The following updates has been released for Debian GNU/Linux:

Debian GNU/Linux 8 LTS:
DLA 1619-1: graphicsmagick security update
DLA 1620-1: ghostscript security update

Debian GNU/Linux 9:
DSA 4358-1: ruby-sanitize security update
DSA 4359-1: wireshark security update
DSA 4360-1: libarchive security update

DLA 1619-1: graphicsmagick security update

Package : graphicsmagick
Version : 1.3.20-3+deb8u5
CVE ID : CVE-2018-20184 CVE-2018-20185 CVE-2018-20189
Debian Bug : 916752 916719 916721

Multiple vulnerabilities have been found in GraphicsMagick, the image
processing system.

CVE-2018-20184

The WriteTGAImage function (tga.c) is affected by a heap-based buffer
overflow. Remote attackers might leverage this vulnerability to cause
a denial of service via a crafted image file.

CVE-2018-20185

The ReadBMPImage function (bmp.c) is affected by a heap-based buffer
over-read. Remote attackers might leverage this vulnerability to cause
a denial of service via a crafted image file.

CVE-2018-20189

The ReadDIBImage function (coders/dib.c) is affected by an assertion
error. Remote attackers might leverage this vulnerability to cause
a denial of service via a crafted image file.

For Debian 8 "Jessie", these problems have been fixed in version
1.3.20-3+deb8u5.

We recommend that you upgrade your graphicsmagick packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1620-1: ghostscript security update

Package : ghostscript
Version : 9.06~dfsg-2+deb8u13
CVE ID : CVE-2018-19134 CVE-2018-19478


Some vulnerabilities were discovered in ghostscript, an interpreter for the
PostScript language and for PDF.

CVE-2018-19134

The setpattern operator did not properly validate certain types. A specially
crafted PostScript document could exploit this to crash Ghostscript or,
possibly, execute arbitrary code in the context of the Ghostscript process.
This is a type confusion issue because of failure to check whether the
Implementation of a pattern dictionary was a structure type.

CVE-2018-19478

Attempting to open a carefully crafted PDF file results in long-running
computation. A sufficiently bad page tree can lead to us taking significant
amounts of time when checking the tree for recursion.

For Debian 8 "Jessie", these problems have been fixed in version
9.06~dfsg-2+deb8u13.

We recommend that you upgrade your ghostscript packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DSA 4358-1: ruby-sanitize security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4358-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
December 27, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : ruby-sanitize
CVE ID : CVE-2018-3740
Debian Bug : 893610

The Shopify Application Security Team discovered that ruby-sanitize, a
whitelist-based HTML sanitizer, is prone to a HTML injection
vulnerability. A specially crafted HTML fragment can cause to allow non-
whitelisted attributes to be used on a whitelisted HTML element.

For the stable distribution (stretch), this problem has been fixed in
version 2.1.0-2+deb9u1.

We recommend that you upgrade your ruby-sanitize packages.

For the detailed security status of ruby-sanitize please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/ruby-sanitize

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4359-1: wireshark security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4359-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
December 27, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : wireshark
CVE ID : CVE-2018-12086 CVE-2018-18225 CVE-2018-18226
CVE-2018-18227 CVE-2018-19622 CVE-2018-19623
CVE-2018-19624 CVE-2018-19625 CVE-2018-19626
CVE-2018-19627 CVE-2018-19628

Multiple vulnerabilities have been discovered in Wireshark, a network
protocol analyzer, which could result in denial of service or the
execution of arbitrary code.

For the stable distribution (stretch), these problems have been fixed in
version 2.6.5-1~deb9u1.

We recommend that you upgrade your wireshark packages.

For the detailed security status of wireshark please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/wireshark

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4360-1: libarchive security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4360-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
December 27, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : libarchive
CVE ID : CVE-2016-10209 CVE-2016-10349 CVE-2016-10350
CVE-2017-14166 CVE-2017-14501 CVE-2017-14502
CVE-2017-14503 CVE-2018-1000877 CVE-2018-1000878
CVE-2018-1000880

Multiple security issues were found in libarchive, a multi-format archive
and compression library: Processing malformed RAR archives could result
in denial of service or the execution of arbitrary code and malformed
WARC, LHarc, ISO, Xar or CAB archives could result in denial of service.

For the stable distribution (stretch), these problems have been fixed in
version 3.2.2-2+deb9u1.

We recommend that you upgrade your libarchive packages.

For the detailed security status of libarchive please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libarchive

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/