The following updates has been released for Debian GNU/Linux:

Debian GNU/Linux 7 LTS:
DLA 1138-1: nss security update
DLA 1139-1: imagemagick security update
DLA 1140-1: graphicsmagick security update

Debian GNU/Linux 9:
DSA 4001-1: yadifa security update

DLA 1138-1: nss security update

Package : nss
Version : 2:3.26-1+debu7u5
CVE ID : CVE-2017-7805

Martin Thomson discovered that nss, the Mozilla Network Security Service
library, is prone to a use-after-free vulnerability in the TLS 1.2
implementation when handshake hashes are generated. A remote attacker
can take advantage of this flaw to cause an application using the nss
library to crash, resulting in a denial of service, or potentially to
execute arbitrary code.

For Debian 7 "Wheezy", these problems have been fixed in version
2:3.26-1+debu7u5.

We recommend that you upgrade your nss packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1139-1: imagemagick security update

Package : imagemagick
Version : 8:6.7.7.10-5+deb7u18
CVE ID : CVE-2017-15277 CVE-2017-15281
Debian Bug : 878578 878579


This update fixes two vulnerabilities in ImageMagick:

CVE-2017-15277

An uninitialized data structure could lead to information disclosure
when reading a specially crafted GIF file.

CVE-2017-15281

An uninitialized value used in a conditional jump could cause a
denial of service (application crash) or other unspecified impacts
when reading a specially crafted PSD file.

For Debian 7 "Wheezy", these problems have been fixed in version
8:6.7.7.10-5+deb7u18.

We recommend that you upgrade your imagemagick packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1140-1: graphicsmagick security update

Package : graphicsmagick
Version : 1.3.16-1.1+deb7u11
CVE ID : CVE-2017-13737 CVE-2017-15277


Immediately after the previous update to graphicsmagick, two more security
issues were identified. These updates are included here.

CVE-2017-13737

Incorrect rounding up resulted in scrambling the heap beyond the
allocation.

CVE-2017-15277

Left the palette uninitialized when processing a GIF
file that has neither a global nor local palette.

For Debian 7 "Wheezy", these problems have been fixed in version
1.3.16-1.1+deb7u11.

We recommend that you upgrade your graphicsmagick packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DSA 4001-1: yadifa security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4001-1 security@debian.org
https://www.debian.org/security/ Sebastien Delafond
October 19, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : yadifa
CVE ID : CVE-2017-14339
Debian Bug : 876315

It was discovered that YADIFA, an authoritative DNS server, did not
sufficiently check its input. This allowed a remote attacker to cause
a denial-of-service by forcing the daemon to enter an infinite loop.

For the stable distribution (stretch), this problem has been fixed in
version 2.2.3-1+deb9u1.

We recommend that you upgrade your yadifa packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/