The following updates has been released for Debian GNU/Linux:

[DLA 1017-1] mpg123 security update
[DLA 1018-1] sqlite3 security update
[DSA 3904-1] bind9 security update

[DLA 1017-1] mpg123 security update

Package : mpg123
Version : 1.14.4-1+deb7u2
CVE ID : CVE-2017-10683
Debian Bug : #866860

It was discovered that there was a remote denial of service vulnerability in
the mpg123 audio library/player. This was caused by a heap-based buffer
over-read in the "convert_latin1" function.

For Debian 7 "Wheezy", this issue has been fixed in mpg123 version
1.14.4-1+deb7u2.

We recommend that you upgrade your mpg123 packages.

[DLA 1018-1] sqlite3 security update

Package : sqlite3
Version : 3.7.13-1+deb7u4
CVE ID : CVE-2017-10989
Debian Bug : #867618

It was discovered that there was a heap-based buffer over-read vulnerability in
SQLite, a lightweight database engine. The getNodeSize function in
ext/rtree/rtree.c mishandled undersized RTree blobs in a specially-crafted
database,

For Debian 7 "Wheezy", this issue has been fixed in sqlite3 version
3.7.13-1+deb7u4.

We recommend that you upgrade your sqlite3 packages.

[DSA 3904-1] bind9 security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3904-1 security@debian.org
https://www.debian.org/security/ Yves-Alexis Perez
July 08, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : bind9
CVE ID : CVE-2017-3142 CVE-2017-3143
Debian Bug : 866564

Clément Berthaux from Synaktiv discovered two vulnerabilities in BIND, a DNS
server implementation. They allow an attacker to bypass TSIG authentication by
sending crafted DNS packets to a server.

CVE-2017-3142

An attacker who is able to send and receive messages to an authoritative
DNS server and who has knowledge of a valid TSIG key name may be able to
circumvent TSIG authentication of AXFR requests via a carefully constructed
request packet. A server that relies solely on TSIG keys for protection
with no other ACL protection could be manipulated into:
- providing an AXFR of a zone to an unauthorized recipient
- accepting bogus NOTIFY packets

CVE-2017-3143

An attacker who is able to send and receive messages to an authoritative
DNS server and who has knowledge of a valid TSIG key name for the zone and
service being targeted may be able to manipulate BIND into accepting an
unauthorized dynamic update.

For the oldstable distribution (jessie), these problems have been fixed
in version 1:9.9.5.dfsg-9+deb8u12.

For the stable distribution (stretch), these problems have been fixed in
version 1:9.10.3.dfsg.P4-12.4.

We recommend that you upgrade your bind9 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/