[DLA 854-1] icoutils security update

Package : icoutils
Version : 0.29.1-5deb7u2
CVE ID : CVE-2017-6009 CVE-2017-6010 CVE-2017-6011
Debian Bug : 854054 854050

Icoutils is a set of programs that deal with MS Windows icons and
cursors. Resources such as icons and cursors can be extracted from
MS Windows executable and library files with wrestool.

Three vulnerabilities has been found in these tools.

CVE-2017-6009

A buffer overflow was observed in wrestool.

CVE-2017-6010

A buffer overflow was observed in the extract_icons function.
This issue can be triggered by processing a corrupted ico file
and will result in an icotool crash.

CVE-2017-6011

An out-of-bounds read leading to a buffer overflow was observed
icotool.

For Debian 7 "Wheezy", these problems have been fixed in version
0.29.1-5deb7u2.

We recommend that you upgrade your icoutils packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

[DLA 855-1] roundcube security update

Package : roundcube
Version : 0.7.2-9+deb7u6
CVE ID : CVE-2017-6820
Debian Bug : 857473

Roundcube, a webmail solution for IMAP servers, was susceptible to
a cross-site-scripting (XSS) vulnerability via a crafted Cascading
Style Sheets (CSS) token sequence within an SVG element or HTML message.

For Debian 7 "Wheezy", these problems have been fixed in version
0.7.2-9+deb7u6.

We recommend that you upgrade your roundcube packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

[DSA 3808-1] imagemagick security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3808-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
March 13, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : imagemagick
CVE ID : CVE-2017-6498 CVE-2017-6499 CVE-2017-6500
Debian Bug : 856878 856879 856880 857426 844594

This update fixes several vulnerabilities in imagemagick: Various memory
handling problems and cases of missing or incomplete input sanitising
may result in denial of service or the execution of arbitrary code if
malformed TGA, Sun or PSD files are processed.

This update also fixes visual artefacts when running -sharpen on CMYK
images (no security impact, but piggybacked on top of the security
update with approval of the Debian stable release managers since it's
a regression in jessie compared to wheezy).

For the stable distribution (jessie), these problems have been fixed in
version 8:6.8.9.9-5+deb8u8.

For the upcoming stable distribution (stretch), these problems have been
fixed in version 8:6.9.7.4+dfsg-2.

For the unstable distribution (sid), these problems have been fixed in
version 8:6.9.7.4+dfsg-2.

We recommend that you upgrade your imagemagick packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/