The security updates of bind9, samba, evince, heimdal, apache2, catdoc and openjdk-8. Vulnerability Information DSA-3904-1 bind9 —Security Updates Security database details: Clément Berthaux from Synaktiv discovered two vulnerabilities in BIND, a DNS server implementation. They allow an attacker to bypass TSIG authentication by sending crafted DNS packets to a server. CVE-2017-3142: An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection ...Read more

The security updates of openvpn、tiff、undertow and Linux Kernel. Vulnerability Information DSA-3900-1 openvpn —Security Updates Security database details: Several issues were discovered in openvpn, a virtual private network application. CVE-2017-7479: It was discovered that openvpn did not properly handle the rollover of packet identifiers. This would allow an authenticated remote attacker to cause a denial-of-service via application crash. CVE-2017-7508: Guido Vranken discovered that openvpn did not properly handle specific malformed IPv6 packets. This would allow a remote attacker to cause a denial-of-service via application crash. CVE-2017-7520: Guido Vranken discovered that openvpn did not properly handle clients connecting to an HTTP proxy ...Read more

The security updates of systemd and linux kernal. Vulnerability Information CVE-2017-9445 —Security Updates Security database details: In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it.   CVE-2017-8890 —Security Updates Security database details: The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) ...Read more

The security updates of spip, tomcat8, jython, flatpak, apache2 and expat. Vulnerability Information DSA-3890-1 spip — Security Updates Security database details: Emeric Boit of ANSSI reported that SPIP, a website engine for publishing, insufficiently sanitises the value from the X-Forwarded-Host HTTP header field. An unauthenticated attacker can take advantage of this flaw to cause remote code execution.   DSA-3891-1 tomcat8 — Security Updates Security database details: Aniket Nandkishor Kulkarni discovered that in tomcat8, a servlet and JSP engine, static error pages used the original request's HTTP method to serve content, instead of systematically using the GET method. This could under certain ...Read more

The security updates of vim, imagemagick, imagemagick, icu, firefox-esr, weechat, ghostscript, libxstream-java, tomcat7, tomcat8, tiff, libtirpc, libytnef, xen, git, kde4libs, rtmpdump, bitlbee, bind9, jbig2dec, deluge, mysql-connector-java, puppet, imagemagick, fop, mosquitto, strongswan, sudo, openldap, tnef, wordpress, perl, ettercap, libmwaw, otrs2, tor, zziplib, libosip2, libgcrypt20, firefox-esr, request-tracker4, gnutls28, irssi. Vulnerability Information DSA-3786-1 vim —Security Updates Security database details: Editor spell files passed to the vim (Vi IMproved) editor may result in an integer overflow in memory allocation and a resulting buffer overflow which potentially could result in the execution of arbitrary code or denial of service.   DSA-3799-1 imagemagick —Security Updates Security database details: This ...Read more