The following updates has been released for Debian GNU/Linux:

[DLA 934-1] radicale security update
[DSA 3846-1] libytnef security update
[DSA 3847-1] xen security update

[DLA 934-1] radicale security update

Package : radicale
Version : 0.7-1.1+deb7u2
CVE ID : CVE-2017-8342

Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to
timing oracles and simple brute-force attacks when using
the htpasswd authentication method.

For Debian 7 "Wheezy", these problems have been fixed in version
0.7-1.1+deb7u2.

We recommend that you upgrade your radicale packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

[DSA 3846-1] libytnef security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3846-1 security@debian.org
https://www.debian.org/security/ Sebastien Delafond
May 09, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : libytnef
CVE ID : CVE-2017-6298 CVE-2017-6299 CVE-2017-6300 CVE-2017-6301
CVE-2017-6302 CVE-2017-6303 CVE-2017-6304 CVE-2017-6305
CVE-2017-6306 CVE-2017-6800 CVE-2017-6801 CVE-2017-6802
Debian Bug :

Several issues were discovered in libytnef, a library used to decode
application/ms-tnef e-mail attachments. Multiple heap overflows,
out-of-bound writes and reads, NULL pointer dereferences and infinite
loops could be exploited by tricking a user into opening a maliciously
crafted winmail.dat file.

For the stable distribution (jessie), these problems have been fixed in
version 1.5-6+deb8u1.

For the upcoming stable (stretch) and unstable (sid) distributions,
these problems have been fixed in version 1.9.2-1.

We recommend that you upgrade your libytnef packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[DSA 3847-1] xen security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3847-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
May 09, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : xen
CVE ID : CVE-2016-9932 CVE-2016-10013 CVE-2016-10024
CVE-2017-7228

Jan Beulich and Jann Horn discovered multiple vulnerabilities in the Xen
hypervisor, which may lead to privilege escalation, guest-to-host
breakout, denial of service or information leaks.

In additional to the CVE identifiers listed above, this update also
addresses the vulnerabilities announced as XSA-213, XSA-214 and XSA-215.

For the stable distribution (jessie), these problems have been fixed in
version 4.4.1-9+deb8u9.

For the upcoming stable distribution (stretch), these problems have been
fixed in version 4.8.1-1+deb9u1.

For the unstable distribution (sid), these problems have been fixed in
version 4.8.1-1+deb9u1.

We recommend that you upgrade your xen packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/