[SECURITY] [DLA 1884-1] linux security update

Package: linux Version: 3.16.72-1 CVE ID : CVE-2017-18509 CVE-2018-20836 CVE-2019-1125 CVE-2019-3900 CVE-2019-10207 CVE-2019-10638 CVE-2019-13631 CVE-2019-14283 CVE-2019-14284 Several vulnerabilities have been discovered in the Linux

Accepted linux-4.9 4.9.168-1+deb9u5~deb8u1 (all source) into oldoldstable

-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Tue, 13 Aug 2019 19:47:06 +0100 Binary: linux-doc-4.9 linux-headers-4.9.0-0.bpo.9-common linux-headers-4.9.0-0.bpo.9-common-rt linux-manual-4.9 linux-source-4.9 linux-support-4.9.0-0.bpo.9 Source: linux-4.9 Architecture: all

Accepted linux 3.16.72-1 (all source) into oldoldstable

-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Tue, 13 Aug 2019 19:44:18 +0100 Binary: linux-doc-3.16 linux-manual-3.16 linux-source-3.16 linux-support-3.16.0-10 Source: linux Architecture: all source Version: 3.16.72-1 Distribution: jessie-security Urgency: high Maintainer:

[SECURITY] [DLA 1883-1] tomcat8 security update

-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Package: tomcat8 Version: 8.0.14-1+deb8u15 CVE ID : CVE-2016-5388 CVE-2018-8014 CVE-2019-0221 Debian Bug : 929895 898935 Several minor issues have been fixed in tomcat8, a Java Servlet and JSP engine. CVE-2016-5388

Accepted tomcat8 8.0.14-1+deb8u15 (source all) into oldoldstable

-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Tue, 13 Aug 2019 16:22:22 +0200 Source: tomcat8 Binary: tomcat8-common tomcat8 tomcat8-user libtomcat8-java libservlet3.1-java libservlet3.1-java-doc tomcat8-admin tomcat8-examples tomcat8-docs Architecture: source all Version:

Re: On tomcat FTBFS.

Hi, On Thu, Aug 08, 2019 at 02:15:52PM +0200, Markus Koschany wrote: > Am 08.08.19 um 00:50 schrieb Sylvain Beucler: > > So I reworked CVE-2017-5647, which involved 5 new commits related to > > non-blocking I/O (NIO2 and COMET). > > Stable build. > > > > Then I got upstream to renew their new

Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4}

IIUC, ASF policy is not to update the commit message in git. See #16: https://www.apache.org/security/committers.html On Tue, Aug 13, 2019 at 1:58 AM Hugo Lefeuvre wrote: > > Hi Tim, > > > Y. You got CVE-2019-10088: > >

Accepted atril 1.8.1+dfsg1-4+deb8u2 (source all amd64) into oldoldstable

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Format: 1.8 Date: Tue, 13 Aug 2019 13:37:47 +0200 Source: atril Binary: atril atril-dbg atril-common libatrilview3 libatrilview-dev libatrilview3-dbg libatrildocument3 libatrildocument-dev libatrildocument3-dbg Architecture: source all amd64

[SECURITY] [DLA 1882-1] atril security update

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Package: atril Version: 1.8.1+dfsg1-4+deb8u2 CVE ID : CVE-2017-1000159 CVE-2019-11459 CVE-2019-1010006 A few issues were found in Atril, the MATE document viewer. CVE-2017-1000159 When printing from DVI to PDF, the

Accepted evince 3.14.1-2+deb8u3 (source all amd64) into oldoldstable

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Format: 1.8 Date: Tue, 13 Aug 2019 12:04:27 +0200 Source: evince Binary: evince evince-dbg evince-gtk evince-common libevdocument3-4 libevview3-3 libevince-dev gir1.2-evince-3.0 Architecture: source all amd64 Version: 3.14.1-2+deb8u3 Distribution:

Accepted ghostscript 9.26a~dfsg-0+deb8u4 (source all amd64) into oldoldstable

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Format: 1.8 Date: Tue, 13 Aug 2019 10:08:53 +0200 Source: ghostscript Binary: ghostscript ghostscript-x ghostscript-doc libgs9 libgs9-common libgs-dev ghostscript-dbg Architecture: source all amd64 Version: 9.26a~dfsg-0+deb8u4 Distribution:

[SECURITY] [DLA 1880-1] ghostscript security update

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Package: ghostscript Version: 9.26a~dfsg-0+deb8u4 CVE ID : CVE-2019-10216 Debian Bug : 934638 Netanel reported that the .buildfont1 procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict

reproducing tika vulnerabilities in jessie/buster

Hi Emmanuel, I'd like to determine the status of CVE-2019-10094, CVE-2019-10093 and CVE-2019-10088 in tika[0] for jessie and buster. I had a look at the source code: so far CVE-2019-10094 and CVE-2019-10088 don't seem to affect jessie. I have doubts concerning CVE-2019-10093. Being able to