The following updates has been released for Debian GNU/Linux:
[DLA 561-1] uclibc security update
[DLA 562-1] gosa security update
[DLA 563-1] libgd2 security update
[DSA 3630-1] libgd2 security update
[DSA 3631-1] php5 security update
[DLA 561-1] uclibc security update
[DLA 562-1] gosa security update
[DLA 563-1] libgd2 security update
[DSA 3630-1] libgd2 security update
[DSA 3631-1] php5 security update
[DLA 561-1] uclibc security update
Package : uclibc
Version : 0.9.32-1+deb7u1
CVE ID : CVE-2016-2224 CVE-2016-2225 CVE-2016-6264
Several vulnerabilities have been discovered in uClibc, an
implementation of the standard C library that is much smaller than
glibc, which makes it useful for embedded systems.
CVE-2016-2224
Fix possible denial of service via a specially crafted DNS reply
that could cause an infinite loop.
CVE-2016-2225
Fix possible denial of service via specially crafted packet that
will make the parser in libc/inet/resolv.c terminate early.
CVE-2016-6264
It was found that 'BLT' instruction in libc/string/arm/memset.S
checks for signed values. If the parameter of memset is negative,
then value added to the PC will be large. An attacker that controls
the length parameter of memset can also control the value of PC
register.
For Debian 7 "Wheezy", these problems have been fixed in version
0.9.32-1+deb7u1.
We recommend that you upgrade your uclibc packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[DLA 562-1] gosa security update
Package : gosa
Version : 2.7.4-4.3~deb7u3
CVE ID : CVE-2015-8771
GOsa² is a combination of system-administrator and end-user web
interface, designed to handle LDAP based setups.
A code injection vulnerability in the Samba plugin code of GOsa has
been discovered. During Samba password changes it has been possible to
inject malicious Perl code.
If you upgrade to this fixed package revision, please note that Samba
password changes will stop working until the sambaHashHook parameter
in gosa.conf has been updated to accept base64 encoded password strings.
Please read the gosa.conf (5) man page after you have upgraded to this
package revision and adapt gosa.conf as described there.
For Debian 7 "Wheezy", these problems have been fixed in version
2.7.4-4.3~deb7u3.
We recommend that you upgrade your gosa packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[DLA 563-1] libgd2 security update
Package : libgd2
Version : 2.0.36~rc1~dfsg-6.1+deb7u5
CVE ID : CVE-2016-6161
A global out of bounds read when encoding gif from malformed input was
found in this software.
When given invalid inputs, we might be fed the EOF marker before it is
actually the EOF. The gif logic assumes once it sees the EOF marker,
there won't be any more data, so it leaves the cur_bits index possibly
negative. So when we get more data, we underflow the masks array.
For Debian 7 "Wheezy", these problems have been fixed in version
2.0.36~rc1~dfsg-6.1+deb7u5.
We recommend that you upgrade your libgd2 packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[DSA 3630-1] libgd2 security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-3630-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
July 26, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : libgd2
CVE ID : CVE-2016-6207
Secunia Research at Flexera Software discovered an integer overflow
vulnerability within the _gdContributionsAlloc() function in libgd2, a
library for programmatic graphics creation and manipulation. A remote
attacker can take advantage of this flaw to cause a denial-of-service
against an application using the libgd2 library.
For the stable distribution (jessie), this problem has been fixed in
version 2.1.0-5+deb8u6.
For the unstable distribution (sid), this problem has been fixed in
version 2.2.2-43-g22cba39-1.
We recommend that you upgrade your libgd2 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[DSA 3631-1] php5 security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-3631-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
July 26, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : php5
CVE ID : CVE-2016-5385 CVE-2016-5399 CVE-2016-6289 CVE-2016-6290
CVE-2016-6291 CVE-2016-6292 CVE-2016-6294 CVE-2016-6295
CVE-2016-6296 CVE-2016-6297
Several vulnerabilities were found in PHP, a general-purpose scripting
language commonly used for web application development.
The vulnerabilities are addressed by upgrading PHP to the new upstream
version 5.6.24, which includes additional bug fixes. Please refer to the
upstream changelog for more information:
https://php.net/ChangeLog-5.php#5.6.24
For the stable distribution (jessie), these problems have been fixed in
version 5.6.24+dfsg-0+deb8u1.
For the unstable distribution (sid), these problems have been fixed in
version 7.0.9-1 of the php7.0 source package.
We recommend that you upgrade your php5 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
