The following updates has been released for Debian GNU/Linux:

Debian GNU/Linux 7 Extended LTS:
ELA-38-1 spice security update

Debian GNU/Linux 8 LTS:
DLA 1506-1: intel-microcode security update

Debian GNU/Linux 9:
DSA 4273-2: intel-microcode security update
DSA 4294-1: ghostscript security update
DSA 4295-1: thunderbird security update
DSA 4296-1: mbedtls security update

ELA-38-1 spice security update

Package: spice
Version: 0.11.0-1+deb7u5
Related CVE: CVE-2018-10873
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.

The issue has been fixed by upstream by bailing out with an error if the pointer to the start of some message data is strictly greater than the pointer to the end of the message data.

For Debian 7 Wheezy, these problems have been fixed in version 0.11.0-1+deb7u5.

We recommend that you upgrade your spice packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

DLA 1506-1: intel-microcode security update

Package : intel-microcode
Version : 3.20180807a.1~deb8u1
CVE ID : CVE-2018-3615, CVE-2018-3620, CVE-2018-3646
CVE-2018-3639, CVE-2018-3640, CVE-2017-5715

Security researchers identified speculative execution side-channel
methods which have the potential to improperly gather sensitive data
from multiple types of computing devices with different vendors’
processors and operating systems.

This update requires an update to the intel-microcode package, which is
non-free. It is related to DLA-1446-1 and adds more mitigations for
additional types of Intel processors.

For more information please also read the official Intel security
advisories at:

https://www.intel.com/content/www/us/en/security-center/advisory/intel-s
a-00088.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-s
a-00115.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-s
a-00161.html

For Debian 8 "Jessie", these problems have been fixed in version
3.20180807a.1~deb8u1.

We recommend that you upgrade your intel-microcode packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DSA 4273-2: intel-microcode security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4273-2 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
September 16, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : intel-microcode
CVE ID : CVE-2018-3639 CVE-2018-3640

This update ships updated CPU microcode for additional models of Intel
CPUs which were not yet covered by the Intel microcode update released
as DSA-4273-1 (and thus provides SSBD support (needed to address
"Spectre v4") and fixes for "Spectre v3a")).

For the stable distribution (stretch), these problems have been fixed in
version 3.20180807a.1~deb9u1.

We recommend that you upgrade your intel-microcode packages.

For the detailed security status of intel-microcode please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/intel-microcode

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4294-1: ghostscript security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4294-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
September 16, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : ghostscript
CVE ID : CVE-2018-16509 CVE-2018-16802

Tavis Ormandy discovered multiple vulnerabilites in Ghostscript, an
interpreter for the PostScript language, which could result in the
execution of arbitrary code if a malformed Postscript file is processed
(despite the dSAFER sandbox being enabled).

For the stable distribution (stretch), these problems have been fixed in
version 9.20~dfsg-3.2+deb9u5.

We recommend that you upgrade your ghostscript packages.

For the detailed security status of ghostscript please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ghostscript

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4295-1: thunderbird security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4295-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
September 16, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : thunderbird
CVE ID : CVE-2018-5156 CVE-2018-5187 CVE-2018-12361 CVE-2018-12367
CVE-2018-12371

Multiple security issues have been found in Thunderbird: Multiple memory
safety errors and use-after-frees may lead to the execution of arbitrary
code or denial of service.

Debian follows the Thunderbird upstream releases. Support for the 52.x
series has ended, so starting with this update we're now following the
60.x releases.

Between 52.x and 60.x, Thunderbird has undergone significant internal
updates, which makes it incompatible with a number of extensions. For
more information please refer to
https://support.mozilla.org/en-US/kb/new-thunderbird-60

In addition, the new Thunderbird packages require Rust to build. A
compatible Rust toolchain has been backported to Debian stretch, but is
not available for all architectures which previously supported the
purely C++-based Thunderbird packages. Thus, the new Thunderbird packages
don't support the mips, mips64el and mipsel architectures at this point.

For the stable distribution (stretch), these problems have been fixed in
version 1:60.0-3~deb9u1.

We recommend that you upgrade your thunderbird packages.

For the detailed security status of thunderbird please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/thunderbird

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4296-1: mbedtls security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4296-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
September 16, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : mbedtls
CVE ID : CVE-2018-0497 CVE-2018-0498

Two vulnerabilities were discovered in mbedtls, a lightweight crypto and
SSL/TLS library which could result in plain text recovery via
side-channel attacks.

For the stable distribution (stretch), these problems have been fixed in
version 2.4.2-1+deb9u3.

We recommend that you upgrade your mbedtls packages.

For the detailed security status of mbedtls please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/mbedtls

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/