The following updates has been released for Debian GNU/Linux:

DLA 1167-1: ruby-yajl security update
DSA 4022-1: libreoffice security update
DSA 4024-1: chromium-browser security update
DSA 4025-1: libpam4j security update

DLA 1167-1: ruby-yajl security update

Package : ruby-yajl
Version : 1.1.0-2+deb7u1
CVE ID : CVE-2017-16516
Debian Bug : 880691

A vulnerability was found in ruby-yajl, an interface to Yajl, a JSON
stream-based parser library. When a crafted JSON file is supplied to
Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT
in the yajl_string_decode function in yajl_encode.c. This may result
in a denial of service.

For Debian 7 "Wheezy", these problems have been fixed in version
1.1.0-2+deb7u1.

We recommend that you upgrade your ruby-yajl packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DSA 4022-1: libreoffice security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4022-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
November 07, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : libreoffice
CVE ID : CVE-2017-12607 CVE-2017-12608

Marcin Noga discovered two vulnerabilities in LibreOffice, which could
result in the execution of arbitrary code if a malformed PPT or DOC
document is opened.

For the oldstable distribution (jessie), these problems have been fixed
in version 1:4.3.3-2+deb8u9.

These vulnerabilities were fixed in Libreoffice 5.0.2, so the version
in the stable distribution (stretch) is not affected.

We recommend that you upgrade your libreoffice packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4024-1: chromium-browser security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4024-1 security@debian.org
https://www.debian.org/security/ Michael Gilbert
November 08, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : chromium-browser
CVE ID : CVE-2017-15398 CVE-2017-15399

Several vulnerabilities have been discovered in the chromium browser.

CVE-2017-15398

Ned Williamson discovered a stack overflow issue.

CVE-2017-15399

Zhao Qixun discovered a use-after-free issue in the v8 javascript
library.

For the oldstable distribution (jessie), security support for chromium has
been discontinued.

For the stable distribution (stretch), these problems have been fixed in
version 62.0.3202.89-1~deb9u1.

For the testing distribution (buster), these problems will be fixed soon.

For the unstable distribution (sid), these problems have been fixed in
version 62.0.3202.89-1.

We recommend that you upgrade your chromium-browser packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4025-1: libpam4j security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4025-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
November 08, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : libpam4j
CVE ID : CVE-2017-12197

It was discovered that libpam4j, a Java library wrapper for the
integration of PAM did not call pam_acct_mgmt() during authentication.
As such a user who has a valid password, but a deactivated or disabled
account could still log in.

For the oldstable distribution (jessie), this problem has been fixed
in version 1.4-2+deb8u1.

For the stable distribution (stretch), this problem has been fixed in
version 1.4-2+deb9u1.

We recommend that you upgrade your libpam4j packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/