[SECURITY] [DLA 2268-2] mutt regression update

2020-06-30 Thread Mike Gabriel
Package: mutt Version: 1.5.23-3+deb8u3 CVE ID : CVE-2020-14093 CVE-2020-14954 Debian Bug : Two vulnerabilities have been discovered in mutt, a console email client. CVE-2020-14093 Mutt allowed an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH

[SECURITY] [DLA 2268-1] mutt security update

2020-06-30 Thread Mike Gabriel
Package: mutt Version: 1.5.23-3+deb8u2 CVE ID : CVE-2020-14093 CVE-2020-14954 Debian Bug : 962897 Two vulnerabilities have been discovered in mutt, a console email client. CVE-2020-14093 Mutt allowed an IMAP fcc/postpone man-in-the-middle attack via a

[SECURITY] [DLA 2266-1] nss security update

2020-06-30 Thread Adrian Bunk
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Package: nss Version: 2:3.26-1+debu8u11 CVE ID : CVE-2020-12399 CVE-2020-12402 Several vulnerabilities were fixed in nss, the Network Security Service libraries. CVE-2020-12399 Force a fixed length for DSA

[SECURITY] [DLA 2267-1] libmatio security update

2020-06-30 Thread Adrian Bunk
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Package: libmatio Version: 1.5.2-3+deb8u1 CVE ID : CVE-2019-17533 In libmatio, a library to read and write Matlab MAT files, a vulnerability was fixed in Mat_VarReadNextInfo4 in mat4.c that could lead to a heap-based buffer

[SECURITY] [DLA 2265-1] mailman security update

2020-06-30 Thread Mike Gabriel
Package: mailman Version: 1:2.1.18-2+deb8u7 CVE ID : CVE-2020-15011 Debian Bug : GNU Mailman allowed arbitrary content injection via the Cgi/private.py private archive login page. For Debian 8 "Jessie", this problem has been fixed in version 1:2.1.18-2+deb8u7. We

[SECURITY] [DLA 2264-1] libvncserver security update

2020-06-30 Thread Mike Gabriel
Package: libvncserver Version: 0.9.9+dfsg2-6.1+deb8u8 CVE ID : CVE-2019-20839 CVE-2020-14397 CVE-2020-14399 CVE-2020-14400 CVE-2020-14401 CVE-2020-14402 CVE-2020-14403 CVE-2020-14404 CVE-2020-14405 Debian Bug : Several

[SECURITY] [DLA 2263-1] drupal7 security update

2020-06-30 Thread Ola Lundqvist
Package: drupal7 Version: 7.32-1+deb8u19 CVE ID : CVE-2020-13663 Debian Bug : CVE-2020-13663 - Drupal SA 2020-004 The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities. For Debian