The following updates has been released for Debian GNU/Linux:

Debian GNU/Linux 7 Extended LTS:
ELA-91-1 php5 security update

Debian GNU/Linux 8 LTS:
DLA 1707-1: symfony security update

Debian GNU/Linux 9:
DSA 4404-1: chromium security update

ELA-91-1 php5 security update

Package: php5
Version: 5.4.45-0+deb7u20
Related CVE: CVE-2019-9637 CVE-2019-9638 CVE-2019-9639 CVE-2019-9640 CVE-2019-9641
Vulnerabilities have been discovered in php5, a server-side, HTML-embedded scripting language. Note that this update includes a change to the default behavior for IMAP connections. See below for details.

CVE-2019-9637

rename() across the device may allow unwanted access during processing
CVE-2019-9638 CVE-2019-9639

Uninitialized read in exif_process_IFD_in_MAKERNOTE
CVE-2019-9640

Invalid Read on exif_process_SOFn
CVE-2019-9641

Uninitialized read in exif_process_IFD_in_TIFF
For Debian 7 Wheezy, these problems have been fixed in version 5.4.45-0+deb7u20.

We recommend that you upgrade your php5 packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

DLA 1707-1: symfony security update

Package : symfony
Version : 2.3.21+dfsg-4+deb8u4
CVE ID : CVE-2017-16652 CVE-2017-16654 CVE-2018-11385 CVE-2018-11408
CVE-2018-14773 CVE-2018-19789 CVE-2018-19790


Several security vulnerabilities have been discovered in symfony, a PHP
web application framework. Numerous symfony components are affected:
Security, bundle readers, session handling, SecurityBundle,
HttpFoundation, Form, and Security\Http.

The corresponding upstream advisories contain further details:

[CVE-2017-16652]
https://symfony.com/blog/cve-2017-16652-open-redirect-vulnerability-on-security-handlers

[CVE-2017-16654]
https://symfony.com/blog/cve-2017-16654-intl-bundle-readers-breaking-out-of-paths

[CVE-2018-11385]
https://symfony.com/blog/cve-2018-11385-session-fixation-issue-for-guard-authentication

[CVE-2018-11408]
https://symfony.com/blog/cve-2018-11408-open-redirect-vulnerability-on-security-handlers

[CVE-2018-14773]
https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers

[CVE-2018-19789]
https://symfony.com/blog/cve-2018-19789-disclosure-of-uploaded-files-full-path

[CVE-2018-19790]
https://symfony.com/blog/cve-2018-19790-open-redirect-vulnerability-when-using-security-http

For Debian 8 "Jessie", these problems have been fixed in version
2.3.21+dfsg-4+deb8u4.

We recommend that you upgrade your symfony packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DSA 4404-1: chromium security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4404-1 security@debian.org
https://www.debian.org/security/ Michael Gilbert
March 09, 2019 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : chromium
CVE ID : CVE-2019-5786

Clement Lecigne discovered a use-after-free issue in chromium's file
reader implementation. A maliciously crafted file could be used to
remotely execute arbitrary code because of this problem.

This update also fixes a regression introduced in a previous update. The
browser would always crash when launched in remote debugging mode.

For the stable distribution (stretch), this problem has been fixed in
version 72.0.3626.122-1~deb9u1.

We recommend that you upgrade your chromium packages.

For the detailed security status of chromium please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/chromium

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/