Package        : libmtp
Version        : 1.1.3-35-g0ece104-5+deb7u1
CVE ID         : CVE-2017-9831 CVE-2017-9832

libmtp, a library for communicating with MTP aware devices (like
cellular phones and audio players), was found to be vulnerable to
several integer overflow vulnerabilities, which allowed malicious
devices to cause denial of service crashes and maybe remote code
execution.

CVE-2017-9831

    An integer overflow vulnerability in the
    ptp_unpack_EOS_CustomFuncEx function of the ptp-pack.c file of
    libmtp (version 1.1.12 and below) allows attackers to cause a
    denial of service (out-of-bounds memory access) or maybe remote
    code execution by inserting a mobile device into a personal
    computer through a USB cable.

CVE-2017-9832

    An integer overflow vulnerability in ptp-pack.c (ptp_unpack_OPL
    function) of libmtp (version 1.1.12 and below) allows attackers to
    cause a denial of service (out-of-bounds memory access) or maybe
    remote code execution by inserting a mobile device into a personal
    computer through a USB cable.

For Debian 7 "Wheezy", these problems have been fixed in version
1.1.3-35-g0ece104-5+deb7u1.

We recommend that you upgrade your libmtp packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS