[DLA 770-2] libphp-phpmailer regression update

Package : libphp-phpmailer
Version : 5.1-1.2
CVE ID : CVE-2016-10033
Debian Bug : 849365

Dawid Golunski discovered that PHPMailer, a popular library to send
email from PHP applications, allowed a remote attacker to execute
code if they were able to provide a crafted Sender address.

Note that for this issue also CVE-2016-10045 was assigned, which is a
regression in the original patch proposed for CVE-2016-10033. Because
the origial patch was not applied in Debian, Debian was not vulnerable
to CVE-2016-10045.

For Debian 7 "Wheezy", these problems have been fixed in version
5.1-1.2.

We recommend that you upgrade your libphp-phpmailer packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

[DLA 776-1] samba security update

Package : samba
Version : 2:3.6.6-6+deb7u11
CVE ID : CVE-2016-2125

Simo Sorce of Red Hat discovered that the Samba client code always
requests a forwardable ticket when using Kerberos authentication. A
target server, which must be in the current or trusted domain/realm,
is given a valid general purpose Kerberos "Ticket Granting Ticket"
(TGT), which can be used to fully impersonate the authenticated user
or service.

For Debian 7 "Wheezy", these problems have been fixed in version
2:3.6.6-6+deb7u11.

We recommend that you upgrade your samba packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

[DLA 777-1] libvncserver security update

Package : libvncserver
Version : 0.9.9+dfsg-1+deb7u2
CVE IDs : CVE-2016-9941, CVE-2016-9942
Debian Bugs : #850007, #850008

It was discovered that there were two vulnerabilities in libvncserver, a
library to create/embed a VNC server:

* CVE-2016-9941: Fix a heap-based buffer overflow that allows remote servers
to cause a denial of service via a crafted FramebufferUpdate message
containing a subrectangle outside of the drawing area.

* CVE-2016-9942: Fix a heap-based buffer overflow that allow remote servers
to cause a denial of service via a crafted FramebufferUpdate message with
the "Ultra" type tile such that the LZO decompressed payload exceeds the
size of the tile dimensions.

For Debian 7 "Wheezy", these issues have been fixed in libvncserver version
0.9.9+dfsg-1+deb7u2.

We recommend that you upgrade your libvncserver packages.