The following security updates has been released for Debian GNU/Linux:

Debian GNU/Linux 8 LTS:
DLA 1706-1: poppler security update

Debian GNU/Linux 9:
DSA 4403-1: php7.0 security update

DLA 1706-1: poppler security update

Package : poppler
Version : 0.26.5-2+deb8u8
CVE ID : CVE-2018-19058 CVE-2018-20481 CVE-2018-20662
CVE-2019-7310 CVE-2019-9200
Debian Bug : 913177 917325 918158 921215 923414

Several security vulnerabilities were discovered in the poppler PDF
rendering shared library.

CVE-2018-19058

A reachable abort in Object.h will lead to denial-of-service because
EmbFile::save2 in FileSpec.cc lacks a stream check before saving an
embedded file.

CVE-2018-20481

Poppler mishandles unallocated XRef entries, which allows remote
attackers to cause a denial-of-service (NULL pointer dereference)
via a crafted PDF document.

CVE-2018-20662

Poppler allows attackers to cause a denial-of-service (application
crash and segmentation fault by crafting a PDF file in which an xref
data structure is corrupted.

CVE-2019-7310

A heap-based buffer over-read (due to an integer signedness error in
the XRef::getEntry function in XRef.cc) allows remote attackers to
cause a denial of service (application crash) or possibly have
unspecified other impact via a crafted PDF document.

CVE-2019-9200

A heap-based buffer underwrite exists in ImageStream::getLine()
located at Stream.cc that can (for example) be triggered by sending
a crafted PDF file to the pdfimages binary. It allows an attacker to
cause denial-of-service (segmentation fault) or possibly have
unspecified other impact.

For Debian 8 "Jessie", these problems have been fixed in version
0.26.5-2+deb8u8.

We recommend that you upgrade your poppler packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DSA 4403-1: php7.0 security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4403-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
March 08, 2019 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : php7.0
CVE ID : not yet available

Multiple security issues were found in PHP, a widely-used open source
general purpose scripting language: The EXIF extension had multiple cases
of invalid memory access and rename() was implemented insecurely.

For the stable distribution (stretch), this problem has been fixed in
version 7.0.33-0+deb9u3.

We recommend that you upgrade your php7.0 packages.

For the detailed security status of php7.0 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/php7.0

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/