The security updates of spip, tomcat8, jython, flatpak, apache2 and expat. Vulnerability Information DSA-3890-1 spip — Security Updates Security database details: Emeric Boit of ANSSI reported that SPIP, a website engine for publishing, insufficiently sanitises the value from the X-Forwarded-Host HTTP header field. An unauthenticated attacker can take advantage of this flaw to cause remote code execution.   DSA-3891-1 tomcat8 — Security Updates Security database details: Aniket Nandkishor Kulkarni discovered that in tomcat8, a servlet and JSP engine, static error pages used the original request's HTTP method to serve content, instead of systematically using the GET method. This could under certain ...Read more

The security updates of vim, imagemagick, imagemagick, icu, firefox-esr, weechat, ghostscript, libxstream-java, tomcat7, tomcat8, tiff, libtirpc, libytnef, xen, git, kde4libs, rtmpdump, bitlbee, bind9, jbig2dec, deluge, mysql-connector-java, puppet, imagemagick, fop, mosquitto, strongswan, sudo, openldap, tnef, wordpress, perl, ettercap, libmwaw, otrs2, tor, zziplib, libosip2, libgcrypt20, firefox-esr, request-tracker4, gnutls28, irssi. Vulnerability Information DSA-3786-1 vim —Security Updates Security database details: Editor spell files passed to the vim (Vi IMproved) editor may result in an integer overflow in memory allocation and a resulting buffer overflow which potentially could result in the execution of arbitrary code or denial of service.   DSA-3799-1 imagemagick —Security Updates Security database details: This ...Read more

The security updates of rabbitmq-server, tiff, pdns, mapserver, libphp-swiftmailer, libxpm, openssl, lcms2, tcpdump, libgd2, wordpress, ntfs-3g, svgsalamander, viewvc, libevent, spice, libreoffice, munin, bind9, apache2, mupdf, libquicktime, ruby-zip, zabbix, texlive-base, icoutils, chromium-browser, wireshark, ioquake3, r-base, audiofile, wordpress, jbig2dec, gst-plugins-bad1.0, gst-plugins-base1.0, gst-plugins-good1.0, gst-plugins-ugly1.0, gstreamer1.0, eject, jhead, tryton-server, libreoffice, mysql-connector-java. Vulnerability Information DSA-3761-1 rabbitmq-server —Security Updates Security database details: It was discovered that RabbitMQ, an implementation of the AMQP protocol, didn't correctly validate MQTT (MQ Telemetry Transport) connection authentication. This allowed anyone to login to an existing user account without having to provide a password.   DSA-3762-1 tiff —Security Updates Security database details: Multiple vulnerabilities have been discovered in the libtiff library and the included tools tiff2rgba, rgb2ycbcr, tiffcp, tiffcrop, tiff2pdf and tiffsplit, which may result in denial of service, memory disclosure or the execution of arbitrary code.   DSA-3764-1 pdns —Security Updates Security ...Read more

The security updates of gst-plugins-bad1.0, drupal7, wireshark, gst-plugins-good1.0, icu, hdf5, chromium-browser, apt, game-music-emu, libupnp, tor, flightgear, python-bottle, squid3, graphicsmagick, libcrypto++, dcmtk, libphp-phpmailer, libgd2, pcsc-lite, libvncserver and tomcat8. Vulnerability Information DSA-3717-1 gst-plugins-bad1.0, gst-plugins-bad0.10 —Security Updates Security database details: Chris Evans discovered that the GStreamer plugin to decode VMware screen capture files allowed the execution of arbitrary code.   DSA-3718-1 drupal7 — Security Updates Security database details: Multiple vulnerabilities has been found in the Drupal content management framework. For additional information, please refer to the upstream advisory at https://www.drupal.org/SA-CORE-2016-005   DSA-3719-1 wireshark — Security Updates Security database details: It was discovered that wireshark, a ...Read more