The following updates has been released for Debian GNU/Linux:

[DLA 754-1] tor security update
[DLA 755-1] dcmtk security update
[DSA 3741-1] tor security update
[DSA 3742-1] flightgear security update
[DSA 3743-1] python-bottle security update

[DLA 754-1] tor security update

Package : tor
Version : 0.2.4.27-3
CVE ID : CVE-2016-1254
Debian Bug : #848847

It was discovered that Tor, a connection-based low-latency anonymous
communication system, may read one byte past a buffer when parsing
hidden service descriptors. This issue may enable a hostile hidden
service to crash Tor clients depending on hardening options and malloc
implementation.

For Debian 7 "Wheezy", these problems have been fixed in version
0.2.4.27-3.

We recommend that you upgrade your tor packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

[DLA 755-1] dcmtk security update

Package : dcmtk
Version : 3.6.0-12+deb7u1
CVE ID : CVE-2015-8979
Debian Bug : 848830


At several places in the code a wrong length of ACSE data structures
received over the network can cause overflows or underflows when
processing those data structures. Related checks have been added at
various places in order to prevent such (possible) attacks. Thanks to
Kevin Basista for the report.

The bug will indeed affect all DCMTK-based server applications that
accept incoming DICOM network connections that are using the
dcmtk-3.6.0 and earlier versions.

(From: http://zeroscience.mk/en/vulnerabilities/ZSL-2016-5384.php)

For Debian 7 "Wheezy", these problems have been fixed in version
3.6.0-12+deb7u1.

We recommend that you upgrade your dcmtk packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

[DSA 3741-1] tor security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3741-1 security@debian.org
https://www.debian.org/security/ Sebastien Delafond
December 20, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : tor
CVE ID : CVE-2016-1254
Debian Bug : 848847

It was discovered that Tor, a connection-based low-latency anonymous
communication system, may read one byte past a buffer when parsing
hidden service descriptors. This issue may enable a hostile hidden
service to crash Tor clients depending on hardening options and malloc
implementation.

For the stable distribution (jessie), this problem has been fixed in
version 0.2.5.12-4.

For the testing (stretch) and unstable (sid) distributions, this
problem has been fixed in version 0.2.9.8-2.

We recommend that you upgrade your tor packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[DSA 3742-1] flightgear security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3742-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
December 20, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : flightgear
CVE ID : CVE-2016-9956

It was discovered that the Flight Gear flight simulator performs
insufficient sanitising of Nasal scripts which allows a malicious script
to overwrite arbitrary files with the privileges of the user running
Flight Gear.

For the stable distribution (jessie), this problem has been fixed in
version 3.0.0-5+deb8u1.

For the unstable distribution (sid), this problem has been fixed in
version 1:2016.4.3+dfsg-1.

We recommend that you upgrade your flightgear packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[DSA 3743-1] python-bottle security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3743-1 security@debian.org
https://www.debian.org/security/ Sebastien Delafond
December 20, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : python-bottle
CVE ID : CVE-2016-9964
Debian Bug : 848392

It was discovered that bottle, a WSGI-framework for the Python
programming language, did not properly filter "\r\n" sequences when
handling redirections. This allowed an attacker to perform CRLF
attacks such as HTTP header injection.

For the stable distribution (jessie), this problem has been fixed in
version 0.12.7-1+deb8u1.

For the testing (stretch) and unstable (sid) distributions, this
problem has been fixed in version 0.12.11-1.

We recommend that you upgrade your python-bottle packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/