The following security updates are available for Debian:

[DLA 381-1] icu security update
[DSA 3440-1] sudo security update
[DSA 3441-1] perl security update

[DLA 381-1] icu security update

Package : icu
Version : 4.4.1-8+squeeze5
CVE ID : CVE-2015-2632

A vulnerability was found in ICU, a set of libraries that provides Unicode and
internationalization support. Integer overflows in the ICU layout engine made
it possible to disclose information.

For Debian 6 "Squeeze", this problem has been fixed in icu version
4.4.1-8+squeeze5. We recommend you to upgrade your icu packages.

Learn more about the Debian Long Term Support (LTS) Project and how to
apply these updates at: https://wiki.debian.org/LTS/

[DSA 3440-1] sudo security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3440-1 security@debian.org
https://www.debian.org/security/ Ben Hutchings
January 11, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : sudo
CVE ID : CVE-2015-5602
Debian Bug : 804149

When sudo is configured to allow a user to edit files under a directory
that they can already write to without using sudo, they can actually
edit (read and write) arbitrary files. Daniel Svartman reported that a
configuration like this might be introduced unintentionally if the
editable files are specified using wildcards, for example:

operator ALL=(root) sudoedit /home/*/*/test.txt

The default behaviour of sudo has been changed so that it does not allow
editing of a file in a directory that the user can write to, or that is
reached by following a symlink in a directory that the user can write
to. These restrictions can be disabled, but this is strongly
discouraged.

For the oldstable distribution (wheezy), this problem has been fixed
in version 1.8.5p2-1+nmu3+deb7u1.

For the stable distribution (jessie), this problem has been fixed in
version 1.8.10p3-1+deb8u3.

For the testing distribution (stretch), this problem has been fixed
in version 1.8.15-1.1.

For the unstable distribution (sid), this problem has been fixed in
version 1.8.15-1.1.

We recommend that you upgrade your sudo packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[DSA 3441-1] perl security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3441-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
January 11, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : perl
CVE ID : CVE-2015-8607
Debian Bug : 810719

David Golden of MongoDB discovered that File::Spec::canonpath() in Perl
returned untainted strings even if passed tainted input. This defect
undermines taint propagation, which is sometimes used to ensure that
unvalidated user input does not reach sensitive code.

The oldstable distribution (wheezy) is not affected by this problem.

For the stable distribution (jessie), this problem has been fixed in
version 5.20.2-3+deb8u2.

For the unstable distribution (sid), this problem will be fixed soon.

We recommend that you upgrade your perl packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/