Univention Corporate Server 4.2 erratum 304 (security)

This update addresses the following issues:
* plugins\codec\libflac_plugin.dll allows remote attackers to cause a denial
  of service (heap corruption and application crash) or possibly have
  unspecified other impact via a crafted FLAC file. (CVE-2017-9300)
* Heap out-of-bound read in ParseJSS due to missing check of string length
  allows attackers to read heap uninitialized data via a crafted subtitles
  file. (CVE-2017-8312)
* plugins\audio_filter\libmpgatofixed32_plugin.dll allows remote attackers to
  cause a denial of service (invalid read and application crash) or possibly
  have unspecified other impact via a crafted file. (CVE-2017-9301)
* Potential heap based buffer overflow in ParseJSS due to skipping NULL
  terminator in an input string allows attackers to execute arbitrary code
  via a crafted subtitles file. (CVE-2017-8311)
* Heap out-of-bound read in CreateHtmlSubtitle due to missing check of string
  termination allows attackers to read data beyond allocated memory and
  potentially crash the process (causing a denial of service) via a crafted
  subtitles file. (CVE-2017-8310)
* Heap out-of-bound read in ParseJSS due to missing check of string
  termination allows attackers to read data beyond allocated memory and
  potentially crash the process via a crafted subtitles file. (CVE-2017-8313)
* avcodec 2.2.x allows out-of-bounds heap memory write due to calling
  memcpy() with a wrong size, leading to a denial of service (application
  crash) or possibly code execution. (CVE-2017-10699)