The following security updates has been released for Debian GNU/Linux:

Debian GNU/Linux 8 LTS:
DLA 1547-1: libpdfbox-java security update

Debian GNU/Linux 9:
DSA 4320-1: asterisk security update
DSA 4321-1: graphicsmagick security update

DLA 1547-1: libpdfbox-java security update

Package : libpdfbox-java
Version : 1:1.8.7+dfsg-1+deb8u2
CVE ID : CVE-2018-11797
Debian Bug : #910390

It was discovered that there was a denial-of-service vulnerability in
libpdfbox-java, a PDF library for Java.

A malicious PDF file could have triggered an extremely long running
computation when parsing the page tree.

For Debian 8 "Jessie", this issue has been fixed in libpdfbox-java version
1:1.8.7+dfsg-1+deb8u2.

We recommend that you upgrade your libpdfbox-java packages.

DSA 4320-1: asterisk security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4320-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
October 16, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : asterisk
CVE ID : CVE-2018-7284 CVE-2018-7286 CVE-2018-12227 CVE-2018-17281
Debian Bug : 891227 891228 902954 909554

Multiple vulnerabilities have been discovered in Asterisk, an open source
PBX and telephony toolkit, which may result in denial of service or
information disclosure.

For the stable distribution (stretch), these problems have been fixed in
version 1:13.14.1~dfsg-2+deb9u4.

We recommend that you upgrade your asterisk packages.

For the detailed security status of asterisk please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/asterisk

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4321-1: graphicsmagick security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4321-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
October 16, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : graphicsmagick
CVE ID : CVE-2017-10794 CVE-2017-10799 CVE-2017-10800 CVE-2017-11102
CVE-2017-11139 CVE-2017-11140 CVE-2017-11403 CVE-2017-11636
CVE-2017-11637 CVE-2017-11638 CVE-2017-11641 CVE-2017-11642
CVE-2017-11643 CVE-2017-11722 CVE-2017-12935 CVE-2017-12936
CVE-2017-12937 CVE-2017-13063 CVE-2017-13064 CVE-2017-13065
CVE-2017-13134 CVE-2017-13737 CVE-2017-13775 CVE-2017-13776
CVE-2017-13777 CVE-2017-14314 CVE-2017-14504 CVE-2017-14733
CVE-2017-14994 CVE-2017-14997 CVE-2017-15238 CVE-2017-15277
CVE-2017-15930 CVE-2017-16352 CVE-2017-16353 CVE-2017-16545
CVE-2017-16547 CVE-2017-16669 CVE-2017-17498 CVE-2017-17500
CVE-2017-17501 CVE-2017-17502 CVE-2017-17503 CVE-2017-17782
CVE-2017-17783 CVE-2017-17912 CVE-2017-17913 CVE-2017-17915
CVE-2017-18219 CVE-2017-18220 CVE-2017-18229 CVE-2017-18230
CVE-2017-18231 CVE-2018-5685 CVE-2018-6799 CVE-2018-9018

Several vulnerabilities have been discovered in GraphicsMagick, a set of
command-line applications to manipulate image files, which could result
in denial of service or the execution of arbitrary code if malformed
image files are processed.

For the stable distribution (stretch), these problems have been fixed in
version 1.3.30+hg15796-1~deb9u1.

We recommend that you upgrade your graphicsmagick packages.

For the detailed security status of graphicsmagick please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/graphicsmagick

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/