The following updates has been released for Debian GNU/Linux:

Debian GNU/Linux 8 LTS:
DLA 1439-1: resiprocate security update
DLA 1440-1: libarchive-zip-perl security update
DLA 1441-1: sympa security update
DLA 1442-1: mailman security update
DLA 1443-1: evolution-data-server security update

Debian GNU/Linux 9:
DSA 4254-1: slurm-llnl security update
DSA 4255-1: ant security update

DLA 1439-1: resiprocate security update

Package : resiprocate
Version : 1:1.9.7-5+deb8u1
CVE ID : CVE-2017-11521 CVE-2018-12584


CVE-2018-12584
A flaw in function ConnectionBase::preparseNewBytes of
resip/stack/ConnectionBase.cxx has been detected, that
allows remote attackers to cause a denial of service
(buffer overflow) or possibly execute arbitrary code
when TLS communication is enabled.

CVE-2017-11521
A flaw in function SdpContents::Session::Medium::parse of
resip/stack/SdpContents.cxx has been detected, that allows
remote attackers to cause a denial of service (memory
consumption) by triggering many media connections.


For Debian 8 "Jessie", these problems have been fixed in version
1:1.9.7-5+deb8u1.

We recommend that you upgrade your resiprocate packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1440-1: libarchive-zip-perl security update

Package : libarchive-zip-perl
Version : 1.39-1+deb8u1
CVE ID : CVE-2018-10860
Debian Bug : 902882

The libarchive-zip-perl package is vulnerable to a directory traversal
attack in Archive::Zip. It was found that the Archive::Zip module did
not properly sanitize paths while extracting zip files. An attacker
able to provide a specially crafted archive for processing could use
this flaw to write or overwrite arbitrary files in the context of the
Perl interpreter.

For Debian 8 "Jessie", this problem has been fixed in version
1.39-1+deb8u1.

We recommend that you upgrade your libarchive-zip-perl packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1441-1: sympa security update

Package : sympa
Version : 6.1.23~dfsg-2+deb8u2
CVE ID : CVE-2018-1000550

A vulnerability has been discovered in Sympa, a modern mailing list
manager, that allows write access to files on the server filesystem.
This flaw allows to create or modify any file writable by the Sympa
user, located on the server filesystem, using the function of Sympa
web interface template file saving.

For Debian 8 "Jessie", this problem has been fixed in version
6.1.23~dfsg-2+deb8u2.

We recommend that you upgrade your sympa packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1442-1: mailman security update

Package : mailman
Version : 1:2.1.18-2+deb8u3
CVE ID : CVE-2018-0618 CVE-2018-13796
Debian Bug : 903674

Two flaws were discovered in mailman, a web-based mailing list manager.

CVE-2018-0618

Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc.
discovered that mailman is prone to a cross-site scripting flaw
allowing a malicious listowner to inject scripts into the listinfo
page, due to not validated input in the host_name field.

CVE-2018-13796

Hammad Qureshi discovered a content spoofing vulnerability with
invalid list name messages in the web UI.

For Debian 8 "Jessie", these problems have been fixed in version
1:2.1.18-2+deb8u3.

We recommend that you upgrade your mailman packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1443-1: evolution-data-server security update

Package : evolution-data-server
Version : 3.12.9~git20141128.5242b0-2+deb8u4
CVE IDs : CVE-2016-10727

It was discovered that there was a protocol implementation error in
evolution-data-server where "STARTTLS not supported" errors from IMAP
servers were ignored leading to the use of insecure connections without
the user's knowledge or consent.

For Debian 8 "Jessie", this issue has been fixed in evolution-data-server
version 3.12.9~git20141128.5242b0-2+deb8u4.

We recommend that you upgrade your evolution-data-server packages.

DSA 4254-1: slurm-llnl security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4254-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
July 24, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : slurm-llnl
CVE ID : CVE-2018-7033 CVE-2018-10995
Debian Bug : 893044 900548

Several vulnerabilities were discovered in the Simple Linux Utility for
Resource Management (SLURM), a cluster resource management and job
scheduling system. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2018-7033

Incomplete sanitization of user-provided text strings could lead to
SQL injection attacks against slurmdbd.

CVE-2018-10995

Insecure handling of user_name and gid fields leading to improper
authentication handling.

For the stable distribution (stretch), these problems have been fixed in
version 16.05.9-1+deb9u2.

We recommend that you upgrade your slurm-llnl packages.

For the detailed security status of slurm-llnl please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/slurm-llnl

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4255-1: ant security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4255-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
July 24, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : ant
CVE ID : CVE-2018-10886

Danny Grander reported that the unzip and untar tasks in ant, a Java
based build tool like make, allow the extraction of files outside a
target directory. An attacker can take advantage of this flaw by
submitting a specially crafted Zip or Tar archive to an ant build to
overwrite any file writable by the user running ant.

For the stable distribution (stretch), this problem has been fixed in
version 1.9.9-1+deb9u1.

We recommend that you upgrade your ant packages.

For the detailed security status of ant please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/ant

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/