The following updates has been released for Debian GNU/Linux 8 LTS:

DLA 1640-1: tmpreaper security update
DLA 1641-1: mxml security update

DLA 1640-1: tmpreaper security update

Package : tmpreaper
Version : 1.6.13+nmu1+deb8u1
CVE ID : CVE-2019-3461
Debian Bug : 918956

It was discovered that tmpreaper, a program that cleans up files in
directories based on their age, is vulnerable to a race condition. This
vulnerability might be exploited by local attackers to perform privilege
escalation.

For Debian 8 "Jessie", this problem has been fixed in version
1.6.13+nmu1+deb8u1.

We recommend that you upgrade your tmpreaper packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1641-1: mxml security update

Package : mxml
Version : 2.6-2+deb8u1
CVE ID : CVE-2016-4570 CVE-2016-4571 CVE-2018-20004
Debian Bug : 825855 918007


Several stack exhaustion conditions were found in mxml that can easily
crash when parsing xml files.

CVE-2016-4570

The mxmlDelete function in mxml-node.c allows remote attackers to
cause a denial of service (stack consumption) via crafted xml file.

CVE-2016-4571

The mxml_write_node function in mxml-file.c allows remote attackers
to cause a denial of service (stack consumption) via crafted xml
file

CVE-2018-20004

A stack-based buffer overflow in mxml_write_node via vectors
involving a double-precision floating point number.

For Debian 8 "Jessie", these problems have been fixed in version
2.6-2+deb8u1.

We recommend that you upgrade your mxml packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS