The following update has been released for Debian GNU/Linux:

Debian GNU/Linux 7 LTS:
DLA 1056-1: cvs security update

Debian GNU/Linux 8 and 9:
DSA 3942-1: supervisor security update

Debian GNU/Linux 9:
DSA 3940-1: iortcw security update

DLA 1056-1: cvs security update

Package : cvs
Version : 2:1.12.13+real-9+deb7u1
CVE ID : CVE-2017-12836
Debian Bug : #871810

It was discovered that there was a command injection vulnerability in the CVS
revision control system.

For Debian 7 "Wheezy", this issue has been fixed in cvs version
2:1.12.13+real-9+deb7u1.

We recommend that you upgrade your cvs packages. Thanks to Thorsten Glaser
for preparing and testing this upload.

DSA 3942-1: supervisor security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3942-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
August 13, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : supervisor
CVE ID : CVE-2017-11610
Debian Bug : 870187

Calum Hutton reported that the XML-RPC server in supervisor, a system
for controlling process state, does not perform validation on requested
XML-RPC methods, allowing an authenticated client to send a malicious
XML-RPC request to supervisord that will run arbitrary shell commands on
the server as the same user as supervisord.

The vulnerability has been fixed by disabling nested namespace lookup
entirely. supervisord will now only call methods on the object
registered to handle XML-RPC requests and not any child objects it may
contain, possibly breaking existing setups. No publicly available
plugins are currently known that use nested namespaces. Plugins that use
a single namespace will continue to work as before. Details can be found
on the upstream issue at
https://github.com/Supervisor/supervisor/issues/964 .

For the oldstable distribution (jessie), this problem has been fixed
in version 3.0r1-1+deb8u1.

For the stable distribution (stretch), this problem has been fixed in
version 3.3.1-1+deb9u1.

We recommend that you upgrade your supervisor packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 3940-1: iortcw security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3940-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
August 13, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : iortcw
CVE ID : CVE-2017-11721

A read buffer overflow was discovered in the idtech3 (Quake III Arena)
family of game engines. This allows remote attackers to cause a denial
of service (application crash) or possibly have unspecified other impact
via a crafted packet.

For the stable distribution (stretch), this problem has been fixed in
version 1.50a+dfsg1-3+deb9u1.

We recommend that you upgrade your iortcw packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/