The following updates has been released for Debian GNU/Linux:

Debian GNU/Linux 7 LTS:
DLA 1385-1: batik security update
DLA 1386-1: ming security update

Debian GNU/Linux 8 and 9:
DSA 4211-1: xdg-utils security update

DLA 1385-1: batik security update

Package : batik
Version : 1.7+dfsg-3+deb7u3
CVE ID : CVE-2018-8013
Debian Bug : 899374

Man Yue Mo discovered a security vulnerability in Apache Batik, an SVG
image library. A missing check for the class type before calling
newInstance when deserializing a subclass of AbstractDocument could
lead to information disclosure.

For Debian 7 "Wheezy", these problems have been fixed in version
1.7+dfsg-3+deb7u3.

We recommend that you upgrade your batik packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1386-1: ming security update

Package : ming
Version : 1:0.4.4-1.1+deb7u9
CVE ID : CVE-2018-7866 CVE-2018-7873 CVE-2018-7876 CVE-2018-9009
CVE-2018-9132

Multiple vulnerabilities have been discovered in Ming:

CVE-2018-7866

NULL pointer dereference in the newVar3 function (util/decompile.c).
Remote attackers might leverage this vulnerability to cause a denial
of service via a crafted swf file.

CVE-2018-7873

Heap-based buffer overflow vulnerability in the getString function
(util/decompile.c). Remote attackers might leverage this vulnerability
to cause a denial of service via a crafted swf file.

CVE-2018-7876

Integer overflow and resulting memory exhaustion in the
parseSWF_ACTIONRECORD function (util/parser.c). Remote attackers might
leverage this vulnerability to cause a denial of service via a crafted
swf file.

CVE-2018-9009

Various heap-based buffer overflow vulnerabilites in util/decompiler.c.
Remote attackers might leverage this vulnerability to cause a denial of
service via a crafted swf file.

CVE-2018-9132

NULL pointer dereference in the getInt function (util/decompile.c).
Remote attackers might leverage this vulnerability to cause a denial
of service via a crafted swf file.

For Debian 7 "Wheezy", these problems have been fixed in version
1:0.4.4-1.1+deb7u9.

We recommend that you upgrade your ming packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DSA 4211-1: xdg-utils security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4211-1 security@debian.org
https://www.debian.org/security/ Luciano Bello
May 25, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : xdg-utils
CVE ID : CVE-2017-18266
Debian Bug : 898317

Gabriel Corona discovered that xdg-utils, a set of tools for desktop
environment integration, is vulnerable to argument injection attacks. If
the environment variable BROWSER in the victim host has a "%s" and the
victim opens a link crafted by an attacker with xdg-open, the malicious
party could manipulate the parameters used by the browser when opened.
This manipulation could set, for example, a proxy to which the network
traffic could be intercepted for that particular execution.

For the oldstable distribution (jessie), this problem has been fixed
in version 1.1.0~rc1+git20111210-7.4+deb8u1.

For the stable distribution (stretch), this problem has been fixed in
version 1.1.1-1+deb9u1.

We recommend that you upgrade your xdg-utils packages.

For the detailed security status of xdg-utils please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/xdg-utils

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/