The following updates has been released for Debian GNU/Linux 7 Extended LTS:

ELA-63-1 perl security update
ELA-64-1 suricata security update

ELA-63-1 perl security update

Package: perl
Version: 5.14.2-21+deb7u8
Related CVE: CVE-2018-18311
Jayakrishna Menon and Christophe Hauser discovered an integer overflow vulnerability in Perl_my_setenv leading to a heap-based buffer overflow with attacker-controlled input.

For Debian 7 Wheezy, these problems have been fixed in version 5.14.2-21+deb7u8.

We recommend that you upgrade your perl packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

ELA-64-1 suricata security update

Package: suricata
Version: 1.2.1-2+deb7u3
Related CVE: CVE-2015-0928 CVE-2015-8954 CVE-2018-6794 TEMP-0000000-C04FE8

CVE-2015-0928

A NULL pointer dereference allows remote attackers to cause a
denial-of-service by specially crafted network traffic.

CVE-2015-8954

The MemcmpLowercase function in Suricata improperly excludes the first
byte from comparisons, which might allow remote attackers to bypass
intrusion-prevention functionality via a crafted HTTP request.

CVE-2018-6794

Suricata is prone to an HTTP detection bypass vulnerability
in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP
flow and sends data before the 3-way handshake is complete, then the data
sent by the malicious server will be accepted by web clients such as a
web browser or Linux CLI utilities, but ignored by Suricata IDS
signatures. This mostly affects IDS signatures for the HTTP protocol and
TCP stream content; signatures for TCP packets will inspect such network
traffic as usual.
TEMP-0000000-C04FE8 (no CVE assigned yet)

If memory allocation fails and Suricata runs out of memory, a flaw in the
DCERP parser may lead to a denial-of-service (application crash).
For Debian 7 Wheezy, these problems have been fixed in version 1.2.1-2+deb7u3.

We recommend that you upgrade your suricata packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/