The following updates has been released for Debian GNU/Linux:

Debian GNU/Linux 7 LTS:
DLA 1176-1: ming security update
DLA 1177-1: poppler security update
DLA 1178-1: opensaml2 security update
DLA 1179-1: shibboleth-sp2 security update

Debian GNU/Linux 8 and 9:
DSA 4041-1: procmail security update
DSA 4042-1: libxml-libxml-perl security update

DLA 1176-1: ming security update

Package : ming
Version : 1:0.4.4-1.1+deb7u5
CVE ID : CVE-2017-9988 CVE-2017-9989 CVE-2017-11733

Multiple vulnerabilities have been discovered in Ming:

CVE-2017-9988

NULL pointer dereference in the readEncUInt30 function (util/read.c)
in Ming

DLA 1177-1: poppler security update

Package : poppler
Version : 0.18.4-6+deb7u4
CVE ID : CVE-2017-14975 CVE-2017-14976 CVE-2017-14977
CVE-2017-15565
Debian Bug : 879066 877952 877954 877957

It was discovered that poppler, a PDF rendering library, was affected
by several denial-of-service (application crash), null pointer
dereferences and heap-based buffer over-read bugs:

CVE-2017-14975
The FoFiType1C::convertToType0 function in FoFiType1C.cc
has a NULL pointer dereference vulnerability because a data structure
is not initialized, which allows an attacker to launch a denial of
service attack.

CVE-2017-14976
The FoFiType1C::convertToType0 function in FoFiType1C.cc
has a heap-based buffer over-read vulnerability if an out-of-bounds
font dictionary index is encountered, which allows an attacker to
launch a denial of service attack.

CVE-2017-14977
The FoFiTrueType::getCFFBlock function in FoFiTrueType.cc
has a NULL pointer dereference vulnerability due to lack of validation
of a table pointer, which allows an attacker to launch a denial of
service attack.

CVE-2017-15565
NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine()
function in GfxState.cc via a crafted PDF document.


For Debian 7 "Wheezy", these problems have been fixed in version
0.18.4-6+deb7u4.

We recommend that you upgrade your poppler packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1178-1: opensaml2 security update

Package : opensaml2
Version : 2.4.3-4+deb7u2
CVE ID : CVE-2017-16853
Debian Bug : 881856

Rod Widdowson of Steading System Software LLP discovered a coding error
in the OpenSAML library, causing the DynamicMetadataProvider class to
fail configuring itself with the filters provided and omitting whatever
checks they are intended to perform.

For Debian 7 "Wheezy", these problems have been fixed in version
2.4.3-4+deb7u2.

We recommend that you upgrade your opensaml2 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1179-1: shibboleth-sp2 security update

Package : shibboleth-sp2
Version : 2.4.3+dfsg-5+deb7u2
CVE ID : CVE-2017-16852
Debian Bug : 881857

Rod Widdowson of Steading System Software LLP discovered a coding error
in the "Dynamic" metadata plugin of the Shibboleth Service Provider,
causing the plugin to fail configuring itself with the filters provided
and omitting whatever checks they are intended to perform.

For Debian 7 "Wheezy", these problems have been fixed in version
2.4.3+dfsg-5+deb7u2.

We recommend that you upgrade your shibboleth-sp2 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DSA 4041-1: procmail security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4041-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
November 19, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : procmail
CVE ID : CVE-2017-16844
Debian Bug : 876511

Jakub Wilk reported a heap-based buffer overflow vulnerability in
procmail's formail utility when processing specially-crafted email
headers. A remote attacker could use this flaw to cause formail to
crash, resulting in a denial of service or data loss.

For the oldstable distribution (jessie), this problem has been fixed
in version 3.22-24+deb8u1.

For the stable distribution (stretch), this problem has been fixed in
version 3.22-25+deb9u1.

We recommend that you upgrade your procmail packages.

For the detailed security status of procmail please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/procmail

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4042-1: libxml-libxml-perl security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4042-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
November 19, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : libxml-libxml-perl
CVE ID : CVE-2017-10672
Debian Bug : 866676

A use-after-free vulnerability was discovered in XML::LibXML, a Perl
interface to the libxml2 library, allowing an attacker to execute
arbitrary code by controlling the arguments to a replaceChild() call.

For the oldstable distribution (jessie), this problem has been fixed
in version 2.0116+dfsg-1+deb8u2.

For the stable distribution (stretch), this problem has been fixed in
version 2.0128+dfsg-1+deb9u1.

We recommend that you upgrade your libxml-libxml-perl packages.

For the detailed security status of libxml-libxml-perl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libxml-libxml-perl

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/