[SECURITY] [DLA 361-1] bouncycastle security update

2015-12-08 Thread Raphael Hertzog
Package: bouncycastle Version: 1.44+dfsg-2+deb6u1 CVE ID : CVE-2015-7940 Debian Bug : 802671 The Bouncy Castle Java library before 1.51 does not validate that a point is within the elliptic curve, which makes it easier for remote attackers to obtain private keys via a s

[SECURITY] [DLA 360-1] linux-2.6 security update

2015-12-08 Thread Ben Hutchings
Package: linux-2.6 Version: 2.6.32-48squeeze17 CVE ID : CVE-2013-7446 CVE-2015-7799 CVE-2015-7833 CVE-2015-7990  CVE-2015-8324 This update fixes the CVEs described below. CVE-2013-7446 Dmitry Vyukov discovered that a particular sequence of valid o

[SECURITY] [DLA 362-1] dhcpcd security update

2015-12-08 Thread Raphael Hertzog
Package: dhcpcd Version: 1:3.2.3-5+squeeze2 CVE ID : CVE-2012-6698 CVE-2012-6699 CVE-2012-6700 Guido Vranken discovered several memory-related vulnerabilities while fuzzing DHCP messages sent to dhcpcd. For Debian 6 “Squeeze”, those issues have been fixed in version 1:3.2.

[SECURITY] [DLA 363-1] libphp-phpmailer security update

2015-12-08 Thread Chris Lamb
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Package: libphp-phpmailer Version: 5.1-1+deb6u11 CVE ID : CVE-2015-8476 Debian Bug : 807265 It was discovered that there was a header injection vulnerability in libphp-phpmailer, am email transfer library for PHP. For De