apticron report [Sat, 14 Mar 2015 09:48:16 +0100] ======================================================================== apticron has detected that some packages need upgrading on: hexagon.federez.net [ 5.39.82.35 2001:41d0:8:9423::1 5.39.82.35 2001:41d0:8:9423::1 ] The following packages are currently pending an upgrade: gnupg 1.4.12-7+deb7u7 gpgv 1.4.12-7+deb7u7 libgcrypt11 1.5.0-5+deb7u3 libnss3 2:3.14.5-1+deb7u4 libssh2-1 1.4.2-1.1+deb7u1 ======================================================================== Package Details: Lecture des fichiers de modifications (« changelog »)... --- Modifications pour gnupg (gnupg gpgv) --- gnupg (1.4.12-7+deb7u7) wheezy-security; urgency=high * Use ciphertext blinding for Elgamal decryption to counteract a side-channel attack as per CVE-2014-3591 * Fix data-dependent timing variations in the modular exponentiation function that could be used to mount a side-channel attack as per CVE-2015-0837 * Fix a use-after-free when importing a garbled keyring file as per CVE-2015-1606 (Closes: #778652) -- Alessandro Ghedini <ghedo(a)debian.org> Wed, 04 Mar 2015 18:46:34 +0100 --- Modifications pour libgcrypt11 --- libgcrypt11 (1.5.0-5+deb7u3) wheezy-security; urgency=high * Use ciphertext blinding for Elgamal decryption to counteract a side-channel attack as per CVE-2014-3591 * Fix data-dependent timing variations in the modular exponentiation function that could be used to mount a side-channel attack as per CVE-2015-0837 -- Alessandro Ghedini <ghedo(a)debian.org> Wed, 04 Mar 2015 19:39:20 +0100 --- Modifications pour libssh2 (libssh2-1) --- libssh2 (1.4.2-1.1+deb7u1) wheezy-security; urgency=high * Non-maintainer upload by the Security Team. * Add CVE-2015-1782.patch. CVE-2015-1782: Using SSH_MSG_KEXINIT data unbounded. -- Salvatore Bonaccorso <carnil(a)debian.org> Fri, 06 Mar 2015 18:46:50 +0100 --- Modifications pour nss (libnss3) --- nss (2:3.14.5-1+deb7u4) wheezy-security; urgency=high * Non-maintainer upload by the Security Team. * Add CVE-2014-1569.patch. CVE-2014-1569: ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data. (Closes: #773625) -- Salvatore Bonaccorso <carnil(a)debian.org> Mon, 29 Dec 2014 16:11:33 +0100 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on hexagon.federez.net -- apticron