The following updates has been released for Debian GNU/Linux:

Debian GNU/Linux 7 LTS:
DLA 1194-1: libxml2 security update
DLA 1195-1: curl security update

Debian GNU/Linux 9:
DSA 4053-1: exim4 security update

DLA 1194-1: libxml2 security update

Package : libxml2
Version : 2.8.0+dfsg1-7+wheezy11
CVE ID : CVE-2017-16931 CVE-2017-16932


CVE-2017-16931
parser.c in libxml2 before 2.9.5 mishandles parameter-entity
references because the NEXTL macro calls the
xmlParserHandlePEReference function in the case of a '%' character
in a DTD name.

CVE-2017-16932
parser.c in libxml2 before 2.9.5 does not prevent infinite
recursion in parameter entities.


For Debian 7 "Wheezy", these problems have been fixed in version
2.8.0+dfsg1-7+wheezy11.

We recommend that you upgrade your libxml2 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1195-1: curl security update

Package : curl
Version : 7.26.0-1+wheezy23
CVE ID : CVE-2017-8817


CVE-2017-8817

Fuzzing by the OSS-Fuzz project led to the discovery of a read out of
bounds flaw in the FTP wildcard function in libcurl. A malicious
server could redirect a libcurl-based client to an URL using a
wildcard pattern, triggering the out-of-bound read.


For Debian 7 "Wheezy", these problems have been fixed in version
7.26.0-1+wheezy23.

We recommend that you upgrade your curl packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DSA 4053-1: exim4 security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4053-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
November 30, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : exim4
CVE ID : CVE-2017-16943 CVE-2017-16944
Debian Bug : 882648 882671

Several vulnerabilities have been discovered in Exim, a mail transport
agent. The Common Vulnerabilities and Exposures project identifies the
following issues:

CVE-2017-16943

A use-after-free vulnerability was discovered in Exim's routines
responsible for parsing mail headers. A remote attacker can take
advantage of this flaw to cause Exim to crash, resulting in a denial
of service, or potentially for remote code execution.

CVE-2017-16944

It was discovered that Exim does not properly handle BDAT data
headers allowing a remote attacker to cause Exim to crash, resulting
in a denial of service.

For the stable distribution (stretch), these problems have been fixed in
version 4.89-2+deb9u2. Default installations disable advertising the
ESMTP CHUNKING extension and are not affected by these issues.

We recommend that you upgrade your exim4 packages.

For the detailed security status of exim4 please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/exim4

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/