The following security updates has been released for Debian GNU/Linux:

Debian GNU/Linux 7 Extended LTS:
ELA-130-1 dbus security update

Debian GNU/Linux 8 LTS:
DLA 1818-1: dbus security update

Debian GNU/Linux 9:
DSA 4463-1: znc security update

ELA-130-1 dbus security update

Package: dbus
Version: 1.6.8-1+deb7u7
Related CVE: CVE-2019-12749
Joe Vennix discovered an authentication bypass vulnerability in dbus, an asynchronous inter-process communication system. The implementation of the DBUS_COOKIE_SHA1 authentication mechanism was susceptible to a symbolic link attack. A local attacker could take advantage of this flaw to bypass authentication and connect to a DBusServer with elevated privileges.

For Debian 7 Wheezy, these problems have been fixed in version 1.6.8-1+deb7u7.

We recommend that you upgrade your dbus packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

DLA 1818-1: dbus security update

Package : dbus
Version : 1.8.22-0+deb8u2
CVE ID : CVE-2019-12749
Debian Bug : 930375

Joe Vennix discovered an authentication bypass vulnerability in dbus, an
asynchronous inter-process communication system. The implementation of
the DBUS_COOKIE_SHA1 authentication mechanism was susceptible to a
symbolic link attack. A local attacker could take advantage of this flaw
to bypass authentication and connect to a DBusServer with elevated
privileges.

For Debian 8 "Jessie", this problem has been fixed in version
1.8.22-0+deb8u2.

We recommend that you upgrade your dbus packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DSA 4463-1: znc security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4463-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
June 14, 2019 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : znc
CVE ID : CVE-2019-9917 CVE-2019-12816
Debian Bug : 925285

Two vulnerabilities were discovered in the ZNC IRC bouncer which could
result in remote code execution (CVE-2019-12816) or denial of service
via invalid encoding (CVE-2019-9917).

For the stable distribution (stretch), these problems have been fixed in
version 1.6.5-1+deb9u2.

We recommend that you upgrade your znc packages.

For the detailed security status of znc please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/znc

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/