The following updates has been released for Debian GNU/Linux:

Debian GNU/Linux 8 LTS:
DLA 1683-1: rdesktop security update
DLA 1684-1: systemd security update
DLA 1685-1: drupal7 security update

Debian GNU/Linux 9:
DSA 4396-1: ansible security update

DLA 1683-1: rdesktop security update

Package : rdesktop
Version : 1.8.4-0+deb8u1
CVE ID : CVE-2018-8791 CVE-2018-8792 CVE-2018-8793 CVE-2018-8794
CVE-2018-8795 CVE-2018-8796 CVE-2018-8797 CVE-2018-8798
CVE-2018-8799 CVE-2018-8800 CVE-2018-20174 CVE-2018-20175
CVE-2018-20176 CVE-2018-20177 CVE-2018-20178 CVE-2018-20179
CVE-2018-20180 CVE-2018-20181 CVE-2018-20182

Multiple security issues were found in the rdesktop RDP client, which
could result in denial of service, information disclosure and the
execution of arbitrary code.

For Debian 8 "Jessie", these problems have been fixed in version
1.8.4-0+deb8u1.

We recommend that you upgrade your rdesktop packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1684-1: systemd security update

Package : systemd
Version : 215-17+deb8u10
CVE ID : CVE-2019-6454

Chris Coulson discovered a flaw in systemd leading to denial of service.
An unprivileged user could take advantage of this issue to crash PID1 by
sending a specially crafted D-Bus message on the system bus.

For Debian 8 "Jessie", this problem has been fixed in version
215-17+deb8u10.

We recommend that you upgrade your systemd packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1685-1: drupal7 security update

Package : drupal7
Version : 7.32-1+deb8u15
CVE ID : CVE-2019-6338


Drupal core uses the third-party PEAR Archive_Tar library. This
library has released a security update which impacts some Drupal
configurations. Refer to CVE-2018-1000888 for details. Also a possible
regression caused by CVE-2019-6339 is fixed.

For Debian 8 "Jessie", this problem has been fixed in version
7.32-1+deb8u15.

We recommend that you upgrade your drupal7 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DSA 4396-1: ansible security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4396-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
February 19, 2019 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : ansible
CVE ID : CVE-2018-10855 CVE-2018-10875 CVE-2018-16837 CVE-2018-16876
CVE-2019-3828

Several vulnerabilities have been found in Ansible, a configuration
management, deployment, and task execution system:

CVE-2018-10855 / CVE-2018-16876

The no_log task flag wasn't honored, resulting in an information leak.

CVE-2018-10875

ansible.cfg was read from the current working directory.

CVE-2018-16837

The user module leaked parameters passed to ssh-keygen to the process
environment.

CVE-2019-3828

The fetch module was susceptible to path traversal.

For the stable distribution (stretch), these problems have been fixed in
version 2.2.1.0-2+deb9u1.

We recommend that you upgrade your ansible packages.

For the detailed security status of ansible please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ansible

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/