The following updates has been released for Debian GNU/Linux 7 LTS:

DSA 4112-1: xen security update
DSA 4113-1: libvorbis security update
DSA 4114-1: jackson-databind security update

DSA 4112-1: xen security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4112-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
February 14, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : xen
CVE ID : CVE-2017-17563 CVE-2017-17564 CVE-2017-17565
CVE-2017-17566

Multiple vulnerabilities have been discovered in the Xen hypervisor:

CVE-2017-17563

Jan Beulich discovered that an incorrect reference count overflow
check in x86 shadow mode may result in denial of service or
privilege escalation.

CVE-2017-17564

Jan Beulich discovered that improper x86 shadow mode reference count
error handling may result in denial of service or privilege
escalation.

CVE-2017-17565

Jan Beulich discovered that an incomplete bug check in x86 log-dirty
handling may result in denial of service.

CVE-2017-17566

Jan Beulich discovered that x86 PV guests may gain access to
internally used pages which could result in denial of service or
potential privilege escalation.

In addition this update ships the "Comet" shim to address the Meltdown
class of vulnerabilities for guests with legacy PV kernels. In addition,
the package provides the "Xen PTI stage 1" mitigation which is built-in
and enabled by default on Intel systems, but can be disabled with
`xpti=false' on the hypervisor command line (It does not make sense to
use both xpti and the Comet shim.)

Please refer to the following URL for more details on how to configure
individual mitigation strategies:
https://xenbits.xen.org/xsa/advisory-254.html

Additional information can also be found in README.pti and README.comet.

For the stable distribution (stretch), these problems have been fixed in
version 4.8.3+comet2+shim4.10.0+comet3-1+deb9u4.1.

We recommend that you upgrade your xen packages.

For the detailed security status of xen please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/xen

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4113-1: libvorbis security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4113-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
February 14, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : libvorbis
CVE ID : CVE-2017-14632 CVE-2017-14633

Two vulnerabilities were discovered in the libraries of the Vorbis audio
compression codec, which could result in denial of service or the
execution of arbitrary code if a malformed media file is processed.

For the stable distribution (stretch), these problems have been fixed in
version 1.3.5-4+deb9u1.

We recommend that you upgrade your libvorbis packages.

For the detailed security status of libvorbis please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libvorbis

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

DSA 4114-1: jackson-databind security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4114-1 security@debian.org
https://www.debian.org/security/ Sebastien Delafond
February 15, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : jackson-databind
CVE ID : CVE-2017-17485 CVE-2018-5968
Debian Bug : 888316 888318

It was discovered that jackson-databind, a Java library used to parse
JSON and other data formats, did not properly validate user input
before attempting deserialization. This allowed an attacker to perform
code execution by providing maliciously crafted input.

For the oldstable distribution (jessie), these problems have been fixed
in version 2.4.2-2+deb8u3.

For the stable distribution (stretch), these problems have been fixed in
version 2.8.6-1+deb9u3.

We recommend that you upgrade your jackson-databind packages.

For the detailed security status of jackson-databind please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/jackson-databind

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/