Monitoring Avril 2015

monitoring@federez.net

3 participants
40 discussions

3 Debian package update(s) for quigon.federez.net

par root＠quigon.rez-gif.supelec.fr

apticron report [Fri, 10 Apr 2015 17:38:13 +0200] ======================================================================== apticron has detected that some packages need upgrading on: quigon.federez.net [ 160.228.155.65 ] The following packages are currently pending an upgrade: dpkg 1.16.16 dpkg-dev 1.16.16 libdpkg-perl 1.16.16 ======================================================================== Package Details: Lecture des fichiers de modifications (« changelog »)... --- Modifications pour dpkg (dpkg dpkg-dev libdpkg-perl) --- dpkg (1.16.16) wheezy-security; urgency=high [ Guillem Jover ] * Do not leak long tar names on bogus or truncated archives. * Do not leak the filepackages iterator when a directory is used by other packages. * Do not leak color string on «dselect --color». * Fix memory leaks when parsing alternatives. * Fix memory leaks in buffer_copy() on error conditions. * Fix possible out of bounds buffer read access in the error output on bogus ar member sizes. * Fix file triggers/Unincorp descriptor leak on subprocesses. Regression introduced with the initial triggers implementation in dpkg 1.14.17. Closes: #751021 * Fix a descriptor leak on dselect subprocesses when --debug is used. * Do not run qsort() over the scandir() list in libcompat if it is NULL. * Fix off-by-one stack buffer overrun in start-stop-daemon on GNU/Linux and GNU/kFreeBSD if the executable pathname is longer than _POSIX_PATH_MAX. Although this should not have security implications as the buffer is surrounded by two arrays (so those catch accesses even if the stack grows up or down), and we are compiling with -fstack-protector anyway. * Add a workaround to start-stop-daemon for bogus OpenVZ Linux kernels that prepend, instead of appending, the " (deleted)" marker in /proc/PID/exe. Closes: #731530 * Fix off-by-one error in libdpkg command argv size calculation. Based on a patch by Bálint Réczey <balint(a)balintreczey.hu>. Closes: #760690 * Escape package and architecture names on control file parsing warning, as those get injected into a variable that is used as a format string, and they come from the package fields, which are under user control. Regression introduced in dpkg 1.16.0. Fixes CVE-2014-8625. Closes: #768485 Reported by Joshua Rogers <megamansec(a)gmail.com>. * Do not match partial field names in control files. Closes: #769119 Regression introduced in dpkg 1.10. * Fix out-of-bounds buffer read accesses when parsing field and trigger names or checking package ownership of conffiles and directories. Reported by Joshua Rogers <megamansec(a)gmail.com>. * Add powerpcel support to cputable. Thanks to Jae Junh <jaejunh(a)embian.com>. * Fix OpenPGP Armor Header Line parsing in Dpkg::Control::Hash. We should only accept [\r\t ] as trailing whitespace, although RFC4880 does not clarify what whitespace really maps to, we should really match the GnuPG implementation anyway, as that's what we use to verify the signatures. Reported by Jann Horn <jann(a)thejh.net>. Fixes CVE-2015-0840. [ Raphaël Hertzog ] * Drop myself from Uploaders. [ Updated scripts translations ] * Fix typos in German (Helge Kreutzmann) * Swedish (Peter Krefting). [ Updated man page translations ] * Fix typos in German (Helge Kreutzmann) * Swedish (Peter Krefting). -- Guillem Jover <guillem(a)debian.org> Thu, 09 Apr 2015 08:45:47 +0200 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on quigon.federez.net -- apticron

10 années

3 Debian package update(s) for hexagon.federez.net

par root＠hexagon.federez.net

apticron report [Fri, 10 Apr 2015 10:48:15 +0200] ======================================================================== apticron has detected that some packages need upgrading on: hexagon.federez.net [ 5.39.82.35 2001:41d0:8:9423::1 5.39.82.35 2001:41d0:8:9423::1 ] The following packages are currently pending an upgrade: dpkg 1.16.16 dpkg-dev 1.16.16 libdpkg-perl 1.16.16 ======================================================================== Package Details: Lecture des fichiers de modifications (« changelog »)... --- Modifications pour dpkg (dpkg dpkg-dev libdpkg-perl) --- dpkg (1.16.16) wheezy-security; urgency=high [ Guillem Jover ] * Do not leak long tar names on bogus or truncated archives. * Do not leak the filepackages iterator when a directory is used by other packages. * Do not leak color string on «dselect --color». * Fix memory leaks when parsing alternatives. * Fix memory leaks in buffer_copy() on error conditions. * Fix possible out of bounds buffer read access in the error output on bogus ar member sizes. * Fix file triggers/Unincorp descriptor leak on subprocesses. Regression introduced with the initial triggers implementation in dpkg 1.14.17. Closes: #751021 * Fix a descriptor leak on dselect subprocesses when --debug is used. * Do not run qsort() over the scandir() list in libcompat if it is NULL. * Fix off-by-one stack buffer overrun in start-stop-daemon on GNU/Linux and GNU/kFreeBSD if the executable pathname is longer than _POSIX_PATH_MAX. Although this should not have security implications as the buffer is surrounded by two arrays (so those catch accesses even if the stack grows up or down), and we are compiling with -fstack-protector anyway. * Add a workaround to start-stop-daemon for bogus OpenVZ Linux kernels that prepend, instead of appending, the " (deleted)" marker in /proc/PID/exe. Closes: #731530 * Fix off-by-one error in libdpkg command argv size calculation. Based on a patch by Bálint Réczey <balint(a)balintreczey.hu>. Closes: #760690 * Escape package and architecture names on control file parsing warning, as those get injected into a variable that is used as a format string, and they come from the package fields, which are under user control. Regression introduced in dpkg 1.16.0. Fixes CVE-2014-8625. Closes: #768485 Reported by Joshua Rogers <megamansec(a)gmail.com>. * Do not match partial field names in control files. Closes: #769119 Regression introduced in dpkg 1.10. * Fix out-of-bounds buffer read accesses when parsing field and trigger names or checking package ownership of conffiles and directories. Reported by Joshua Rogers <megamansec(a)gmail.com>. * Add powerpcel support to cputable. Thanks to Jae Junh <jaejunh(a)embian.com>. * Fix OpenPGP Armor Header Line parsing in Dpkg::Control::Hash. We should only accept [\r\t ] as trailing whitespace, although RFC4880 does not clarify what whitespace really maps to, we should really match the GnuPG implementation anyway, as that's what we use to verify the signatures. Reported by Jann Horn <jann(a)thejh.net>. Fixes CVE-2015-0840. [ Raphaël Hertzog ] * Drop myself from Uploaders. [ Updated scripts translations ] * Fix typos in German (Helge Kreutzmann) * Swedish (Peter Krefting). [ Updated man page translations ] * Fix typos in German (Helge Kreutzmann) * Swedish (Peter Krefting). -- Guillem Jover <guillem(a)debian.org> Thu, 09 Apr 2015 08:45:47 +0200 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on hexagon.federez.net -- apticron

10 années

2 Debian package update(s) for baldrick

par root＠baldrick.crans.org

apticron report [Wed, 08 Apr 2015 16:44:06 +0000] ======================================================================== apticron has detected that some packages need upgrading on: baldrick [ 138.231.142.239 2a01:240:fe3d:4:62:61ff:fe6c:6401 138.231.142.239 ] [ 2a01:240:fe3d:4:62:61ff:fe6c:6401 ] The following packages are currently pending an upgrade: libgd2-xpm 2.0.36~rc1~dfsg-6.1+deb7u1 libxml2 2.8.0+dfsg1-7+wheezy4 ======================================================================== Package Details: Lecture des fichiers de modifications (« changelog »)... --- Modifications pour libgd2 (libgd2-xpm) --- libgd2 (2.0.36~rc1~dfsg-6.1+deb7u1) wheezy-security; urgency=high * Fix NULL pointer dereference when reading XPM files with a crafted color table as per CVE-2014-2497 (Closes: #744719) * Fix buffer read overflow when reading invalid GIF files as per CVE-2014-9709 -- Alessandro Ghedini <ghedo(a)debian.org> Wed, 01 Apr 2015 15:50:38 +0200 --- Modifications pour libxml2 --- libxml2 (2.8.0+dfsg1-7+wheezy4) wheezy-security; urgency=high * Non-maintainer upload by the Security Team. * Add missing required patches for CVE-2014-3660. The two upstream commits a3f1e3e5712257fd279917a9158278534e8f4b72 and cff2546f13503ac028e4c1f63c7b6d85f2f2d777 are required in addition to the commit be2a7edaf289c5da74a4f9ed3a0b6c733e775230 to fix CVE-2014-3660 due to changes in the use of ent->checked. Fixes "libxml2: CVE-2014-3660 patch makes installation-guide FTBFS". (Closes: #774358) * Refresh cve-2014-3660.patch patch * Refresh cve-2014-3660-bis.patch patch -- Salvatore Bonaccorso <carnil(a)debian.org> Sat, 04 Apr 2015 11:01:18 +0200 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on baldrick -- apticron

10 années

3 Debian package update(s) for quigon.federez.net

par root＠quigon.rez-gif.supelec.fr

apticron report [Wed, 08 Apr 2015 17:38:14 +0200] ======================================================================== apticron has detected that some packages need upgrading on: quigon.federez.net [ 160.228.155.65 ] The following packages are currently pending an upgrade: arj 3.10.22-10+deb7u1 libxml2 2.8.0+dfsg1-7+wheezy4 mailman 1:2.1.15-1+deb7u1 ======================================================================== Package Details: Lecture des fichiers de modifications (« changelog »)... --- Modifications pour arj --- arj (3.10.22-10+deb7u1) wheezy-security; urgency=high * Non-maintainer upload by the Security Team with patches from Guillem Jover * Fix buffer overflow from size under user control. This is causing free() on an invalid pointer. Fixes: CVE-2015-2782 (Closes: #774015) * Fix absolute path directory traversal. Fixes: CVE-2015-0557 (Closes: #774435) * Fix symlink directory traversal. Fixes: CVE-2015-0556 (Closes: #774434) -- Salvatore Bonaccorso <carnil(a)debian.org> Fri, 03 Apr 2015 20:21:46 +0200 --- Modifications pour libxml2 --- libxml2 (2.8.0+dfsg1-7+wheezy4) wheezy-security; urgency=high * Non-maintainer upload by the Security Team. * Add missing required patches for CVE-2014-3660. The two upstream commits a3f1e3e5712257fd279917a9158278534e8f4b72 and cff2546f13503ac028e4c1f63c7b6d85f2f2d777 are required in addition to the commit be2a7edaf289c5da74a4f9ed3a0b6c733e775230 to fix CVE-2014-3660 due to changes in the use of ent->checked. Fixes "libxml2: CVE-2014-3660 patch makes installation-guide FTBFS". (Closes: #774358) * Refresh cve-2014-3660.patch patch * Refresh cve-2014-3660-bis.patch patch -- Salvatore Bonaccorso <carnil(a)debian.org> Sat, 04 Apr 2015 11:01:18 +0200 --- Modifications pour mailman --- mailman (1:2.1.15-1+deb7u1) wheezy-security; urgency=high * Fix security issue: path traversal through local_part. Affects installations which use an Exim or Postfix transport instead of fixed aliases; attacker needs to be able to place files on the local filesystem. (CVE-2015-2775, Closes: 781626) -- Thijs Kinkhorst <thijs(a)debian.org> Mon, 06 Apr 2015 18:17:34 +0200 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on quigon.federez.net -- apticron

10 années

4 Debian package update(s) for hexagon.federez.net

par root＠hexagon.federez.net

apticron report [Wed, 08 Apr 2015 10:48:15 +0200] ======================================================================== apticron has detected that some packages need upgrading on: hexagon.federez.net [ 5.39.82.35 2001:41d0:8:9423::1 5.39.82.35 2001:41d0:8:9423::1 ] The following packages are currently pending an upgrade: arj 3.10.22-10+deb7u1 libgd2-xpm 2.0.36~rc1~dfsg-6.1+deb7u1 libxml2 2.8.0+dfsg1-7+wheezy4 mailman 1:2.1.15-1+deb7u1 ======================================================================== Package Details: Lecture des fichiers de modifications (« changelog »)... --- Modifications pour arj --- arj (3.10.22-10+deb7u1) wheezy-security; urgency=high * Non-maintainer upload by the Security Team with patches from Guillem Jover * Fix buffer overflow from size under user control. This is causing free() on an invalid pointer. Fixes: CVE-2015-2782 (Closes: #774015) * Fix absolute path directory traversal. Fixes: CVE-2015-0557 (Closes: #774435) * Fix symlink directory traversal. Fixes: CVE-2015-0556 (Closes: #774434) -- Salvatore Bonaccorso <carnil(a)debian.org> Fri, 03 Apr 2015 20:21:46 +0200 --- Modifications pour libgd2 (libgd2-xpm) --- libgd2 (2.0.36~rc1~dfsg-6.1+deb7u1) wheezy-security; urgency=high * Fix NULL pointer dereference when reading XPM files with a crafted color table as per CVE-2014-2497 (Closes: #744719) * Fix buffer read overflow when reading invalid GIF files as per CVE-2014-9709 -- Alessandro Ghedini <ghedo(a)debian.org> Wed, 01 Apr 2015 15:50:38 +0200 --- Modifications pour libxml2 --- libxml2 (2.8.0+dfsg1-7+wheezy4) wheezy-security; urgency=high * Non-maintainer upload by the Security Team. * Add missing required patches for CVE-2014-3660. The two upstream commits a3f1e3e5712257fd279917a9158278534e8f4b72 and cff2546f13503ac028e4c1f63c7b6d85f2f2d777 are required in addition to the commit be2a7edaf289c5da74a4f9ed3a0b6c733e775230 to fix CVE-2014-3660 due to changes in the use of ent->checked. Fixes "libxml2: CVE-2014-3660 patch makes installation-guide FTBFS". (Closes: #774358) * Refresh cve-2014-3660.patch patch * Refresh cve-2014-3660-bis.patch patch -- Salvatore Bonaccorso <carnil(a)debian.org> Sat, 04 Apr 2015 11:01:18 +0200 --- Modifications pour mailman --- mailman (1:2.1.15-1+deb7u1) wheezy-security; urgency=high * Fix security issue: path traversal through local_part. Affects installations which use an Exim or Postfix transport instead of fixed aliases; attacker needs to be able to place files on the local filesystem. (CVE-2015-2775, Closes: 781626) -- Thijs Kinkhorst <thijs(a)debian.org> Mon, 06 Apr 2015 18:17:34 +0200 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on hexagon.federez.net -- apticron

10 années

1 Debian package update(s) for baldrick

par root＠baldrick.crans.org

apticron report [Tue, 07 Apr 2015 16:44:07 +0000] ======================================================================== apticron has detected that some packages need upgrading on: baldrick [ 138.231.142.239 2a01:240:fe3d:4:62:61ff:fe6c:6401 138.231.142.239 ] [ 2a01:240:fe3d:4:62:61ff:fe6c:6401 ] The following packages are currently pending an upgrade: libgd2-xpm 2.0.36~rc1~dfsg-6.1+deb7u1 ======================================================================== Package Details: Lecture des fichiers de modifications (« changelog »)... --- Modifications pour libgd2 (libgd2-xpm) --- libgd2 (2.0.36~rc1~dfsg-6.1+deb7u1) wheezy-security; urgency=high * Fix NULL pointer dereference when reading XPM files with a crafted color table as per CVE-2014-2497 (Closes: #744719) * Fix buffer read overflow when reading invalid GIF files as per CVE-2014-9709 -- Alessandro Ghedini <ghedo(a)debian.org> Wed, 01 Apr 2015 15:50:38 +0200 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on baldrick -- apticron

10 années

2 Debian package update(s) for quigon.federez.net

par root＠quigon.rez-gif.supelec.fr

apticron report [Tue, 07 Apr 2015 17:38:13 +0200] ======================================================================== apticron has detected that some packages need upgrading on: quigon.federez.net [ 160.228.155.65 ] The following packages are currently pending an upgrade: arj 3.10.22-10+deb7u1 mailman 1:2.1.15-1+deb7u1 ======================================================================== Package Details: Lecture des fichiers de modifications (« changelog »)... --- Modifications pour arj --- arj (3.10.22-10+deb7u1) wheezy-security; urgency=high * Non-maintainer upload by the Security Team with patches from Guillem Jover * Fix buffer overflow from size under user control. This is causing free() on an invalid pointer. Fixes: CVE-2015-2782 (Closes: #774015) * Fix absolute path directory traversal. Fixes: CVE-2015-0557 (Closes: #774435) * Fix symlink directory traversal. Fixes: CVE-2015-0556 (Closes: #774434) -- Salvatore Bonaccorso <carnil(a)debian.org> Fri, 03 Apr 2015 20:21:46 +0200 --- Modifications pour mailman --- mailman (1:2.1.15-1+deb7u1) wheezy-security; urgency=high * Fix security issue: path traversal through local_part. Affects installations which use an Exim or Postfix transport instead of fixed aliases; attacker needs to be able to place files on the local filesystem. (CVE-2015-2775, Closes: 781626) -- Thijs Kinkhorst <thijs(a)debian.org> Mon, 06 Apr 2015 18:17:34 +0200 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on quigon.federez.net -- apticron

10 années

3 Debian package update(s) for hexagon.federez.net

par root＠hexagon.federez.net

apticron report [Tue, 07 Apr 2015 10:48:15 +0200] ======================================================================== apticron has detected that some packages need upgrading on: hexagon.federez.net [ 5.39.82.35 2001:41d0:8:9423::1 5.39.82.35 2001:41d0:8:9423::1 ] The following packages are currently pending an upgrade: arj 3.10.22-10+deb7u1 libgd2-xpm 2.0.36~rc1~dfsg-6.1+deb7u1 mailman 1:2.1.15-1+deb7u1 ======================================================================== Package Details: Lecture des fichiers de modifications (« changelog »)... --- Modifications pour arj --- arj (3.10.22-10+deb7u1) wheezy-security; urgency=high * Non-maintainer upload by the Security Team with patches from Guillem Jover * Fix buffer overflow from size under user control. This is causing free() on an invalid pointer. Fixes: CVE-2015-2782 (Closes: #774015) * Fix absolute path directory traversal. Fixes: CVE-2015-0557 (Closes: #774435) * Fix symlink directory traversal. Fixes: CVE-2015-0556 (Closes: #774434) -- Salvatore Bonaccorso <carnil(a)debian.org> Fri, 03 Apr 2015 20:21:46 +0200 --- Modifications pour libgd2 (libgd2-xpm) --- libgd2 (2.0.36~rc1~dfsg-6.1+deb7u1) wheezy-security; urgency=high * Fix NULL pointer dereference when reading XPM files with a crafted color table as per CVE-2014-2497 (Closes: #744719) * Fix buffer read overflow when reading invalid GIF files as per CVE-2014-9709 -- Alessandro Ghedini <ghedo(a)debian.org> Wed, 01 Apr 2015 15:50:38 +0200 --- Modifications pour mailman --- mailman (1:2.1.15-1+deb7u1) wheezy-security; urgency=high * Fix security issue: path traversal through local_part. Affects installations which use an Exim or Postfix transport instead of fixed aliases; attacker needs to be able to place files on the local filesystem. (CVE-2015-2775, Closes: 781626) -- Thijs Kinkhorst <thijs(a)debian.org> Mon, 06 Apr 2015 18:17:34 +0200 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on hexagon.federez.net -- apticron

10 années

Cron <root@hexagon> test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )

par root＠hexagon.federez.net

/etc/cron.daily/logrotate: gzip: stdin: file size changed while zipping

10 années

Cron <root@hexagon> if test -x /usr/sbin/apticron; then /usr/sbin/apticron --cron; else true; fi

par root＠hexagon.federez.net

E: Dépendances manquantes. Essayez d'utiliser l'option -f.

10 années

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

Monitoring Avril 2015