The following updates has been released for Debian GNU/Linux:

Debian GNU/Linux 7 Extended LTS:
ELA-9-1 plexus-archiver security update
An arbitrary file write vulnerability was discovered in plexus-archiver, the archiver plugin for the Plexus modular compiler system.

Debian GNU/Linux 8 LTS:
DLA 1394-1: imagemagick security update
Several security vulnerabilities were discovered in ImageMagick, an image manipulation program, that allow remote attackers to cause denial of service (application crash) or out of bounds memory access via crafted SUN, BMP, or DIB image files.

DLA 1397-1: php5 security update
Several vulnerabilities were found in PHP, a widely-used open source general purpose scripting language.

ELA-9-1 plexus-archiver security update

Package: plexus-archiver
Version: 1.0~alpha12-3+deb7u1
Related CVE: CVE-2018-1002200
An arbitrary file write vulnerability was discovered in plexus-archiver, the archiver plugin for the Plexus modular compiler system.

A specially-crafted .zip file could overwrite any file on disk, leading to a privilege esclation.

For Debian 7 Wheezy, these problems have been fixed in version 1.0~alpha12-3+deb7u1.

We recommend that you upgrade your plexus-archiver packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

DLA 1394-1: imagemagick security update

Package : imagemagick
Version : 8:6.8.9.9-5+deb8u13
CVE ID : CVE-2018-11251 CVE-2018-12599 CVE-2018-12600


Several security vulnerabilities were discovered in ImageMagick, an
image manipulation program, that allow remote attackers to cause denial
of service (application crash) or out of bounds memory access via
crafted SUN, BMP, or DIB image files.

For Debian 8 "Jessie", these problems have been fixed in version
8:6.8.9.9-5+deb8u13.

We recommend that you upgrade your imagemagick packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1397-1: php5 security update

Package : php5
Version : 5.6.36+dfsg-0+deb8u1
CVE ID : CVE-2018-7584 CVE-2018-10545 CVE-2018-10546 CVE-2018-10547
CVE-2018-10548 CVE-2018-10549

Several vulnerabilities were found in PHP, a widely-used open source
general purpose scripting language:

CVE-2018-7584

A stack-buffer-overflow while parsing HTTP response results in copying a
large string and possible memory corruption and/or denial of service

CVE-2018-10545

Dumpable FPM child processes allow bypassing opcache access controls
resulting in potential information disclosure where one user can obtain
information about another user's running PHP applications

CVE-2018-10546

An invalid sequence of bytes can trigger an infinite loop in the stream
filter convert.iconv

CVE-2018-10547

A previous fix for CVE-2018-5712 may not be complete, resulting in an
additional vulnerability in the form of a reflected XSS in the PHAR 403
and 404 error pages

CVE-2018-10548

A malicious remote LDAP server can send a crafted response that will
cause a denial of service (NULL pointer dereference resulting in an
application crash)

CVE-2018-10549

A crafted JPEG file can case an out-of-bounds read and heap buffer
overflow

For Debian 8 "Jessie", these problems have been fixed in version
5.6.36+dfsg-0+deb8u1.

We recommend that you upgrade your php5 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS