The following Debian updates has been released today:

[DLA 472-2] icedove regression update
[DLA 480-1] nss security update
[DLA 481-1] phpmyadmin security update
[DSA 3583-1] swift-plugin-s3 security update

[DLA 472-2] icedove regression update

Package : icedove
Version : 31.8.0-1~deb7u1.1
CVE ID : CVE-2016-1979 CVE-2016-2805 CVE-2016-2807
Debian Bug : #823430

The security update for icedove did not build on armhf. This is resolved
by this upload.

The text of the original DLA follows:

Multiple security issues have been found in Icedove, Debian's version of
the Mozilla Thunderbird mail client. Multiple memory safety errors may
lead to the execution of arbitrary code or denial of service.

For Debian 7 "Wheezy", this problem has been fixed in version
38.8.0-1~deb7u1.

We recommend that you upgrade your icedove packages.

[DLA 480-1] nss security update

Package : nss
Version : 3.14.5-1+deb7u6
CVE ID : CVE-2015-7181 CVE-2015-7182 CVE-2016-1938 CVE-2016-1950
CVE-2016-1978 CVE-2016-1979

This security update fixes serious security issues in NSS including
arbitrary code execution and remote denial service attacks.

For Debian 7 "wheezy", these problems have been fixed in
3.14.5-1+deb7u6. We recommend you upgrade your nss packages as soon as
possible.

CVE-2015-7181

The sec_asn1d_parse_leaf function improperly restricts access to
an unspecified data structure.

CVE-2015-7182

Heap-based buffer overflow in the ASN.1 decoder.

CVE-2016-1938

The s_mp_div function in lib/freebl/mpi/mpi.c in improperly
divides numbers, which might make it easier for remote attackers
to defeat cryptographic protection mechanisms.

CVE-2016-1950

Heap-based buffer overflow allows remote attackers to execute
arbitrary code via crafted ASN.1 data in an X.509 certificate.

CVE-2016-1978

Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange
function allows remote attackers to cause a denial of service or
possibly have unspecified other impact by making an SSL (1) DHE or
(2) ECDHE handshake at a time of high memory consumption.

CVE-2016-1979

Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey
function allows remote attackers to cause a denial of service or
possibly have unspecified other impact via crafted key data with
DER encoding.

Further information about Debian LTS security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

[DLA 481-1] phpmyadmin security update

Package : phpmyadmin
Version : 4:3.4.11.1-2+deb7u3
CVE ID : CVE-2016-1927 CVE-2016-2038 CVE-2016-2039 CVE-2016-2040
CVE-2016-2041 CVE-2016-2045 CVE-2016-2560

This security update fixes a number of security issues in
phpMyAdmin. We recommend you upgrade your phpmyadmin packages.

CVE-2016-1927

suggestPassword generates weak passphrases

CVE-2016-2038

information disclosure via crafted requests

CVE-2016-2039

weak CSRF token values

CVE-2016-2040

XSS vulnerabilities in authenticated users

CVE-2016-2041

information breach in CSRF token comparison

CVE-2016-2045

XSS injection via crafted SQL queries

CVE-2016-2560

XSS injection

Further information about Debian LTS security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

[DSA 3583-1] swift-plugin-s3 security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3583-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
May 18, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : swift-plugin-s3
CVE ID : CVE-2015-8466
Debian Bug : 822688

It was discovered that the swift3 (S3 compatibility) middleware plugin
for Swift performed insufficient validation of date headers which might
result in replay attacks.

For the stable distribution (jessie), this problem has been fixed in
version 1.7-5+deb8u1.

For the testing distribution (stretch), this problem has been fixed
in version 1.9-1.

For the unstable distribution (sid), this problem has been fixed in
version 1.9-1.

We recommend that you upgrade your swift-plugin-s3 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/