[Secure-testing-team] Bug#869879: ghostscript: CVE-2017-9610 CVE-2017-9618 CVE-2017-9619 CVE-2017-9620 CVE-2017-9740

Source: ghostscript Version: 9.21~dfsg-1 Severity: normal Tags: security patch upstream Hi, the following vulnerabilities were published for ghostscript. Note, I'm collecting those in one bug, because they are currently unimportant for Debian as xps/ not used during build. But it would be nice

[Secure-testing-team] Bug#869880: CVE-2017-2834 CVE-2017-2835 CVE-2017-2836 CVE-2017-2837 CVE-2017-2838 CVE-2017-2839

Source: freerdp Severity: grave Tags: security Hi, please see: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0341 https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0340 https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0339

[Secure-testing-team] Bug#869912: zookeeper: JMX opened for remote hosts

Source: zookeeper Severity: important Tags: security Hi. I've noticed that in: /etc/zookeeper/conf/environment the following is set JMXLOCALONLY=false which in turn sets com.sun.management.jmxremote.local.only=false Is there any reason for this? It's neither the default in Java (see e.g.

[Secure-testing-team] Bug#869913: ghostscript: CVE-2017-9727: heap-buffer-overflow in gx_ttfReader__Read(base/gxttfb.c)

Source: ghostscript Version: 9.06~dfsg-2 Severity: important Tags: upstream patch security fixed-upstream Forwarded: https://bugs.ghostscript.com/show_bug.cgi?id=698056 Hi, the following vulnerability was published for ghostscript. CVE-2017-9727[0]: | The gx_ttfReader__Read function in

[Secure-testing-team] Bug#869907: ghostscript: CVE-2017-9835: heap-buffer-overflow in gs_alloc_ref_array(ialloc.c)

Source: ghostscript Version: 9.21~dfsg-1 Severity: important Tags: security patch upstream fixed-upstream Forwarded: https://bugs.ghostscript.com/show_bug.cgi?id=697985 Hi, the following vulnerability was published for ghostscript. CVE-2017-9835[0]: | The gs_alloc_ref_array function in

[Secure-testing-team] Bug#869922: policykit-1: members of group sudo become root with pkexec while ignoring /etc/sudoers

Package: policykit-1 Version: 0.105-18 Severity: grave Tags: security Justification: user security hole Dear Maintainer, If an unprivileged user is member of group sudo, he can achieve unrestricted root privileges with pkexec and his user password (instead of root password). This happens

[Secure-testing-team] Bug#869910: ghostscript: CVE-2017-9739: heap-buffer-overflow in Ins_JMPR

Source: ghostscript Version: 9.06~dfsg-1 Severity: important Tags: security patch upstream fixed-upstream Forwarded: https://bugs.ghostscript.com/show_bug.cgi?id=698063 Hi, the following vulnerability was published for ghostscript. CVE-2017-9739[0]: | The Ins_JMPR function in base/ttinterp.c in

[Secure-testing-team] Bug#869916: ghostscript: CVE-2017-9612: heap-use-after-free in Ins_IP(base/ttinterp.c)

Source: ghostscript Version: 9.06~dfsg-2 Severity: important Tags: patch security upstream fixed-upstream Forwarded: https://bugs.ghostscript.com/show_bug.cgi?id=698026 Hi, the following vulnerability was published for ghostscript. CVE-2017-9612[0]: | The Ins_IP function in base/ttinterp.c in

[Secure-testing-team] Bug#869917: ghostscript: CVE-2017-9611: heap-buffer-overflow in Ins_MIRP(base/ttinterp.c)

Source: ghostscript Version: 9.06~dfsg-2 Severity: important Tags: security upstream patch fixed-upstream Forwarded: https://bugs.ghostscript.com/show_bug.cgi?id=698024 Hi, the following vulnerability was published for ghostscript. CVE-2017-9611[0]: | The Ins_MIRP function in base/ttinterp.c in

[Secure-testing-team] Bug#869915: ghostscript: CVE-2017-9726: heap-use-after-free in Ins_MDRP(base/ttinterp.c)

Source: ghostscript Version: 9.06~dfsg-2 Severity: important Tags: upstream security patch fixed-upstream Forwarded: https://bugs.ghostscript.com/show_bug.cgi?id=698055 Hi, the following vulnerability was published for ghostscript. CVE-2017-9726[0]: | The Ins_MDRP function in base/ttinterp.c in

[Secure-testing-team] Bug#869927: libjpeg-turbo: CVE-2017-9614: invalid memory access in the fill_input_buffer function

Source: libjpeg-turbo Version: 1:1.3.1-12 Severity: important Tags: upstream security Hi, the following vulnerability was published for libjpeg-turbo. CVE-2017-9614[0]: | The fill_input_buffer function in jdatasrc.c in libjpeg-turbo 1.5.1 | allows remote attackers to cause a denial of service