[SECURITY] [DLA 545-1] icu security update

Package: icu Version: 4.8.1.1-12+deb7u4 CVE ID : CVE-2015-2632 CVE-2015-4844 CVE-2016-0494 Several security issues have been identified and corrected in ICU, the International Components for Unicode C and C++ library, in Debian Wheezy. CVE-2015-2632 Buffer overflow

[SECURITY] [DLA 674-2] ghostscript regression update

Package: ghostscript Version: 9.05~dfsg-6.3+deb7u4 Debian Bug : 840691 The update for ghostscript issued as DLA-674-1 caused regressions for certain Postscript document viewers (evince, zathura). Updated packages are now available to address this problem. For reference, the

[SECURITY] [DLA 744-1] icu security update

Package: icu Version: 4.8.1.1-12+deb7u6 CVE ID : CVE-2014-9911 CVE-2016-7415 Debian Bug : 838694 Brief introduction CVE-2014-9911 Michele Spagnuolo discovered a buffer overflow vulnerability which might allow remote attackers to cause a denial of service or

[SECURITY] [DLA 731-1] imagemagick security update

Package: imagemagick Version: 8:6.7.7.10-5+deb7u8 CVE ID : CVE-2014-9805 CVE-2014-9806 CVE-2014-9807 CVE-2014-9808 CVE-2014-9809 CVE-2014-9810 CVE-2014-9811 CVE-2014-9812 CVE-2014-9813 CVE-2014-9814 CVE-2014-9815 CVE-2014-9816

[SECURITY] [DLA 1023-1] tiff3 security update

Package: tiff3 Version: 3.9.6-11+deb7u7 CVE ID : CVE-2017-9936 Debian Bug : 866113 A vulnerabilitie has been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code. CVE-2017-9936 A

[SECURITY] [DLA 1022-1] tiff security update

Package: tiff Version: 4.0.2-6+deb7u15 CVE ID : CVE-2017-9936 CVE-2017-10688 Debian Bug : 866113 866611 Two vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code.

[SECURITY] [DLA 1009-1] apache2 security update

Package: apache2 Version: 2.2.22-13+deb7u9 CVE ID : CVE-2017-3167 CVE-2017-3169 CVE-2017-7668 CVE-2017-7679 Several vulnerabilities have been found in the Apache HTTPD server. CVE-2017-3167 Emmanuel Dreyfus reported that the use of ap_get_basic_auth_pw() by

[SECURITY] [DLA 1000-1] imagemagick security update

Package: imagemagick Version: 8:6.7.7.10-5+deb7u15 CVE ID : CVE-2017-9261 CVE-2017-9262 CVE-2017-9405 CVE-2017-9407 CVE-2017-9409 CVE-2017-9439 CVE-2017-9500 CVE-2017-9501 Debian Bug : 863833 863834 864087 864089 864090 864274 This update fixes

[SECURITY] [DLA 1094-1] tiff3 security update

Package: tiff3 Version: 3.9.6-11+deb7u8 CVE ID : CVE-2017-11335 Debian Bug : 868513 A heap based buffer overflow has been discovered in the tiff2pdf utility, part of the Tag Image File Format (TIFF) library. A PlanarConfig=Contig image can cause an out-of-bounds write

[SECURITY] [DLA 1093-1] tiff security update

Package: tiff Version: 4.0.2-6+deb7u16 CVE ID : CVE-2017-11335 CVE-2017-12944 CVE-2017-13726 CVE-2017-13727 Debian Bug : 868513 872607 873880 873879 Several vulnerabilities have been discovered in the Tag Image File Format (TIFF) library and its associated tools.

[SECURITY] [DLA 1081-1] imagemagick security update

Package: imagemagick Version: 6.7.7.10-5+deb7u16 CVE ID : CVE-2017-8352 CVE-2017-9144 CVE-2017-9501 CVE-2017-10928 CVE-2017-10995 CVE-2017-11141 CVE-2017-11170 CVE-2017-11188 CVE-2017-11352 CVE-2017-11360 CVE-2017-11446 CVE-2017-11448

[SECURITY] [DLA 1138-1] nss security update

Package: nss Version: 2:3.26-1+debu7u5 CVE ID : CVE-2017-7805 Martin Thomson discovered that nss, the Mozilla Network Security Service library, is prone to a use-after-free vulnerability in the TLS 1.2 implementation when handshake hashes are generated. A remote attacker

[SECURITY] [DLA 1189-1] python2.7 security update

Package: python2.7 Version: 2.7.3-6+deb7u4 CVE ID : CVE-2017-1000158 A minor security vulnerability has been discovered in Python 2.7, an interactive high-level object-oriented language. CVE-2017-1000158 CPython (the reference implementation of Python also commonly

[SECURITY] [DLA 1190-1] python2.6 security update

Package: python2.6 Version: 2.6.8-1.1+deb7u1 CVE ID : CVE-2017-1000158 A minor security vulnerability has been discovered in Python 2.7, an interactive high-level object-oriented language. CVE-2017-1000158 CPython (the reference implementation of Python also

[SECURITY] [DLA 1193-1] roundcube security update

Package: roundcube Version: 0.7.2-9+deb7u9 CVE ID : CVE-2017-16651 A file disclosure vulnerability was discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers. CVE-2017-16651 An authenticated attacker can take advantage of this flaw to read

[SECURITY] [DLA 1168-1] graphicsmagick security update

Package: graphicsmagick Version: 1.3.16-1.1+deb7u14 CVE ID : CVE-2017-16669 A remote denial of service vulnerability has been discovered in graphicsmagick, a collection of image processing tools and associated libraries. A specially crafted file can be used to produce a

[SECURITY] [DLA 1182-1] ldns security update

Package: ldns Version: 1.6.13-1+deb7u2 CVE ID : CVE-2017-1000231 Debian Bug : 882015 A security vulnerability has been discovered in ldns, a library and collection of utilities for DNS programming. CVE-2017-1000231 The generic parser contained a double-free

[SECURITY] [DLA 1166-2] tomcat7 regression update

Package: tomcat7 Version: 7.0.28-4+deb7u17 Debian Bug : 881162 The update for tomcat7 issued as DLA-1166-1 caused a regressions whereby every request, including for the root document (/), returned HTTP status 404. Updated packages are now available to address this problem.

[SECURITY] [DLA 1166-1] tomcat7 security update

Package: tomcat7 Version: 7.0.28-4+deb7u16 CVE ID : CVE-2017-12617 A remote code execution vulnerability has been discovered in tomcat7. When HTTP PUT was enabled (e.g., via setting the readonly initialization parameter of the Default servlet to false) it was possible to

[SECURITY] [DLA 1389-1] apache2 security update

Package: apache2 Version: 2.2.22-13+deb7u13 CVE ID : CVE-2017-15710 CVE-2018-1301 CVE-2018-1312 Debian Bug : Several vulnerabilities have been found in the Apache HTTPD server. CVE-2017-15710 Alex Nichols and Jakob Hirsch reported that mod_authnz_ldap, if

[SECURITY] [DLA 1397-1] php5 security update

Package: php5 Version: 5.6.36+dfsg-0+deb8u1 CVE ID : CVE-2018-7584 CVE-2018-10545 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 Several vulnerabilities were found in PHP, a widely-used open source general purpose scripting language:

[SECURITY] [DLA 1394-1] imagemagick security update

Package: imagemagick Version: 8:6.8.9.9-5+deb8u13 CVE ID : CVE-2018-11251 CVE-2018-12599 CVE-2018-12600 Several security vulnerabilities were discovered in ImageMagick, an image manipulation program, that allow remote attackers to cause denial of service (application

[SECURITY] [DLA 1245-1] graphicsmagick security update

Package: graphicsmagick Version: 1.3.16-1.1+deb7u17 CVE ID : CVE-2018-5685 Debian Bug : 887158 A vulnerability has been discovered in GraphicsMagick, a collection of image processing tools, which may result in a denial of service. CVE-2018-5685: An infinite loop

[SECURITY] [DLA 1267-1] squid security update

Package: squid Version: 2.7.STABLE9-4.1+deb7u3 CVE ID : CVE-2018-127 Debian Bug : 888720 Squid, a high-performance proxy caching server for web clients, has been found vulnerable to denial of service attacks associated with ESI response processing and intermediate

[SECURITY] [DLA 1266-1] squid3 security update

Package: squid3 Version: 3.1.20-2.2+deb7u8 CVE ID : CVE-2018-124 CVE-2018-127 Debian Bug : 888719 888720 Squid, a high-performance proxy caching server for web clients, has been found vulnerable to denial of service attacks associated with ESI response

[SECURITY] [DLA 1261-1] clamav security update

Package: clamav Version: 0.99.2+dfsg-0+deb7u4 CVE ID : CVE-2017-12374 CVE-2017-12375 CVE-2017-12376 CVE-2017-12377 CVE-2017-12378 CVE-2017-12379 CVE-2017-12380 Debian Bug : 888484 824196 Multiple vulnerabilities have been discovered

[SECURITY] [DLA 1282-1] graphicsmagick security update

Package: graphicsmagick Version: 1.3.16-1.1+deb7u18 CVE ID : CVE-2018-6799 A denial of service vulnerability has been discovered in graphicsmagick, a collection of image processing tools and associated libraries. A specially crafted file can be used to produce a denial

[SECURITY] [DLA 1224-1] mercurial security update

Package: mercurial Version: 2.2.2-4+deb7u6 CVE ID : CVE-2017-17458 A vulnerability was found in the Mercurial version control system which could lead to remote arbitrary code execution. CVE-2017-17458 A specially malformed Mercurial repository could cause Git

[SECURITY] [DLA 1456-1] graphicsmagick security update

Package: graphicsmagick Version: 1.3.20-3+deb8u4 CVE ID : CVE-2016-5239 CVE-2017-6335 CVE-2017-9098 CVE-2017-11102 CVE-2017-11140 CVE-2017-11403 CVE-2017-11637 CVE-2017-11638 CVE-2017-11641 CVE-2017-11642 CVE-2017-12935 CVE-2017-12936

[SECURITY] [DLA 1450-1] tomcat8 security update

Package: tomcat8 Version: 8.0.14-1+deb8u12 CVE ID : CVE-2018-1304 CVE-2018-1305 Debian Bug : 802312 Several security vulnerabilities have been discovered in the Tomcat servlet and JSP engine. CVE-2018-1304 The URL pattern of "" (the empty string) which exactly

[SECURITY] [DLA 1490-1] php5 security update

Package: php5 Version: 5.6.37+dfsg-0+deb8u1 CVE ID : CVE-2018-14851 CVE-2018-14883 Debian Bug : 890266 Two vulnerabilities have been discovered in php5, a server-side, HTML-embedded scripting language. One (CVE-2018-14851) results in a potential denial of service

[SECURITY] [DLA 1402-1] exiv2 security update

Package: exiv2 Version: 0.24-4.1+deb8u1 CVE ID : CVE-2018-10958 CVE-2018-10998 CVE-2018-10999 CVE-2018-11531 CVE-2018-12264 CVE-2018-12265 Debian Bug : 901706 901707 Several vulnerabilities have been discovered in exiv2, a C++ library and a command

[SECURITY] [DLA 1566-1] mysql-5.5 security update

Package: mysql-5.5 Version: 5.5.62-0+deb8u1 CVE ID : CVE-2018-2767 CVE-2018-3058 CVE-2018-3063 CVE-2018-3066 CVE-2018-3070 CVE-2018-3081 CVE-2018-3133 CVE-2018-3174 CVE-2018-3282 Several issues have been discovered in the MySQL database

[SECURITY] [DLA 1530-1] imagemagick security update

Package: imagemagick Version: 8:6.8.9.9-5+deb8u14 CVE ID : CVE-2018-16412 CVE-2018-16413 CVE-2018-16642 CVE-2018-16643 CVE-2018-16644 CVE-2018-16645 CVE-2018-16749 Several security vulnerabilities were discovered in ImageMagick, an image

[SECURITY] [DLA 1491-1] tomcat8 security update

Package: tomcat8 Version: 8.0.14-1+deb8u13 CVE ID : CVE-2018-1336 CVE-2018-8034 Two security issues have been discovered in the Tomcat servlet and JSP engine. CVE-2018-1336 An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to

[SECURITY] [DLA 1509-1] php5 security update

Package: php5 Version: 5.6.38+dfsg-0+deb8u1 CVE ID : CVE-2018-17082 A vulnerability has been discovered in php5, a server-side, HTML-embedded scripting language. The Apache2 component allows XSS via the body of a "Transfer-Encoding: chunked" request because of a defect

[SECURITY] [DLA 1609-1] libapache-mod-jk security update

Package: libapache-mod-jk Version: 1.2.46-0+deb8u1 CVE ID : CVE-2018-11759 A vulnerability has been discovered in libapache-mod-jk, the Apache 2 connector for the Tomcat Java servlet engine. The libapache-mod-jk connector is susceptible to information disclosure and

[SECURITY] [DLA 1608-1] php5 security update

Package: php5 Version: 5.6.39+dfsg-0+deb8u1 CVE ID : CVE-2018-19518 CVE-2018-19935 Vulnerabilities have been discovered in php5, a server-side, HTML-embedded scripting language. Note that this update includes a change to the default behavior for IMAP connections. See

[SECURITY] [DLA 1704-1] nss security update

Package: nss Version: 2:3.26-1+debu8u4 CVE ID : CVE-2018-12404 CVE-2018-18508 Debian Bug : 921614 Vulnerabilities have been discovered in nss, the Mozilla Network Security Service library. CVE-2018-12404 Cache side-channel variant of the Bleichenbacher attack

[SECURITY] [DLA 1700-1] uw-imap security update

Package: uw-imap Version: 8:2007f~dfsg-4+deb8u1 CVE ID : CVE-2018-19518 Debian Bug : 914632 A vulnerability was discovered in uw-imap, the University of Washington IMAP Toolkit, that might allow remote attackers to execute arbitrary OS commands if the IMAP server name

[SECURITY] [DLA 1707-1] symfony security update

Package: symfony Version: 2.3.21+dfsg-4+deb8u4 CVE ID : CVE-2017-16652 CVE-2017-16654 CVE-2018-11385 CVE-2018-11408 CVE-2018-14773 CVE-2018-19789 CVE-2018-19790 Several security vulnerabilities have been discovered in symfony, a PHP web application

[SECURITY] [DLA 1679-1] php5 security update

Package: php5 Version: 5.6.40+dfsg-0+deb8u1 Several security bugs have been identified and fixed in php5, a server-side, HTML-embedded scripting language. The affected components include GD graphics, multi-byte string handling, phar file format handling, and xmlrpc. CVEs have

[SECURITY] [DLA 1834-1] python2.7 security update

Package: python2.7 Version: 2.7.9-2+deb8u3 CVE ID : CVE-2018-14647 CVE-2019-5010 CVE-2019-9636 CVE-2019-9740 CVE-2019-9947 CVE-2019-9948 CVE-2019-10160 Debian Bug : 921039 921040 924073 Multiple vulnerabilities were discovered in Python, an

[SECURITY] [DLA 1835-2] python3.4 regression update

Package: python3.4 Version: 3.4.2-1+deb8u4 CVE ID : CVE-2019-9740 CVE-2019-9947 Debian Bug : 931044 The update issued as DLA-1835-1 caused a regression in the http.client library in Python 3.4 which was broken by the patch intended to fix CVE-2019-9740 and

[SECURITY] [DLA 1828-1] python-urllib3 security update

Package: python-urllib3 Version: 1.9.1-3+deb8u1 CVE ID : CVE-2019-11236 Debian Bug : 927172 A vulnerability was discovered in python-urllib3, an HTTP library with thread-safe connection pooling, whereby an attacker can inject CRLF characters in the request parameter.

[SECURITY] [DLA 1792-1] ghostscript security update

Package: ghostscript Version: 9.26a~dfsg-0+deb8u3 CVE ID : CVE-2019-3839 A vulnerability was discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service or the execution of arbitrary code if a malformed Postscript file is processed

[SECURITY] [DLA 1792-2] cups-filters regression update

Package: cups-filters Version: 1.0.61-5+deb8u4 Debian Bug : 926576 928936 928952 The update for ghostscript released as DLA-1792-1 uncovered an issue in cups-filters which was using the undocumented Ghostscript internal "pdfdict" now hidden in the ghostscript update. Updated

[SECURITY] [DLA 1794-1] libspring-security-2.0-java security update

Package: libspring-security-2.0-java Version: 2.0.7.RELEASE-3+deb8u1 CVE ID : CVE-2019-3795 A vulnerability was discovered in libspring-security-2.0-java, a modular Java/J2EE application security framework, when using SecureRandomFactoryBean#setSeed to configure a

[SECURITY] [DLA 1853-1] libspring-java security update

Package: libspring-java Version: 3.0.6.RELEASE-17+deb8u1 CVE ID : CVE-2014-3578 CVE-2014-3625 CVE-2015-3192 CVE-2015-5211 CVE-2016-9878 Debian Bug : 760733 769698 796137 849167 Vulnerabilities have been identified in libspring-java, a modular

[SECURITY] [DLA 1879-1] jackson-databind security update

Package: jackson-databind Version: 2.4.2-2+deb8u8 CVE ID : CVE-2019-14379 CVE-2019-14439 Debian Bug : 933393 Deserialization flaws were discovered in jackson-databind relating to EHCache and logback/jndi, which could allow an unauthenticated user to perform remote

[SECURITY] [DLA 1903-1] subversion security update

Package: subversion Version: 1.8.10-6+deb8u7 CVE ID : CVE-2018-11782 CVE-2019-0203 Several vulnerabilities were discovered in Subversion, a version control system. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2018-11782 Ace

[SECURITY] [DLA 1901-1] dovecot security update

Package: dovecot Version: 1:2.2.13-12~deb8u7 CVE ID : CVE-2019-11500 Nick Roessler and Rafi Rubin discovered that the IMAP and ManageSieve protocol parsers in the Dovecot email server do not properly validate input (both pre- and post-login). A remote attacker can take

[SECURITY] [DLA 1924-1] python3.4 security update

Package: python3.4 Version: 3.4.2-1+deb8u7 CVE ID : CVE-2019-16056 A vulnerability was discovered in Python, an interactive high-level object-oriented language. CVE-2019-16056 The email module wrongly parses email addresses that contain multiple @ characters. An

[SECURITY] [DLA 1925-1] python2.7 security update

Package: python2.7 Version: 2.7.9-2+deb8u5 CVE ID : CVE-2019-16056 A vulnerability was discovered in Python, an interactive high-level object-oriented language. CVE-2019-16056 The email module wrongly parses email addresses that contain multiple @ characters. An

[SECURITY] [DLA 1857-1] nss security update

Package: nss Version: 2:3.26-1+debu8u5 CVE ID : CVE-2019-11719 CVE-2019-11729 Vulnerabilities have been discovered in nss, the Mozilla Network Security Service library. CVE-2019-11719: Out-of-bounds read when importing curve25519 private key When importing a

[SECURITY] [DLA 1858-1] squid3 security update

Package: squid3 Version: 3.4.8-6+deb8u8 CVE ID : CVE-2019-12525 CVE-2019-12529 Squid, a high-performance proxy caching server for web clients, has been found vulnerable to denial of service attacks associated with HTTP authentication header processing. CVE-2019-12525

[SECURITY] [DLA 1929-1] php-pecl-http security update

Package: php-pecl-http Version: 2.0.4-1+deb8u1 CVE ID : CVE-2016-7398 A vulnerability has been discovered in php-pecl-http, the pecl_http module for PHP 5 Extended HTTP Support. A type confusion vulnerability in the merge_param() function allows attackers to crash PHP

[SECURITY] [DLA 1928-1] php5 security update

Package: php5 Version: 5.6.40+dfsg-0+deb8u6 Debian Bug : 805222 An update has been made to php5, a server-side, HTML-embedded scripting language. Specficially, as reported in #805222, the ability to build extensions in certain older versions of PHP within Debian has been

[SECURITY] [DLA 1988-1] ampache security update

Package: ampache Version: 3.6-rzb2752+dfsg-5+deb8u1 CVE ID : CVE-2019-12385 CVE-2019-12386 Several vulnerabilities were discovered in Ampache, a web-based audio file management system. CVE-2019-12385 A stored XSS exists in the localplay.php LocalPlay "add instance"

[SECURITY] [DLA 1992-1] ghostscript security update

Package: ghostscript Version: 9.26a~dfsg-0+deb8u6 CVE ID : CVE-2019-14869 Manfred Paul and Lukas Schauer reported that the .charkeys procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of

[SECURITY] [DLA 2033-1] php-horde security update

Package: php-horde Version: 5.2.1+debian0-2+deb8u5 CVE ID : CVE-2019-12095 A vulnerability has been found in php-horde, the Horde Application Framework, which may result in information disclosure via cross-site scripting. For Debian 8 "Jessie", this problem has been

[SECURITY] [DLA 2034-1] davical security update

Package: davical Version: 1.1.3.1-1+deb8u1 CVE ID : CVE-2019-18345 CVE-2019-18346 CVE-2019-18347 Debian Bug : 946343 Multiple cross-site scripting and cross-site request forgery issues were discovered in the DAViCal CalDAV Server. For Debian 8 "Jessie", these

[SECURITY] [DLA 1999-1] symfony security update

Package: symfony Version: 2.3.21+dfsg-4+deb8u6 CVE ID : CVE-2019-18886 CVE-2019-18887 CVE-2019-1 Multiple vulnerabilities have been found in the Symfony PHP framework which could lead to a timing attack/information leak, argument injection and code execution via

[SECURITY] [DLA 2008-1] nss security update

Package: nss Version: 2:3.26-1+debu8u7 CVE ID : CVE-2019-11745 A vulnerability has been discovered in nss, the Mozilla Network Security Service library. An out-of-bounds write can occur when passing an output buffer smaller than the block size to NSC_EncryptUpdate. For

[SECURITY] [DLA 1945-1] openconnect security update

Package: openconnect Version: 6.00-2+deb8u1 CVE ID : CVE-2019-16239 Debian Bug : 940871 A vulnerability was discovered by Lukas Kupczyk of the Advanced Research Team at CrowdStrike Intelligence in OpenConnect, an open client for Cisco AnyConnect, Pulse, GlobalProtect

[SECURITY] [DLA 1947-1] libreoffice security update

Package: libreoffice Version: 1:4.3.3-2+deb8u13 CVE ID : CVE-2019-9848 CVE-2019-9849 CVE-2019-9850 CVE-2019-9851 CVE-2019-9852 CVE-2019-9853 CVE-2019-9854 Several vulnerabilities were discovered in LibreOffice, the office productivity suite.

[SECURITY] [DLA 2117-1] zsh security update

Package: zsh Version: 5.0.7-5+deb8u1 CVE ID : CVE-2019-20044 Debian Bug : 951458 A privilege escalation vulnerability was discovered in zsh, a shell with lots of features, whereby a user could regain a formerly elevated privelege level even when such an action should

[SECURITY] [DLA 2123-1] pure-ftpd security update

Package: pure-ftpd Version: 1.0.36-3.2+deb8u1 CVE ID : CVE-2020-9274 Debian Bug : 925666 An uninitialized pointer vulnerability was discovered in pure-ftpd, a secure and efficient FTP server, which could result in an out-of-bounds memory read and potential

[SECURITY] [DLA 2059-1] git security update

Package: git Version: 1:2.1.4-2.1+deb8u8 CVE ID : CVE-2019-1348 CVE-2019-1349 CVE-2019-1352 CVE-2019-1353 CVE-2019-1387 Several vulnerabilities have been discovered in git, a fast, scalable, distributed revision control system. CVE-2019-1348 It was

[SECURITY] [DLA 2106-1] libgd2 security update

Package: libgd2 Version: 2.1.0-5+deb8u14 CVE ID : CVE-2018-14553 Debian Bug : 951287 A vulnerability was discovered in libgd2, the GD graphics library, whereby an attacker can employ a specific function call sequence to trigger a NULL pointer dereference, subsequently

[SECURITY] [DLA 2046-1] opensc security update

Package: opensc Version: 0.16.0-3+deb8u2 CVE ID : CVE-2019-19479 An issue was discovered in libopensc/card-setcos.c in OpenSC, which has an incorrect read operation during parsing of a SETCOS file attribute. For Debian 8 "Jessie", this problem has been fixed in version

[SECURITY] [DLA 2177-1] git security update

Package: git Version: 1:2.1.4-2.1+deb8u9 CVE ID : CVE-2020-5260 Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled

[SECURITY] [DLA 2174-1] php-horde-data security update

Package: php-horde-data Version: 2.1.0-5+deb8u1 CVE ID : CVE-2020-8518 Debian Bug : 951537 A remote code execution vulnerability was discovered in the Horde Application Framework. An authenticated remote attacker could use this flaw to cause execution of uploaded CSV

[SECURITY] [DLA 2175-1] php-horde-trean security update

Package: php-horde-trean Version: 1.1.1-2+deb8u1 CVE ID : CVE-2020-8865 Debian Bug : 955019 A directory traversal vulnerability resulting from insufficient input sanitization was discovered in the Horde Application Framework. An authenticated remote attacker could

[SECURITY] [DLA 2173-1] graphicsmagick security update

Package: graphicsmagick Version: 1.3.20-3+deb8u10 CVE ID : CVE-2020-10938 A vulnerability was discovered in graphicsmagick, a collection of image processing tools, that results in a heap overflow in 32-bit applications because of a signed overflow on range check in the

[SECURITY] [DLA 2162-1] php-horde-form security update

Package: php-horde-form Version: 2.0.8-2+deb8u2 CVE ID : CVE-2020-8866 Debian Bug : 955020 A remote code execution vulnerability was discovered in the Form API component of the Horde Application Framework. An authenticated remote attacker could use this flaw to

[SECURITY] [DLA 2167-1] python-bleach security update

Package: python-bleach Version: 1.4-1+deb8u1 CVE ID : CVE-2020-6817 Debian Bug : 955388 A vulnerability was discovered in python-bleach, a whitelist-based HTML-sanitizing library. Calls to bleach.clean with an allowed tag with an allowed style attribute are

[SECURITY] [DLA 2193-1] openjdk-7 security update

Package: openjdk-7 Version: 7u261-2.6.22-1~deb8u1 CVE ID : CVE-2020-2756 CVE-2020-2757 CVE-2020-2773 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803 CVE-2020-2805 CVE-2020-2830 Several vulnerabilities have been discovered in the OpenJDK Java runtime, resulting

[SECURITY] [DLA 2182-1] git security update

Package: git Version: 1:2.1.4-2.1+deb8u10 CVE ID : CVE-2020-11008 Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can

[SECURITY] [DLA 2199-1] openldap security update

Package: openldap Version: 2.4.40+dfsg-1+deb8u6 CVE ID : CVE-2020-12243 A vulnerability was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. LDAP search filters with nested boolean expressions can result in denial of service

[SECURITY] [DLA 2205-1] firefox-esr security update

Package: firefox-esr Version: 68.8.0esr-1~deb8u1 CVE ID : CVE-2020-6831 CVE-2020-12387 CVE-2020-12392 CVE-2020-12395 Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or

[SECURITY] [DLA 2213-1] exim4 security update

Package: exim4 Version: 4.84.2-2+deb8u7 CVE ID : CVE-2020-12783 It was discovered that exim4, a mail transport agent, suffers from a authentication bypass vulnerability in the spa authentication driver. The spa authentication driver is not enabled by default. For Debian

[SECURITY] [DLA 2176-1] inetutils security update

Package: inetutils Version: 2:1.9.2.39.3a460-3+deb8u1 CVE ID : CVE-2020-10188 Debian Bug : 956084 NOTE: This DLA was intially sent on 2020-04-14 but for reasons unknown failed to reach the mailing list. It is being re-sent now to ensure that it appears in the mailing

[SECURITY] [DLA 2206-1] thunderbird security update

Package: thunderbird Version: 1:68.8.0-1~deb8u1 CVE ID : CVE-2020-6831 CVE-2020-12387 CVE-2020-12392 CVE-2020-12395 CVE-2020-12397 Multiple security issues have been found in Thunderbird which could result in spoofing the displayed sender email address,

[SECURITY] [DLA 2152-1] graphicsmagick security update

Package: graphicsmagick Version: 1.3.20-3+deb8u9 CVE ID : CVE-2019-12921 A vulnerability was discovered in graphicsmagick, a collection of image processing tools, that allows allows an attacker to read arbitrary files via a crafted image because of TranslateTextEx for

[SECURITY] [DLA 2364-1] netty security update

- Debian LTS Advisory DLA-2364-1debian-...@lists.debian.org https://www.debian.org/lts/security/ Roberto C. Sánchez September 04, 2020https://wiki.debian.org/LTS

[SECURITY] [DLA 2365-1] netty-3.9 security update

- Debian LTS Advisory DLA-2365-1debian-...@lists.debian.org https://www.debian.org/lts/security/ Roberto C. Sánchez September 04, 2020https://wiki.debian.org/LTS

[SECURITY] [DLA 2399-1] packagekit security update

- Debian LTS Advisory DLA-2399-1debian-...@lists.debian.org https://www.debian.org/lts/security/ Roberto C. Sánchez October 07, 2020 https://wiki.debian.org/LTS

[SECURITY] [DLA 2395-1] libvirt security update

- Debian LTS Advisory DLA-2395-1debian-...@lists.debian.org https://www.debian.org/lts/security/ Roberto C. Sánchez October 02, 2020 https://wiki.debian.org/LTS

[SECURITY] [DLA 2396-1] tigervnc security update

- Debian LTS Advisory DLA-2396-1debian-...@lists.debian.org https://www.debian.org/lts/security/ Roberto C. Sánchez October 06, 2020 https://wiki.debian.org/LTS

[SECURITY] [DLA 2397-1] php7.0 security update

- Debian LTS Advisory DLA-2397-1debian-...@lists.debian.org https://www.debian.org/lts/security/ Roberto C. Sánchez October 06, 2020 https://wiki.debian.org/LTS

[SECURITY] [DLA 2340-1] sqlite3 security update

- Debian LTS Advisory DLA-2340-1debian-...@lists.debian.org https://www.debian.org/lts/security/ August 22, 2020 https://wiki.debian.org/LTS

[SECURITY] [DLA 2344-1] mongodb security update

- Debian LTS Advisory DLA-2344-1debian-...@lists.debian.org https://www.debian.org/lts/security/ August 24, 2020 https://wiki.debian.org/LTS

[SECURITY] [DLA 2343-1] icingaweb2 security update

- Debian LTS Advisory DLA-2343-1debian-...@lists.debian.org https://www.debian.org/lts/security/ August 24, 2020 https://wiki.debian.org/LTS

[SECURITY] [DLA 2379-1] mediawiki security update

- Debian LTS Advisory DLA-2379-1debian-...@lists.debian.org https://www.debian.org/lts/security/ Roberto C. Sánchez September 25, 2020https://wiki.debian.org/LTS

[SECURITY] [DLA 2381-1] lua5.3 security update

- Debian LTS Advisory DLA-2381-1debian-...@lists.debian.org https://www.debian.org/lts/security/ Roberto C. Sánchez September 26, 2020https://wiki.debian.org/LTS

[SECURITY] [DLA 2379-2] mediawiki regression update

- Debian LTS Advisory DLA-2379-2debian-...@lists.debian.org https://www.debian.org/lts/security/ Roberto C. Sánchez September 28, 2020https://wiki.debian.org/LTS

[SECURITY] [DLA 2378-1] openssl1.0 security update

- Debian LTS Advisory DLA-2378-1debian-...@lists.debian.org https://www.debian.org/lts/security/ Roberto C. Sánchez September 25, 2020https://wiki.debian.org/LTS

[SECURITY] [DLA 2322-1] roundcube security update

- Debian LTS Advisory DLA-2322-1debian-...@lists.debian.org https://www.debian.org/lts/security/ August 11, 2020 https://wiki.debian.org/LTS

[SECURITY] [DLA 2293-1] mercurial security update

- Debian LTS Advisory DLA-2293-1debian-...@lists.debian.org https://www.debian.org/lts/security/ July 27, 2020 https://wiki.debian.org/LTS

  1   2   >