Several vulnerabilities have been fixed in eglibc, Debian’s version of
the GNU C library:

Kousuke Ebihara discovered that redcloth, a Ruby module used to
convert Textile markup to HTML, did not properly sanitize its
input. This allowed a remote attacker to perform a cross-site
scripting attack by injecting arbitrary JavaScript code into the
generated HTML.

Jakub Wilk reported that sudo, a program designed to provide limited
super user privileges to specific users, preserves the TZ variable from
a user’s environment without any sanitization. A user with sudo access
may take advantage of this to exploit bugs in the C library functions
which parse the TZ environment variable or to open files that the user
would not otherwise be able to open. The later could potentially cause
changes in system behavior when reading certain device special files or
cause the program run via sudo to block.

Jose Duart of the Google Security Team discovered a buffer overflow in
in e2fsprogs, a set of utilities for the ext2, ext3, and ext4 file
systems. This issue can possibly lead to arbitrary code execution if
a malicious device is plugged in, the system is configured to
automatically mount it, and the mounting process chooses to run fsck
on the device’s malicious filesystem.

Jiri Horner discovered a way to cause xdg-open, a tool that automatically
opens URLs in a user’s preferred application, to execute arbitrary
commands remotely.

Pierrick Caillon discovered that the authentication could be bypassed in
the Typo 3 content management system. Please refer to the upstream
advisory for additional information:

It was discovered that LibreOffice, an office productivity suite, could
try to write to invalid memory areas when importing malformed RTF files.
This could allow remote attackers to cause a denial of service (crash)
or arbitrary code execution via crafted RTF files.

Jan-Piet Mens discovered that the BIND DNS server would crash when
processing an invalid DNSSEC key rollover, either due to an error on
the zone operator’s part, or due to interference with network traffic
by an attacker. This issue affects configurations with the directives
“dnssec-validation auto;” (as enabled in the Debian default
configuration) or “dnssec-lookaside auto;”.

Simon McVittie discovered a local denial of service flaw in dbus, an
asynchronous inter-process communication system. On systems with
systemd-style service activation, dbus-daemon does not prevent forged
ActivationFailure messages from non-root processes. A malicious local
user could use this flaw to trick dbus-daemon into thinking that systemd
failed to activate a system service, resulting in an error reply back to
the requester.

Olivier Fourdan discovered that missing input validation in the Xserver’s
handling of XkbSetGeometry requests may result in an information leak
or denial of service.