An updated strongswan package has been released for Debian GNU/Linux 7 LTS:
DLA 1059-1: strongswan security update
An updated newsbeuter packages is available for both Debian GNU/linux 8 and 9:
DSA 3947-1: newsbeuter security update
DLA 1059-1: strongswan security update
An updated newsbeuter packages is available for both Debian GNU/linux 8 and 9:
DSA 3947-1: newsbeuter security update
DLA 1059-1: strongswan security update
Package : strongswan
Version : 4.5.2-1.5+deb7u10
CVE ID : CVE-2017-11185
Debian Bug : #872155
It was discovered that there was a denial-of-service vulnerability in
the Strongswan Virtual Private Network (VPN) software.
Specific RSA signatures passed to the gmp plugin for verification could
cause a null-pointer dereference. Potential triggers are signatures in
certificates, but also signatures used during IKE authentication.
For more details, please see:
https://www.strongswan.org/blog/2017/08/14/strongswan-vulnerability-(cve-2017-11185).html
For Debian 7 "Wheezy", this issue has been fixed in strongswan version
4.5.2-1.5+deb7u10.
We recommend that you upgrade your strongswan packages.
DSA 3947-1: newsbeuter security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-3947-1 security@debian.org
https://www.debian.org/security/ Sebastien Delafond
August 18, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : newsbeuter
CVE ID : CVE-2017-12904
Jeriko One discovered that newsbeuter, a text-mode RSS feed reader,
did not properly escape the title and description of a news article
when bookmarking it. This allowed a remote attacker to run an
arbitrary shell command on the client machine.
For the oldstable distribution (jessie), this problem has been fixed
in version 2.8-2+deb8u1.
For the stable distribution (stretch), this problem has been fixed in
version 2.9-5+deb9u1.
We recommend that you upgrade your newsbeuter packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/