The following updates has been released for Debian GNU/Linux:

Debian GNU/Linux 7 LTS:
DLA 1288-1: cups security update

Debian GNU/Linux 9:
DSA 4120-1: linux security update
DSA 4121-1: gcc-6 security update

DLA 1288-1: cups security update

Package : cups
Version : 1.5.3-5+deb7u7
CVE ID : CVE-2017-18190

It was discovered that there was an issue in the CUPS printer
framework where remote attackers could execute arbitrary commands by
sending POST requests to the CUPS daemon in conjunction with DNS
rebinding.

This was caused by a whitelisted "localhost.localdomain" entry.

For Debian 7 "Wheezy", this issue has been fixed in cups version
1.5.3-5+deb7u7.

We recommend that you upgrade your cups packages.

DSA 4120-1: linux security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4120-1 security@debian.org
https://www.debian.org/security/ Yves-Alexis Perez
February 22, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : linux
CVE ID : CVE-2017-5715 CVE-2017-5754 CVE-2017-13166 CVE-2018-5750

Several vulnerabilities have been discovered in the Linux kernel that may
lead to a privilege escalation, denial of service or information leaks.

CVE-2017-5715

Multiple researchers have discovered a vulnerability in various
processors supporting speculative execution, enabling an attacker
controlling an unprivileged process to read memory from arbitrary
addresses, including from the kernel and all other processes running on
the system.

This specific attack has been named Spectre variant 2 (branch target
injection) and is mitigated in the Linux kernel for the Intel x86-64
architecture by using the 'retpoline' compiler feature which allows
indirect branches to be isolated from speculative execution.

CVE-2017-5754

Multiple researchers have discovered a vulnerability in Intel
processors, enabling an attacker controlling an unprivileged process to
read memory from arbitrary addresses, including from the kernel and all
other processes running on the system.

This specific attack has been named Meltdown and is addressed in the
Linux kernel on the powerpc/ppc64el architectures by flushing the L1
data cache on exit from kernel mode to user mode (or from hypervisor to
kernel).

This works on Power7, Power8 and Power9 processors.

CVE-2017-13166

A bug in the 32-bit compatibility layer of the v4l2 IOCTL handling code
has been found. Memory protections ensuring user-provided buffers always
point to userland memory were disabled, allowing . This bug could be
exploited by an attacker to overwrite kernel memory from an unprivileged
userland process, leading to privilege escalation.

CVE-2018-5750

An information leak has been found in the Linux kernel. The
acpi_smbus_hc_add() prints a kernel address in the kernel log at every
boot, which could be used by an attacker on the system to defeat kernel
ASLR.

Additionnaly to those vulnerability, some mitigations for CVE-2017-5753 are
included in this release.

CVE-2017-5753

Multiple researchers have discovered a vulnerability in various
processors supporting speculative execution, enabling an attacker
controlling an unprivileged process to read memory from arbitrary
addresses, including from the kernel and all other processes running on
the system.

This specific attack has been named Spectre variant 1 (bounds-check
bypass) and is mitigated in the Linux kernel architecture by identifying
vulnerable code sections (array bounds checking followed by array
access) and replacing the array access with the speculation-safe
array_index_nospec() function.

More use sites will be added over time.

For the stable distribution (stretch), these problems have been fixed in
version 4.9.82-1+deb9u2.

We recommend that you upgrade your linux packages.

For the detailed security status of linux please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/linux

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4121-1: gcc-6 security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4121-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
February 22, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : gcc-6
CVE ID : not applicable

This update doesn't fix a vulnerability in GCC itself, but instead
provides support for building retpoline-enabled Linux kernel updates.

For the stable distribution (stretch), this problem has been fixed in
version 6.3.0-18+deb9u1.

We recommend that you upgrade your gcc-6 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/