Multiple security vulnerabilities were discovered in the Tomcat
servlet and JSP engine, as well as in its Debian-specific maintainer
scripts. Those flaws allowed for privilege escalation, information
disclosure, and remote code execution.

Multiple security vulnerabilities were discovered in the Tomcat
servlet and JSP engine, as well as in its Debian-specific maintainer
scripts. Those flaws allowed for privilege escalation, information
disclosure, and remote code execution.

Two vulnerabilities were discovered in libupnp, a portable SDK for
UPnP devices.

Several vulnerabilities were found in PHP, a general-purpose scripting
language commonly used for web application development.

Chris Evans discovered that incorrect emulation of the SPC700 audio
co-processor of the Super Nintendo Entertainment System allows the
execution of arbitrary code if a malformed SPC music file is opened.
Further information can be found at

http://scarybeastsecurity.blogspot.de/2016/12/redux-compromising-linux-using-snes.html

Multiple security issues have been found in the Mozilla Firefox web
browser: Multiple memory safety errors, buffer overflows and other
implementation errors may lead to the execution of arbitrary code or
information leaks.

Jann Horn of Google Project Zero discovered that APT, the high level
package manager, does not properly handle errors when validating
signatures on InRelease files. An attacker able to man-in-the-middle
HTTP requests to an apt repository that uses InRelease files
(clearsigned Release files), can take advantage of this flaw to
circumvent the signature of the InRelease file, leading to arbitrary
code execution.

Several vulnerabilities were found in PHP, a general-purpose scripting
language commonly used for web application development.

Several vulnerabilities have been discovered in the chromium web browser.

Multiple security issues have been found in Icedove, Debian’s version of
the Mozilla Thunderbird mail client: Multiple memory safety errors,
same-origin policy bypass issues, integer overflows, buffer overflows
and use-after-frees may lead to the execution of arbitrary code or
denial of service.