[DLA 200-1] ruby1.9.1 security update

Package : ruby1.9.1
Version : 1.9.2.0-2+deb6u3
CVE ID : CVE-2014-4975 CVE-2014-8080 CVE-2014-8090

CVE-2014-4975

The encodes() function in pack.c had an off-by-one error that could
lead to a stack-based buffer overflow. This could allow remote
attackers to cause a denial of service (crash) or arbitrary code
execution.

CVE-2014-8080, CVE-2014-8090

The REXML parser could be coerced into allocating large string
objects that could consume all available memory on the system. This
could allow remote attackers to cause a denial of service (crash).

[DSA 3225-1] gst-plugins-bad0.10 security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3225-1 security@debian.org
http://www.debian.org/security/ Moritz Muehlenhoff
April 15, 2015 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : gst-plugins-bad0.10
CVE ID : CVE-2015-0797

Aki Helin discovered a buffer overflow in the GStreamer plugin for MP4
playback, which could lead in the execution of arbitrary code.

For the stable distribution (wheezy), this problem has been fixed in
version 0.10.23-7.1+deb7u2.

For the unstable distribution (sid), this problem will be fixed soon.

We recommend that you upgrade your gst-plugins-bad0.10 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[DSA 3226-1] inspircd security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3226-1 security@debian.org
http://www.debian.org/security/ Sebastien Delafond
April 15, 2015 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : inspircd
Debian Bug : 780880

adam@anope.org discovered several problems in inspircd, an IRC daemon:

- an incomplete patch for CVE-2012-1836 failed to adequately resolve
the problem where maliciously crafted DNS requests could lead to
remote code execution through a heap-based buffer overflow.

- the incorrect processing of specific DNS packets could trigger an
infinite loop, thus resulting in a denial of service.

For the stable distribution (wheezy), this problem has been fixed in
version 2.0.5-1+deb7u1.

For the upcoming stable distribution (jessie) and unstable
distribution (sid), this problem has been fixed in version 2.0.16-1.

We recommend that you upgrade your inspircd packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[DSA 3227-1] movabletype-opensource security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3227-1 security@debian.org
http://www.debian.org/security/ Salvatore Bonaccorso
April 15, 2015 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : movabletype-opensource
CVE ID : CVE-2015-0845

John Lightsey discovered a format string injection vulnerability in the
localisation of templates in Movable Type, a blogging system. An
unauthenticated remote attacker could take advantage of this flaw to
execute arbitrary code as the web server user.

For the stable distribution (wheezy), this problem has been fixed in
version 5.1.4+dfsg-4+deb7u3.

We recommend that you upgrade your movabletype-opensource packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/