The following security updates has been released for Debian GNU/Linux:

Debian GNU/Linux 7 LTS:
DLA 1343-1: ming security update

Debian GNU/Linux 9:
DSA 4170-1: pjproject security update

DLA 1343-1: ming security update

Package : ming
Version : 0.4.4-1.1+deb7u8
CVE ID : CVE-2018-6358 CVE-2018-7867 CVE-2018-7868 CVE-2018-7870
CVE-2018-7871 CVE-2018-7872 CVE-2018-7875 CVE-2018-9165

Multiple vulnerabilities have been discovered in Ming:

CVE-2018-6358

Heap-based buffer overflow vulnerability in the printDefineFont2 function
(util/listfdb.c). Remote attackers might leverage this vulnerability to
cause a denial of service via a crafted swf file.

CVE-2018-7867

Heap-based buffer overflow vulnerability in the getString function
(util/decompile.c) during a RegisterNumber sprintf. Remote attackers might
leverage this vulnerability to cause a denial of service via a crafted swf
file.

CVE-2018-7868

Heap-based buffer over-read vulnerability in the getName function
(util/decompile.c) for CONSTANT8 data. Remote attackers might leverage this
vulnerability to cause a denial of service via a crafted swf file.

CVE-2018-7870

Invalid memory address dereference in the getString function
(util/decompile.c) for CONSTANT16 data. Remote attackers might leverage this
vulnerability to cause a denial of service via a crafted swf file.

CVE-2018-7871

Heap-based buffer over-read vulnerability in the getName function
(util/decompile.c) for CONSTANT16 data. Remote attackers might leverage this
vulnerability to cause a denial of service via a crafted swf file.

CVE-2018-7872

Invalid memory address dereference in the getName function
(util/decompile.c) for CONSTANT16 data. Remote attackers might leverage this
vulnerability to cause a denial of service via a crafted swf file.

CVE-2018-7875

Heap-based buffer over-read vulnerability in the getName function
(util/decompile.c) for CONSTANT8 data. Remote attackers might leverage this
vulnerability to cause a denial of service via a crafted swf file.

CVE-2018-9165

The pushdup function (util/decompile.c) performs shallow copy of String
elements (instead of deep copy), allowing simultaneous change of multiple
elements of the stack, which indirectly makes the library vulnerable to a
NULL pointer dereference in getName (util/decompile.c). Remote attackers
might leverage this vulnerability to cause dos via a crafted swf file.

For Debian 7 "Wheezy", these problems have been fixed in version
0.4.4-1.1+deb7u8.

We recommend that you upgrade your ming packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DSA 4170-1: pjproject security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4170-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
April 09, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : pjproject
CVE ID : CVE-2017-16872 CVE-2017-16875 CVE-2018-1000098
CVE-2018-1000099

Multiple vulnerabilities have been discovered in the PJSIP/PJProject
multimedia communication which may result in denial of service during
the processing of SIP and SDP messages and ioqueue keys.

For the stable distribution (stretch), these problems have been fixed in
version 2.5.5~dfsg-6+deb9u1.

We recommend that you upgrade your pjproject packages.

For the detailed security status of pjproject please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/pjproject

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/