The following updates has been released for Debian GNU/Linux:

[DLA 338-1] xscreensaver security update
[DSA 3381-2] openjdk-7 security update
[DSA 3385-1] mariadb-10.0 security update
[DSA 3386-1] unzip security update
[DSA 3387-1] openafs security update
[DSA 3388-1] ntp security update
[DSA 3389-1] elasticsearch end-of-life

[DLA 338-1] xscreensaver security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Package : xscreensaver
Version : 5.11-1+deb6u11
CVE ID : CVE-2015-8025
Debian Bug : 802914

xscreensaver, a screensaver daemon and frontend for X11 was vulnerable
to crashing when hot-swapping monitors.

For Debian 6 Squeeze, this issue has been fixed in xscreensaver version
5.11-1+deb6u11.

[DSA 3381-2] openjdk-7 security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3381-2 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
November 1, 2015 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : openjdk-7
CVE ID : CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806
CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843
CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872
CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893
CVE-2015-4903 CVE-2015-4911

Several vulnerabilities have been discovered in OpenJDK, an
implementation of the Oracle Java platform, resulting in the execution
of arbitrary code, breakouts of the Java sandbox, information disclosure,
or denial of service.

The jessie update in DSA 3381 was built incorrectly, we apologise for
the inconvenience. In addition the version number in jessie-security
was lower than in wheezy-security which could result in upgrade problems
during distribution updates. This has been fixed in 7u85-2.6.1-6~deb8u1.

We recommend that you upgrade your openjdk-7 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[DSA 3385-1] mariadb-10.0 security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3385-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
October 31, 2015 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : mariadb-10.0
CVE ID : CVE-2015-4792 CVE-2015-4802 CVE-2015-4815 CVE-2015-4816
CVE-2015-4819 CVE-2015-4826 CVE-2015-4830 CVE-2015-4836
CVE-2015-4858 CVE-2015-4861 CVE-2015-4870 CVE-2015-4879
CVE-2015-4895 CVE-2015-4913
Debian Bug : 802874

Several issues have been discovered in the MariaDB database server. The
vulnerabilities are addressed by upgrading MariaDB to the new upstream
version 10.0.22. Please see the MariaDB 10.0 Release Notes for further
details:

https://mariadb.com/kb/en/mariadb/mariadb-10021-release-notes/
https://mariadb.com/kb/en/mariadb/mariadb-10022-release-notes/

For the stable distribution (jessie), these problems have been fixed in
version 10.0.22-0+deb8u1.

For the unstable distribution (sid), these problems have been fixed in
version 10.0.22-1 or earlier.

We recommend that you upgrade your mariadb-10.0 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[DSA 3386-1] unzip security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3386-1 security@debian.org
https://www.debian.org/security/ Laszlo Boszormenyi (GCS)
October 31, 2015 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : unzip
CVE ID : CVE-2015-7696 CVE-2015-7697
Debian Bug : 802160 802162

Two vulnerabilities have been found in unzip, a de-archiver for .zip
files. The Common Vulnerabilities and Exposures project identifies the
following problems:

CVE-2015-7696

Gustavo Grieco discovered that unzip incorrectly handled certain
password protected archives. If a user or automated system were
tricked into processing a specially crafted zip archive, an attacker
could possibly execute arbitrary code.

CVE-2015-7697

Gustavo Grieco discovered that unzip incorrectly handled certain
malformed archives. If a user or automated system were tricked into
processing a specially crafted zip archive, an attacker could
possibly cause unzip to hang, resulting in a denial of service.

For the oldstable distribution (wheezy), these problems have been fixed
in version 6.0-8+deb7u4.

For the stable distribution (jessie), these problems have been fixed in
version 6.0-16+deb8u1.

For the testing distribution (stretch), these problems have been fixed
in version 6.0-19.

For the unstable distribution (sid), these problems have been fixed in
version 6.0-19.

We recommend that you upgrade your unzip packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[DSA 3387-1] openafs security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3387-1 security@debian.org
https://www.debian.org/security/ Florian Weimer
November 01, 2015 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : openafs
CVE ID : CVE-2015-7762 CVE-2015-7763

John Stumpo discovered that OpenAFS, a distributed file system, does
not fully initialize certain network packets before transmitting them.
This can lead to a disclosure of the plaintext of previously processed
packets.

For the oldstable distribution (wheezy), these problems have been fixed
in version 1.6.1-3+deb7u5.

For the stable distribution (jessie), these problems have been fixed in
version 1.6.9-2+deb8u4.

For the testing distribution (stretch) and the unstable distribution
(sid), these problems have been fixed in version 1.6.15-1.

We recommend that you upgrade your openafs packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[DSA 3388-1] ntp security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3388-1 security@debian.org
https://www.debian.org/security/ Kurt Roeckx
November 01, 2015 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : ntp
CVE ID : CVE-2014-9750 CVE-2014-9751 CVE-2015-3405 CVE-2015-5146
CVE-2015-5194 CVE-2015-5195 CVE-2015-5219 CVE-2015-5300
CVE-2015-7691 CVE-2015-7692 CVE-2015-7701 CVE-2015-7702
CVE-2015-7703 CVE-2015-7704 CVE-2015-7850 CVE-2015-7852
CVE-2015-7855 CVE-2015-7871

Several vulnerabilities were discovered in the Network Time Protocol
daemon and utility programs:

CVE-2015-5146

A flaw was found in the way ntpd processed certain remote
configuration packets. An attacker could use a specially crafted
package to cause ntpd to crash if:

* ntpd enabled remote configuration
* The attacker had the knowledge of the configuration password
* The attacker had access to a computer entrusted to perform remote
configuration

Note that remote configuration is disabled by default in NTP.

CVE-2015-5194

It was found that ntpd could crash due to an uninitialized
variable when processing malformed logconfig configuration
commands.

CVE-2015-5195

It was found that ntpd exits with a segmentation fault when a
statistics type that was not enabled during compilation (e.g.
timingstats) is referenced by the statistics or filegen
configuration command

CVE-2015-5219

It was discovered that sntp program would hang in an infinite loop
when a crafted NTP packet was received, related to the conversion
of the precision value in the packet to double.

CVE-2015-5300

It was found that ntpd did not correctly implement the -g option:

Normally, ntpd exits with a message to the system log if the offset
exceeds the panic threshold, which is 1000 s by default. This
option allows the time to be set to any value without restriction;
however, this can happen only once. If the threshold is exceeded
after that, ntpd will exit with a message to the system log. This
option can be used with the -q and -x options.

ntpd could actually step the clock multiple times by more than the
panic threshold if its clock discipline doesn't have enough time to
reach the sync state and stay there for at least one update. If a
man-in-the-middle attacker can control the NTP traffic since ntpd
was started (or maybe up to 15-30 minutes after that), they can
prevent the client from reaching the sync state and force it to step
its clock by any amount any number of times, which can be used by
attackers to expire certificates, etc.

This is contrary to what the documentation says. Normally, the
assumption is that an MITM attacker can step the clock more than the
panic threshold only once when ntpd starts and to make a larger
adjustment the attacker has to divide it into multiple smaller
steps, each taking 15 minutes, which is slow.

CVE-2015-7691, CVE-2015-7692, CVE-2015-7702

It was found that the fix for CVE-2014-9750 was incomplete: three
issues were found in the value length checks in ntp_crypto.c, where
a packet with particular autokey operations that contained malicious
data was not always being completely validated. Receipt of these
packets can cause ntpd to crash.

CVE-2015-7701

A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If ntpd is
configured to use autokey authentication, an attacker could send
packets to ntpd that would, after several days of ongoing attack,
cause it to run out of memory.

CVE-2015-7703

Miroslav Lichvar of Red Hat found that the :config command can be
used to set the pidfile and driftfile paths without any
restrictions. A remote attacker could use this flaw to overwrite a
file on the file system with a file containing the pid of the ntpd
process (immediately) or the current estimated drift of the system
clock (in hourly intervals). For example:

ntpq -c ':config pidfile /tmp/ntp.pid'
ntpq -c ':config driftfile /tmp/ntp.drift'

In Debian ntpd is configured to drop root privileges, which limits
the impact of this issue.

CVE-2015-7704

If ntpd as an NTP client receives a Kiss-of-Death (KoD) packet
from the server to reduce its polling rate, it doesn't check if the
originate timestamp in the reply matches the transmit timestamp from
its request. An off-path attacker can send a crafted KoD packet to
the client, which will increase the client's polling interval to a
large value and effectively disable synchronization with the server.

CVE-2015-7850

An exploitable denial of service vulnerability exists in the remote
configuration functionality of the Network Time Protocol. A
specially crafted configuration file could cause an endless loop
resulting in a denial of service. An attacker could provide a the
malicious configuration file to trigger this vulnerability.

CVE-2015-7852

A potential off by one vulnerability exists in the cookedprint
functionality of ntpq. A specially crafted buffer could cause a
buffer overflow potentially resulting in null byte being written out
of bounds.

CVE-2015-7855

It was found that NTP's decodenetnum() would abort with an assertion
failure when processing a mode 6 or mode 7 packet containing an
unusually long data value where a network address was expected. This
could allow an authenticated attacker to crash ntpd.

CVE-2015-7871

An error handling logic error exists within ntpd that manifests due
to improper error condition handling associated with certain
crypto-NAK packets. An unauthenticated, off-path attacker can force
ntpd processes on targeted servers to peer with time sources of the
attacker's choosing by transmitting symmetric active crypto-NAK
packets to ntpd. This attack bypasses the authentication typically
required to establish a peer association and allows an attacker to
make arbitrary changes to system time.

For the oldstable distribution (wheezy), these problems have been fixed
in version 1:4.2.6.p5+dfsg-2+deb7u6.

For the stable distribution (jessie), these problems have been fixed in
version 1:4.2.6.p5+dfsg-7+deb8u1.

For the testing distribution (stretch), these problems have been fixed
in version 1:4.2.8p4+dfsg-3.

For the unstable distribution (sid), these problems have been fixed in
version 1:4.2.8p4+dfsg-3.

We recommend that you upgrade your ntp packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[DSA 3389-1] elasticsearch end-of-life

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3389-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
November 01, 2015 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : elasticsearch

Security support for elasticsearch in jessie is hereby discontinued. The
project no longer releases information on fixed security issues which
allow backporting them to released versions of Debian and actively
discourages from doing so.

elasticsearch will also be removed from Debian stretch (the next stable
Debian release), but will continue to remain in unstable and available
in jessie-backports.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/