An updated strongswan package has been released for Debian GNU/Linux 7 LTS:
DLA 1059-1: strongswan security update

An updated newsbeuter packages is available for both Debian GNU/linux 8 and 9:
DSA 3947-1: newsbeuter security update

DLA 1059-1: strongswan security update

Package : strongswan
Version : 4.5.2-1.5+deb7u10
CVE ID : CVE-2017-11185
Debian Bug : #872155

It was discovered that there was a denial-of-service vulnerability in
the Strongswan Virtual Private Network (VPN) software.

Specific RSA signatures passed to the gmp plugin for verification could
cause a null-pointer dereference. Potential triggers are signatures in
certificates, but also signatures used during IKE authentication.

For more details, please see:

https://www.strongswan.org/blog/2017/08/14/strongswan-vulnerability-(cve-2017-11185).html


For Debian 7 "Wheezy", this issue has been fixed in strongswan version
4.5.2-1.5+deb7u10.

We recommend that you upgrade your strongswan packages.

DSA 3947-1: newsbeuter security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3947-1 security@debian.org
https://www.debian.org/security/ Sebastien Delafond
August 18, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : newsbeuter
CVE ID : CVE-2017-12904

Jeriko One discovered that newsbeuter, a text-mode RSS feed reader,
did not properly escape the title and description of a news article
when bookmarking it. This allowed a remote attacker to run an
arbitrary shell command on the client machine.

For the oldstable distribution (jessie), this problem has been fixed
in version 2.8-2+deb8u1.

For the stable distribution (stretch), this problem has been fixed in
version 2.9-5+deb9u1.

We recommend that you upgrade your newsbeuter packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/