The following updates has been released for Debian GNU/Linux 8 LTS:

DLA 1452-1: wordpress security update
DLA 1453-1: tomcat7 security update

DLA 1452-1: wordpress security update

Package : wordpress
Version : 4.1+dfsg-1+deb8u18
CVE ID : CVE-2016-5836 CVE-2018-12895
Debian Bug : 902876

Two vulnerabilities were discovered in wordpress, a web blogging
tool. The Common Vulnerabilities and Exposures project identifies the
following issues.

CVE-2016-5836

The oEmbed protocol implementation in WordPress before 4.5.3 allows
remote attackers to cause a denial of service via unspecified
vectors.

CVE-2018-12895

A vulnerability was discovered in Wordpress, a web blogging tool. It
allowed remote attackers with specific roles to execute arbitrary
code.

For Debian 8 "Jessie", these problems have been fixed in version
4.1+dfsg-1+deb8u18.

We recommend that you upgrade your wordpress packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1453-1: tomcat7 security update

Package : tomcat7
Version : 7.0.56-3+really7.0.90-1
CVE ID : CVE-2018-8034

The host name verification in Tomcat when using TLS with the WebSocket
client was missing. It is now enabled by default.

For Debian 8 "Jessie", this problem has been fixed in version
7.0.56-3+really7.0.90-1.

We recommend that you upgrade your tomcat7 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS