Two updates for Debian 6 LTS and one for Debian 7 has been released:

[DLA 143-1] python-django security update
[DLA 144-1] polarssl security update
[DSA 3144-1] openjdk-7 security update

[DLA 143-1] python-django security update

Package : python-django
Version : 1.2.3-3+squeeze12
CVE ID : CVE-2015-0219 CVE-2015-0220 CVE-2015-0221

Multiple security issues have been found in Django:
https://www.djangoproject.com/weblog/2015/jan/13/security/

For Debian 6 Squeeeze, they have been fixed in version 1.2.3-3+squeeze12
of python-django. Here is what the upstream developers have to say about
those issues:

CVE-2015-0219 - WSGI header spoofing via underscore/dash conflation

When HTTP headers are placed into the WSGI environ, they are
normalized by converting to uppercase, converting all dashes to
underscores, and prepending HTTP_. For instance, a header X-Auth-User
would become HTTP_X_AUTH_USER in the WSGI environ (and thus also in
Django's request.META dictionary).

Unfortunately, this means that the WSGI environ cannot distinguish
between headers containing dashes and headers containing underscores:
X-Auth-User and X-Auth_User both become HTTP_X_AUTH_USER. This means
that if a header is used in a security-sensitive way (for instance,
passing authentication information along from a front-end proxy), even
if the proxy carefully strips any incoming value for X-Auth-User, an
attacker may be able to provide an X-Auth_User header (with
underscore) and bypass this protection.

In order to prevent such attacks, both Nginx and Apache 2.4+ strip
all headers containing underscores from incoming requests by
default. Django's built-in development server now does the same.
Django's development server is not recommended for production use,
but matching the behavior of common production servers reduces the
surface area for behavior changes during deployment.

CVE-2015-0220 - Possible XSS attack via user-supplied redirect URLs

Django relies on user input in some cases (e.g.
django.contrib.auth.views.login() and i18n) to redirect the user to an
"on success" URL. The security checks for these redirects (namely
django.util.http.is_safe_url()) didn't strip leading whitespace on the
tested URL and as such considered URLs like "\njavascript:..." safe. If
a developer relied on is_safe_url() to provide safe redirect targets
and put such a URL into a link, they could suffer from a XSS attack.
This bug doesn't affect Django currently, since we only put this URL
into the Location response header and browsers seem to ignore
JavaScript there.

CVE-2015-0221 - Denial-of-service attack against django.views.static.serve

In older versions of Django, the django.views.static.serve() view read
the files it served one line at a time. Therefore, a big file with no
newlines would result in memory usage equal to the size of that file.
An attacker could exploit this and launch a denial-of-service attack
by simultaneously requesting many large files. This view now reads the
file in chunks to prevent large memory usage.

Note, however, that this view has always carried a warning that it is
not hardened for production use and should be used only as a
development aid. Now may be a good time to audit your project and
serve your files in production using a real front-end web server if
you are not doing so.

Note that the version of Django in use in Debian 6 Squeeze was not
affected by CVE-2015-0222 (Database denial-of-service with
ModelMultipleChoiceField) since that feature does not exist
in this version.

[DLA 144-1] polarssl security update

Package : polarssl
Version : 1.2.9-1~deb6u4
CVE ID : CVE-2015-1182

A vulnerability was discovered in PolarSSL, a lightweight crypto and
SSL/TLS library. A remote attacker could exploit this flaw using
specially crafted certificates to mount a denial of service against an
application linked against the library (application crash), or
potentially, to execute arbitrary code.

[DSA 3144-1] openjdk-7 security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3144-1 security@debian.org
http://www.debian.org/security/ Moritz Muehlenhoff
January 29, 2015 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : openjdk-7
CVE ID : CVE-2014-3566 CVE-2014-6585 CVE-2014-6587 CVE-2014-6591
CVE-2014-6593 CVE-2014-6601 CVE-2015-0383 CVE-2015-0395
CVE-2015-0407 CVE-2015-0408 CVE-2015-0410 CVE-2015-0412

Several vulnerabilities have been discovered in OpenJDK, an
implementation of the Oracle Java platform, resulting in the execution
of arbitrary code, information disclosure or denial of service.

For the stable distribution (wheezy), these problems have been fixed in
version 7u75-2.5.4-1~deb7u1.

For the upcoming stable distribution (jessie), these problems will be
fixed soon.

For the unstable distribution (sid), these problems have been fixed in
version 7u75-2.5.4-1.

We recommend that you upgrade your openjdk-7 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/