The following updates has been released for Debian GNU/Linux:

Debian GNU/Linux 7 Extended LTS:
ELA-163-1: curl security update

Debian GNU/Linux 8 LTS:
DLA 1919-2: linux-4.9 security update

Debian GNU/Linux 9:
DSA 4522-1: faad2 security update

Debian GNU/Linux 9 and 10:
DSA 4523-1: thunderbird security update

ELA-163-1: curl security update

Package: curl
Version: 7.26.0-1+wheezy25+deb7u5
Related CVE: CVE-2019-5482

Thomas Vegas discovered a heap-based buffer overflow in the function tftp_receive_packet() that receives data from a TFTP server. It can call recvfrom() with the default size for the buffer rather than with the size that was used to allocate it. Thus, the content that might overwrite the heap memory is controlled by the server. This issue was introduced by the add of the TFTP BLKSIZE option handling. It was previously incompletely fixed by an almost identical issue called CVE-2019-5436.

For Debian 7 Wheezy, these problems have been fixed in version 7.26.0-1+wheezy25+deb7u5.

We recommend that you upgrade your curl packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

DLA 1919-2: linux-4.9 security update

Package : linux-4.9
Version : 4.9.189-3~deb8u1
CVE ID : CVE-2019-0136 CVE-2019-9506 CVE-2019-11487 CVE-2019-15211
CVE-2019-15212 CVE-2019-15215 CVE-2019-15216 CVE-2019-15218
CVE-2019-15219 CVE-2019-15220 CVE-2019-15221 CVE-2019-15292
CVE-2019-15538 CVE-2019-15666 CVE-2019-15807 CVE-2019-15924
CVE-2019-15926
Debian Bug : 930904

Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.

This updated advisory text mentions the additional non-security
changes and notes the need to install new binary packages.

CVE-2019-0136

It was discovered that the wifi soft-MAC implementation (mac80211)
did not properly authenticate Tunneled Direct Link Setup (TDLS)
messages. A nearby attacker could use this for denial of service
(loss of wifi connectivity).

CVE-2019-9506

Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen
discovered a weakness in the Bluetooth pairing protocols, dubbed
the "KNOB attack". An attacker that is nearby during pairing
could use this to weaken the encryption used between the paired
devices, and then to eavesdrop on and/or spoof communication
between them.

This update mitigates the attack by requiring a minimum encryption
key length of 56 bits.

CVE-2019-11487

Jann Horn discovered that the FUSE (Filesystem-in-Userspace)
facility could be used to cause integer overflow in page reference
counts, leading to a use-after-free. On a system with sufficient
physical memory, a local user permitted to create arbitrary FUSE
mounts could use this for privilege escalation.

By default, unprivileged users can only mount FUSE filesystems
through fusermount, which limits the number of mounts created and
should completely mitigate the issue.

CVE-2019-15211

The syzkaller tool found a bug in the radio-raremono driver that
could lead to a use-after-free. An attacker able to add and
remove USB devices could use this to cause a denial of service
(memory corruption or crash) or possibly for privilege escalation.

CVE-2019-15212

The syzkaller tool found that the rio500 driver does not work
correctly if more than one device is bound to it. An attacker
able to add USB devices could use this to cause a denial of
service (memory corruption or crash) or possibly for privilege
escalation.

CVE-2019-15215

The syzkaller tool found a bug in the cpia2_usb driver that leads
to a use-after-free. An attacker able to add and remove USB
devices could use this to cause a denial of service (memory
corruption or crash) or possibly for privilege escalation.

CVE-2019-15216

The syzkaller tool found a bug in the yurex driver that leads to
a use-after-free. An attacker able to add and remove USB
devices could use this to cause a denial of service (memory
corruption or crash) or possibly for privilege escalation.

CVE-2019-15218

The syzkaller tool found that the smsusb driver did not validate
that USB devices have the expected endpoints, potentially leading
to a null pointer dereference. An attacker able to add USB
devices could use this to cause a denial of service (BUG/oops).

CVE-2019-15219

The syzkaller tool found that a device initialisation error in the
sisusbvga driver could lead to a null pointer dereference. An
attacker able to add USB devices could use this to cause a denial
of service (BUG/oops).

CVE-2019-15220

The syzkaller tool found a race condition in the p54usb driver
which could lead to a use-after-free. An attacker able to add and
remove USB devices could use this to cause a denial of service
(memory corruption or crash) or possibly for privilege escalation.

CVE-2019-15221

The syzkaller tool found that the line6 driver did not validate
USB devices' maximum packet sizes, which could lead to a heap
buffer overrun. An attacker able to add USB devices could use
this to cause a denial of service (memory corruption or crash) or
possibly for privilege escalation.

CVE-2019-15292

The Hulk Robot tool found missing error checks in the Appletalk
protocol implementation, which could lead to a use-after-free.
The security impact of this is unclear.

CVE-2019-15538

Benjamin Moody reported that operations on XFS hung after a
chgrp command failed due to a disk quota. A local user on a
system using XFS and disk quotas could use this for denial of
service.

CVE-2019-15666

The Hulk Robot tool found an incorrect range check in the network
transformation (xfrm) layer, leading to out-of-bounds memory
accesses. A local user with CAP_NET_ADMIN capability (in any user
namespace) could use this to cause a denial of service (memory
corruption or crash) or possibly for privilege escalation.

CVE-2019-15807

Jian Luo reported that the Serial Attached SCSI library (libsas)
did not correctly handle failure to discover devices beyond a SAS
expander. This could lead to a resource leak and crash (BUG).
The security impact of this is unclear.

CVE-2019-15924

The Hulk Robot tool found a missing error check in the fm10k
Ethernet driver, which could lead to a null pointer dereference
and crash (BUG/oops). The security impact of this is unclear.

CVE-2019-15926

It was found that the ath6kl wifi driver did not consistently
validate traffic class numbers in received control packets,
leading to out-of-bounds memory accesses. A nearby attacker on
the same wifi network could use this to cause a denial of service
(memory corruption or crash) or possibly for privilege escalation.

For Debian 8 "Jessie", these problems have been fixed in version
4.9.189-3~deb8u1. This version also includes a fix for Debian bug
#930904, and other fixes included in upstream stable updates.

We recommend that you upgrade your linux-4.9 and linux-latest-4.9
packages. You will need to use "apt-get upgrade --with-new-pkgs"
or "apt upgrade" as the binary package names have changed.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DSA 4522-1: faad2 security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4522-1 security@debian.org
https://www.debian.org/security/ Hugo Lefeuvre
September 15, 2019 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : faad2
CVE ID : CVE-2018-19502 CVE-2018-19503 CVE-2018-19504 CVE-2018-20194
CVE-2018-20195 CVE-2018-20197 CVE-2018-20198 CVE-2018-20357
CVE-2018-20358 CVE-2018-20359 CVE-2018-20361 CVE-2018-20362
CVE-2019-15296
Debian Bug : 914641

Multiple vulnerabilities have been discovered in faad2, the Freeware Advanced
Audio Coder. These vulnerabilities might allow remote attackers to cause
denial-of-service, or potentially execute arbitrary code if crafted MPEG AAC
files are processed.

For the oldstable distribution (stretch), these problems have been fixed
in version 2.8.0~cvs20161113-1+deb9u2.

We recommend that you upgrade your faad2 packages.

For the detailed security status of faad2 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/faad2

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4523-1: thunderbird security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4523-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
September 15, 2019 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : thunderbird
CVE ID : CVE-2019-11739 CVE-2019-11740 CVE-2019-11742 CVE-2019-11743
CVE-2019-11744 CVE-2019-11746 CVE-2019-11752

Multiple security issues have been found in Thunderbird which could
potentially result in the execution of arbitrary code, cross-site
scripting, information disclosure and a covert content attack on S/MIME
encryption using a crafted multipart/alternative message.

For the oldstable distribution (stretch), these problems have been fixed
in version 1:60.9.0-1~deb9u1.

For the stable distribution (buster), these problems have been fixed in
version 1:60.9.0-1~deb10u1.

We recommend that you upgrade your thunderbird packages.

For the detailed security status of thunderbird please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/thunderbird

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/