-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3929-1 security@xxxxxxxxxx https://www.debian.org/security/ Salvatore Bonaccorso August 10, 2017 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : libsoup2.4 CVE ID : CVE-2017-2885 Debian Bug : 871650 Aleksandar Nikolic of Cisco Talos discovered a stack-based buffer overflow vulnerability in libsoup2.4, a HTTP library implementation in C. A remote attacker can take advantage of this flaw by sending a specially crafted HTTP request to cause an application using the libsoup2.4 library to crash (denial of service), or potentially execute arbitrary code. For the oldstable distribution (jessie), this problem has been fixed in version 2.48.0-1+deb8u1. For the stable distribution (stretch), this problem has been fixed in version 2.56.0-2+deb9u1. We recommend that you upgrade your libsoup2.4 packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlmMW7pfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0Rn2g//a7f8spfjwWWKsRoFzo1bJAaDoekT4mDQrgoNlQ2HsD6qiZOS6VgTobCz 6JXkaagMj+EQJQ+fiiIRnPUXpwmHyhxSBFjtZumb2FmTots3vFx8s2ygWFnAH2Bu cy+B26idvZUO9Md/kWLAu2rilFn4+pUo4QtoUuSTveO45/E3C9GiOY8DgpYk+bqg 0ryyW6We+UT406fArnL99xP2aOD6pT5JKEm4enJitVFPkln6G4XodAP7RBnqYR3i GbuI6nMsnvPzCibM9LT9Zded6bpNR4vJ7+rOO/uU0SgtgqTBHL7fcc3Y4XlBLZaD k6b6S4F5/Sbjo4SeLiNICddtcqCM7IZOs+tb2nGfX707KuGyD9zpRNtwaSXRcGOw cLJFp90JJ3mLNimajL/5UWoq181CEaRlz63jWkVb/Ov6AEKzF1P/u/LvFRML8wXN qAGbful7k4Tll00nDV7RnZoju3iFIa0VzkdPuKE3hnG+j0YC/ASxibFGuELCwJjY 838tjjX7d+Kd2KIOkK6FbSK5y54FCC62lPw4LeWMu5QIUBV7OgkLSP9OdMwmQoge Mj/2uUCmzajL93XaWD+9ZUzTHzSXBO3VLZCjN/lsHamJ7O+EF+wUDZlLutCkHgrZ tOxMZxrL+ft/eb4zG/oVK3tRX3fYV5vTo2Z5Fc3mITkhFIfugVo= =pvsy -----END PGP SIGNATURE-----
