[SECURITY] [DSA 3939-1] botan1.10 security update

2017-08-12 Thread Moritz Muehlenhoff 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

- -
Debian Security Advisory DSA-3939-1   secur...@debian.org
https://www.debian.org/security/   Moritz Muehlenhoff
August 12, 2017   https://www.debian.org/security/faq
- -

Package: botan1.10
CVE ID : CVE-2017-2801

Aleksandar Nikolic discovered that an error in the x509 parser of the
Botan crypto library could result in an out-of-bounds memory read,
resulting in denial of service or an information leak if processing
a malformed certificate.

For the oldstable distribution (jessie), this problem has been fixed
in version 1.10.8-2+deb8u2.

For the stable distribution (stretch), this problem has been fixed
prior to the initial release.

We recommend that you upgrade your botan1.10 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlmPSd8ACgkQEMKTtsN8
TjYdVw/+NzTxYxZjJjhj4uHpmuFNKjInDs1cPLyStXqzl7VO9Cy4+bJKlcDby4/Q
nnDN1F/R73acvCffJmNTISz09Y93vbmDTVN2/j/b1nfCk2YtY7Z2ABc/wQMcpU6S
XjjZdR5wDslH2gdjRKBhVCr/dUY2YM/8xAEVhipoW8eKh8slPjEuvBdYGJN+91X2
Qbm/LWntMFOAxNwPMcgGzCD8WSP136/cORrdjWZwXKQvxPfHCiMQXYzuy+vtLb1m
eaJInDyVKvKJ+xj2CZrLHXt52Wpkw9oHIDICgkVx15zI4DDf/HsIcVYmogOXIYVB
udpRvf1yYQLkqkEJNdN0n5Eb3ZXk1EtpDJDh2AACXZX23ZQ4gx2H7gsZVdpcg4yz
DIKTx8yuP05PKuXb/zvopHIA6bNY5S5i/6h0Xwv8TIznbaG6/nQg767OrQcj7JnV
KQcYP9SV0aKex9R+jYhthsKnGN8jKRXzk5+PAZu2aKprnTa1runXWR3SF2n/n80E
F4oVpg7Xrlo8EHHdxitMSMyCUtYz3c8Tdim1ZG0jkpn39ALE9WPZi4INlURfoHEW
vKIOOooGVJrxcy5LAatTuvTDOQG8ZdScUrZ7kl14M2yUM8i/YXClWOZNQtyYOFaY
U/kMP58bqFWFM5d1045vAgTflfkp4bznVT3KEzPZDO1dhiFjpS8=
=U+7i
-END PGP SIGNATURE-

[SECURITY] [DSA 3938-1] libgd2 security update

2017-08-12 Thread Salvatore Bonaccorso 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

- -
Debian Security Advisory DSA-3938-1   secur...@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
August 12, 2017   https://www.debian.org/security/faq
- -

Package: libgd2
CVE ID : CVE-2017-7890
Debian Bug : 869263

Matviy Kotoniy reported that the gdImageCreateFromGifCtx() function used
to load images from GIF format files in libgd2, a library for
programmatic graphics creation and manipulation, does not zero stack
allocated color map buffers before their use, which may result in
information disclosure if a specially crafted file is processed.

For the oldstable distribution (jessie), this problem has been fixed
in version 2.1.0-5+deb8u10.

For the stable distribution (stretch), this problem has been fixed in
version 2.2.4-2+deb9u1.

We recommend that you upgrade your libgd2 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-BEGIN PGP SIGNATURE-

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlmO9e5fFIAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0SCVhAAk0unKNrQqvnzieUN9dm3xCKmHnn3msOrK+/WUEhwG1Genql/avk9vJCv
1Rb/GExb422o9BbFSddZDOSenNCnqJttRD7GNayAIdKlwcsjPfcsW5YO47wUIeuz
1WiKy1ez2ULRDqD5qfNWOdt+QJFmtpBrKodbiprxGbicxrPnwjT/vVOZBSJoLidy
v1E9mszPLjfKrEmhxGLtwI/JwOnbQKklhcnVC5v8S7WlGRs425iQYn0GSFNEBxnI
ieSL6K5in6C6/fnwGvWtj1ySiB9gzlxbF6ZMN4Gq/9CF9+Nl4FkKTxba8NtRsdI5
QfkJSxTZ4Ht/guJXc2fgfwG3NfIDlqJOBtGugmUISihVLMkSguTEE7WHzVFeg765
RBYDFpu8ITnCBv6Ob3UTauQ78b2TQ6zRmfTVGgDcIY3gowFFG5Ygpsjv6vgUVPPr
ax6G7ePnk6hKIc+T6K++FJ7mUuW6s5SX4mUEz452tEnjdyL1xiTVqZl+OVqzBWEu
hfmGQh1P09HLPPHw3H0OvBHWWfc2bUi0EdvAQ9/DNMThHnvCUh4Cnc23OaRRtKen
uzmUVDFrWtGQsfhgsNFVZKoL1i+OeXXVMrT3GqKB0xmglxM51xuGoIVPvjcmrLpk
wmhxt0j3edmPiqzayCll3G4SA/FNKJTJ8kWGv4AoROeQuPEFBvM=
=84p8
-END PGP SIGNATURE-