The following two updates has been released for Debian GNU/Linux 8 LTS:

DLA 1521-1: otrs2 security update
DLA 1522-1: strongswan security update

DLA 1521-1: otrs2 security update

Package : otrs2
Version : 3.3.18-1+deb8u6
CVE ID : CVE-2018-16586 CVE-2018-16587


Fabien Arnoux discovered several security issues in email validation
of otrs system.

CVE-2018-16586

Load external image or CSS resources in browser when user opens a
malicious email.

CVE-2018-16587

Remote deletions of arbitrary files that the OTRS web server user
has write access when opening malicious email.

For Debian 8 "Jessie", these problems have been fixed in version
3.3.18-1+deb8u6.

We recommend that you upgrade your otrs2 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1522-1: strongswan security update

Package : strongswan
Version : 5.2.1-6+deb8u7
CVE ID : CVE-2018-16151 CVE-2018-16152


Sze Yiu Chau and his team from Purdue University and The University of
Iowa found several security issues in the gmp plugin for strongSwan,
an IKE/IPsec suite.

CVE-2018-16151

The OID parser in the ASN.1 code in gmp allows any number of random
bytes after a valid OID.

CVE-2018-16152

The algorithmIdentifier parser in the ASN.1 code in gmp doesn't
enforce a NULL value for the optional parameter which is not used
with any PKCS#1 algorithm.

For Debian 8 "Jessie", these problems have been fixed in version
5.2.1-6+deb8u7.

We recommend that you upgrade your strongswan packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS