[DLA 77-1] libtasn1-3 security update

Package : libtasn1-3
Version : 2.7-1+squeeze+2
CVE ID : CVE-2014-3467 CVE-2014-3468 CVE-2014-3469

Several vulnerabilities were discovered in libtasn1-3, a library that
manages ASN1 (Abstract Syntax Notation One) structures. An attacker
could use those to cause a denial-of-service via out-of-bounds access
or NULL pointer dereference.

[DSA 3056-1] libtasn1-3 security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3056-1 security@debian.org
http://www.debian.org/security/ Sebastien Delafond
October 26, 2014 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : libtasn1-3
CVE ID : CVE-2014-3467 CVE-2014-3468 CVE-2014-3469

Several vulnerabilities were discovered in libtasn1-3, a library that
manages ASN1 (Abstract Syntax Notation One) structures. An attacker
could use those to cause a denial-of-service via out-of-bounds access
or NULL pointer dereference.

For the stable distribution (wheezy), these problems have been fixed in
version 2.13-2+deb7u1.

We recommend that you upgrade your libtasn1-3 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[DSA 3057-1] libxml2 security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3057-1 security@debian.org
http://www.debian.org/security/ Thijs Kinkhorst
October 26, 2014 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : libxml2
CVE ID : CVE-2014-3660
Debian Bug : 762864 765722 765770

Sogeti found a denial of service flaw in libxml2, a library providing
support to read, modify and write XML and HTML files. A remote attacker
could provide a specially crafted XML file that, when processed by an
application using libxml2, would lead to excessive CPU consumption
(denial of service) based on excessive entity substitutions, even if
entity substitution was disabled, which is the parser default behavior.
(CVE-2014-3660)

In addition, this update addresses a misapplied chunk for a patch
released in version 2.8.0+dfsg1-7+wheezy1 (#762864), and a memory leak
regression (#765770) introduced in version 2.8.0+dfsg1-7+nmu3.

For the stable distribution (wheezy), this problem has been fixed in
version 2.8.0+dfsg1-7+wheezy2.

For the unstable distribution (sid), this problem has been fixed in
version 2.9.2+dfsg1-1.

We recommend that you upgrade your libxml2 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/