The following security updates has been released for Debian GNU/Linux:

Debian GNU/Linux 7 Extended LTS:
ELA-62-1 libarchive security update

Debian GNU/Linux 8 LTS:
DLA 1562-2: poppler security update
DLA 1599-1: qemu security update
DLA 1601-1: perl security update
DLA 1602-1: nsis security update

Debian GNU/Linux 9:
DSA 4348-1: openssl security update
DSA 4349-1: tiff security update

ELA-62-1 libarchive security update

Package: libarchive
Version: 3.0.4-3+wheezy6+deb7u2
Related CVE: CVE-2017-14501 CVE-2017-14502 CVE-2017-14503
Several security vulnerabilities were found in libarchive, a multi-format archive and compression library. Heap-based buffer over-reads, NULL pointer dereferences and out-of-bounds reads allow remote attackers to cause a denial-of-service (application crash) via specially crafted archive files.

For Debian 7 Wheezy, these problems have been fixed in version 3.0.4-3+wheezy6+deb7u2.

We recommend that you upgrade your libarchive packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

DLA 1562-2: poppler security update

Package : poppler
Version : 0.26.5-2+deb8u6
CVE ID : CVE-2018-16646


A regression issue has been resolved in the poppler PDF rendering
shared library introduced with version 0.26.5-2+deb8u5.


CVE-2018-16646

In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may
cause infinite recursion via a crafted file. A remote attacker can
leverage this for a DoS attack.

The previous solution in Debian LTS fixed the above issue in XRef.cc,
the patches had been obtained from a merge request (#67) on upstream's
Git development platform. Unfortunately, this merge request was declined
by upstream and another merge request (#91) got applied instead. The
fix now directly occurs in the Parser.cc file.

This version of poppler now ships the changeset that got favorized by
the poppler upstream developers (MR #91) and drops the patches from
MR #67.

For Debian 8 "Jessie", this problem has been fixed in version
0.26.5-2+deb8u6.

We recommend that you upgrade your poppler packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

--

mike gabriel aka sunweaver (Debian Developer)
fon: +49 (1520) 1976 148

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31
mail: sunweaver@debian.org, http://sunweavers.net

DLA 1599-1: qemu security update

Package : qemu
Version : 1:2.1+dfsg-12+deb8u8
CVE ID : CVE-2016-2391 CVE-2016-2392 CVE-2016-2538 CVE-2016-2841
CVE-2016-2857 CVE-2016-2858 CVE-2016-4001 CVE-2016-4002
CVE-2016-4020 CVE-2016-4037 CVE-2016-4439 CVE-2016-4441
CVE-2016-4453 CVE-2016-4454 CVE-2016-4952 CVE-2016-5105
CVE-2016-5106 CVE-2016-5107 CVE-2016-5238 CVE-2016-5337
CVE-2016-5338 CVE-2016-6351 CVE-2016-6834 CVE-2016-6836
CVE-2016-6888 CVE-2016-7116 CVE-2016-7155 CVE-2016-7156
CVE-2016-7161 CVE-2016-7170 CVE-2016-7421 CVE-2016-7908
CVE-2016-7909 CVE-2016-8577 CVE-2016-8578 CVE-2016-8909
CVE-2016-8910 CVE-2016-9101 CVE-2016-9102 CVE-2016-9103
CVE-2016-9104 CVE-2016-9105 CVE-2016-9106 CVE-2017-10664
CVE-2018-10839 CVE-2018-17962 CVE-2018-17963
Debian Bug : 815008 815009 815680 817181 817182 817183 821038 821061
821062 822344 824856 825210 825614 825615 825616 826152
827024 827026 832621 834902 834905 834944 836502 837174
837316 837339 838147 838850 839834 839835 840340 840341
841950 841955 842455 866674 910431 911468 911469


Several vulnerabilities were found in QEMU, a fast processor emulator:

CVE-2016-2391

Zuozhi Fzz discovered that eof_times in USB OHCI emulation support
could be used to cause a denial of service, via a null pointer
dereference.

CVE-2016-2392 / CVE-2016-2538

Qinghao Tang found a NULL pointer dereference and multiple integer
overflows in the USB Net device support that could allow local guest
OS administrators to cause a denial of service. These issues related
to remote NDIS control message handling.

CVE-2016-2841

Yang Hongke reported an infinite loop vulnerability in the NE2000 NIC
emulation support.

CVE-2016-2857

Liu Ling found a flaw in QEMU IP checksum routines. Attackers could
take advantage of this issue to cause QEMU to crash.

CVE-2016-2858

Arbitrary stack based allocation in the Pseudo Random Number Generator
(PRNG) back-end support.

CVE-2016-4001 / CVE-2016-4002

Oleksandr Bazhaniuk reported buffer overflows in the Stellaris and the
MIPSnet ethernet controllers emulation. Remote malicious users could
use these issues to cause QEMU to crash.

CVE-2016-4020

Donghai Zdh reported that QEMU incorrectly handled the access to the
Task Priority Register (TPR), allowing local guest OS administrators
to obtain sensitive information from host stack memory.

CVE-2016-4037

Du Shaobo found an infinite loop vulnerability in the USB EHCI
emulation support.

CVE-2016-4439 / CVE-2016-4441 / CVE-2016-5238 / CVE-2016-5338 / CVE-2016-6351

Li Qiang found different issues in the QEMU 53C9X Fast SCSI Controller
(FSC) emulation support, that made it possible for local guest OS
privileged users to cause denials of service or potentially execute
arbitrary code.

CVE-2016-4453 / CVE-2016-4454

Li Qiang reported issues in the QEMU VMWare VGA module handling, that
may be used to cause QEMU to crash, or to obtain host sensitive
information.

CVE-2016-4952 / CVE-2016-7421 / CVE-2016-7156

Li Qiang reported flaws in the VMware paravirtual SCSI bus emulation
support. These issues concern an out-of-bounds access and infinite
loops, that allowed local guest OS privileged users to cause a denial
of service.

CVE-2016-5105 / CVE-2016-5106 / CVE-2016-5107 / CVE-2016-5337

Li Qiang discovered several issues in the MegaRAID SAS 8708EM2 Host
Bus Adapter emulation support. These issues include stack information
leakage while reading configuration and out-of-bounds write and read.

CVE-2016-6834

Li Qiang reported an infinite loop vulnerability during packet
fragmentation in the network transport abstraction layer support.
Local guest OS privileged users could made use of this flaw to cause a
denial of service.

CVE-2016-6836 / CVE-2016-6888

Li Qiang found issues in the VMWare VMXNET3 network card emulation
support, relating to information leak and integer overflow in packet
initialisation.

CVE-2016-7116

Felix Wilhel discovered a directory traversal flaw in the Plan 9 File
System (9pfs), exploitable by local guest OS privileged users.

CVE-2016-7155

Tom Victor and Li Qiang reported an out-of-bounds read and an infinite
loop in the VMware paravirtual SCSI bus emulation support.

CVE-2016-7161

Hu Chaojian reported a heap overflow in the xlnx.xps-ethernetlite
emulation support. Privileged users in local guest OS could made use
of this to cause QEMU to crash.

CVE-2016-7170

Qinghao Tang and Li Qiang reported a flaw in the QEMU VMWare VGA
module, that could be used by privileged user in local guest OS to
cause QEMU to crash via an out-of-bounds stack memory access.

CVE-2016-7908 / CVE-2016-7909

Li Qiang reported infinite loop vulnerabilities in the ColdFire Fast
Ethernet Controller and the AMD PC-Net II (Am79C970A) emulations.
These flaws allowed local guest OS administrators to cause a denial of
service.

CVE-2016-8909

Huawei PSIRT found an infinite loop vulnerability in the Intel HDA
emulation support, relating to DMA buffer stream processing.
Privileged users in local guest OS could made use of this to cause a
denial of service.

CVE-2016-8910

Andrew Henderson reported an infinite loop in the RTL8139 ethernet
controller emulation support. Privileged users inside a local guest OS
could made use of this to cause a denial of service.

CVE-2016-9101

Li Qiang reported a memory leakage in the i8255x (PRO100) ethernet
controller emulation support.

CVE-2016-9102 / CVE-2016-9103 / CVE-2016-9104 / CVE-2016-9105 /
CVE-2016-9106 / CVE-2016-8577 / CVE-2016-8578

Li Qiang reported various Plan 9 File System (9pfs) security issues,
including host memory leakage and denial of service.

CVE-2017-10664

Denial of service in the qemu-nbd (QEMU Disk Network Block Device)
Server.

CVE-2018-10839 / CVE-2018-17962 / CVE-2018-17963

Daniel Shapira reported several integer overflows in the packet
handling in ethernet controllers emulated by QEMU. These issues could
lead to denial of service.

For Debian 8 "Jessie", these problems have been fixed in version
1:2.1+dfsg-12+deb8u8.

We recommend that you upgrade your qemu packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1601-1: perl security update

Package : perl
Version : 5.20.2-3+deb8u12
CVE ID : CVE-2018-18311

Jayakrishna Menon and Christophe Hauser discovered an integer
overflow vulnerability in Perl_my_setenv leading to a heap-based
buffer overflow with attacker-controlled input.

For Debian 8 "Jessie", this problem has been fixed in version
5.20.2-3+deb8u12.

We recommend that you upgrade your perl packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1602-1: nsis security update

Package : nsis
Version : 2.46-10+deb8u1
CVE ID : CVE-2015-9267 CVE-2015-9268


Among others, Andre Heinicke from gpg4win.org found several issues of
nsis, a tool for creating quick and user friendly installers for
Microsoft Windows operating systems.

The issues are fixed by ...
... using SetDefaultDllDirectories() to restrict implicitly loaded
and dynamically loaded modules to trusted directories
... creating temporary directories in a way that only elevated users
can write into it
... not implicitly linking against Version.dll but using wrapper
functions


For Debian 8 "Jessie", these problems have been fixed in version
2.46-10+deb8u1.

We recommend that you upgrade your nsis packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DSA 4348-1: openssl security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4348-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
November 30, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : openssl
CVE ID : CVE-2018-0732 CVE-2018-0734 CVE-2018-0735 CVE-2018-0737
CVE-2018-5407

Several local side channel attacks and a denial of service via large
Diffie-Hellman parameters were discovered in OpenSSL, a Secure Sockets
Layer toolkit.

For the stable distribution (stretch), these problems have been fixed in
version 1.1.0j-1~deb9u1. Going forward, openssl security updates for
stretch will be based on the 1.1.0x upstream releases.

We recommend that you upgrade your openssl packages.

For the detailed security status of openssl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/openssl

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4349-1: tiff security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4349-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
November 30, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : tiff
CVE ID : CVE-2017-11613 CVE-2017-17095 CVE-2018-5784
CVE-2018-7456 CVE-2018-8905 CVE-2018-10963
CVE-2018-17101 CVE-2018-18557 CVE-2018-15209
CVE-2018-16335

Multiple vulnerabilities have been discovered in the libtiff library and
the included tools, which may result in denial of service or the
execution of arbitrary code if malformed image files are processed.

For the stable distribution (stretch), these problems have been fixed in
version 4.0.8-2+deb9u4.

We recommend that you upgrade your tiff packages.

For the detailed security status of tiff please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/tiff

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/