Tag: security

Categories
Redis

Redis 2.8.5

Redis 2.8.5 has been released on February 4th 2014, bringing the following changes (take a look at the Changelog) :

  • [FIX] Fixed a replication bug caused by Lua scripts + expired keys: keys could expire in the middle of scripts causing non-deterministic behavior.
  • [FIX] MISCONFIG error if condition fixed, the server was no longer able to stop writes on RDB misconfiguration after this error was introduced.
  • [FIX] REDIS_AOF_REWRITE_MIN_SIZE is now 64mb like example redis.conf default.
  • [FIX] Perform fflush() before fsync() in rio.c (bug without actual effects).
  • [FIX] Don’t log MONITOR clients as disconnecting slaves.
  • [FIX] SENTINEL MASTER arity check fixed. Crashed the Sentinel instance when the command was given without arguments.
  • [NEW] Allow CONFIG and SHUTDOWN while in stale-slave state.
  • [NEW] Support for configurable TCP listen(2) backlog size.
  • [NEW] redis-cli supports SCAN via the --scan and --pattern options.
  • [NEW] SENTINEL SET master quorum via runtime API implemented.

The upgrade urgency high for Redis, low for Sentinel. Redis users using Lua scripts with expires, and Redis users relying on the ability of Redis to block writes on RDB saving errors should plan to upgrade a.s.a.p.

The packages are now available for both Debian 7.0 “Wheezy” and Debian 6.0 “Squeeze” on both amd64 and i386 architectures.

Categories
PHP

PHP 5.5.7, for Debian 7.0 “Wheezy”

On December 12th 2013, the PHP group has released PHP 5.5.7. This release fixes some bugs against PHP 5.5.6 and it also includes a fix for CVE-2013-6420 in OpenSSL extension. All users are strongly encouraged to upgrade.

As a consequence, PHP 5.5.7 packages are now available on Dotdeb for Debian 7.0 “Wheezy”, on both amd64 and i386 architectures.

Please read the Changelog and the migration guide (be aware of the backward incompatible changes) before upgrading.

Last but not least, if you find Dotdeb useful, you may want to show your support.

Categories
PHP

PHP 5.4.23, for Wheezy and Squeeze

On December 12th 2013, the PHP group has released PHP 5.4.23. About 10 bugs were fixed, including a security issue in OpenSSL module (CVE-2013-6420). All PHP 5.4 users are encouraged to upgrade to this version.

The corresponding packages are now available on Dotdeb :

  • for Debian 7.0 “Wheezy” and Debian 6.0 “Squeeze”,
  • on both amd64 and i386 architectures.

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

And if you find Dotdeb useful, feel free to show your support.

Categories
PHP

PHP 5.3.28 for Squeeze

On December 12th 2013, the PHP group has released PHP 5.3.28.

The PHP development team announces the immediate availability of PHP 5.3.28. This release fixes two security issues in OpenSSL module in PHP 5.3 – CVE-2013-4073 and CVE-2013-6420. All PHP 5.3 users are encouraged to upgrade to PHP 5.3.28 or latest versions of PHP 5.4 or PHP 5.5.

The corresponding packages are now available on Dotdeb for Debian 6.0 “Squeeze”, on both amd64 and i386 architectures.

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

And if you like Dotdeb, feel free to show your support.

Categories
Nginx

Security : Nginx 1.4.4 for Wheezy and Squeeze

Nginx 1.4.4 has been released on November 19th 2013, fixing a request line parsing vulnerability by Ivan Fratric of the Google Security Team (CVE-2013-4547). More info in the changelog.

As a consequence, Dotdeb’s packages of Nginx 1.4.4 are now available for both Debian 7.0 “Wheezy” and Debian 6.0 “Squeeze” (amd64/i386).

Reminder : Users of naxsi-ui should be aware that it has been deprecated in the upcoming Naxsi 0.53 and that it won’t be provided by Dotdeb starting with the next Nginx packages.

As usual, if you want to know which module has been included in each Nginx flavor, you just have to look at this document.

Categories
Zabbix

Zabbix 2.0.9

Zabbix 2.0.9 has been released on October 8th 2013. It fixes critical security issues, as well as known issues of Zabbix 2.0.x, and introduces new minor features (take a look at the Zabbix 2.0.9 release notes for more info).

The packages are now available :

  • for Debian 7.0 “Wheezy and 6.0 “Squeeze”,
  • on both amd64 and i386 architectures.
Categories
PHP

PHP 5.5.3, for Debian 7.0 “Wheezy”

On August 22nd 2013, the PHP group has released PHP 5.5.3. Since the previously-packaged PHP 5.5.1 version, about 20 bugs were fixed, including security issue in OpenSSL module (CVE-2013-4248) and session fixation problem (CVE-2011-4718).

As a consequence, PHP 5.5.3 packages are now available on Dotdeb for Debian 7.0 “Wheezy”, on both amd64 and i386 architectures, with the following changes :

  • each SAPI (apache2, apache2filter, CLI, CGI, FPM, embed) has now its own /etc/php5/SAPI/conf.d/ subdirectory, not just a symlink to a common one, so it can have its own list of activated modules (it involved some more tests, so sorry for the delay),
  • the php5-mongo package is now available, allowing you interacting with MongoDB servers,
  • the php5-fpm init script now reports syntax errors with full error messages.

Please read the Changelog and the migration guide (be aware of the backward incompatible changes) before upgrading.

Last but not least, if you find Dotdeb useful, you may want to show your support.

Categories
PHP

PHP 5.4.19, for Wheezy and Squeeze

On August 22nd 2013, the PHP group has released PHP 5.4.19. It fixes a bug in the patch for CVE-2013-4248 in OpenSSL module. All PHP users are encouraged to upgrade to PHP 5.4.19.

The corresponding packages are now available on Dotdeb :

  • for Debian 7.0 “Wheezy” and Debian 6.0 “Squeeze”,
  • on both amd64 and i386 architectures.

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

And if you find Dotdeb useful, feel free to show your support.

Categories
PHP

PHP 5.4.18, for Wheezy and Squeeze

On August 15th 2013, the PHP group has released PHP 5.4.18.

About 30 bugs were fixed, including security issues CVE-2013-4113 and CVE-2013-4248. All users of PHP are encouraged to upgrade to this release.

On the Dotdeb side,

  • the php5-mongo package is now available, allowing you interacting with MongoDB servers,
  • the php5-fpm init script now reports syntax errors with full error messages.

The corresponding packages are now available on Dotdeb :

  • for Debian 7.0 “Wheezy” and Debian 6.0 “Squeeze”,
  • on both amd64 and i386 architectures.

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

And if you like Dotdeb, feel free to show your support.

Categories
PHP

PHP 5.3.26 for Squeeze

On June 6th 2013, the PHP group has released PHP 5.3.26.

These releases fix about 15 bugs, including CVE-2013-2110. All users of PHP are encouraged to upgrade to PHP 5.4.16.

The corresponding packages are now available on Dotdeb for Debian 6.0 “Squeeze”, on both amd64 and i386 architectures.

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

And if you like Dotdeb, feel free to show your support.