The following updates has been released for Debian:

[DLA 335-1] ntp security update
[DLA 336-1] phpmyadmin security update
[DSA 3382-1] phpmyadmin security update

[DLA 335-1] ntp security update

Package : ntp
Version : 1:4.2.6.p2+dfsg-1+deb6u4
CVE ID : CVE-2015-5146 CVE-2015-5194 CVE-2015-5195 CVE-2015-5219
CVE-2015-5300 CVE-2015-7691 CVE-2015-7692 CVE-2015-7701
CVE-2015-7702 CVE-2015-7703 CVE-2015-7704 CVE-2015-7850
CVE-2015-7851 CVE-2015-7852 CVE-2015-7855 CVE-2015-7871

Several security issues where found in ntp:

CVE-2015-5146

A flaw was found in the way ntpd processed certain remote
configuration packets. An attacker could use a specially crafted
package to cause ntpd to crash if:

* ntpd enabled remote configuration
* The attacker had the knowledge of the configuration password
* The attacker had access to a computer entrusted to perform remote
configuration

Note that remote configuration is disabled by default in NTP.

CVE-2015-5194

It was found that ntpd could crash due to an uninitialized variable
when processing malformed logconfig configuration commands.

CVE-2015-5195

It was found that ntpd exits with a segmentation fault when a
statistics type that was not enabled during compilation (e.g.
timingstats) is referenced by the statistics or filegen
configuration command

CVE-2015-5219

It was discovered that sntp program would hang in an infinite loop when
a crafted NTP packet was received, related to the conversion of the
precision value in the packet to double.

CVE-2015-5300

It was found that ntpd did not correctly implement the -g option:

Normally, ntpd exits with a message to the system log if the offset
exceeds the panic threshold, which is 1000 s by default. This
option allows the time to be set to any value without restriction;
however, this can happen only once. If the threshold is exceeded
after that, ntpd will exit with a message to the system log. This
option can be used with the -q and -x options.

ntpd could actually step the clock multiple times by more than the
panic threshold if its clock discipline doesn't have enough time to
reach the sync state and stay there for at least one update. If a
man-in-the-middle attacker can control the NTP traffic since ntpd
was started (or maybe up to 15-30 minutes after that), they can
prevent the client from reaching the sync state and force it to step
its clock by any amount any number of times, which can be used by
attackers to expire certificates, etc.

This is contrary to what the documentation says. Normally, the
assumption is that an MITM attacker can step the clock more than the
panic threshold only once when ntpd starts and to make a larger
adjustment the attacker has to divide it into multiple smaller
steps, each taking 15 minutes, which is slow.

CVE-2015-7691, CVE-2015-7692, CVE-2015-7702

It was found that the fix for CVE-2014-9750 was incomplete: three
issues were found in the value length checks in ntp_crypto.c, where
a packet with particular autokey operations that contained malicious
data was not always being completely validated. Receipt of these
packets can cause ntpd to crash.

CVE-2015-7701

A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If ntpd is
configured to use autokey authentication, an attacker could send
packets to ntpd that would, after several days of ongoing attack,
cause it to run out of memory.

CVE-2015-7703

Miroslav Lichv

[DLA 336-1] phpmyadmin security update

Package : phpmyadmin
Version : 4:3.3.7-9
CVE ID : CVE-2014-8958 CVE-2014-9218 CVE-2015-2206 CVE-2015-3902

Several issues have been fixed in phpMyAdmin, the web administration
tool for MySQL.

CVE-2014-8958

Multiple cross-site scripting (XSS) vulnerabilities.

CVE-2014-9218

Denial of service (resource consumption) via a long password.

CVE-2015-2206

Risk of BREACH attack due to reflected parameter.

CVE-2015-3902

XSRF/CSRF vulnerability in phpMyAdmin setup.

[DSA 3382-1] phpmyadmin security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3382-1 security@debian.org
https://www.debian.org/security/ Thijs Kinkhorst
October 28, 2015 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : phpmyadmin
CVE ID : CVE-2014-8958 CVE-2014-9218 CVE-2015-2206 CVE-2015-3902
CVE-2015-3903 CVE-2015-6830 CVE-2015-7873
Debian Bug : 774194

Several issues have been fixed in phpMyAdmin, the web administration
tool for MySQL.

CVE-2014-8958 (Wheezy only)

Multiple cross-site scripting (XSS) vulnerabilities.

CVE-2014-9218 (Wheezy only)

Denial of service (resource consumption) via a long password.

CVE-2015-2206

Risk of BREACH attack due to reflected parameter.

CVE-2015-3902

XSRF/CSRF vulnerability in phpMyAdmin setup.

CVE-2015-3903 (Jessie only)

Vulnerability allowing man-in-the-middle attack on API call to GitHub.

CVE-2015-6830 (Jessie only)

Vulnerability that allows bypassing the reCaptcha test.

CVE-2015-7873 (Jessie only)

Content spoofing vulnerability when redirecting user to an
external site.

For the oldstable distribution (wheezy), these problems have been fixed
in version 4:3.4.11.1-2+deb7u2.

For the stable distribution (jessie), these problems have been fixed in
version 4:4.2.12-2+deb8u1.

For the unstable distribution (sid), these problems have been fixed in
version 4:4.5.1-1.

We recommend that you upgrade your phpmyadmin packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/