The following updates has been released for Debian GNU/Linux:

Debian GNU/Linux 7 Extended LTS:
ELA-96-1 bash security update
ELA-97-1 wireshark security update

Debian GNU/Linux 8 LTS:
DLA 1726-1: bash security update
DLA 1727-1: firefox-esr security update
DLA 1728-1: openssh security update
DLA 1729-1: wireshark security update

ELA-96-1 bash security update

Package: bash
Version: 4.2+dfsg-0.1+deb7u5
Related CVE: CVE-2016-9401 CVE-2019-9924
Two issues have been fixed in bash, the GNU Bourne-Again Shell:

CVE-2016-9401

The popd builtin segfaulted when called with negative out of range
offsets.
CVE-2019-9924

Sylvain Beucler discovered that it was possible to call commands
that contained a slash when in restricted mode (rbash) by adding
them to the BASH_CMDS array.
For Debian 7 Wheezy, these problems have been fixed in version 4.2+dfsg-0.1+deb7u5.

We recommend that you upgrade your bash packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

ELA-97-1 wireshark security update

Package: wireshark
Version: 1.12.1+g01b65bf-4+deb8u6~deb7u15
Related CVE: CVE-2017-9344 CVE-2017-9349 CVE-2019-9209
Several vulnerabilities have been found in wireshark, a network traffic analyzer.

CVE-2019-9209: Preventing the crash of the ASN.1 BER and related dissectors by avoiding a buffer overflow associated with excessive digits in time values.

CVE-2017-9349: Fixing an infinite loop in the DICOM dissector by validationg a length value.

CVE-2017-9344: Avoid a divide by zero, by validating an interval value in the Bluetooth L2CAP dissector.

For Debian 7 Wheezy, these problems have been fixed in version 1.12.1+g01b65bf-4+deb8u6~deb7u15.

We recommend that you upgrade your wireshark packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

DLA 1726-1: bash security update

Package : bash
Version : 4.3-11+deb8u2
CVE ID : CVE-2016-9401 CVE-2019-9924

Two issues have been fixed in bash, the GNU Bourne-Again Shell:

CVE-2016-9401

The popd builtin segfaulted when called with negative out of range
offsets.

CVE-2019-9924

Sylvain Beucler discovered that it was possible to call commands
that contained a slash when in restricted mode (rbash) by adding
them to the BASH_CMDS array.

For Debian 8 "Jessie", these problems have been fixed in version
4.3-11+deb8u2.

We recommend that you upgrade your bash packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1727-1: firefox-esr security update

Package : firefox-esr
Version : 60.6.1esr-1~deb8u1
CVE ID : CVE-2019-9810 CVE-2019-9813

Multiple security issues have been found in the Mozilla Firefox web
browser, which could potentially result in the execution of arbitrary
code.

For Debian 8 "Jessie", these problems have been fixed in version
60.6.1esr-1~deb8u1.

We recommend that you upgrade your firefox-esr packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1728-1: openssh security update

Package : openssh
Version : 1:6.7p1-5+deb8u8
CVE ID : CVE-2018-20685 CVE-2019-6109 CVE-2019-6111
Debian Bug : 793412 919101 923486


Multiple scp client vulnerabilities have been discovered in OpenSSH, the
premier connectivity tool for secure remote shell login and secure file
transfer.

CVE-2018-20685

In scp.c, the scp client allowed remote SSH servers to bypass
intended access restrictions via the filename of . or an empty
filename. The impact was modifying the permissions of the target
directory on the client side.

CVE-2019-6109

Due to missing character encoding in the progress display, a
malicious server (or Man-in-The-Middle attacker) was able to employ
crafted object names to manipulate the client output, e.g., by using
ANSI control codes to hide additional files being transferred. This
affected refresh_progress_meter() in progressmeter.c.

CVE-2019-6111

Due to the scp implementation being derived from 1983 rcp, the server
chooses which files/directories are sent to the client. However, the
scp client only performed cursory validation of the object name
returned (only directory traversal attacks are prevented). A
malicious scp server (or Man-in-The-Middle attacker) was able to
overwrite arbitrary files in the scp client target directory. If
recursive operation (-r) was performed, the server was able to
manipulate subdirectories, as well (for example, to overwrite the
.ssh/authorized_keys file).

For Debian 8 "Jessie", these problems have been fixed in version
1:6.7p1-5+deb8u8.

We recommend that you upgrade your openssh packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

--

mike gabriel aka sunweaver (Debian Developer)
fon: +49 (1520) 1976 148

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31
mail: sunweaver@debian.org, http://sunweavers.net

DLA 1729-1: wireshark security update

Package : wireshark
Version : 1.12.1+g01b65bf-4+deb8u18
CVE ID : CVE-2017-9344 CVE-2017-9349 CVE-2019-9209


Several vulnerabilities have been found in wireshark, a network traffic
analyzer.

CVE-2019-9209:
Preventing the crash of the ASN.1 BER and related dissectors by
avoiding a buffer overflow associated with excessive digits in
time values.

CVE-2017-9349:
Fixing an infinite loop in the DICOM dissector by validating
a length value.

CVE-2017-9344:
Avoid a divide by zero, by validating an interval value in the
Bluetooth L2CAP dissector.


For Debian 8 "Jessie", these problems have been fixed in version
1.12.1+g01b65bf-4+deb8u18.

We recommend that you upgrade your wireshark packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS