The following updates has been released for Debian GNU/Linux:

Debian GNU/Linux 8 LTS:
DLA 1473-1: otrs2 security update
DLA-1474-1: openssh security update

Debian GNU/Linux 9:
DSA 4280-1: openssh security update

DLA 1473-1: otrs2 security update

Package : otrs2
Version : 3.3.18-1+deb8u5
CVE ID : CVE-2018-14593

Francesco Sirocco discovered a privilege escalation flaw in otrs2, the
Open Ticket Request System. An attacker who is logged into OTRS as a
user may escalate their privileges by accessing a specially crafted URL.

For Debian 8 "Jessie", this problem has been fixed in version
3.3.18-1+deb8u5.

We recommend that you upgrade your otrs2 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA-1474-1: openssh security update

Package : openssh
Version : 1:6.7p1-5+deb8u5
CVE ID : CVE-2018-15473
Debian Bug : #906236

It was discovered that there was a user enumeration vulnerability in
OpenSSH. A remote attacker couldtest whether a certain user exists
on a target server.

For Debian 8 "Jessie", this issue has been fixed in openssh version
1:6.7p1-5+deb8u5.

We recommend that you upgrade your openssh packages.

DSA 4280-1: openssh security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4280-1 security@debian.org
https://www.debian.org/security/ Sebastien Delafond
August 22, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : openssh
CVE ID : CVE-2018-15473
Debian Bug : 906236

Dariusz Tytko, Michal Sajdak and Qualys Security discovered that
OpenSSH, an implementation of the SSH protocol suite, was prone to a
user enumeration vulnerability. This would allow a remote attacker to
check whether a specific user account existed on the target server.

For the stable distribution (stretch), this problem has been fixed in
version 1:7.4p1-10+deb9u4.

We recommend that you upgrade your openssh packages.

For the detailed security status of openssh please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/openssh

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/