The following updates has been released for Debian GNU/Linux:

Debian GNU/Linux 7 LTS:
DLA 1367-1: slurm-llnl security update

Debian GNU/Linux 8:
DSA 4186-1: gunicorn security update

Debian GNU/Linux 8 and 9:
DSA 4182-1: chromium-browser security update
DSA 4184-1: sdl-image1.2 security update

Debian GNU/Linux 9:
DSA 4181-1: roundcube security update
DSA 4183-1: tor security update
DSA 4185-1: openjdk-8 security update

DLA 1367-1: slurm-llnl security update

Package : slurm-llnl
Version : 2.3.4-2+deb7u2
CVE ID : CVE-2018-7033


CVE-2018-7033
An issue that could be used for SQL Injection attacks against
SlurmDBD has been fixed.


For Debian 7 "Wheezy", these problems have been fixed in version
2.3.4-2+deb7u2.

We recommend that you upgrade your slurm-llnl packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DSA 4181-1: roundcube security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4181-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
April 28, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : roundcube
CVE ID : CVE-2018-9846
Debian Bug : 895184

Andrea Basile discovered that the 'archive' plugin in roundcube, a
skinnable AJAX based webmail solution for IMAP servers, does not
properly sanitize a user-controlled parameter, allowing a remote
attacker to inject arbitrary IMAP commands and perform malicious
actions.

For the stable distribution (stretch), this problem has been fixed in
version 1.2.3+dfsg.1-4+deb9u2.

We recommend that you upgrade your roundcube packages.

For the detailed security status of roundcube please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/roundcube

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4182-1: chromium-browser security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4182-1 security@debian.org
https://www.debian.org/security/ Michael Gilbert
April 28, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : chromium-browser
CVE ID : CVE-2018-6056 CVE-2018-6057 CVE-2018-6060 CVE-2018-6061
CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065
CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069
CVE-2018-6070 CVE-2018-6071 CVE-2018-6072 CVE-2018-6073
CVE-2018-6074 CVE-2018-6075 CVE-2018-6076 CVE-2018-6077
CVE-2018-6078 CVE-2018-6079 CVE-2018-6080 CVE-2018-6081
CVE-2018-6082 CVE-2018-6083 CVE-2018-6085 CVE-2018-6086
CVE-2018-6087 CVE-2018-6088 CVE-2018-6089 CVE-2018-6090
CVE-2018-6091 CVE-2018-6092 CVE-2018-6093 CVE-2018-6094
CVE-2018-6095 CVE-2018-6096 CVE-2018-6097 CVE-2018-6098
CVE-2018-6099 CVE-2018-6100 CVE-2018-6101 CVE-2018-6102
CVE-2018-6103 CVE-2018-6104 CVE-2018-6105 CVE-2018-6106
CVE-2018-6107 CVE-2018-6108 CVE-2018-6109 CVE-2018-6110
CVE-2018-6111 CVE-2018-6112 CVE-2018-6113 CVE-2018-6114
CVE-2018-6116 CVE-2018-6117

Several vulnerabilities have been discovered in the chromium web browser.

CVE-2018-6056

lokihardt discovered an error in the v8 javascript library.

CVE-2018-6057

Gal Beniamini discovered errors related to shared memory permissions.

CVE-2018-6060

Omair discovered a use-after-free issue in blink/webkit.

CVE-2018-6061

Guang Gong discovered a race condition in the v8 javascript library.

CVE-2018-6062

A heap overflow issue was discovered in the v8 javascript library.

CVE-2018-6063

Gal Beniamini discovered errors related to shared memory permissions.

CVE-2018-6064

lokihardt discovered a type confusion error in the v8 javascript
library.

CVE-2018-6065

Mark Brand discovered an integer overflow issue in the v8 javascript
library.

CVE-2018-6066

Masato Kinugawa discovered a way to bypass the Same Origin Policy.

CVE-2018-6067

Ned Williamson discovered a buffer overflow issue in the skia library.

CVE-2018-6068

Luan Herrera discovered object lifecycle issues.

CVE-2018-6069

Wanglu and Yangkang discovered a stack overflow issue in the skia
library.

CVE-2018-6070

Rob Wu discovered a way to bypass the Content Security Policy.

CVE-2018-6071

A heap overflow issue was discovered in the skia library.

CVE-2018-6072

Atte Kettunen discovered an integer overflow issue in the pdfium
library.

CVE-2018-6073

Omair discover a heap overflow issue in the WebGL implementation.

CVE-2018-6074

Abdulrahman Alqabandi discovered a way to cause a downloaded web page
to not contain a Mark of the Web.

CVE-2018-6075

Inti De Ceukelaire discovered a way to bypass the Same Origin Policy.

CVE-2018-6076

Mateusz Krzeszowiec discovered that URL fragment identifiers could be
handled incorrectly.

CVE-2018-6077

Khalil Zhani discovered a timing issue.

CVE-2018-6078

Khalil Zhani discovered a URL spoofing issue.

CVE-2018-6079

Ivars discovered an information disclosure issue.

CVE-2018-6080

Gal Beniamini discovered an information disclosure issue.

CVE-2018-6081

Rob Wu discovered a cross-site scripting issue.

CVE-2018-6082

WenXu Wu discovered a way to bypass blocked ports.

CVE-2018-6083

Jun Kokatsu discovered that AppManifests could be handled incorrectly.

CVE-2018-6085

Ned Williamson discovered a use-after-free issue.

CVE-2018-6086

Ned Williamson discovered a use-after-free issue.

CVE-2018-6087

A use-after-free issue was discovered in the WebAssembly implementation.

CVE-2018-6088

A use-after-free issue was discovered in the pdfium library.

CVE-2018-6089

Rob Wu discovered a way to bypass the Same Origin Policy.

CVE-2018-6090

ZhanJia Song discovered a heap overflow issue in the skia library.

CVE-2018-6091

Jun Kokatsu discovered that plugins could be handled incorrectly.

CVE-2018-6092

Natalie Silvanovich discovered an integer overflow issue in the
WebAssembly implementation.

CVE-2018-6093

Jun Kokatsu discovered a way to bypass the Same Origin Policy.

CVE-2018-6094

Chris Rohlf discovered a regression in garbage collection hardening.

CVE-2018-6095

Abdulrahman Alqabandi discovered files could be uploaded without user
interaction.

CVE-2018-6096

WenXu Wu discovered a user interface spoofing issue.

CVE-2018-6097

xisigr discovered a user interface spoofing issue.

CVE-2018-6098

Khalil Zhani discovered a URL spoofing issue.

CVE-2018-6099

Jun Kokatsu discovered a way to bypass the Cross Origin Resource
Sharing mechanism.

CVE-2018-6100

Lnyas Zhang dsicovered a URL spoofing issue.

CVE-2018-6101

Rob Wu discovered an issue in the developer tools remote debugging
protocol.

CVE-2018-6102

Khalil Zhani discovered a URL spoofing issue.

CVE-2018-6103

Khalil Zhani discovered a user interface spoofing issue.

CVE-2018-6104

Khalil Zhani discovered a URL spoofing issue.

CVE-2018-6105

Khalil Zhani discovered a URL spoofing issue.

CVE-2018-6106

lokihardt discovered that v8 promises could be handled incorrectly.

CVE-2018-6107

Khalil Zhani discovered a URL spoofing issue.

CVE-2018-6108

Khalil Zhani discovered a URL spoofing issue.

CVE-2018-6109

Dominik Weber discovered a way to misuse the FileAPI feature.

CVE-2018-6110

Wenxiang Qian discovered that local plain text files could be handled
incorrectly.

CVE-2018-6111

Khalil Zhani discovered a use-after-free issue in the developer tools.

CVE-2018-6112

Khalil Zhani discovered incorrect handling of URLs in the developer
tools.

CVE-2018-6113

Khalil Zhani discovered a URL spoofing issue.

CVE-2018-6114

Lnyas Zhang discovered a way to bypass the Content Security Policy.

CVE-2018-6116

Chengdu Security Response Center discovered an error when memory
is low.

CVE-2018-6117

Spencer Dailey discovered an error in form autofill settings.

For the oldstable distribution (jessie), security support for chromium
has been discontinued.

For the stable distribution (stretch), these problems have been fixed in
version 66.0.3359.117-1~deb9u1.

We recommend that you upgrade your chromium-browser packages.

For the detailed security status of chromium-browser please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/chromium-browser

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4183-1: tor security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4183-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
April 28, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : tor
CVE ID : CVE-2018-0490

It has been discovered that Tor, a connection-based low-latency
anonymous communication system, contains a protocol-list handling bug
that could be used to remotely crash directory authorities with a
null-pointer exception (TROVE-2018-001).

For the stable distribution (stretch), this problem has been fixed in
version 0.2.9.15-1.

We recommend that you upgrade your tor packages.

For the detailed security status of tor please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/tor

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4184-1: sdl-image1.2 security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4184-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
April 28, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : sdl-image1.2
CVE ID : CVE-2017-2887 CVE-2017-12122 CVE-2017-14440 CVE-2017-14441
CVE-2017-14442 CVE-2017-14448 CVE-2017-14450 CVE-2018-3837
CVE-2018-3838 CVE-2018-3839
Debian Bug : 878267

Multiple vulnerabilities have been discovered in the image loading
library for Simple DirectMedia Layer 1.2, which could result in denial
of service or the execution of arbitrary code if malformed image files
are opened.

For the oldstable distribution (jessie), these problems have been fixed
in version 1.2.12-5+deb8u1.

For the stable distribution (stretch), these problems have been fixed in
version 1.2.12-5+deb9u1.

We recommend that you upgrade your sdl-image1.2 packages.

For the detailed security status of sdl-image1.2 please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/sdl-image1.2

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4185-1: openjdk-8 security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4185-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
April 28, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : openjdk-8
CVE ID : CVE-2018-2790 CVE-2018-2794 CVE-2018-2795 CVE-2018-2796
CVE-2018-2797 CVE-2018-2798 CVE-2018-2799 CVE-2018-2800
CVE-2018-2814 CVE-2018-2815

Several vulnerabilities have been discovered in OpenJDK, an
implementation of the Oracle Java platform, resulting in denial of
service, sandbox bypass, execution of arbitrary code or bypass of JAR
signature validation.

For the stable distribution (stretch), these problems have been fixed in
version 8u171-b11-1~deb9u1.

We recommend that you upgrade your openjdk-8 packages.

For the detailed security status of openjdk-8 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/openjdk-8

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4186-1: gunicorn security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4186-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
April 28, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : gunicorn
CVE ID : CVE-2018-1000164

It was discovered that gunicorn, an event-based HTTP/WSGI server was
susceptible to HTTP Response splitting.

For the oldstable distribution (jessie), this problem has been fixed
in version 19.0-1+deb8u1.

We recommend that you upgrade your gunicorn packages.

For the detailed security status of gunicorn please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/gunicorn

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/