cACork0ngE5Gu8h EGGbataSIhL/C1aisJIvEfWJykvLGjcgd696AKPUiC2dnUdk21CfMYj6YEJQXFBB U+TfkL3aFZHBwIgKH7SkDL1yTpHbSJAGNvPK1vEyOfhIrkK1f2B0Gu4zRyIVnFXW vXhaAeHwJ5TI74RmY+cbw3Hfu7lG1Q== =NCjS -END PGP SIGNATURE-
[SECURITY] [DSA 4389-1] libu2f-host security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4389-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond February 11, 2019 https://www.debian.org/security/faq - - Package: libu2f-host CVE ID : CVE-2018-20340 Debian Bug : 921725 Christian Reitter discovered that libu2f-host, a library implementing the host-side of the U2F protocol, failed to properly check for a buffer overflow. This would allow an attacker with a custom made malicious USB device masquerading as a security key, and physical access to a computer where PAM U2F or an application with libu2f-host integrated, to potentially execute arbitrary code on that computer. For the stable distribution (stretch), this problem has been fixed in version 1.1.2-2+deb9u1. We recommend that you upgrade your libu2f-host packages. For the detailed security status of libu2f-host please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libu2f-host Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlxhdxAACgkQEL6Jg/PV nWSRdQf+Pt+y/MxE9ugOhakI80frcv8zTVYjE1PDu8ZvP6TjJDUT354O1njS05iX bYgw+PCHORKSvDIiwisMUFFqN6JdtWdweGyk+CyKO2pa4PLaQKXoTHSqfkxgSk5+ 7bykv5KgxfYLHFs3WewW2ZjC0TMcLMNr8u6uW0i9gWC8r4cnvZP7ftpUFdTfCcvj lFVLBGDBB6cS4dX+ZkMxtzJuyXE4JzIlLCECKJTYPeEGDxJLwd6v2MEgqKYswF1J +50VqdWi398+4koamrpAt1YnRK/QPYknU6Sfir++MuONPKbmHwPQX3/wDupsG//n AvswjQEqfv03MvTPNpEr50EBpeRbeA== =jLYL -END PGP SIGNATURE-
[SECURITY] [DSA 4374-1] qtbase-opensource-src security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4374-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond January 28, 2019 https://www.debian.org/security/faq - - Package: qtbase-opensource-src CVE ID : CVE-2018-15518 CVE-2018-19870 CVE-2018-19873 Debian Bug : 907139 Several issues were discovered in qtbase-opensource-src, a cross-platform C++ application framework, which could lead to denial-of-service via application crash. Additionally, this update fixes a problem affecting vlc, where it would start without a GUI. For the stable distribution (stretch), these problems have been fixed in version 5.7.1+dfsg-3+deb9u1. We recommend that you upgrade your qtbase-opensource-src packages. For the detailed security status of qtbase-opensource-src please refer to its security tracker page at: https://security-tracker.debian.org/tracker/qtbase-opensource-src Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlxOvoMACgkQEL6Jg/PV nWQ5Vgf/RlQ9Wmx4fYN1+e2kNRcDz2EkA59YaYux+OTDvHGlS+pkQrlTWgJJZt/m AzIjXb3VLWj9VqmwMA0vhxRFRh+tc2mubA7He8SDwaKOl0Is2GpU3qEGH7Sx0XHj IxMqlxqDDXUQBTBWIFTA/Bi3uzD0sr7601PyPfUS0HI0c64Jw+HbtilwHtOqlDvW Kjeyd+Oem1T1JitdXbgRVpubeN8uN+UEcKPFCXSBz8JiKfbEIn2Cd2VlpiMQSM7B serZ1FYp2orHb22u9w/LSEsYMuFwnq2prBMoXHq7Znxr/pcqxTBzkrQ2VN5qQ0Tb fT9PLrG3DsE37/OyUnMneGKMCY5tsQ== =AW74 -END PGP SIGNATURE-
[SECURITY] [DSA 4325-1] mosquitto security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4325-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond October 25, 2018 https://www.debian.org/security/faq - - Package: mosquitto CVE ID : CVE-2017-7651 CVE-2017-7652 CVE-2017-7653 CVE-2017-7654 Debian Bug : 911265 911266 It was discovered that mosquitto, an MQTT broker, was vulnerable to remote denial-of-service attacks that could be mounted using various vectors. For the stable distribution (stretch), these problems have been fixed in version 1.4.10-3+deb9u2. We recommend that you upgrade your mosquitto packages. For the detailed security status of mosquitto please refer to its security tracker page at: https://security-tracker.debian.org/tracker/mosquitto Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlvRbKYACgkQEL6Jg/PV nWTXRgf+LVq6UqDlXYtQT9xVTNj+LwSpPZBSOAGAd8lhvPX2Z+GfS7mCnp8b9hnc KtT7SZ4BYaEhgrp7Jomo/XEBEkBKwpD9gOdHAtlzU6A6bwI3OSs5AY66ZqV32eJg 723D77W4hxzaqt0VBenARZTiei/O0u9sbjQxRylBCm/5J/tdMdzgSUoVpaO33WCw nrK2rG9TQtvMtRxpy3fk2MDiAb1xZVKmzoVg5BPJ+D/9px+9cqy0TciYY+kGhHh+ gV9HFsdWIAqw/HT+bq8k3XbQEesLHCcv1uzTXAyvPIZ6yYQvIesMVWqSDVqb25+H 5NroxHUQ2P8T6SLpOnVmX+phDs9nVw== =V3ia -END PGP SIGNATURE-
[SECURITY] [DSA 4280-1] openssh security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4280-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond August 22, 2018 https://www.debian.org/security/faq - - Package: openssh CVE ID : CVE-2018-15473 Debian Bug : 906236 Dariusz Tytko, Michal Sajdak and Qualys Security discovered that OpenSSH, an implementation of the SSH protocol suite, was prone to a user enumeration vulnerability. This would allow a remote attacker to check whether a specific user account existed on the target server. For the stable distribution (stretch), this problem has been fixed in version 1:7.4p1-10+deb9u4. We recommend that you upgrade your openssh packages. For the detailed security status of openssh please refer to its security tracker page at: https://security-tracker.debian.org/tracker/openssh Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlt9ATUACgkQEL6Jg/PV nWSHYggArjTv1/72Mxj8D8qXRiixHTY3QIRki03VOLQtk7tje8BmymeRerwmECGh fjBuF4sueVrBED7vWpf9+HU9Z8VYLDKQp56xMLlqnt1Ge5HaPVHLToY4gn/lOl+J pFGwn4BKYMlo+v/rnWg1Ay0n8DZnmg8GnBqgpeFI56AUy4rw9eaRAByI80Btd69u vInT9A/sOYmywD4fH6cl7JDDZHF1AxgkW9Jar/tTVQtR/PqT7Cb2RJmxOB75/BrG /8etuiWfh6sY4cBZco+AkXL2Yb97bJQdwDZQwqMLJtA2rdjSGA3zQdnzM8htrSYH p0SeM24q209KRsvXG9KM3vKWW4vohw== =qxOC -END PGP SIGNATURE-
[SECURITY] [DSA 4228-1] spip security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4228-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond June 14, 2018 https://www.debian.org/security/faq - - Package: spip CVE ID : CVE-2017-15736 Debian Bug : 879954 Several vulnerabilities were found in SPIP, a website engine for publishing, resulting in cross-site scripting and PHP injection. For the oldstable distribution (jessie), this problem has been fixed in version 3.0.17-2+deb8u4. For the stable distribution (stretch), this problem has been fixed in version 3.1.4-4~deb9u1. We recommend that you upgrade your spip packages. For the detailed security status of spip please refer to its security tracker page at: https://security-tracker.debian.org/tracker/spip Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlsiCn4ACgkQEL6Jg/PV nWQXoggApFwGkzK369kROgPl0gd6QMvtTdIZdxqS+0B7ax44BRE9jFUHI/ENMycq oWbq4jy8/8VuqsCX6PA/mKdlBtYktvj9SBH2zcEHhyyFZmZbPjtpRiY8Sd5iUrC0 k4IPTWkLLynZbUCcKs/bmMCOwPQorMfsFIFF18dVC4eiDMVlvaodKDXcvhfK/cS3 ycZH9Q+LNagKfNz8kgxoLQnL2RJJrd03WqGuU1l88xQ8nWjpg8DgMV3ZbzWLWib9 Ff6/J+AW8rKouNiBp9uuq16NhclK32tNjSIXrEmvae++Atiaj7vFHYahOhRfV7kN oC0BIlxWX5gE+20/z6v5US/aCrx9hg== =P0ev -END PGP SIGNATURE-
[SECURITY] [DSA 4219-1] jruby security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4219-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond June 08, 2018 https://www.debian.org/security/faq - - Package: jruby CVE ID : CVE-2018-173 CVE-2018-174 CVE-2018-175 CVE-2018-176 CVE-2018-177 CVE-2018-178 CVE-2018-179 Debian Bug : 895778 Several vulnerabilities were discovered in jruby, a Java implementation of the Ruby programming language. They would allow an attacker to use specially crafted gem files to mount cross-site scripting attacks, cause denial of service through an infinite loop, write arbitrary files, or run malicious code. For the stable distribution (stretch), these problems have been fixed in version 1.7.26-1+deb9u1. We recommend that you upgrade your jruby packages. In addition, this message serves as an announcement that security support for jruby in the Debian 8 oldstable release (jessie) is now discontinued. Users of jruby in Debian 8 that want security updates are strongly encouraged to upgrade now to the current Debian 9 stable release (stretch). For the detailed security status of jruby please refer to its security tracker page at: https://security-tracker.debian.org/tracker/jruby Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlsaS+EACgkQEL6Jg/PV nWS8Jgf+LHR9BYS8ZelTjDsbTy87E4DKALqLWORN+12IhLMOAYqM02RJsH6tgOvj nASVwqjKvOymnPAf+80dBU9VHY7vkNFryglhubUagHg+OqWHCg2Ovpm0JgR91nT2 TnFIGOvDpHmPqrTQ+yiDqsEC5E4ABveVbJ7uARQKZ3o4x5Gf8h+AnFZbNyZF9L4J d53EzgUKBU+8SEqla1jchqErxg1yBvzCpDHI3SsdX+P+Ofa2tH8slSt4Qy8KHqcS c9YGevgJLfl8ClqlST0hxYgNZhAxCJOocTUUnpBq1KKKx/PM1sW4w5+ynBHTuQoO dnK5UGVKVgRu6nVgY5pZ0mcUtIhC+g== =N+5Z -END PGP SIGNATURE-
[SECURITY] [DSA 4204-1] imagemagick security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4204-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond May 18, 2018 https://www.debian.org/security/faq - - Package: imagemagick CVE ID : CVE-2017-10995 CVE-2017-11533 CVE-2017-11535 CVE-2017-11639 CVE-2017-13143 CVE-2017-17504 CVE-2017-17879 CVE-2018-5248 Debian Bug : 867748 869827 869834 870012 870065 885125 885340 886588 This update fixes several vulnerabilities in imagemagick, a graphical software suite. Various memory handling problems or issues about incomplete input sanitizing would result in denial of service or memory disclosure. For the oldstable distribution (jessie), these problems have been fixed in version 8:6.8.9.9-5+deb8u12. We recommend that you upgrade your imagemagick packages. For the detailed security status of imagemagick please refer to its security tracker page at: https://security-tracker.debian.org/tracker/imagemagick Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlr/BU8ACgkQEL6Jg/PV nWTEIQf/YirH/RXDrvF4CRNZS3jPHCaNEmxXvvgs1tGTs04fQMPNdrEP2gZFfUnk hu83t7GjUE+J1DAjjgtZQ9PQYPGhXidOaKHR6kTcUTENySl5V8PLkdF1EFK1M2Tn CAd1TH4L5Q/2SFZnfBsu3KzpYOHWHSYl5BlJwwDznruGt7yAhHIGHP/RLRnlxJCx uYUhM3PyU41CATeLCMX/owea3ND7Ro+ZpEKHy7KDcdx0WLx29yBU1wNN2+kxGsEc ScHWGMFUMmTVeKtpfGF1rw5+8r6wgKiQoEzBPgSiXYLIDptTBTiS1rrBoy6hysXv hi8jcwjII6qmrEqwTGjN1yMAnx/CWQ== =UKUX -END PGP SIGNATURE-
[SECURITY] [DSA 4174-1] corosync security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4174-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond April 17, 2018https://www.debian.org/security/faq - - Package: corosync CVE ID : CVE-2018-1084 Debian Bug : 895653 The Citrix Security Response Team discovered that corosync, a cluster engine implementation, allowed an unauthenticated user to cause a denial-of-service by application crash. For the stable distribution (stretch), this problem has been fixed in version 2.4.2-3+deb9u1. We recommend that you upgrade your corosync packages. For the detailed security status of corosync please refer to its security tracker page at: https://security-tracker.debian.org/tracker/corosync Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlrVih0ACgkQEL6Jg/PV nWQ4tggAuZPJnVIcR+A+HMsW+LDldXgb14Y3OZ04RBE3493w0CTR1SWCLHs8xUUp tf7NsPc3pxCJR1HVXkrmMHEMd7pfzNcg6T/xE07wxoEG1cv1udILoWpBrPOAEL+p qKYDC07WBmyWF5/PbjU18os7y9QE2/6m4ZSlqEanAbqN3VRj3Jemp0yEzYO1NU2W tx5d97O6WOjdg8BfFxYFtBuqvmysXDB2y+8e6XmkDxV5dbI64b1Ssd2ejCdRLju1 ymQ4k1NvBlX6Cx1XETTdtTRSPOABBd26Cb9ZpmWwRghgR0vW6EqKFNWSs44CDUxm mH6BJWCCtptomJ8ZbGUobjxbSd1LXw== =vEL+ -END PGP SIGNATURE-
[SECURITY] [DSA 4147-1] polarssl security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4147-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond March 21, 2018https://www.debian.org/security/faq - - Package: polarssl CVE ID : CVE-2017-18187 CVE-2018-0487 CVE-2018-0488 Debian Bug : 890287 890288 Several vulnerabilities were discovered in PolarSSL, a lightweight crypto and SSL/TLS library, that allowed a remote attacker to either cause a denial-of-service by application crash, or execute arbitrary code. For the oldstable distribution (jessie), these problems have been fixed in version 1.3.9-2.1+deb8u3. We recommend that you upgrade your polarssl packages. For the detailed security status of polarssl please refer to its security tracker page at: https://security-tracker.debian.org/tracker/polarssl Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlqyZtoACgkQEL6Jg/PV nWQNXgf/dWbA84eKSfhDbsIGEHvazbvA1XakD0iG5aCYUJL/f2skDSxrCMQucXRU 9pBepOHTlaZ/yeQOvW4Jw+aThWtG0Y8VJU23+z5C66ClSXSdtsZ4lvFMbv610KVo zBbTQ8u92fyENb3Sl6IinT8WVkqJ5ed1060Qbj0jwKTQ35NDFDmDKxbT8j1Nx0za f974AeHE1kSApSHjkpr3gwbiAvzQn19pDuk5rN7dGns6tPvov6JmOrQRHr/JknEl aDGIM/VfXggPTZoh1pPlv3FOCf4po3+cpXuKR1YbwrLkcslQdOMdT2EQCNLq9RD3 SGBi7CnlM1Bw33K0NTo1OJRcIuCXQg== =ndmj -END PGP SIGNATURE-
[SECURITY] [DSA 4138-1] mbedtls security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4138-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond March 15, 2018https://www.debian.org/security/faq - - Package: mbedtls CVE ID : CVE-2017-18187 CVE-2018-0487 CVE-2018-0488 Debian Bug : 890287 890288 Several vulnerabilities were discovered in mbed TLS, a lightweight crypto and SSL/TLS library, that allowed a remote attacker to either cause a denial-of-service by application crash, or execute arbitrary code. For the stable distribution (stretch), these problems have been fixed in version 2.4.2-1+deb9u2. We recommend that you upgrade your mbedtls packages. For the detailed security status of mbedtls please refer to its security tracker page at: https://security-tracker.debian.org/tracker/mbedtls Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlqqS+sACgkQEL6Jg/PV nWTGzAf/Qxdeu9zdq0KMbcx7yKbr1zpchng/Y7doZFZviKjK2eZb1KvXCR3LqHzx L4+fZE/aK1cfQXdG424xYZkKGrpcz7WFyZV7euDv0vFpk4QmdDQHHVS+jPqvbRT2 x0ekhE98uKzJirOTdES2P2yrF+eNYtRowxbqw0q2uqchGmwYnRKYaApSbSaaaybN 4Ltoj3bTIv0dyEDN95JTzRY405iwVaeQiP5+RjlTnAo2wVQmw1GVV1Dm+fIOMo+i hc41fuKdHrGTod4Gh1opg3cF7AKGoL2cRBrbBVMZp6mk+cdjwXoWrmDzxol7sHXO Rp4o8Ci2n36DYFtugUaBnDVumcLk0w== =tk/E -END PGP SIGNATURE-
[SECURITY] [DSA 4128-1] trafficserver security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4128-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond March 02, 2018https://www.debian.org/security/faq - - Package: trafficserver CVE ID : CVE-2017-5660 CVE-2017-7671 Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forward proxy server. They could lead to the use of an incorrect upstream proxy, or allow a remote attacker to cause a denial-of-service by application crash. For the stable distribution (stretch), these problems have been fixed in version 7.0.0-6+deb9u1. We recommend that you upgrade your trafficserver packages. For the detailed security status of trafficserver please refer to its security tracker page at: https://security-tracker.debian.org/tracker/trafficserver Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlqZem4ACgkQEL6Jg/PV nWRrngf+N5S4zOMBaPdHfJN27x0ZTcEiNxvCh1yc2xQyu3suc+dSsFQ2adeEUIlC Jbd6zi11P9MoVDSrk4ywLX9AQz+E60UKMhnarUYWzhPvC76aFbXV2x3968TPXNoD wA5gXvE0w29OyNnSEAN8haEwMNv6BQcrSLE9SO4GI9cdfwM06rpYhVTKi78t+CZH wYiOuYgBNChNE5WoyJ4fypbxRLUzRNNNW0u/URX4rcxBvzAQ/Dikn5wX5z1Tl2t6 tfUo7Z6QYex3VwzPXbFcWWm6QQACoRPRmh16UK4/lWwvo0faa9f2usX3u+bIowWF rArW6BygAPlXiIuAnhE7aBlazRMiDQ== =Bawx -END PGP SIGNATURE-
[SECURITY] [DSA 4092-1] awstats security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4092-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond January 19, 2018 https://www.debian.org/security/faq - - Package: awstats CVE ID : CVE-2017-1000501 Debian Bug : 885835 The cPanel Security Team discovered that awstats, a log file analyzer, was vulnerable to path traversal attacks. A remote unauthenticated attacker could leverage that to perform arbitrary code execution. For the oldstable distribution (jessie), this problem has been fixed in version 7.2+dfsg-1+deb8u1. For the stable distribution (stretch), this problem has been fixed in version 7.6+dfsg-1+deb9u1. We recommend that you upgrade your awstats packages. For the detailed security status of awstats please refer to its security tracker page at: https://security-tracker.debian.org/tracker/awstats Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlphtDgACgkQEL6Jg/PV nWRmuwgAmVAKcZjARRVoHOatp4foI9QPyCtTwZAfw+46H1SoA92y72LL3lCvHfre OHoOaJdVWY937guS812xSWbfWkw+u+RCLq9WyHlrJQor1IgPnF54kNbMHnyYb5RF +63i3ZrBfqfUqBLkYhsVdDIcLRe/f973mv3MJvI8WuZyJ7c5aGx1KeL2HiWbLTeQ rf5+E6vWbAGSR13+E/5AEM1CQ69CzsTcXJo6txeQwOnVNMb3S5ln6iKHczpTcO5C FSNs7pawHGaZubFAQcf+nFjcGnA9Ix+kxWAunPtp3vXagADWfS1cnXi0QUkEG3nv d5AlDg8JvdsnTX/KudXC3nqAfEhRsw== =7vDn -END PGP SIGNATURE-
[SECURITY] [DSA 4084-1] gifsicle security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4084-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond January 12, 2018 https://www.debian.org/security/faq - - Package: gifsicle CVE ID : CVE-2017-1000421 It was discovered that gifsicle, a tool for manipulating GIF image files, contained a flaw that could lead to arbitrary code execution. For the oldstable distribution (jessie), this problem has been fixed in version 1.86-1+deb8u1. For the stable distribution (stretch), this problem has been fixed in version 1.88-3+deb9u1. We recommend that you upgrade your gifsicle packages. For the detailed security status of gifsicle please refer to its security tracker page at: https://security-tracker.debian.org/tracker/gifsicle Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlpYpIwACgkQEL6Jg/PV nWRjYAgAo0Drf8Jo7xHbRjuStl9ixkAC/UBNOngLvs38BdE5hDPRMIngwjnKEIGl ms11ascazOu4vKRbsZwQxt0mDI6J4XMnMBSLV4JfsFlqdNTFwdyLSAULHEJ6/N3T zBRMfW8nD/kYWLbyFkTG3BXXWmgCXXSuwoXg2+G4rUox2XK4PNAJ0uloveQS46pm GwYgqS4f9HFBAbXZnUDfQHdUsRZ/Q2spzvvBT69n88jEEYAcGi7YDW+smDXGgnuU Vsu3N+dPrCLLPAsUPsyFbLEXxbg9el4chLe2Ged/ZUUYt/ZGZlM5t4MR9HqtORNB gB1ApmNxoTyC0Y5BrqmSU+mmXvVfDQ== =jqum -END PGP SIGNATURE-
[SECURITY] [DSA 4083-1] poco security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4083-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond January 11, 2018 https://www.debian.org/security/faq - - Package: poco CVE ID : CVE-2017-1000472 Stephan Zeisberg discovered that poco, a collection of open source C++ class libraries, did not correctly validate file paths in ZIP archives. An attacker could leverage this flaw to create or overwrite arbitrary files. For the oldstable distribution (jessie), this problem has been fixed in version 1.3.6p1-5+deb8u1. For the stable distribution (stretch), this problem has been fixed in version 1.7.6+dfsg1-5+deb9u1. We recommend that you upgrade your poco packages. For the detailed security status of poco please refer to its security tracker page at: https://security-tracker.debian.org/tracker/poco Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlpXJZkACgkQEL6Jg/PV nWQSAAgAyZdKxW5ach7bfDAW9JiPHMAMW5Z32DFgmcEqfmYhFbTa9I3nF6yABjiJ QTF2eSwmPDua6QzozOI4OGAFfO0aJ4DH70pEuj1B0Ea5CItiMeZXXFiquL6sdjud OJTt1Iwh5eKRW0iOenQw24QU4Zd6r254MpIYtppdHfVYF45/E08KcTh78yTEpB5a XR4L23oVQOonytc0GASV/mogfce5bPRMvaGMONQo3d66Dfe5grFFUfO9yrhT47G1 r3eIsMvPWHp6tiCToiZ4nc2/z+o8rp/oBP+y9imvHrZXpsdEjl9DOM0miBrqmzZ6 NOSk3Dywnxm+JPwxJNNf/fm7zbYALw== =cZI8 -END PGP SIGNATURE-
[SECURITY] [DSA 4056-1] nova security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4056-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond December 07, 2017 https://www.debian.org/security/faq - - Package: nova CVE ID : CVE-2017-16239 Debian Bug : 882009 George Shuklin from servers.com discovered that Nova, a cloud computing fabric controller, did not correctly enforce its image- or hosts-filters. This allowed an authenticated user to bypass those filters by simply rebuilding an instance. For the stable distribution (stretch), this problem has been fixed in version 2:14.0.0-4+deb9u1. We recommend that you upgrade your nova packages. For the detailed security status of nova please refer to its security tracker page at: https://security-tracker.debian.org/tracker/nova Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlopB00ACgkQEL6Jg/PV nWQvGwgAh+clzIDc7FdEhuYFSmGPz8XOxnIsvyymeYxvz/M3gCkQU2tdw/80Jv78 Y35pP1g8u/rq1Ub4cV6QAZt1UK571m8qXFqh/mnxOwFuqQJrkY0L8pu93anRVAz3 uwPlwC3jKo4dEyi4QDphGc54qiqf28twWz8iX+XdnBVG++T7ZAZykbqU5+WlNpQF 5kpbFsUV38W6jP2VyQ/2/Uozh839rnhBmQ/Sy9gIbIeycbp0Veigwh5PVnXgXqvA 83O8oTr2++5prB24ESFcl8FQ82kjs2suf4M1IbLJyJrsT6X1VORcYz6PPW/v3EVq whmgpC6orU68AoPGo4FDHV8UpH7HoA== =+GR1 -END PGP SIGNATURE-
[SECURITY] [DSA 4055-1] heimdal security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4055-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond December 07, 2017 https://www.debian.org/security/faq - - Package: heimdal CVE ID : CVE-2017-17439 Debian Bug : 878144 Michael Eder and Thomas Kittel discovered that Heimdal, an implementation of Kerberos 5 that aims to be compatible with MIT Kerberos, did not correctly handle ASN.1 data. This would allow an unauthenticated remote attacker to cause a denial of service (crash of the KDC daemon) by sending maliciously crafted packets. For the stable distribution (stretch), this problem has been fixed in version 7.1.0+dfsg-13+deb9u2. We recommend that you upgrade your heimdal packages. For the detailed security status of heimdal please refer to its security tracker page at: https://security-tracker.debian.org/tracker/heimdal Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAloo8VsACgkQEL6Jg/PV nWQsrQgAkOt019q15yl6Ctx1SzWHNT0NfOFybG8WzMp1TZ3JzjsoRUSffymWKceB mJiuim5J+5se2+bVEMkblsXuNmbqnn1EaTwZ6XjI41J5Kv+/2qvbGsosvGP8JdTB 0cHWgSyNTaV8mwD745AoctIN8BL/5lxO3r7LjC8Mpw+W7l3XjhK6SfGL2QHd65BY 6K2r1hHTypOM3iLSNnWC2nR9/4OK5RU2JBvK9kjP4cRJJzZX7JacR53tO/+bY4eL 5fEzXexh97jNW7M5svJtCsdyoEwauAtkIl6noLGTs+K/a8afw8VU0gDQfTD35d3H e+rG1WMEv0H1tYQGdIKOGqtWYuNQKQ== =iHQJ -END PGP SIGNATURE-
[SECURITY] [DSA 4046-1] libspring-ldap-java security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4046-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond November 22, 2017 https://www.debian.org/security/faq - - Package: libspring-ldap-java CVE ID : CVE-2017-8028 Tobias Schneider discovered that libspring-ldap-java, a Java library for Spring-based applications using the Lightweight Directory Access Protocol, would under some circumstances allow authentication with a correct username but an arbitrary password. For the oldstable distribution (jessie), this problem has been fixed in version 1.3.1.RELEASE-5+deb8u1. We recommend that you upgrade your libspring-ldap-java packages. For the detailed security status of libspring-ldap-java please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libspring-ldap-java Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAloVtEUACgkQEL6Jg/PV nWSbSgf/aBFHoKWTrjUx9W++O+Fc7Or0ZqMYZgHRTmWxorIRL+QT18jxVYYwnKfe JLvjuX68foYcS9oArbcNbafYWgjkRVZZCA05+RT8ws0c4qC4/0Gf909jn/7iUCp1 4bLdLNYrTm5rkk2a1iNOu7GDAo5bTanj/0uZVKp78U9mn3bJkzjy+TUSAe9Aw/fa pBAGlIJfp7PSTB1BHjaW2cHActuTOKQyT9rN33GFK3lX40TqMesyOL7mZiJtBJ/C +YtlrdHHL8uuQA9Fg6LMEzwMBOtmtgvaN6yVpn80BZSQ6nsL+r+xQRutGPup1Gq0 xaYT8ClXlaYknaKtTbZ6dJMdmvz4Bg== =4Vlo -END PGP SIGNATURE-
[SECURITY] [DSA 4037-1] jackson-databind security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4037-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond November 16, 2017 https://www.debian.org/security/faq - - Package: jackson-databind CVE ID : CVE-2017-15095 It was discovered that jackson-databind, a Java library used to parse JSON and other data formats, improperly validated user input prior to deserializing: following DSA-4004-1 for CVE-2017-7525, an additional set of classes was identified as unsafe for deserialization. For the oldstable distribution (jessie), this problem has been fixed in version 2.4.2-2+deb8u2. For the stable distribution (stretch), this problem has been fixed in version 2.8.6-1+deb9u2. We recommend that you upgrade your jackson-databind packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAloNf+oACgkQEL6Jg/PV nWTBnggAogzxlYvQ7LVYtUo8TLj2LLOUdeXAzDvUK8fCAXVxfwGUBayM81jy2DPL IRx+GLdnnturazObeVtwdw+7ipLkMwviQkUdfqjwlL71XoKLTnAdaL+pmcfdQTZm Zi+IouYhKkoGdrHNx6CLW7/xQJc3WU6vHC2Mnl6YrVvvkgkQwZHrJuHwfdW0ZBD1 /0gZlc72Uh5pSQAQNIbHMdvbKjyhctH7ZFIN/G+AehPD1lIW9nPgM0B0Tr3QavzF vy1plEmWgeTXCHwhZFPZcNuAdcO4bhZEfm8r/ZixXcKBqdaknMiXpvO6IsPhwhTv WfSQKHm2EnMgu5qxudy+QvJW/KUi7A== =3gTd -END PGP SIGNATURE-
[SECURITY] [DSA 4026-1] bchunk security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4026-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond November 09, 2017 https://www.debian.org/security/faq - - Package: bchunk CVE ID : CVE-2017-15953 CVE-2017-15954 CVE-2017-15955 Debian Bug : 880116 Wen Bin discovered that bchunk, an application that converts a CD image in bin/cue format into a set of iso and cdr/wav tracks files, did not properly check its input. This would allow malicious users to crash the application or potentially execute arbitrary code. For the oldstable distribution (jessie), these problems have been fixed in version 1.2.0-12+deb8u1. For the stable distribution (stretch), these problems have been fixed in version 1.2.0-12+deb9u1. We recommend that you upgrade your bchunk packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAloEk+wACgkQEL6Jg/PV nWQThAf+O/cqMInKkiwqZ72TdQiADpZgta7ZKCA8gmLMIUwgirZhZxoJAY2AIebR M/QPVlBzyo/W5jxbzZD/YO4ZlbKF/X5opiBW+2oXxnPH92zDSDSYrZ1tCzLBwLZT GzsVdUx+p8AQX0W1NBaX49RG6jyrMA+LwsdwCLAlyvdQsCYASrG0QheFpOHtE6Fh Oe6MbaG3iepNWZl0qEdTQfPO8yEYP6hQ9eUo2dUAnEUyhLvuRPNCtPutS/EhB715 awMvJ4hKQ9g5WaEeZPf5DlLbdpcBY+oVQPe8wrSh+qHnuMGMrtTUwlD/xxrt5uoJ gWxJK6iTJqHS731J1oECJxiQum/MBw== =pVF7 -END PGP SIGNATURE-
[SECURITY] [DSA 4010-1] git-annex security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4010-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond October 30, 2017 https://www.debian.org/security/faq - - Package: git-annex CVE ID : CVE-2017-12976 Debian Bug : 873088 It was discovered that git-annex, a tool to manage files with git without checking their contents in, did not correctly handle maliciously constructed ssh:// URLs. This allowed an attacker to run an arbitrary shell command. For the oldstable distribution (jessie), this problem has been fixed in version 5.20141125+deb8u1. For the stable distribution (stretch), this problem has been fixed in version 6.20170101-1+deb9u1. We recommend that you upgrade your git-annex packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAln21ToACgkQEL6Jg/PV nWRtQAf9Ei+h60JxNnNzcD+Ymrw79U0YMEGLmvuBwDLVoChsHj9XYhMvW/AWCNhf G6zMjmhwNH33vY8XPfaOnTdZiKKY7sIdOqCFT0besXrxIutJqj9qv61A33s9XSXs KAvtCkI6IywY+Gwo7BYaohA2gIIvopLfW9ssc/ZwGMnNE5ahFX6jPFhZz4oL9Luj 9Y6HzJobJihAlVtaPki5wNwZcz2WshIp3yV6+0nsUpxDpomVimEWbcCkf2LdmP4p PsftHwRjMLNHZk4M1ZCF4EYi4rQh/P1ECxl45puuiOqI2kBIzxO/QJviTK2y3Rj0 +NLx8qR+fb/sKKLbgfKvQs0QSRkIpw== =VejX -END PGP SIGNATURE-
[SECURITY] [DSA 4004-1] jackson-databind security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4004-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond October 20, 2017 https://www.debian.org/security/faq - - Package: jackson-databind CVE ID : CVE-2017-7525 Debian Bug : 870848 Liao Xinxi discovered that jackson-databind, a Java library used to parse JSON and other data formats, did not properly validate user input before attemtping deserialization. This allowed an attacker to perform code execution by providing maliciously crafted input. For the oldstable distribution (jessie), this problem has been fixed in version 2.4.2-2+deb8u1. For the stable distribution (stretch), this problem has been fixed in version 2.8.6-1+deb9u1. We recommend that you upgrade your jackson-databind packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlnpjfIACgkQEL6Jg/PV nWRpNgf/Qr9B9O5J6JfcQIZV2j0gFEtskjYjzw0Mus+TC1IMFHOLRcKMD4O0FgGO IY8IPrBoefyvYxwwZNVCY86yo21uiMNAqmAnJBBpt0t7GCViDyKDJNK+ksNH6Ey9 bjEF+Pck4Ku5bHXUEb0/W1u91I6dKye1wP4R3S8sUaGxlEDeVPJTfGtXTpe+oB+Y CO7J3XtzpaF4d83SFLmOCobWBe0zKWHvTu5PiJdSwJvhEPmFNkTrs2v8yhxmS8Gv K0kF8P8EdXS2pB5sxKV17nw0IIs+D3nVey1BitNkhhQ862ChlkgYMspjukcBuwHd W2/rMyC2JxiXyeT4w8CxNok2BHjKRg== =RuHf -END PGP SIGNATURE-
[SECURITY] [DSA 3974-1] tomcat8 security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3974-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond September 15, 2017https://www.debian.org/security/faq - - Package: tomcat8 CVE ID : CVE-2017-7674 CVE-2017-7675 Debian Bug : 802312 Two issues were discovered in the Tomcat servlet and JSP engine. CVE-2017-7674 Rick Riemer discovered that the Cross-Origin Resource Sharing filter did not add a Vary header indicating possible different responses, which could lead to cache poisoning. CVE-2017-7675 (stretch only) Markus Dörschmidt found that the HTTP/2 implementation bypassed some security checks, thus allowing an attacker to conduct directory traversal attacks by using specially crafted URLs. For the oldstable distribution (jessie), these problems have been fixed in version 8.0.14-1+deb8u11. For the stable distribution (stretch), these problems have been fixed in version 8.5.14-1+deb9u2. We recommend that you upgrade your tomcat8 packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlm7v8kACgkQEL6Jg/PV nWTiaQf/VyP0zFZLkavB79tt1VOOL4SySHg2EiHt1mIcoWg40varb/yFffS5Hoax pltX7er3jF1mJBaXrM2D4Sz2xTIRrDolf1SK6rnUn8z3Jg7jhD5SZy/y8aEY6+H8 Wfj5CZ2Y3S1WYSXsVqH08/hUCmCke5vxUc4s8FTaDVSfVfX/xoFrD3Juo1MNOo67 oP9RbjL24CNSosJn51eMDbYEHq0rpBa+NrkwSlkmd1kG6H4jnTna2b4YYeJsEULy UFBpoaSxY1pmsflfNifE5aU7Np6G2cundReDnnij+RUM6YBEdCO8uCw/YqRKgNnb DGUwNCoS7/DQ2a9IkKt+8yEFPOMpBw== =xr3r -END PGP SIGNATURE-
[SECURITY] [DSA 3963-1] mercurial security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3963-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond September 04, 2017https://www.debian.org/security/faq - - Package: mercurial CVE ID : CVE-2017-9462 CVE-2017-1000115 CVE-2017-1000116 Debian Bug : 861243 871709 871710 Several issues were discovered in Mercurial, a distributed revision control system. CVE-2017-9462 (fixed in stretch only) Jonathan Claudius of Mozilla discovered that repositories served over stdio could be tricked into granting authorized users access to the Python debugger. CVE-2017-1000115 Mercurial's symlink auditing was incomplete, and could be abused to write files outside the repository. CVE-2017-1000116 Joern Schneeweisz discovered that Mercurial did not correctly handle maliciously constructed ssh:// URLs. This allowed an attacker to run an arbitrary shell command. For the oldstable distribution (jessie), these problems have been fixed in version 3.1.2-2+deb8u4. For the stable distribution (stretch), these problems have been fixed in version 4.0-1+deb9u1. We recommend that you upgrade your mercurial packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlms+vwACgkQEL6Jg/PV nWQD6Af/Qd87aCWVfqfpCjeHpW+l6JWU/90pbf6pAFNt56WJzKm0A6HZi0ep1Pvg QBIB7V97Nu35gCYgzvAL4Mj35vV1WdVPNBfPzcLByC3b0U615GkM58egNCwz6bt2 PFYOn7GE1T0eph0vNxAh5cktyJMnNfD2su61kinxYvtOZPnBVKGeqmvB51gGMlmA eGcmPUxNsrjBxTaBW7L2vMjHb4zp+dQQYn3So4bRQS0vSIIl77+D2hZO+Pme4XZO LW4B6kTiwMCRbLDfy2I8+qyZdaIrs9rrfyMYeBC2+lYlL+u05qUrj/9+Igf8KBOa jPketS2AOfb3hS4o123Kfv4Rwuqesg== =i/YV -END PGP SIGNATURE-
[SECURITY] [DSA 3958-1] fontforge security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3958-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond August 29, 2017 https://www.debian.org/security/faq - - Package: fontforge CVE ID : CVE-2017-11568 CVE-2017-11569 CVE-2017-11571 CVE-2017-11572 CVE-2017-11574 CVE-2017-11575 CVE-2017-11576 CVE-2017-11577 Debian Bug : 869614 It was discovered that FontForge, a font editor, did not correctly validate its input. An attacker could use this flaw by tricking a user into opening a maliciously crafted OpenType font file, thus causing a denial-of-service via application crash, or execution of arbitrary code. For the oldstable distribution (jessie), these problems have been fixed in version 20120731.b-5+deb8u1. For the stable distribution (stretch), these problems have been fixed in version 1:20161005~dfsg-4+deb9u1. We recommend that you upgrade your fontforge packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlmlIokACgkQEL6Jg/PV nWT9QAf9GKd21mv9ExDFSOID2I+cIinOrZRSkOvnZSHVLhaJIg4yhhWOCfquktoU CgVRMuH02qeR/4PNJCvqC7mq0tvWg6TVJqtQGVQhqQmLqwA7m1bz0qzi4uBfEsML rFmmttIPNqi9J6gydeqJHG1Pl0eJWxsIpzKr6ZNeb+SxurE3mkhCsUW8mqkl8brb LtD7kxD573pS1L7Ny9mYm8ZutIN05dm/VqntleOxE1QeHDMBZVTChowT6RK7bq/q GWAgGoWZwF3JJCf8TW1ybXM/BHuSEh/v5k6srGt/kO7gM4tDdeNVlz1GXuT3GTI5 YI9BM6MO2NKq1eG4lt43GCq6gcjFVg== =AQ9b -END PGP SIGNATURE-
[SECURITY] [DSA 3949-1] augeas security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3949-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond August 21, 2017 https://www.debian.org/security/faq - - Package: augeas CVE ID : CVE-2017-7555 Debian Bug : 872400 Han Han of Red Hat discovered that augeas, a configuration editing tool, improperly handled some escaped strings. A remote attacker could leverage this flaw by sending maliciously crafted strings, thus causing an augeas-enabled application to crash or potentially execute arbitrary code. For the oldstable distribution (jessie), this problem has been fixed in version 1.2.0-0.2+deb8u2. For the stable distribution (stretch), this problem has been fixed in version 1.8.0-1+deb9u1. We recommend that you upgrade your augeas packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlmaoi0ACgkQEL6Jg/PV nWQa6AgAuDE/urqDtUlXt53PL3b9pZsUSdKQ+74l64hhKMV0+kQ8SSitBdcjXR/8 1nsdd7Qi36lOCwYv7EEcCqz98puB+ef31LwVZiYbVLAG6YT54Zl7XSSIpXx94Ef+ JCAJ8NGOCLoqHjTNtsQVnPMtLUbV42aDqlNeDgMEXzvoDb/k8R4CmrSMremz8xn9 0bPuziBV73NfQAf3hnrj+Q+whEHg9rCie/wsH1m6QcpibJEJpLlTC1gV8PZehGMM g3h+H2XV/YrMR1swecIH5VxIEeLCL0mgeLJ4azfIxyWH0adVFRCRp8ZiZ3c2KyQS ejEgj24vgFvrvdQWGAeeh0dl2e/LWw== =502b -END PGP SIGNATURE-
[SECURITY] [DSA 3946-1] libmspack security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3946-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond August 18, 2017 https://www.debian.org/security/faq - - Package: libmspack CVE ID : CVE-2017-6419 CVE-2017-11423 Debian Bug : 868956 871263 It was discovered that libsmpack, a library used to handle Microsoft compression formats, did not properly validate its input. A remote attacker could craft malicious CAB or CHM files and use this flaw to cause a denial of service via application crash, or potentially execute arbitrary code. For the oldstable distribution (jessie), these problems have been fixed in version 0.5-1+deb8u1. For the stable distribution (stretch), these problems have been fixed in version 0.5-1+deb9u1. We recommend that you upgrade your libmspack packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlmWriEACgkQEL6Jg/PV nWSjpAgAoBv5fbJpOjLiluLV3ArGCiIg2W2XYrHUe309kFpomZ3OqFoW3d6OO7xS 9msEABEYEHfGdTSFWzAz9gPv3Q0B/hZcO+Hjv7SRYoNNO8DnBkLvOMyzmJ/Av/6n aDIifUOU94EMFp9t0MbCJxOQBhWqZgye5w8JG7bHjn9YUN/qGX/6rdp7RoCyXF8+ UNptvNSOqEslrByLeoSbe4Wpv+jEdTZHjVzyT8nEv7tUbfXhMIFQWYWUiFuIwTiX 8HUAxWA2bGwiAryjw/qo2mjdbfcR0Mq0wyL4Yuh4OLjsug6rIxwzSMa7/XA+GGFy jzcc4eNuKRE+ZddmbbXe1OKHHe1wkQ== =hX4O -END PGP SIGNATURE-
[SECURITY] [DSA 3940-1] cvs security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3940-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond August 13, 2017 https://www.debian.org/security/faq - - Package: cvs CVE ID : CVE-2017-12836 Debian Bug : 871810 It was discovered that CVS, a centralised version control system, did not correctly handle maliciously constructed repository URLs, which allowed an attacker to run an arbitrary shell command. For the oldstable distribution (jessie), this problem has been fixed in version 2:1.12.13+real-15+deb8u1. For the stable distribution (stretch), this problem has been fixed in version 2:1.12.13+real-22+deb9u1. We recommend that you upgrade your cvs packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlmQFhwACgkQEL6Jg/PV nWST2Af+PpoK8xsgAPPNowUS7+Vg4y/ogmf/s5aRTbWw0w1y2aAC0kz1VohUhP+q lNypM1gNqUCnRL5r/e7EfsTkj5Xwk355wizHg2VgElpv+HAFSMu3y78O3tA3R9Hb VCT0YCzsOOt9UlnMgZMMNJf2yeXYFgTj94j4W2yf2Q4h3v3wvWCwH4vEAjC0qoBC RvnDvxJv0sJWKBmZExv2QCIojROlSjBYju0DYFzZnacrHH6HrjI77jy7IUSZxQnN CWEI03Xla2QAeW541r0YGhKFoC9+aMbXQnn8miJv8s3jSggIZYw/QVADRRbHk5Q5 SDHYK3IynlpBqBVtuT4Ak6DrHLjDBQ== =Rc7I -END PGP SIGNATURE-
[SECURITY] [DSA 3934-1] git security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3934-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond August 10, 2017 https://www.debian.org/security/faq - - Package: git CVE ID : CVE-2017-1000117 Joern Schneeweisz discovered that git, a distributed revision control system, did not correctly handle maliciously constructed ssh:// URLs. This allowed an attacker to run an arbitrary shell command, for instance via git submodules. For the oldstable distribution (jessie), this problem has been fixed in version 1:2.1.4-2.1+deb8u4. For the stable distribution (stretch), this problem has been fixed in version 1:2.11.0-3+deb9u1. We recommend that you upgrade your git packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlmMrNUACgkQEL6Jg/PV nWRICwgAlwokEXk2KcCA2aT8lnNlKjM2Ur97JlCB0Ceyu3l+wFfeTeRAN3wRBZAg UNbeElPoCkpLJGiqiSIz7E1EOn5GmMUGoCqy2HWrDvYAKaMvkvWUOHtBaq3nvrGg HsLGc3g70zf2Egv06R94jBisktqn847OAs9FMKz6mrnxZsRCGQPIe57+GYHC3dH9 bTGnwEYiBI5gkQV4uIheVGxKBup9CB5CXQWx9suzG5YRNXLpp1PIBSOaqM4Tstam Kk1yXM1qVlZ6tKwCMsIJJ7aBs5AEt1cYLQqxjr917zoACwiGOuAiAvJZs+Mlsb2Y aAc1b/mWIMC3oB6hxl1Lsr6V2/4M4Q== =VNzk -END PGP SIGNATURE-
[SECURITY] [DSA 3932-1] subversion security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3932-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond August 10, 2017 https://www.debian.org/security/faq - - Package: subversion CVE ID : CVE-2016-8734 CVE-2017-9800 Several problems were discovered in Subversion, a centralised version control system. CVE-2016-8734 (jessie only) Subversion's mod_dontdothat server module and Subversion clients using http(s):// were vulnerable to a denial-of-service attack caused by exponential XML entity expansion. CVE-2017-9800 Joern Schneeweisz discovered that Subversion did not correctly handle maliciously constructed svn+ssh:// URLs. This allowed an attacker to run an arbitrary shell command, for instance via svn:externals properties or when using 'svnsync sync'. For the oldstable distribution (jessie), these problems have been fixed in version 1.8.10-6+deb8u5. For the stable distribution (stretch), these problems have been fixed in version 1.9.5-1+deb9u1. We recommend that you upgrade your subversion packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlmMqV0ACgkQEL6Jg/PV nWRK+ggAgTLGpBr6HhwRYwjZ0jIGVZ0+CF3Wq7ypkYdyW4C/SQSgoefQ9PLdrr8A FShgukqNtRE626pc6vLBvNWTC1xtyB3Oez5qy/Hlpi4O5eV4NBLJSN1Yo8vsFlmi t++uI9+v+pZ1I2LUYptmJH8Zf+MsT22VIpqMxbvFPvQUWp5+rCwKsl743KVsqAqo acXR0o74D0jeCMtcAdAVSbO6zelac6fl+AM7729oxW5aoB6qXWDWphYouq2e1CTR KfeBI02i61z2L6N0k1WzPfSvl0DGlN2PJ8WtAlW8iRIX0KL/FAM9VuE/92pVGZWr 7b7fYjiRiQKV5dxVjODbus39EX+avQ== =MQa7 -END PGP SIGNATURE-
[SECURITY] [DSA 3930-1] freeradius security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3930-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond August 10, 2017 https://www.debian.org/security/faq - - Package: freeradius CVE ID : CVE-2017-10978 CVE-2017-10979 CVE-2017-10980 CVE-2017-10981 CVE-2017-10982 CVE-2017-10983 CVE-2017-10984 CVE-2017-10985 CVE-2017-10986 CVE-2017-10987 Debian Bug : 868765 Guido Vranken discovered that FreeRADIUS, an open source implementation of RADIUS, the IETF protocol for AAA (Authorisation, Authentication, and Accounting), did not properly handle memory when processing packets. This would allow a remote attacker to cause a denial-of-service by application crash, or potentially execute arbitrary code. All those issues are covered by this single DSA, but it's worth noting that not all issues affect all releases: - CVE-2017-10978 and CVE-2017-10983 affect both jessie and stretch - CVE-2017-10979, CVE-2017-10980, CVE-2017-10981 and CVE-2017-10982 affect only jessie - CVE-2017-10984, CVE-2017-10985, CVE-2017-10986 and CVE-2017-10987 affect only stretch. For the oldstable distribution (jessie), these problems have been fixed in version 2.2.5+dfsg-0.2+deb8u1. For the stable distribution (stretch), these problems have been fixed in version 3.0.12+dfsg-5+deb9u1. We recommend that you upgrade your freeradius packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlmMcIgACgkQEL6Jg/PV nWT0QQf/YXstsKWljtn5stb9LLdmDXBWoRBdstYpYEUyYVXcJMFMwQyyZJj7N2Yv BNX3EYTv8+8QzHJSEmO7bXfLf+QHGBC4k8F2+EwSPxkc1fg8bIhcT/oCe95q7o7t n64PmW0JTuCIaK7xosxvxSCnFaDKgJ8Eq3RQ8moRA0RKoAzK15c2pGtVN9cTeZkj 5eQXstBR4xCUWBWHHdYiZKhqMSUqYf09UTgCpPqhDka6RJrXfFZuaaHWrstUUiI2 kl/3zprVUwdGS49Em1PjusCxx07Rri8frKj4NsBcCmvdLJ79TXelaMQvgr66j7bm DcjWUWKgB2iPOlodd++1zA25gaFVpg== =9u8a -END PGP SIGNATURE-
[SECURITY] [DSA 3923-1] freerdp security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3923-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond August 01, 2017 https://www.debian.org/security/faq - - Package: freerdp CVE ID : CVE-2017-2834 CVE-2017-2835 CVE-2017-2836 CVE-2017-2837 CVE-2017-2838 CVE-2017-2839 Debian Bug : 869880 Tyler Bohan of Talos discovered that FreeRDP, a free implementation of the Remote Desktop Protocol (RDP), contained several vulnerabilities that allowed a malicious remote server or a man-in-the-middle to either cause a DoS by forcibly terminating the client, or execute arbitrary code on the client side. For the oldstable distribution (jessie), these problems have been fixed in version 1.1.0~git20140921.1.440916e+dfsg1-4+deb8u1. For the stable distribution (stretch), these problems have been fixed in version 1.1.0~git20140921.1.440916e+dfsg1-13+deb9u1. For the unstable distribution (sid), these problems have been fixed in version 1.1.0~git20140921.1.440916e+dfsg1-14. We recommend that you upgrade your freerdp packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlmAJrwACgkQEL6Jg/PV nWRGTggAvrKAdr07xRi4Jv4qpvhWcUGS0FvDmIPfKxCKl7oX12nrJmkZysA27cck Ql5AIj+H2VgrgnKS0Zc9FgXpXHo+UpOANqJCN8FlFNvH6v+EanzxOSy1cyScSEj0 t8d1nwtLXlHL3XLArk1DkfSDGkuHbLtMO01ENvzQG2SAemqo+nhGucHdFDHinD44 RLRCPKV0h08UilUqd8WAeYxP6NwiedP34+TngaMZ0iZ/ctVjIPLUqkoIok7oMZRm mEkjtGtzFQj6TlPcSohSQoSRWHEcQeCiLdZVI1qmxavzmI3n96ZotOb53g26aIMI QH8OGrpdzq9H9YG5mCkkGGr8mQEUug== =w7ZK -END PGP SIGNATURE-
[SECURITY] [DSA 3915-1] ruby-mixlib-archive security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3915-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond July 20, 2017 https://www.debian.org/security/faq - - Package: ruby-mixlib-archive CVE ID : CVE-2017-126 Debian Bug : 868572 It was discovered that ruby-mixlib-archive, a Chef Software's library used to handle various archive formats, was vulnerable to a directory traversal attack. This allowed attackers to overwrite arbitrary files by using a malicious tar archive containing ".." in its entries. For the stable distribution (stretch), this problem has been fixed in version 0.2.0-1+deb9u1. We recommend that you upgrade your ruby-mixlib-archive packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAllwxaAACgkQEL6Jg/PV nWSQTAf/UK9Q1jyNQ22DT+Fb0UTbQsapPyBNaDbELLHnYeBL4cAr1xQ26NukBKKU EVlmmDCO2O+WZXCysyuUfZvq45QImHQPfb07GGzscBbapMkvwKkhINI8Q4YPleAY JmFA614+H3H4GqhkIMiC7ZZ5kPP0JaK2gVeuYNz1io1WsG/0WYY9Tf/lWWTnLtnS dCs0YEG4DfNEwahVrCwrtIfNioVehDTQvH++vAWjTsoGqQj1wEk7ZuQQs7kS7xX2 LCe7qP1Lzv3i5dOWbuVs6ewBf2Ad/pH3DHKJit6keXFbECtinC52X/IcsOkeDMY4 qhCwriMsvQ1F1ac/LEG1p5uMLsqWHA== =FL/h -END PGP SIGNATURE-
[SECURITY] [DSA 3900-1] openvpn security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3900-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond June 27, 2017 https://www.debian.org/security/faq - - Package: openvpn CVE ID : CVE-2017-7479 CVE-2017-7508 CVE-2017-7520 CVE-2017-7521 Debian Bug : 865480 Several issues were discovered in openvpn, a virtual private network application. CVE-2017-7479 It was discovered that openvpn did not properly handle the rollover of packet identifiers. This would allow an authenticated remote attacker to cause a denial-of-service via application crash. CVE-2017-7508 Guido Vranken discovered that openvpn did not properly handle specific malformed IPv6 packets. This would allow a remote attacker to cause a denial-of-service via application crash. CVE-2017-7520 Guido Vranken discovered that openvpn did not properly handle clients connecting to an HTTP proxy with NTLMv2 authentication. This would allow a remote attacker to cause a denial-of-service via application crash, or potentially leak sensitive information like the user's proxy password. CVE-2017-7521 Guido Vranken discovered that openvpn did not properly handle some x509 extensions. This would allow a remote attacker to cause a denial-of-service via application crash. For the oldstable distribution (jessie), these problems have been fixed in version 2.3.4-5+deb8u2. For the stable distribution (stretch), these problems have been fixed in version 2.4.0-6+deb9u1. For the testing distribution (buster), these problems have been fixed in version 2.4.3-1. For the unstable distribution (sid), these problems have been fixed in version 2.4.3-1. We recommend that you upgrade your openvpn packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAllStd0ACgkQEL6Jg/PV nWRU9wf/dfBa7UxecYqbJDJukRYIhSTD43y7cu8UweGHiXtyRiMFasxOvJBeu9Pc oDg9NnJ5fkEtUQuv7cElr5eMg9sHV/nJ2QYGuVT+8tesJmIPXji7n+ZGZAdia6Kf U8Ach9xBHaK5Ao+/AhsYRj6fTnBD/uZryt3cS8Z22x6Iku3iJx1m/n0fBOT5mK6l tK1wmD8nALl3RcS8ERYFAdeDQfKJ6tCyfYyddovy9kCd1NccDKbdx7/07MKUzfZo VsojNsD6PTCyaUQNl7OaG3EkyPfYDsPGG0UrklSadzxSFD8ynFcjbGr5LmXPhBZ1 zoNdMXDi4M3jPJB6IyVsUW/7u3gBvA== =Cuk2 -END PGP SIGNATURE-
Re: Broken signature for DSA-2040-1
On May/02, Francesco Poli wrote: Could it be a Sylpheed bug? We've narrowed it down to an encoding issue: the original DSA email was sent as ISO-8859-1, and mutt was able to verify it just fine; however, on a system using UTF-8, any kind of pasting of the original text will produce a file that gpg does not verify: that'll teach me to include the é in my firstname instead of a plain e ;) Cheers, --Seb signature.asc Description: Digital signature
Re: How safely to stop using backports repo?
On 2009-05-28, JeffD jeff.dicki...@gmail.com wrote:
Not automatic, but here is a quick script that might help you along:
#!/bin/sh
for pkg in `dpkg -l | awk '{print $2}'|sort` ; do
if apt-cache policy $pkg | grep www.backports.org /dev/null ; then
echo $pkgappears to be from www.backports.org
fi
done
I don't think that can work, unless you make it something like:
apt-cache policy $pkg | grep -A 1 -E '^ \*\*\*' | grep www.backports.org
to make sure www.backports.org actually qualifies the *installed*
version ?
Cheers,
--Seb
--
To UNSUBSCRIBE, email to debian-security-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
