[SECURITY] [DSA 3942-1] supervisor security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3942-1 secur...@debian.org https://www.debian.org/security/ Salvatore Bonaccorso August 13, 2017 https://www.debian.org/security/faq - - Package: supervisor CVE ID : CVE-2017-11610 Debian Bug : 870187 Calum Hutton reported that the XML-RPC server in supervisor, a system for controlling process state, does not perform validation on requested XML-RPC methods, allowing an authenticated client to send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server as the same user as supervisord. The vulnerability has been fixed by disabling nested namespace lookup entirely. supervisord will now only call methods on the object registered to handle XML-RPC requests and not any child objects it may contain, possibly breaking existing setups. No publicly available plugins are currently known that use nested namespaces. Plugins that use a single namespace will continue to work as before. Details can be found on the upstream issue at https://github.com/Supervisor/supervisor/issues/964 . For the oldstable distribution (jessie), this problem has been fixed in version 3.0r1-1+deb8u1. For the stable distribution (stretch), this problem has been fixed in version 3.3.1-1+deb9u1. We recommend that you upgrade your supervisor packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlmQrB9fFIAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0SsTRAAlYytqmEDurPZLfuLt/+LqRVd6JTK1MLxQeADltPvjDLPn6ZwUxwUiw5/ smnv+nGOej2Jnyk+4LdYnZ5zN8gzD4o59HjGEGoONJYAKvzsR8mijFtvcvurwnAe OkTrV6T8ANPNMsiLsbRhIHED3CxO4rWE77rlyIzIF93FFVzNoF3O4Wg9gXZMzmjo uGLnTxj1bzfFuwN963axPoM56HTeCyGBF85/bLlZyD/y1oMI9lLQKSOZ+gd2QmQY UDgxaAAaxEX+Kqr07kk/7qmSIZON35dTibSkqdWN/GY81uMIFX4t7P9RD9DmIpw4 3B/REp3UwOzdzPM0f1mOZxZ2xqTRH4sHojuX+WEuC8nz0O+ZULv4vD8Af/eXFhQE Q028LgnU3x+jT/LBiFZERcznEiWnsXbvR++Ty2OGODkqlJhft0Jes3Y2GhbOXqOD vLYBjKuu9ov67zzOUYJnlOEy1EnqioI6e4QQIQ171a3Wk4m4J+//Gk3j/3LsC264 wKNs1rA32vMAledUoWiU3739GIIw65T7ur/7CV1W8hDrNFxfWD6m5vAZ586tTgam KURn2iEFhm7MLER35a4l+Ipdoz3aXiO6tC3oCvh2x+xY9DGBUGawzDJ6BqC6CVqU P5Rn/fqf4tXkJDXda2k24OGbPmtgdS8WzrQDA4w1pplN6RN2/Pk= =Jo+K -END PGP SIGNATURE-
[SECURITY] [DSA 3940-1] iortcw security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 - - Debian Security Advisory DSA-3940-1 secur...@debian.org https://www.debian.org/security/ Moritz Muehlenhoff August 13, 2017 https://www.debian.org/security/faq - - Package: iortcw CVE ID : CVE-2017-11721 A read buffer overflow was discovered in the idtech3 (Quake III Arena) family of game engines. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted packet. For the stable distribution (stretch), this problem has been fixed in version 1.50a+dfsg1-3+deb9u1. We recommend that you upgrade your iortcw packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQIzBAEBCAAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlmQX8UACgkQEMKTtsN8 TjYhkg//d+bHbtHmzyQCc6g5zN2/yNlc4QFA6sRr8A48V06Nb/0VtWyVDRphPkdo t/7jBe8xll66c0+ZACyqnGlq76QNVBV+pXZTCl86EoQQbJQD1dKiKmqUDy25z3mg mA1CaCXGAlY7iYIbRrfoenfAnn1hOUyPbmzv0YrN1a71glBhUiQGG6Z5/x7VrFqk lqqpRivn1k0y5Vt+QIbJtBWPBPlJhj4J55ouaT4ice9jWQirEWlKIz2oQz4nfrGm fzTes/sewA4dxfgnLPT/LTcvUPpzsB57KtdF7aJ/ARg4bAepCW8KwjMICPBsygSm o8wUrOA9NW4/eGsz5DjO+BqdiUAQXmVbNXSA/2Shb0PJNOf2pKnW1ejxzrfxwYAN Jef49eOiFojI/iOHDhvqdD95v6IGJdP8XlpwPhONwT2VT9QzUN4ynDrzxdhiWHdV b7H642+9BDYoS9NIdxl1JJP3E8OFPU9+S4r0T+Bj4bHzQS3DPEGSGoOu4VGNvSWh BXaOPr57rAjWokzIKky8GtQVgboiDnFUEfQxyoP3/i+GRL6//Mutz6N+TqkMUSh7 NL19a+k1bdPywtXdnGtMN7nEJPlJFtzUAYJTFoIgbGM/v4YFi+0Eo1Mw2HEQVkAK UNYFyeoPfxnYSkCVwYAQVEMiE5mWwq3BLKG6gGHVgaKETu/AEw0= =tUI/ -END PGP SIGNATURE-
[SECURITY] [DSA 3940-1] cvs security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3940-1 secur...@debian.org https://www.debian.org/security/ Sebastien Delafond August 13, 2017 https://www.debian.org/security/faq - - Package: cvs CVE ID : CVE-2017-12836 Debian Bug : 871810 It was discovered that CVS, a centralised version control system, did not correctly handle maliciously constructed repository URLs, which allowed an attacker to run an arbitrary shell command. For the oldstable distribution (jessie), this problem has been fixed in version 2:1.12.13+real-15+deb8u1. For the stable distribution (stretch), this problem has been fixed in version 2:1.12.13+real-22+deb9u1. We recommend that you upgrade your cvs packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlmQFhwACgkQEL6Jg/PV nWST2Af+PpoK8xsgAPPNowUS7+Vg4y/ogmf/s5aRTbWw0w1y2aAC0kz1VohUhP+q lNypM1gNqUCnRL5r/e7EfsTkj5Xwk355wizHg2VgElpv+HAFSMu3y78O3tA3R9Hb VCT0YCzsOOt9UlnMgZMMNJf2yeXYFgTj94j4W2yf2Q4h3v3wvWCwH4vEAjC0qoBC RvnDvxJv0sJWKBmZExv2QCIojROlSjBYju0DYFzZnacrHH6HrjI77jy7IUSZxQnN CWEI03Xla2QAeW541r0YGhKFoC9+aMbXQnn8miJv8s3jSggIZYw/QVADRRbHk5Q5 SDHYK3IynlpBqBVtuT4Ak6DrHLjDBQ== =Rc7I -END PGP SIGNATURE-