Monitoring Janvier 2017

monitoring@federez.net

10 participants
93 discussions

par MAILER-DAEMON＠nonagon.crans.org

This is the mail system at host nonagon.crans.org. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <monitoring(a)federez.net> (expanded from <root>): host smtp.crans.org[138.231.136.39] said: 550 5.1.0 <root(a)nonagon.crans.org>: Sender address rejected: User unknown in relay recipient table (in reply to RCPT TO command)

8 années, 3 mois

57 Debian package update(s) for hexagon.federez.net

par root＠hexagon.federez.net

apticron report [Sun, 15 Jan 2017 09:48:24 +0100] ======================================================================== apticron has detected that some packages need upgrading on: hexagon.federez.net [ 5.39.82.35 2001:41d0:8:9423::1 5.39.82.35 2001:41d0:8:9423::1 ] The following packages are currently pending an upgrade: base-files 8+deb8u7 bash 4.3-11+deb8u1 ca-certificates 20141019+deb8u2 comerr-dev 2.1-1.42.12-2+b1 dbus 1.8.22-0+deb8u1 e2fslibs 1.42.12-2+b1 e2fsprogs 1.42.12-2+b1 file 1:5.22+15-2+deb8u3 jq 1.4-2.1+deb8u1 libc6 2.19-18+deb8u7 libc6-dev 2.19-18+deb8u7 libcairo2 1.14.0-2.1+deb8u2 libc-bin 2.19-18+deb8u7 libc-dev-bin 2.19-18+deb8u7 libcomerr2 1.42.12-2+b1 libdbus-1-3 1.8.22-0+deb8u1 libfcgi-perl 0.77-1+deb8u1 libgnutls-deb0-28 3.3.8-6+deb8u4 libgnutls-openssl27 3.3.8-6+deb8u4 libgnutlsxx28 3.3.8-6+deb8u4 libhogweed2 2.7.1-5+deb8u2 libio-socket-ssl-perl 2.002-2+deb8u2 libmagic1 1:5.22+15-2+deb8u3 libnettle4 2.7.1-5+deb8u2 libnss-ldapd 0.9.4-3+deb8u2 libopendkim9 2.9.2-2+deb8u1 libpam0g 1.1.8-3.1+deb8u2 libpam-ldapd 0.9.4-3+deb8u2 libpam-modules 1.1.8-3.1+deb8u2 libpam-modules-bin 1.1.8-3.1+deb8u2 libpam-runtime 1.1.8-3.1+deb8u2 libpam-systemd 215-17+deb8u6 libpng12-0 1.2.50-2+deb8u3 libpq5 9.4.10-0+deb8u1 librbl1 2.9.2-2+deb8u1 libss2 1.42.12-2+b1 libsystemd0 215-17+deb8u6 libudev1 215-17+deb8u6 libvbr2 2.9.2-2+deb8u1 libwmf0.2-7 0.2.8.4-10.3+deb8u2 linux-image-3.16.0-4-amd64 3.16.39-1 linux-libc-dev 3.16.39-1 locales 2.19-18+deb8u7 mdadm 3.3.2-5+deb8u2 multiarch-support 2.19-18+deb8u7 nettle-dev 2.7.1-5+deb8u2 nscd 2.19-18+deb8u7 nslcd 0.9.4-3+deb8u2 nslcd-utils 0.9.4-3+deb8u2 opendkim 2.9.2-2+deb8u1 opendkim-tools 2.9.2-2+deb8u1 python-crypto 2.6.1-5+deb8u1 sed 4.2.2-4+deb8u1 systemd 215-17+deb8u6 systemd-sysv 215-17+deb8u6 udev 215-17+deb8u6 w3m 0.5.3-19+deb8u1 ======================================================================== Package Details: Lecture des fichiers de modifications (« changelog »)... --- Nouveautés pour ca-certificates --- ca-certificates (20141019+deb8u2) stable; urgency=medium Update Mozilla certificate authority bundle to version 2.9. The following certificate authorities were added (+): + "Certplus Root CA G1" + "Certplus Root CA G2" + "Certum Trusted Network CA 2" + "Hellenic Academic and Research Institutions ECC RootCA 2015" + "Hellenic Academic and Research Institutions RootCA 2015" + "ISRG Root X1" + "OpenTrust Root CA G1" + "OpenTrust Root CA G2" + "OpenTrust Root CA G3" + "SZAFIR ROOT CA2" The following certificate authorities were removed (-): - "CA Disig" - "NetLock Business (Class B) Root" - "NetLock Express (Class C) Root" - "NetLock Notary (Class A) Root" - "NetLock Qualified (Class QA) Root" - "Sonera Class 1 Root CA" - "Staat der Nederlanden Root CA" - "Verisign Class 1 Public Primary Certification Authority - G2" - "Verisign Class 3 Public Primary Certification Authority" - "Verisign Class 3 Public Primary Certification Authority - G2" -- Michael Shuler <michael(a)pbandjelly.org> Fri, 18 Nov 2016 09:09:47 -0600 --- Modifications pour e2fsprogs (comerr-dev e2fslibs e2fsprogs libcomerr2 libss2) --- e2fsprogs (1.42.12-2+b1) jessie; urgency=low, binary-only=yes * Binary-only non-maintainer upload for amd64; no source changes. * Rebuild against dietlibc 0.33~cvs20120325-6+deb8u1 -- amd64 Build Daemon (binet) <buildd-binet(a)buildd.debian.org> Sat, 04 Jun 2016 11:58:06 -0400 --- Modifications pour jq --- jq (1.4-2.1+deb8u1) jessie; urgency=high * Non-maintainer upload. * Add patch to fix CVE-2015-8863. (Closes: #802231) * Add patch to fix CVE-2016-4074. (Closes: #822456) -- Harlan Lieberman-Berg <hlieberman(a)debian.org> Thu, 05 Jan 2017 00:26:08 -0500 --- Modifications pour python-crypto --- python-crypto (2.6.1-5+deb8u1) jessie; urgency=high * debian/patches/CVE-2013-7459.patch: Raise a warning when IV is used with ECB or CTR and ignored the IV in that case. Thanks to Salvatore Bonaccorso for the initial patch. (CVE-2013-7459) (Closes: #849495) -- Sebastian Ramacher <sramacher(a)debian.org> Tue, 03 Jan 2017 13:56:09 +0100 --- Modifications pour bash --- bash (4.3-11+deb8u1) jessie; urgency=medium * Non-maintainer upload. * CVE-2016-0634: Arbitrary code execution via malicious hostname * CVE-2016-7543: Specially crafted SHELLOPTS+PS4 variables allows command substitution -- Salvatore Bonaccorso <carnil(a)debian.org> Sun, 09 Oct 2016 17:35:21 +0200 --- Modifications pour ca-certificates --- ca-certificates (20141019+deb8u2) stable; urgency=medium [ Michael Shuler ] * mozilla/{certdata.txt,nssckbi.h}: Update Mozilla certificate authority bundle to version 2.9. Thanks for the initial 2.7 patch, Jonathan Wiltshire. Closes: #828845 The following certificate authorities were added (+): + "Certplus Root CA G1" + "Certplus Root CA G2" + "Certum Trusted Network CA 2" + "Hellenic Academic and Research Institutions ECC RootCA 2015" + "Hellenic Academic and Research Institutions RootCA 2015" + "ISRG Root X1" + "OpenTrust Root CA G1" + "OpenTrust Root CA G2" + "OpenTrust Root CA G3" + "SZAFIR ROOT CA2" The following certificate authorities were removed (-): - "CA Disig" - "NetLock Business (Class B) Root" - "NetLock Express (Class C) Root" - "NetLock Notary (Class A) Root" - "NetLock Qualified (Class QA) Root" - "Sonera Class 1 Root CA" - "Staat der Nederlanden Root CA" - "Verisign Class 1 Public Primary Certification Authority - G2" - "Verisign Class 3 Public Primary Certification Authority" - "Verisign Class 3 Public Primary Certification Authority - G2" [ Andreas Beckmann ] * debian/postinst: Run update-certificates without hooks to initially populate /etc/ssl/certs. (The hooks are deferred to the noawait trigger.) Closes: #825730 -- Michael Shuler <michael(a)pbandjelly.org> Fri, 18 Nov 2016 09:09:47 -0600 --- Modifications pour cairo (libcairo2) --- cairo (1.14.0-2.1+deb8u2) jessie; urgency=medium * Non-maintainer upload. * CVE-2016-9082: DoS attack based on using SVG to generate invalid pointers from a _cairo_image_surface in write_png. (Closes: #842289) -- Salvatore Bonaccorso <carnil(a)debian.org> Fri, 30 Dec 2016 07:30:39 +0100 --- Modifications pour dbus (dbus libdbus-1-3) --- dbus (1.8.22-0+deb8u1) jessie; urgency=medium * New upstream bugfix release - fix a potential format string vulnerability, which is not believed to be exploitable in practice * dbus.prerm: ensure that dbus.socket is stopped before removal, so that a new connection to the bus won't cause dbus.service to be restarted (Closes: #813970) -- Simon McVittie <smcv(a)debian.org> Mon, 10 Oct 2016 11:42:50 +0100 --- Modifications pour file (file libmagic1) --- file (1:5.22+15-2+deb8u3) stable; urgency=medium * Fix memory leak in magic loader. Closes: #840754 -- Christoph Biedl <debian.axhn(a)manchmal.in-ulm.de> Sun, 04 Dec 2016 10:00:07 +0100 --- Modifications pour glibc (libc6 libc6-dev libc-bin libc-dev-bin locales multiarch-support nscd) --- glibc (2.19-18+deb8u7) stable; urgency=medium [ Aurelien Jarno ] * Update from upstream stable branch: - Do not unconditionally use the fsqrt instruction on 64-bit PowerPC CPUs. Closes: #843904. * debian/patches/any/cvs-hesiod-resolver.diff: patch from upstream to fix a regression introduced by cvs-resolv-ipv6-nameservers.diff in hesiod. Closes: #821358. * debian/sysdeps/{amd64,i386,x32}.mk: disable lock elision (aka Intel TSX) on x86 architectures. This causes programs (wrongly) unlocking an already unlocked mutex to abort. More importantly most of the other distributions decided to disable it, so we don't want to be the only distribution left testing this code path. -- Aurelien Jarno <aurel32(a)debian.org> Thu, 24 Nov 2016 23:48:11 +0100 --- Modifications pour gnutls28 (libgnutls-deb0-28 libgnutls-openssl27 libgnutlsxx28) --- gnutls28 (3.3.8-6+deb8u4) jessie; urgency=medium [ Salvatore Bonaccorso ] * CVE-2016-7444: Incorrect certificate validation when using OCSP responses (GNUTLS-SA-2016-3). See #840191. [ Andreas Metzler ] * Cherry pick 53_nettle-use-rsa_-_key_prepare-on-key-import.patch from upstream GIT, which should allow gnutls continue to work with CVE-2016-6489-patched nettle. See #832983. -- Andreas Metzler <ametzler(a)debian.org> Sun, 30 Oct 2016 07:39:08 +0100 --- Modifications pour libfcgi-perl --- libfcgi-perl (0.77-1+deb8u1) jessie; urgency=medium * Team upload. * CVE-2012-6687: numerous connections cause segfault DoS (Closes: #815840) -- Salvatore Bonaccorso <carnil(a)debian.org> Tue, 27 Dec 2016 08:06:30 +0100 --- Modifications pour libio-socket-ssl-perl --- libio-socket-ssl-perl (2.002-2+deb8u2) jessie; urgency=medium * Add 0001-remove-r-for-checking-SSL_-cert-key-_file-since-this.patch. Removes the -r check for for checking SSL_{cert,key}_file since this will an usable error later anyway. Addresses "Cannot use SSL_key_file with ACL permissions". Thanks to Michael Braun and Steffen Ullrich. (Closes: #839576) -- Salvatore Bonaccorso <carnil(a)debian.org> Sat, 08 Oct 2016 17:26:51 +0200 --- Modifications pour libpng (libpng12-0) --- libpng (1.2.50-2+deb8u3) jessie; urgency=medium * debian/patches/CVE-2016-10087.patch: - cherry-pick upstream fix for CVE-2016-10087 -- Gianfranco Costamagna <locutusofborg(a)debian.org> Mon, 02 Jan 2017 18:21:33 +0100 --- Modifications pour libwmf (libwmf0.2-7) --- libwmf (0.2.8.4-10.3+deb8u2) stable; urgency=medium * LTS Team upload. * Fix allocating huge block of memory (CVE-2016-9011) (Closes: #842090) -- Balint Reczey <balint(a)balintreczey.hu> Wed, 02 Nov 2016 12:56:21 +0100 --- Modifications pour linux (linux-image-3.16.0-4-amd64 linux-libc-dev) --- linux (3.16.39-1) jessie; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.37 - [x86] iommu/vt-d: Ratelimit fault handler - xfs: disallow rw remount on fs with unknown ro-compat features - Bluetooth: vhci: fix open_timeout vs. hdev race - [x86] drm/i915: Prevent machine death on Ivybridge context switching - scsi: Add intermediate STARGET_REMOVE state to scsi_target_state (Closes: #834513) - Revert "scsi: fix soft lockup in scsi_remove_target() on module removal" - Bluetooth: vhci: Fix race at creating hci device - EDAC: Increment correct counter in edac_inc_ue_error() - ext4: fix data exposure after a crash - [armhf] crypto: s5p-sss - Fix missed interrupts when working with 8 kB blocks - [armhf] crypto: s5p-sss - fix incorrect usage of scatterlists api - btrfs: bugfix: handle FS_IOC32_{GETFLAGS,SETFLAGS,GETVERSION} in btrfs_ioctl - [arm*] KVM: Enforce Break-Before-Make on Stage-2 page tables - aacraid: Relinquish CPU during timeout wait - aacraid: Fix for aac_command_thread hang - ext4: fix hang when processing corrupted orphaned inode list - ext4: clean up error handling when orphan list is corrupted - Revert "tty: Fix pty master poll() after slave closes v2" - Fix OpenSSH pty regression on close - cpufreq: Fix GOV_LIMITS handling for the userspace governor - ACPI / sysfs: fix error code in get_status() - ext4: fix oops on corrupted filesystem - [arm64] Ensure pmd_present() returns false after pmd_mknotpresent() - [armhf] dts: exynos: Add interrupt line to MAX8997 PMIC on exynos4210-trats - [mips*] Fix siginfo.h to use strict posix types - USB: serial: keyspan,muxport,quatech2: fix use-after-free in probe error path - irqchip/gic: Ensure ordering between read of INTACK and shared data - [powerpc*] mm/hash64: Fix subpage protection with 4K HPTE config - rtlwifi: Fix logic error in enter/exit power-save mode - sched/loadavg: Fix loadavg artifacts on fully idle and on fully loaded systems - [mips*] Fix race condition in lazy cache flushing. - ring-buffer: Use long for nr_pages to avoid overflow failures - ring-buffer: Prevent overflow of size in ring_buffer_resize() - RDMA/iw_cxgb4: Always wake up waiter in c4iw_peer_abort_intr() - IB/core: Fix a potential array overrun in CMA and SA agent - i40e: fix an uninitialized variable bug - mmc: mmc: Fix partition switch timeout for some eMMCs - net/mlx4_core: Fix access to uninitialized index - [x86] PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs - PCI: Disable all BAR sizing for devices with non-compliant BARs - netlink: Fix dump skb leak/double free (CVE-2016-9806) - sched/preempt: Fix preempt_count manipulations - fs/cifs: correctly do anonymous authentication - fs/cifs: remove directory incorrectly tries to set delete on close on non-empty directories - sunrpc: Update RPCBIND_MAXNETIDLEN - cpuidle: Fix cpuidle_state_is_coupled() argument in cpuidle_enter() - batman-adv: fix skb deref after free - batman-adv: Fix unexpected free of bcast_own on add_if error - batman-adv: Fix integer overflow in batadv_iv_ogm_calc_tq - xfs: xfs_iflush_cluster fails to abort on error - xfs: fix inode validity check in xfs_iflush_cluster - xfs: skip stale inodes in xfs_iflush_cluster - crypto: public_key: select CRYPTO_AKCIPHER - net: ehea: avoid null pointer dereference - cifs: Create dedicated keyring for spnego operations - Input: uinput - handle compat ioctl for UI_SET_PHYS - PM / sleep: Handle failures in device_suspend_late() consistently - tuntap: correctly wake up process during uninit - scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands - [x86] drm/i915: Don't leave old junk in ilk active watermarks on readout - mmc: longer timeout for long read time quirk - sunrpc: fix stripping of padded MIC tokens - wait/ptrace: assume __WALL if the child is traced - xen/events: Don't move disabled irqs - UBI: do propagate positive error codes up - UBI: fix missing brace control flow - UBI: Fix static volume checks when Fastmap is used - RDMA/cxgb3: device driver frees DMA memory with different size - [x86] ALSA: hda - Fix headset mic detection problem for one Dell machine - [x86] crypto: ccp - Fix AES XTS error for request sizes above 4096 - sfc: on MC reset, clear PIO buffer linkage in TXQs - Input: xpad - prevent spurious input from wired Xbox 360 controllers - Input: pwm-beeper - remove useless call to pwm_config() - Input: pwm-beeper - fix - scheduling while atomic - [mips*] fix read_msa_* & write_msa_* functions on non-MSA toolchains - hpfs: fix remount failure when there are no options changed - hpfs: implement the show_options method - [powerpc*] pseries/eeh: Handle RTAS delay requests in configure_bridge - [powerpc*] Fix definition of SIAR and SDAR registers - [powerpc*] Use privileged SPR number for MMCR2 - mac80211_hwsim: Add missing check for HWSIM_ATTR_SIGNAL - mac80211: mesh: flush mesh paths unconditionally - [arm64] Provide "model name" in /proc/cpuinfo for PER_LINUX32 tasks - scsi: Add QEMU CD-ROM to VPD Inquiry Blacklist - ACPI / processor: Avoid reserving IO regions too early - drm/nouveau/fbcon: fix out-of-bounds memory accesses - [armel,armhf] fix PTRACE_SETVFPREGS on SMP systems - KVM: irqfd: fix NULL pointer dereference in kvm_irq_map_gsi - [x86] KVM: fix OOPS after invalid KVM_SET_DEBUGREGS - ALSA: hda - Fix headset mic detection problem for Dell machine - [powerpc*] pseries: Fix PCI config address for DDW - mnt: fs_fully_visible test the proper mount for MNT_LOCKED - IB/IPoIB: Fix race between ipoib_remove_one to sysfs functions - IB/mlx5: Return PORT_ERR in Active to Initializing tranisition - IB/mlx5: Fix returned values of query QP - IB/IPoIB: Don't update neigh validity for unresolved entries - tcp: record TLP and ER timer stats in v6 stats - of: fix autoloading due to broken modalias with no 'compatible' - [x86] cpufreq: intel_pstate: Fix ->set_policy() interface for no_turbo - fs: fix d_walk()/non-delayed __d_free() race - net/mlx5: Fix the size of modify QP mailbox - net/mlx5: Fix masking of reserved bits in XRCD number - uvc: Forward compat ioctls to their handlers directly - [armhf] mfd: omap-usb-tll: Fix scheduling while atomic BUG - [armhf] usb: dwc3: exynos: Fix deferred probing storm. - usb: f_fs: off by one bug in _ffs_func_bind() - usb: gadget: fix spinlock dead lock in gadgetfs - usb: gadget: avoid exposing kernel stack - HID: elo: kill not flush the work - usb: xhci-plat: properly handle probe deferral for devm_clk_get() - USB: quirks: Fix entries on wrong list in 3.16.y - [armhf] usb: musb: Ensure rx reinit occurs for shared_fifo endpoints - [armhf] usb: musb: Stop bulk endpoint while queue is rotated - iio: Fix error handling in iio_trigger_attach_poll_func - scsi: fix race between simultaneous decrements of ->host_failed - [armel,armhf] 8578/1: mm: ensure pmd_present only checks the valid bit - [armel,armhf] 8579/1: mm: Fix definition of pmd_mknotpresent - drm/radeon: fix asic initialization for virtualized environments - [armhf] spi: sun4i: fix FIFO limit - [armhf] spi: sunxi: fix transfer timeout - [x86] kprobes: Clear TF bit in fault on single-stepping - kernel/sysrq, watchdog, sched/core: Reset watchdog on all CPUs while processing sysrq-w - ipv6: fix endianness error in icmpv6_err - net_sched: introduce qdisc_replace() helper - net_sched: update hierarchical backlog too - netem: fix a use after free - net_sched: fix pfifo_head_drop behavior vs backlog - [x86] drm/i915/ilk: Don't disable SSC source if it's in use - base: make module_create_drivers_dir race-free - kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES - [armhf] memory: omap-gpmc: Fix omap gpmc EXTRADELAY timing - IB/mlx4: Properly initialize GRH TClass and FlowLabel in AHs - isa: Call isa_bus_init before dependent ISA bus drivers register - [x86] hwmon: (dell-smm) Restrict fan control and serial number to CAP_SYS_ADMIN by default - tracing: Handle NULL formats in hold_module_trace_bprintk_format() - [arm64] mm: remove page_mapping check in __sync_icache_dcache - pinctrl: single: Fix missing flush of posted write for a wakeirq - net/mlx4_en: Fix the return value of a failure in VLAN VID add/kill - ubi: Make recover_peb power cut aware - mm: Export migrate_page_move_mapping and migrate_page_copy - UBIFS: Implement ->migratepage() - [ppc64el] bpf/jit: Disable classic BPF JIT on ppc64le - can: fix oops caused by wrong rtnl dellink usage - xen/pciback: Fix conf_space read/write overlap check. - IB/mlx5: Fix post send fence logic - IB/mlx4: Fix the SQ size of an RC QP - IB/mlx4: Fix error flow when sending mads under SRIOV - IB/mlx4: Verify port number in flow steering create flow - IB/mlx4: Fix memory leak if QP creation failed - Input: wacom_w8001 - w8001_MAX_LENGTH should be 13 - cifs: use CIFS_MAX_DOMAINNAME_LEN when converting the domain name - cifs: dynamic allocation of ntlmssp blob - ALSA: dummy: Fix a use-after-free at closing - cifs: Fix reconnect to not defer smb3 session reconnect long after socket reconnect - tmpfs: don't undo fallocate past its last page - fs/nilfs2: fix potential underflow in call to crc32_le - staging: iio: accel: fix error check - [armhf,arm64] KVM: Stop leaking vcpu pid references - make nfs_atomic_open() call d_drop() on all ->open_context() errors. - USB: don't free bandwidth_mutex too early - ALSA: echoaudio: Fix memory allocation - [s390x] fix test_fp_ctl inline assembly contraints - net: bgmac: Start transmit queue in bgmac_open - net: bgmac: Remove superflous netif_carrier_on() - mac80211: Fix mesh estab_plinks counting in STA removal case - Bridge: Fix ipv6 mc snooping if bridge has no ipv6 address - NFS: Fix another OPEN_DOWNGRADE bug - ipr: Clear interrupt on croc/crocodile when running with LSI - [powerpc*] tm: Avoid SLB faults in treclaim/trecheckpoint when RI=0 - net: phy: Manage fixed PHY address space using IDA - batman-adv: Fix memory leak on tt add with invalid vlan - batman-adv: replace WARN with rate limited output on non-existing VLAN - batman-adv: Fix use-after-free/double-free of tt_req_node - batman-adv: Fix ICMP RR ethernet access after skb_linearize - batman-adv: Clean up untagged vlan when destroying via rtnl-link - qlcnic: use the correct ring in qlcnic_83xx_process_rcv_ring_diag() - ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift() - [amd64] power: Fix kernel text mapping corruption during image restoration - [x86] amd_nb: Fix boot crash on non-AMD systems - bonding: prevent out of bound accesses - net/mlx5: Fix potential deadlock in command mode change - net/mlx5: Add timeout handle to commands with callback - block: fix use-after-free in sys_ioprio_get() (CVE-2016-7911) - ALSA: timer: Fix negative queue usage by racy accesses - qeth: delete napi struct when removing a qeth device - xenbus: don't bail early from xenbus_dev_request_and_reply() - ecryptfs: don't allow mmap when the lower fs doesn't support it - tmpfs: fix regression hang in fallocate undo - fs: limit filesystem stacking depth - proc: prevent stacking filesystems on top - [powerpc*] KVM: Book3S HV: Pull out TM state save/restore into separate procedures - [powerpc*] KVM: Book3S HV: Save/restore TM state in H_CEDE (CVE-2016-5412) https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.38 https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.39 - HID: uhid: fix timeout when probe races with IO - macvlan: Fix potential use-after free for broadcasts - netlabel: add address family checks to netlbl_{sock,req}_delattr() - em28xx-i2c: rt_mutex_trylock() returns zero on failure - PCI: Mark Atheros AR9485 and QCA9882 to avoid bus reset - [armhf] gpio: pca953x: Fix NBANK calculation for PCA9536 - random: print a warning for the first ten uninitialized random users - [x86] random: add interrupt callback to VMBus IRQ handler - sched/cputime: Fix prev steal time accouting during CPU hotplug - [armel/kirkwood,armhf] mvebu: fix HW I/O coherency related deadlocks - [armhf] usb: dwc3: fix for the isoc transfer EP_BUSY flag - crypto: gcm - Filter out async ghash if necessary - IB/mlx5: Fix MODIFY_QP command input structure - drm/nouveau: Don't leak runtime pm ref on driver unload - drm/radeon: Don't leak runtime pm ref on driver unload - drm/radeon: Don't leak runtime pm ref on driver load - tty/serial: atmel: fix RS485 half duplex with DMA - [armhf] serial: samsung: Fix ERR pointer dereference on deferred probe - [armhf] hwrng: omap - Fix assumption that runtime_get_sync will always succeed - hp-wmi: Fix wifi cannot be hard-unblocked - Input: xpad - validate USB endpoint count during probe - ath9k: Fix programming of minCCA power threshold - ext4: check for extents that wrap around - ext4: fix deadlock during page writeback - ext4: don't call ext4_should_journal_data() on the journal inode - batman-adv: Avoid nullptr dereference in bla after vlan_insert_tag - batman-adv: Avoid nullptr dereference in dat after vlan_insert_tag - batman-adv: Fix orig_node_vlan leak on orig_node_release - batman-adv: lock crc access in bridge loop avoidance - batman-adv: Fix non-atomic bla_claim::backbone_gw access - batman-adv: Fix reference leak in batadv_find_router - batman-adv: Free last_bonding_candidate on release of orig_node - ext4: validate s_reserved_gdt_blocks on mount - iwlwifi: pcie: fix access to scratch buffer - [mips*] Fix page table corruption on THP permission changes. - batman-adv: Fix speedy join in gateway client mode - drm/radeon: add a delay after ATPX dGPU power off - drm/radeon: Poll for both connect/disconnect on analog connectors - ALSA: ctl: Stop notification after disconnection - ALSA: pcm: Free chmap at PCM free callback, too - [armhf] net: mvneta: set real interrupt per packet for tx_done - ppp: defer netns reference release for ppp channel - rtc: ds1307: Fix relying on reset value for weekday - ngene: properly handle __user ptr - media: dvb_ringbuffer: Add memory barriers - [x86] quirks: Apply nvidia_bugs quirk only on root bus - [x86] quirks: Reintroduce scanning of secondary buses - [x86] quirks: Add early quirk to reset Apple AirPort card - posix_cpu_timer: Exit early when process has been reaped - ALSA: hda - fix use-after-free after module unload - svc: Avoid garbage replies when pc_func() returns rpc_drop_reply - NFS: Don't drop CB requests with invalid principals - qxl: check for kmap failures - cifs: Check for existing directory when opening file with O_CREAT - net: ethoc: Fix early error paths - [s390x] mm: fix gmap tlb flush issues - [armel,armhf] 8561/3: dma-mapping: Don't use outer_flush_range when the L2C is coherent - [x86] KVM: nVMX: fix lifetime issues for vmcs02 - [x86] KVM: nVMX: Fix memory corruption when using VMCS shadowing - ext4: fix reference counting bug on block allocation error - ext4: short-cut orphan cleanup on error - [powerpc*] tm: Fix stack pointer corruption in __tm_recheckpoint() - Bluetooth: Fix l2cap_sock_setsockopt() with optname BT_RCVMTU - xfrm: fix crash in XFRM_MSG_GETSA netlink handler - crypto: scatterwalk - Fix test in scatterwalk_done - mmc: block: fix packed command header endianness - crypto: nx - off by one bug in nx_of_update_msc() - tpm: read burstcount from TPM_STS in one 32-bit transaction - [arm64] debug: unmask PSTATE.D earlier - brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain - brcmsmac: Free packet if dma_mapping_error() fails in dma_rxfill - brcmsmac: Initialize power in brcms_c_stf_ss_algo_channel_get() - mtd: nand: fix bug writing 1 byte less than page size - target: Fix missing complete during ABORT_TASK + CMD_T_FABRIC_STOP - target: Fix race between iscsi-target connection shutdown + ABORT_TASK - target: Fix max_unmap_lba_count calc overflow - cifs: fix crash due to race in hmac(md5) handling - hwmon: (adt7411) set bit 3 in CFG1 register - iscsi-target: Fix panic when adding second TCP connection to iSCSI session - tty/vt/keyboard: fix OOB access in do_compute_shiftstate() - [mips*] bpf: fix off-by-one in ctx offset allocation - libceph: set 'exists' flag for newly up osd - libceph: apply new_state before new_up_client on incrementals - [x86] gpio: intel-mid: Remove potentially harmful code - nfs: don't create zero-length requests - radix-tree: fix radix_tree_iter_retry() for tagged iterators. - pps: do not crash when failed to register - [armhf] OMAP3: hwmod data: Add sysc information for DSI - net/irda: fix NULL pointer dereference on memory allocation failure - l2tp: Correctly return -EBADF from pppol2tp_getname. - ceph: Correctly return NXIO errors from ceph_llseek - CIFS: Fix a possible invalid memory access in smb2_query_symlink() - [mips*] KEYS: 64-bit MIPS needs to use compat_sys_keyctl for 32-bit userspace - drm/radeon: fix firmware info version checks - fuse: fsync() did not return IO errors - fuse: fuse_flush must check mapping->flags for errors - fuse: fix wrong assignment of ->flags in fuse_send_init() - ubi: Fix race condition between ubi device creation and udev - ubi: Make volume resize power cut aware - ubi: Be more paranoid while seaching for the most recent Fastmap - drm/nouveau/fbcon: fix font width not divisible by 8 - drm/nouveau/acpi: ensure matching ACPI handle and supported functions - drm/nouveau/acpi: check for function 0x1B before using it - tcp: consider recv buf for the initial window scale - ext4: validate that metadata blocks do not overlap superblock - ALSA: hda - On-board speaker fixup on ACER Veriton - [amd64] syscalls: Add compat_sys_keyctl for 32-bit userspace - balloon: check the number of available pages in leak balloon - dm flakey: error READ bios during the down_interval - mm/hugetlb: avoid soft lockup in set_max_huge_pages() - sysv, ipc: fix security-layer leaking - ALSA: hda: Fix krealloc() with __GFP_ZERO usage - block: fix use-after-free in seq file (CVE-2016-7910) - mac80211: fix purging multicast PS buffer queue - SUNRPC: allow for upcalls for same uid but different gss service - USB: serial: fix memleak in driver-registration error path - vfio/pci: Fix NULL pointer oops in error interrupt setup handling - [x86] drm/edid: Add 6 bpc quirk for display AEO model 0. - [x86] drm/i915/dp: Revert "drm/i915/dp: fall back to 18 bpp when sink capability is unknown" - [powerpc*] powernv: Fix MCE handler to avoid trashing CR0/CR1 registers. - netfilter: nf_ct_expect: remove the redundant slash when policy name is empty - netfilter: nfnetlink_queue: reject verdict request from different portid - [powerpc*] book3s: Fix MCE console messages for unrecoverable MCE. - USB: validate wMaxPacketValue entries in endpoint descriptors - cpuset: make sure new tasks conform to the current config of the cpuset - [s390x] dasd: fix hanging device after clear subchannel - [armhf] usb: dwc3: gadget: increment request->actual once - [x86] mm: Disable preemption during CR3 read+write - megaraid_sas: Fix probing cards without io port - PM / hibernate: Restore processor state before using per-CPU variables - ipv6: suppress sparse warnings in IP6_ECN_set_ce() - USB: serial: mos7720: fix non-atomic allocation in write path - USB: serial: mos7840: fix non-atomic allocation in write path - cdc-acm: fix wrong pipe type on rx interrupt xfers - scsi: fix upper bounds check of sense key in scsi_sense_key_string() - xhci: always handle "Command Ring Stopped" events - usb: xhci: Fix panic if disconnect - xhci: don't dereference a xhci member after removing xhci - [x86] KVM: nVMX: postpone VMCS changes on MSR_IA32_APICBASE write - bcache: register_bcache(): call blkdev_put() when cache_alloc() fails - bcache: RESERVE_PRIO is too small by one when prio_buckets() is a power of two. - drm/radeon: fix radeon_move_blit on 32bit systems - net/mlx5: Added missing check of msg length in verifying its signature - [x86] staging: comedi: daqboard2000: bug fix board type matching code - [x86] staging: comedi: ni_mio_common: fix AO inttrig backwards compatibility - [armhf] iio: adc: ti_am335x_adc: Protect FIFO1 from concurrent access - [powerpc*] pseries: use pci_host_bridge.release_fn() to kfree(phb) - [powerpc*] prom: Fix sub-processor option passed to ibm, client-architecture-support - drm: Reject page_flip for !DRIVER_MODESET - USB: fix typo in wMaxPacketSize validation - USB: avoid left shift by -1 - ubifs: Fix assertion in layout_in_gaps() - tun: fix transmit timestamp support - timekeeping: Cap array access in timekeeping_debug - [x86] apic: Do not init irq remapping if ioapic is disabled - usb: gadget: udc: core: don't starve DMA resources - qdisc: fix a module refcount leak in qdisc_create_dflt() - [armel/kirkwood] ib62x0: fix size of u-boot environment partition - batman-adv: Add missing refcnt for last_candidate - [armhf] clocksource/drivers/sun4i: Clear interrupts after stopping timer in probe function - printk: fix parsing of "brl=" option - fs/seq_file: fix out-of-bounds read - [powerpc*] powernv : Drop reference added by kset_find_obj() - ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE - ALSA: timer: fix NULL pointer dereference on memory allocation failure - NFSv4.x: Fix a refcount leak in nfs_callback_up_net - dm crypt: fix free of bad values after tfm allocation failure - kernfs: don't depend on d_find_any_alias() when generating notifications - ALSA: fireworks: accessing to user space outside spinlock - ipv6: add missing netconf notif when 'all' is updated - tcp: fastopen: fix rcv_wup initialization for TFO server on SYN/data - kernel/fork: fix CLONE_CHILD_CLEARTID regression in nscd - ALSA: timer: fix NULL pointer dereference in read()/ioctl() race - [x86] paravirt: Do not trace _paravirt_ident_*() functions - IB/core: Fix use after free in send_leave function - IB/ipoib: Fix memory corruption in ipoib cm mode connect flow - [x86] AMD: Apply erratum 665 on machines without a BIOS fix - l2tp: fix use-after-free during module unload - iio: fix pressure data output unit in hid-sensor-attributes - sched/core: Fix a race between try_to_wake_up() and a woken up task - [x86] efi/libstub: Allocate headspace in efi_get_memory_map() - iio:core: fix IIO_VAL_FRACTIONAL sign handling - Btrfs: add missing blk_finish_plug in btrfs_sync_log() - Btrfs: remove root_log_ctx from ctx list before btrfs_sync_log returns - ipv6: addrconf: fix dev refcont leak when DAD failed - crypto: cryptd - initialize child shash_desc on import - ALSA: timer: Fix zero-division by continue of uninitialized instance - ALSA: rawmidi: Fix possible deadlock with virmidi registration - xfrm_user: propagate sec ctx allocation errors - [armhf,arm64] kvm-arm: Unmap shadow pagetables properly - [arm64] spinlocks: implement smp_mb__before_spinlock() as smp_mb() - asm-generic: make copy_from_user() zero the destination properly - NFSv4.1: Fix the CREATE_SESSION slot number accounting - crypto: skcipher - Fix blkcipher walk OOM crash - [arm64] crypto: aes-ctr - fix NULL dereference in tail processing - nl80211: validate number of probe response CSA counters - asm-generic: make get_user() clear the destination on errors - [mips*] copy_from_user() must zero the destination on access_ok() failure - [powerpc] ppc32: fix copy_from_user() - [s390x] get_user() should zero on failure - [x86] perf/amd: Make HW_CACHE_REFERENCES and HW_CACHE_MISSES measure L2 - USB: change bInterval default to 10 ms - IB/ipoib: Don't allow MC joins during light MC flush - IB/mlx4: Fix incorrect MC join state bit-masking on SR-IOV - IB/mlx4: Fix code indentation in QP1 MAD flow - IB/mlx4: Use correct subnet-prefix in QP1 mads under SR-IOV - irda: Free skb on irda_accept error path. - xfrm: Fix memory leak of aead algorithm name - ocfs2/dlm: fix race between convert and migration - fsnotify: add a way to stop queueing events on group shutdown - ocfs2: fix start offset to ocfs2_zero_range_for_truncate() - fix fault_in_multipages_...() on architectures with no-op access_ok() - [x86] i2c-eg20t: fix race between i2c init and interrupt enable - btrfs: ensure that file descriptor used with subvol ioctls is a dir - can: dev: fix deadlock reported after bus-off - ip6_gre: Set flowi6_proto as IPPROTO_GRE in xmit path. - ip6_gre: fix flowi6_proto value in ip6gre_xmit_other() - tracing: Move mutex to protect against resetting of seq data - ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route - drm/radeon/si/dpm: add workaround for for Jet parts - mm,ksm: fix endless looping in allocating memory when ksm enable - [armel,armhf] 8617/1: dma: fix dma_max_pfn() - [mips*/5kc-malta] Fix IOCU disable switch read for MIPS64 - mm: workingset: fix crash in shadow node shrinker caused by replace_page_cache_page() - [armhf] 8618/1: decompressor: reset ttbcr fields to use TTBR0 on ARMv7 - [arm64] perf: reject groups spanning multiple HW PMUs (CVE-2015-8955) - firewire: net: guard against rx buffer overflows (CVE-2016-8633) - brcmfmac: avoid potential stack overflow in brcmf_cfg80211_start_ap() (CVE-2016-8658) - vfio/pci: Fix integer overflows, bitmask check (CVE-2016-9083, CVE-2016-9084) - fs: Give dentry to inode_change_ok() instead of inode - fs: Avoid premature clearing of capabilities (CVE-2015-1350) (Closes: #770492) - posix_acl: Clear SGID bit when setting file permissions (CVE-2016-7097) - staging: comedi: ni_mio_common: fix wrong insn_write handler - xenbus: don't BUG() on user mode induced condition - xenbus: don't look up transaction IDs for ordinary writes - compiler-gcc: disable -ftracer for __noclone functions - PM / devfreq: Fix incorrect type issue. - mm: filemap: don't plant shadow entries without radix tree node [ Aurelien Jarno ] * [mips*] Fix ptrace handling of any syscalls returning ENOSYS. [ Salvatore Bonaccorso ] * [x86] KVM: pass host_initiated to functions that read MSRs * [x86] KVM: VMX: Fix host initiated access to guest MSR_TSC_AUX (Closes: #838660) [ Ben Hutchings ] * [x86] video: Disable X86_SYSFB, FB_SIMPLE (Closes: #822575) * Revert "ecryptfs: forbid opening files without mmap handler", redundant with upstream fixes * fs: Move procfs/ecryptfs stacking check into ecryptfs, to avoid ABI change * [mips*] Fix ABI change in 3.16.37 * net/sched: Fix ABI change in 3.16.37 * SCSI: Fix ABI change in 3.16.37 * ubi: Avoid ABI change in 3.16.37 * i8042: Revert ABI break in 3.16.39 * fs: Fix ABI change in 3.16.39 * can: Ignore ABI change in 3.16.39 * [mips*] uaccess: Avoid ABI change in 3.16.39 * [arm64] Revert "arm64: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO" to avoid ABI change * [s390x] Revert "s390: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO" to avoid ABI change * Revert "block: fix bdi vs gendisk lifetime mismatch" to avoid ABI change * fsnotify: Ignore ABI change in 3.16.39 * Fix backport of "fs: Give dentry to inode_change_ok() instead of inode" in fuse, xfs * sg: Fix double-free when drives detach during SG_IO (CVE-2015-8962) * perf: Fix race in swevent hash (CVE-2015-8963) * tty: Prevent ldisc drivers from re-using stale tty fields (CVE-2015-8964) * usb: gadget: f_fs: Fix use-after-free (CVE-2016-7912) * HID: core: prevent out-of-bound readings (CVE-2016-7915) * netfilter: nfnetlink: correctly validate length of batch messages (CVE-2016-7917) * net: ping: check minimum size on ICMP header length (CVE-2016-8399) * net: Add __sock_queue_rcv_skb() * rose,dccp: limit sk_filter trim to payload * tcp: take care of truncations done by sk_filter() (CVE-2016-8645) * mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] (CVE-2016-8650) * packet: fix race condition in packet_set_ring (CVE-2016-8655) * [x86] Fix potential infoleak in older kernels (CVE-2016-9178) * sctp: validate chunk len before actually using it (CVE-2016-9555) * sg_write()/bsg_write() is not fit to be called under KERNEL_DS (CVE-2016-9576, CVE-2016-10088) * [x86] KVM: drop error recovery in em_jmp_far and em_ret_far (CVE-2016-9756) * net: avoid signed overflows for SO_{SND|RCV}BUFFORCE (CVE-2016-9793) * ALSA: pcm : Call kill_fasync() in stream lock (CVE-2016-9794) * security,perf: Allow unprivileged use of perf_event_open to be disabled (sysctl: kernel.perf_event_paranoid=3) * spi-nor: Add support for n25q256a11 SPI flash device (Closes: #843650) (thanks to Matt Sickler) * xen-blkfront: fix accounting of reqs when migrating (Closes: #843715) [ Julien Cristau ] * hwrng: Add chaoskey driver, backported from 4.8 (Closes: #839616) -- Ben Hutchings <ben(a)decadent.org.uk> Fri, 30 Dec 2016 19:42:20 +0000 --- Modifications pour mdadm --- mdadm (3.3.2-5+deb8u2) jessie; urgency=medium * Non-maintainer upload. * fix-grow-continue.patch: Port upstream fix to let '--grow --continue' successfully reshape an array when using backup space on a 'spare' device. (Closes: #840743) -- Jens Sauer <jsauer65(a)gmail.com> Wed, 09 Nov 2016 00:43:48 +0100 --- Modifications pour nettle (libhogweed2 libnettle4 nettle-dev) --- nettle (2.7.1-5+deb8u2) stable; urgency=medium * [SECURITY] cve-2016-6489.patch: Protect against potential side-channel attacks against exponentiation operations as described in CVE-2016-6489 "RSA code is vulnerable to cache sharing related attacks" (Closes: #832983). -- Magnus Holmgren <holmgren(a)debian.org> Sat, 05 Nov 2016 17:37:13 +0100 --- Modifications pour nss-pam-ldapd (libnss-ldapd libpam-ldapd nslcd nslcd-utils) --- nss-pam-ldapd (0.9.4-3+deb8u2) jessie; urgency=medium * Non-maintainer upload. * have init script stop action only return when nslcd has actually stopped (Closes: #814881) -- Salvatore Bonaccorso <carnil(a)debian.org> Wed, 09 Nov 2016 13:48:14 +0100 --- Modifications pour opendkim (libopendkim9 librbl1 libvbr2 opendkim opendkim-tools) --- opendkim (2.9.2-2+deb8u1) stable; urgency=medium * Fix relaxed canonicalization of folded headers breaks signatures, fix backported from upstream 2.11.0 (Closes: #840015) -- Scott Kitterman <scott(a)kitterman.com> Sat, 29 Oct 2016 16:41:59 -0400 --- Modifications pour pam (libpam0g libpam-modules libpam-modules-bin libpam-runtime) --- pam (1.1.8-3.1+deb8u2) jessie; urgency=medium * Non-maintainer upload. * debian/patches-applied/pam-loginuid-in-containers: Updated with the version from Ubuntu, this should fix logins in containers (Closes: #726661) -- Evgeni Golov <evgeni(a)debian.org> Sat, 12 Nov 2016 08:38:19 +0100 --- Modifications pour postgresql-9.4 (libpq5) --- postgresql-9.4 (9.4.10-0+deb8u1) jessie; urgency=medium * New upstream version. If your installation has been affected by the bug described in the first changelog entry below, then after updating you may need to take action to repair corrupted free space maps. + Fix WAL-logging of truncation of relation free space maps and visibility maps (Pavan Deolasee, Heikki Linnakangas) It was possible for these files to not be correctly restored during crash recovery, or to be written incorrectly on a standby server. Bogus entries in a free space map could lead to attempts to access pages that have been truncated away from the relation itself, typically producing errors like could not read block XXX: read only 0 of 8192 bytes. Checksum failures in the visibility map are also possible, if checksumming is enabled. Procedures for determining whether there is a problem and repairing it if so are discussed at https://wiki.postgresql.org/wiki/Free_Space_Map_Problems. -- Christoph Berg <christoph.berg(a)credativ.de> Wed, 16 Nov 2016 15:39:27 +0100 --- Modifications pour sed --- sed (4.2.2-4+deb8u1) stable; urgency=medium [ Jérémy Bobbio ] * Ensure consistent permissions with different umasks. closes: #774347, #835516. -- Clint Adams <clint(a)debian.org> Fri, 09 Sep 2016 18:07:57 -0400 --- Modifications pour systemd (libpam-systemd libsystemd0 libudev1 systemd systemd-sysv udev) --- systemd (215-17+deb8u6) stable; urgency=medium [ Michael Biebl ] * Don't return any error in manager_dispatch_notify_fd(). If manager_dispatch_notify_fd() fails and returns an error then the handling of service notifications will be disabled entirely leading to a compromised system. For example pid1 won't be able to receive the WATCHDOG messages anymore and will kill all services supposed to send such messages. (CVE-2016-7796) (Closes: #839607) * core: Rework logic to determine when we decide to add automatic deps for mounts. This adds a concept of "extrinsic" mounts. If mounts are extrinsic we consider them managed by something else and do not add automatic ordering against umount.target, local-fs.target, remote-fs.target. Extrinsic mounts include API mounts such as everything below /proc, /sys, /dev. This avoids a crash in LXC containers where /dev/urandom is a bind mount from the host system and unmounting it leads to an assert in systemd. (Closes: #818978) * Various ordering fixes for ifupdown. Run ifup after all kernel modules have been loaded and all sysctl settings are applied. Update ifup@.service to add missing After= for the device unit we bind to. This ensures that the device unit is active when systemd tries to start the service. (Closes: #819314) * systemctl: Fix argument handling when invoked as shutdown. (Closes: #776997) [ Simon McVittie ] * localed: tolerate absence of /etc/default/keyboard. The debian-specific patch to read Debian config files was not tolerating the absence of /etc/default/keyboard. This causes systemd-localed to fail to start on systems where that file isn't populated (like embedded systems without keyboards). (Closes: #833849) [ Martin Pitt ] * systemctl, loginctl, etc.: Don't start polkit agent when running as root. (Closes: #774153, LP: #1565617) -- Michael Biebl <biebl(a)debian.org> Wed, 21 Dec 2016 21:33:51 +0100 --- Modifications pour w3m --- w3m (0.5.3-19+deb8u1) jessie; urgency=medium * New patch 901_ucsmap.patch to fix array index (closes: #820162) * New patch 902_johab1.patch to fix array index (closes: #820373) * New patch 903_input-type.patch to fix null deref [CVE-2016-9430] * New patch 904_form-update.patch to fix overflow [CVE-2016-9423] [CVE-2016-9431] * New patch 905_textarea.patch to fix heap write [CVE-2016-9424] * New patch 906_form-update.patch to fix bcopy size [CVE-2016-9432] * New patch 907_iso2022.patch to fix array index [CVE-2016-9433] * New patch 908_forms.patch to fix null deref [CVE-2016-9434] * New patch 909_button-type.patch to fix rodata write [CVE-2016-9437] * New patch 910_input-alt.patch to fix null deref [CVE-2016-9438] * New patch 911_rowcolspan.patch to fix stack smashing [CVE-2016-9422] * New patch 912_i-dd.patch to fix uninit values [CVE-2016-9435] [CVE-2016-9436] * New patch 913_tabwidth.patch to fix heap corruption [CVE-2016-9426] * New patch 914_curline.patch to fix near-null deref [CVE-2016-9440] * New patch 915_table-alt.patch to fix near-null deref [CVE-2016-9441] * New patch 916_anchor.patch to fix heap write [CVE-2016-9425] [CVE-2016-9428] * New patch 917_strgrow.patch to fix potential heap buffer corruption [CVE-2016-9442] * New patch 918_form-value.patch to fix null deref [CVE-2016-9443] * New patch 919_form-update.patch to fix buffer overflow [CVE-2016-9429] [CVE-2016-9621] * New patch 920_table.patch to fix stack overflow [CVE-2016-9439] (closes: #844726) * New patch 921_cotable.patch to fix null deref (additional fix for #844726) * New patch 922_lineproc.patch to fix null deref [CVE-2016-9622] * New patch 923_tagproc.patch to fix null deref [CVE-2016-9623] * New patch 924_curline.patch to fix near-null deref [CVE-2016-9624] * New patch 925_lineproc.patch to fix stack overflow [CVE-2016-9625] * New patch 926_indent-level.patch to fix stack overflow [CVE-2016-9626] * New patch 927_symbol.patch to fix array index [CVE-2016-9627] * New patch 928_form-id.patch to fix null deref [CVE-2016-9628] * New patch 929_anchor.patch to fix null deref [CVE-2016-9629] * New patch 930_tbl-mode.patch to fix null deref [CVE-2016-9631] * New patch 931_parse-url.patch to fix buffer overflow [CVE-2016-9630] * New patch 932_ucsmap.patch to fix buffer overflow [CVE-2016-9632] * New patch 933_table-level.patch to fix out of memory [CVE-2016-9633] -- Tatsuya Kinoshita <tats(a)debian.org> Thu, 24 Nov 2016 19:49:18 +0900 --- Modifications pour base-files --- base-files (8+deb8u7) stable; urgency=low * Changed /etc/debian_version to 8.7, for Debian 8.7 point release. -- Santiago Vila <sanvila(a)debian.org> Wed, 28 Dec 2016 18:39:54 +0100 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on hexagon.federez.net -- apticron

8 années, 3 mois

45 Debian package update(s) for quigon.federez.net

par root＠quigon.rez-gif.supelec.fr

apticron report [Sat, 14 Jan 2017 23:38:26 +0100] ======================================================================== apticron has detected that some packages need upgrading on: quigon.federez.net [ 160.228.155.65 ] The following packages are currently pending an upgrade: base-files 8+deb8u7 bash 4.3-11+deb8u1 ca-certificates 20141019+deb8u2 dbus 1.8.22-0+deb8u1 e2fslibs 1.42.12-2+b1 e2fsprogs 1.42.12-2+b1 file 1:5.22+15-2+deb8u3 libc6 2.19-18+deb8u7 libc6-dev 2.19-18+deb8u7 libcairo2 1.14.0-2.1+deb8u2 libc-bin 2.19-18+deb8u7 libc-dev-bin 2.19-18+deb8u7 libcomerr2 1.42.12-2+b1 libdbus-1-3 1.8.22-0+deb8u1 libfcgi-perl 0.77-1+deb8u1 libgnutls-deb0-28 3.3.8-6+deb8u4 libgnutls-openssl27 3.3.8-6+deb8u4 libhogweed2 2.7.1-5+deb8u2 libio-socket-ssl-perl 2.002-2+deb8u2 libmagic1 1:5.22+15-2+deb8u3 libnettle4 2.7.1-5+deb8u2 libnss-ldapd 0.9.4-3+deb8u2 libpam0g 1.1.8-3.1+deb8u2 libpam-ldapd 0.9.4-3+deb8u2 libpam-modules 1.1.8-3.1+deb8u2 libpam-modules-bin 1.1.8-3.1+deb8u2 libpam-runtime 1.1.8-3.1+deb8u2 libpam-systemd 215-17+deb8u6 libpng12-0 1.2.50-2+deb8u3 libss2 1.42.12-2+b1 libsystemd0 215-17+deb8u6 libudev1 215-17+deb8u6 libwmf0.2-7 0.2.8.4-10.3+deb8u2 linux-image-3.16.0-4-amd64 3.16.39-1 linux-libc-dev 3.16.39-1 locales 2.19-18+deb8u7 multiarch-support 2.19-18+deb8u7 nscd 2.19-18+deb8u7 nslcd 0.9.4-3+deb8u2 nslcd-utils 0.9.4-3+deb8u2 python-crypto 2.6.1-5+deb8u1 sed 4.2.2-4+deb8u1 systemd 215-17+deb8u6 systemd-sysv 215-17+deb8u6 udev 215-17+deb8u6 ======================================================================== Package Details: Lecture des fichiers de modifications (« changelog »)... --- Nouveautés pour ca-certificates --- ca-certificates (20141019+deb8u2) stable; urgency=medium Update Mozilla certificate authority bundle to version 2.9. The following certificate authorities were added (+): + "Certplus Root CA G1" + "Certplus Root CA G2" + "Certum Trusted Network CA 2" + "Hellenic Academic and Research Institutions ECC RootCA 2015" + "Hellenic Academic and Research Institutions RootCA 2015" + "ISRG Root X1" + "OpenTrust Root CA G1" + "OpenTrust Root CA G2" + "OpenTrust Root CA G3" + "SZAFIR ROOT CA2" The following certificate authorities were removed (-): - "CA Disig" - "NetLock Business (Class B) Root" - "NetLock Express (Class C) Root" - "NetLock Notary (Class A) Root" - "NetLock Qualified (Class QA) Root" - "Sonera Class 1 Root CA" - "Staat der Nederlanden Root CA" - "Verisign Class 1 Public Primary Certification Authority - G2" - "Verisign Class 3 Public Primary Certification Authority" - "Verisign Class 3 Public Primary Certification Authority - G2" -- Michael Shuler <michael(a)pbandjelly.org> Fri, 18 Nov 2016 09:09:47 -0600 --- Modifications pour e2fsprogs (e2fslibs e2fsprogs libcomerr2 libss2) --- e2fsprogs (1.42.12-2+b1) jessie; urgency=low, binary-only=yes * Binary-only non-maintainer upload for amd64; no source changes. * Rebuild against dietlibc 0.33~cvs20120325-6+deb8u1 -- amd64 Build Daemon (binet) <buildd-binet(a)buildd.debian.org> Sat, 04 Jun 2016 11:58:06 -0400 --- Modifications pour python-crypto --- python-crypto (2.6.1-5+deb8u1) jessie; urgency=high * debian/patches/CVE-2013-7459.patch: Raise a warning when IV is used with ECB or CTR and ignored the IV in that case. Thanks to Salvatore Bonaccorso for the initial patch. (CVE-2013-7459) (Closes: #849495) -- Sebastian Ramacher <sramacher(a)debian.org> Tue, 03 Jan 2017 13:56:09 +0100 --- Modifications pour bash --- bash (4.3-11+deb8u1) jessie; urgency=medium * Non-maintainer upload. * CVE-2016-0634: Arbitrary code execution via malicious hostname * CVE-2016-7543: Specially crafted SHELLOPTS+PS4 variables allows command substitution -- Salvatore Bonaccorso <carnil(a)debian.org> Sun, 09 Oct 2016 17:35:21 +0200 --- Modifications pour ca-certificates --- ca-certificates (20141019+deb8u2) stable; urgency=medium [ Michael Shuler ] * mozilla/{certdata.txt,nssckbi.h}: Update Mozilla certificate authority bundle to version 2.9. Thanks for the initial 2.7 patch, Jonathan Wiltshire. Closes: #828845 The following certificate authorities were added (+): + "Certplus Root CA G1" + "Certplus Root CA G2" + "Certum Trusted Network CA 2" + "Hellenic Academic and Research Institutions ECC RootCA 2015" + "Hellenic Academic and Research Institutions RootCA 2015" + "ISRG Root X1" + "OpenTrust Root CA G1" + "OpenTrust Root CA G2" + "OpenTrust Root CA G3" + "SZAFIR ROOT CA2" The following certificate authorities were removed (-): - "CA Disig" - "NetLock Business (Class B) Root" - "NetLock Express (Class C) Root" - "NetLock Notary (Class A) Root" - "NetLock Qualified (Class QA) Root" - "Sonera Class 1 Root CA" - "Staat der Nederlanden Root CA" - "Verisign Class 1 Public Primary Certification Authority - G2" - "Verisign Class 3 Public Primary Certification Authority" - "Verisign Class 3 Public Primary Certification Authority - G2" [ Andreas Beckmann ] * debian/postinst: Run update-certificates without hooks to initially populate /etc/ssl/certs. (The hooks are deferred to the noawait trigger.) Closes: #825730 -- Michael Shuler <michael(a)pbandjelly.org> Fri, 18 Nov 2016 09:09:47 -0600 --- Modifications pour cairo (libcairo2) --- cairo (1.14.0-2.1+deb8u2) jessie; urgency=medium * Non-maintainer upload. * CVE-2016-9082: DoS attack based on using SVG to generate invalid pointers from a _cairo_image_surface in write_png. (Closes: #842289) -- Salvatore Bonaccorso <carnil(a)debian.org> Fri, 30 Dec 2016 07:30:39 +0100 --- Modifications pour dbus (dbus libdbus-1-3) --- dbus (1.8.22-0+deb8u1) jessie; urgency=medium * New upstream bugfix release - fix a potential format string vulnerability, which is not believed to be exploitable in practice * dbus.prerm: ensure that dbus.socket is stopped before removal, so that a new connection to the bus won't cause dbus.service to be restarted (Closes: #813970) -- Simon McVittie <smcv(a)debian.org> Mon, 10 Oct 2016 11:42:50 +0100 --- Modifications pour file (file libmagic1) --- file (1:5.22+15-2+deb8u3) stable; urgency=medium * Fix memory leak in magic loader. Closes: #840754 -- Christoph Biedl <debian.axhn(a)manchmal.in-ulm.de> Sun, 04 Dec 2016 10:00:07 +0100 --- Modifications pour glibc (libc6 libc6-dev libc-bin libc-dev-bin locales multiarch-support nscd) --- glibc (2.19-18+deb8u7) stable; urgency=medium [ Aurelien Jarno ] * Update from upstream stable branch: - Do not unconditionally use the fsqrt instruction on 64-bit PowerPC CPUs. Closes: #843904. * debian/patches/any/cvs-hesiod-resolver.diff: patch from upstream to fix a regression introduced by cvs-resolv-ipv6-nameservers.diff in hesiod. Closes: #821358. * debian/sysdeps/{amd64,i386,x32}.mk: disable lock elision (aka Intel TSX) on x86 architectures. This causes programs (wrongly) unlocking an already unlocked mutex to abort. More importantly most of the other distributions decided to disable it, so we don't want to be the only distribution left testing this code path. -- Aurelien Jarno <aurel32(a)debian.org> Thu, 24 Nov 2016 23:48:11 +0100 --- Modifications pour gnutls28 (libgnutls-deb0-28 libgnutls-openssl27) --- gnutls28 (3.3.8-6+deb8u4) jessie; urgency=medium [ Salvatore Bonaccorso ] * CVE-2016-7444: Incorrect certificate validation when using OCSP responses (GNUTLS-SA-2016-3). See #840191. [ Andreas Metzler ] * Cherry pick 53_nettle-use-rsa_-_key_prepare-on-key-import.patch from upstream GIT, which should allow gnutls continue to work with CVE-2016-6489-patched nettle. See #832983. -- Andreas Metzler <ametzler(a)debian.org> Sun, 30 Oct 2016 07:39:08 +0100 --- Modifications pour libfcgi-perl --- libfcgi-perl (0.77-1+deb8u1) jessie; urgency=medium * Team upload. * CVE-2012-6687: numerous connections cause segfault DoS (Closes: #815840) -- Salvatore Bonaccorso <carnil(a)debian.org> Tue, 27 Dec 2016 08:06:30 +0100 --- Modifications pour libio-socket-ssl-perl --- libio-socket-ssl-perl (2.002-2+deb8u2) jessie; urgency=medium * Add 0001-remove-r-for-checking-SSL_-cert-key-_file-since-this.patch. Removes the -r check for for checking SSL_{cert,key}_file since this will an usable error later anyway. Addresses "Cannot use SSL_key_file with ACL permissions". Thanks to Michael Braun and Steffen Ullrich. (Closes: #839576) -- Salvatore Bonaccorso <carnil(a)debian.org> Sat, 08 Oct 2016 17:26:51 +0200 --- Modifications pour libpng (libpng12-0) --- libpng (1.2.50-2+deb8u3) jessie; urgency=medium * debian/patches/CVE-2016-10087.patch: - cherry-pick upstream fix for CVE-2016-10087 -- Gianfranco Costamagna <locutusofborg(a)debian.org> Mon, 02 Jan 2017 18:21:33 +0100 --- Modifications pour libwmf (libwmf0.2-7) --- libwmf (0.2.8.4-10.3+deb8u2) stable; urgency=medium * LTS Team upload. * Fix allocating huge block of memory (CVE-2016-9011) (Closes: #842090) -- Balint Reczey <balint(a)balintreczey.hu> Wed, 02 Nov 2016 12:56:21 +0100 --- Modifications pour linux (linux-image-3.16.0-4-amd64 linux-libc-dev) --- linux (3.16.39-1) jessie; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.37 - [x86] iommu/vt-d: Ratelimit fault handler - xfs: disallow rw remount on fs with unknown ro-compat features - Bluetooth: vhci: fix open_timeout vs. hdev race - [x86] drm/i915: Prevent machine death on Ivybridge context switching - scsi: Add intermediate STARGET_REMOVE state to scsi_target_state (Closes: #834513) - Revert "scsi: fix soft lockup in scsi_remove_target() on module removal" - Bluetooth: vhci: Fix race at creating hci device - EDAC: Increment correct counter in edac_inc_ue_error() - ext4: fix data exposure after a crash - [armhf] crypto: s5p-sss - Fix missed interrupts when working with 8 kB blocks - [armhf] crypto: s5p-sss - fix incorrect usage of scatterlists api - btrfs: bugfix: handle FS_IOC32_{GETFLAGS,SETFLAGS,GETVERSION} in btrfs_ioctl - [arm*] KVM: Enforce Break-Before-Make on Stage-2 page tables - aacraid: Relinquish CPU during timeout wait - aacraid: Fix for aac_command_thread hang - ext4: fix hang when processing corrupted orphaned inode list - ext4: clean up error handling when orphan list is corrupted - Revert "tty: Fix pty master poll() after slave closes v2" - Fix OpenSSH pty regression on close - cpufreq: Fix GOV_LIMITS handling for the userspace governor - ACPI / sysfs: fix error code in get_status() - ext4: fix oops on corrupted filesystem - [arm64] Ensure pmd_present() returns false after pmd_mknotpresent() - [armhf] dts: exynos: Add interrupt line to MAX8997 PMIC on exynos4210-trats - [mips*] Fix siginfo.h to use strict posix types - USB: serial: keyspan,muxport,quatech2: fix use-after-free in probe error path - irqchip/gic: Ensure ordering between read of INTACK and shared data - [powerpc*] mm/hash64: Fix subpage protection with 4K HPTE config - rtlwifi: Fix logic error in enter/exit power-save mode - sched/loadavg: Fix loadavg artifacts on fully idle and on fully loaded systems - [mips*] Fix race condition in lazy cache flushing. - ring-buffer: Use long for nr_pages to avoid overflow failures - ring-buffer: Prevent overflow of size in ring_buffer_resize() - RDMA/iw_cxgb4: Always wake up waiter in c4iw_peer_abort_intr() - IB/core: Fix a potential array overrun in CMA and SA agent - i40e: fix an uninitialized variable bug - mmc: mmc: Fix partition switch timeout for some eMMCs - net/mlx4_core: Fix access to uninitialized index - [x86] PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs - PCI: Disable all BAR sizing for devices with non-compliant BARs - netlink: Fix dump skb leak/double free (CVE-2016-9806) - sched/preempt: Fix preempt_count manipulations - fs/cifs: correctly do anonymous authentication - fs/cifs: remove directory incorrectly tries to set delete on close on non-empty directories - sunrpc: Update RPCBIND_MAXNETIDLEN - cpuidle: Fix cpuidle_state_is_coupled() argument in cpuidle_enter() - batman-adv: fix skb deref after free - batman-adv: Fix unexpected free of bcast_own on add_if error - batman-adv: Fix integer overflow in batadv_iv_ogm_calc_tq - xfs: xfs_iflush_cluster fails to abort on error - xfs: fix inode validity check in xfs_iflush_cluster - xfs: skip stale inodes in xfs_iflush_cluster - crypto: public_key: select CRYPTO_AKCIPHER - net: ehea: avoid null pointer dereference - cifs: Create dedicated keyring for spnego operations - Input: uinput - handle compat ioctl for UI_SET_PHYS - PM / sleep: Handle failures in device_suspend_late() consistently - tuntap: correctly wake up process during uninit - scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands - [x86] drm/i915: Don't leave old junk in ilk active watermarks on readout - mmc: longer timeout for long read time quirk - sunrpc: fix stripping of padded MIC tokens - wait/ptrace: assume __WALL if the child is traced - xen/events: Don't move disabled irqs - UBI: do propagate positive error codes up - UBI: fix missing brace control flow - UBI: Fix static volume checks when Fastmap is used - RDMA/cxgb3: device driver frees DMA memory with different size - [x86] ALSA: hda - Fix headset mic detection problem for one Dell machine - [x86] crypto: ccp - Fix AES XTS error for request sizes above 4096 - sfc: on MC reset, clear PIO buffer linkage in TXQs - Input: xpad - prevent spurious input from wired Xbox 360 controllers - Input: pwm-beeper - remove useless call to pwm_config() - Input: pwm-beeper - fix - scheduling while atomic - [mips*] fix read_msa_* & write_msa_* functions on non-MSA toolchains - hpfs: fix remount failure when there are no options changed - hpfs: implement the show_options method - [powerpc*] pseries/eeh: Handle RTAS delay requests in configure_bridge - [powerpc*] Fix definition of SIAR and SDAR registers - [powerpc*] Use privileged SPR number for MMCR2 - mac80211_hwsim: Add missing check for HWSIM_ATTR_SIGNAL - mac80211: mesh: flush mesh paths unconditionally - [arm64] Provide "model name" in /proc/cpuinfo for PER_LINUX32 tasks - scsi: Add QEMU CD-ROM to VPD Inquiry Blacklist - ACPI / processor: Avoid reserving IO regions too early - drm/nouveau/fbcon: fix out-of-bounds memory accesses - [armel,armhf] fix PTRACE_SETVFPREGS on SMP systems - KVM: irqfd: fix NULL pointer dereference in kvm_irq_map_gsi - [x86] KVM: fix OOPS after invalid KVM_SET_DEBUGREGS - ALSA: hda - Fix headset mic detection problem for Dell machine - [powerpc*] pseries: Fix PCI config address for DDW - mnt: fs_fully_visible test the proper mount for MNT_LOCKED - IB/IPoIB: Fix race between ipoib_remove_one to sysfs functions - IB/mlx5: Return PORT_ERR in Active to Initializing tranisition - IB/mlx5: Fix returned values of query QP - IB/IPoIB: Don't update neigh validity for unresolved entries - tcp: record TLP and ER timer stats in v6 stats - of: fix autoloading due to broken modalias with no 'compatible' - [x86] cpufreq: intel_pstate: Fix ->set_policy() interface for no_turbo - fs: fix d_walk()/non-delayed __d_free() race - net/mlx5: Fix the size of modify QP mailbox - net/mlx5: Fix masking of reserved bits in XRCD number - uvc: Forward compat ioctls to their handlers directly - [armhf] mfd: omap-usb-tll: Fix scheduling while atomic BUG - [armhf] usb: dwc3: exynos: Fix deferred probing storm. - usb: f_fs: off by one bug in _ffs_func_bind() - usb: gadget: fix spinlock dead lock in gadgetfs - usb: gadget: avoid exposing kernel stack - HID: elo: kill not flush the work - usb: xhci-plat: properly handle probe deferral for devm_clk_get() - USB: quirks: Fix entries on wrong list in 3.16.y - [armhf] usb: musb: Ensure rx reinit occurs for shared_fifo endpoints - [armhf] usb: musb: Stop bulk endpoint while queue is rotated - iio: Fix error handling in iio_trigger_attach_poll_func - scsi: fix race between simultaneous decrements of ->host_failed - [armel,armhf] 8578/1: mm: ensure pmd_present only checks the valid bit - [armel,armhf] 8579/1: mm: Fix definition of pmd_mknotpresent - drm/radeon: fix asic initialization for virtualized environments - [armhf] spi: sun4i: fix FIFO limit - [armhf] spi: sunxi: fix transfer timeout - [x86] kprobes: Clear TF bit in fault on single-stepping - kernel/sysrq, watchdog, sched/core: Reset watchdog on all CPUs while processing sysrq-w - ipv6: fix endianness error in icmpv6_err - net_sched: introduce qdisc_replace() helper - net_sched: update hierarchical backlog too - netem: fix a use after free - net_sched: fix pfifo_head_drop behavior vs backlog - [x86] drm/i915/ilk: Don't disable SSC source if it's in use - base: make module_create_drivers_dir race-free - kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES - [armhf] memory: omap-gpmc: Fix omap gpmc EXTRADELAY timing - IB/mlx4: Properly initialize GRH TClass and FlowLabel in AHs - isa: Call isa_bus_init before dependent ISA bus drivers register - [x86] hwmon: (dell-smm) Restrict fan control and serial number to CAP_SYS_ADMIN by default - tracing: Handle NULL formats in hold_module_trace_bprintk_format() - [arm64] mm: remove page_mapping check in __sync_icache_dcache - pinctrl: single: Fix missing flush of posted write for a wakeirq - net/mlx4_en: Fix the return value of a failure in VLAN VID add/kill - ubi: Make recover_peb power cut aware - mm: Export migrate_page_move_mapping and migrate_page_copy - UBIFS: Implement ->migratepage() - [ppc64el] bpf/jit: Disable classic BPF JIT on ppc64le - can: fix oops caused by wrong rtnl dellink usage - xen/pciback: Fix conf_space read/write overlap check. - IB/mlx5: Fix post send fence logic - IB/mlx4: Fix the SQ size of an RC QP - IB/mlx4: Fix error flow when sending mads under SRIOV - IB/mlx4: Verify port number in flow steering create flow - IB/mlx4: Fix memory leak if QP creation failed - Input: wacom_w8001 - w8001_MAX_LENGTH should be 13 - cifs: use CIFS_MAX_DOMAINNAME_LEN when converting the domain name - cifs: dynamic allocation of ntlmssp blob - ALSA: dummy: Fix a use-after-free at closing - cifs: Fix reconnect to not defer smb3 session reconnect long after socket reconnect - tmpfs: don't undo fallocate past its last page - fs/nilfs2: fix potential underflow in call to crc32_le - staging: iio: accel: fix error check - [armhf,arm64] KVM: Stop leaking vcpu pid references - make nfs_atomic_open() call d_drop() on all ->open_context() errors. - USB: don't free bandwidth_mutex too early - ALSA: echoaudio: Fix memory allocation - [s390x] fix test_fp_ctl inline assembly contraints - net: bgmac: Start transmit queue in bgmac_open - net: bgmac: Remove superflous netif_carrier_on() - mac80211: Fix mesh estab_plinks counting in STA removal case - Bridge: Fix ipv6 mc snooping if bridge has no ipv6 address - NFS: Fix another OPEN_DOWNGRADE bug - ipr: Clear interrupt on croc/crocodile when running with LSI - [powerpc*] tm: Avoid SLB faults in treclaim/trecheckpoint when RI=0 - net: phy: Manage fixed PHY address space using IDA - batman-adv: Fix memory leak on tt add with invalid vlan - batman-adv: replace WARN with rate limited output on non-existing VLAN - batman-adv: Fix use-after-free/double-free of tt_req_node - batman-adv: Fix ICMP RR ethernet access after skb_linearize - batman-adv: Clean up untagged vlan when destroying via rtnl-link - qlcnic: use the correct ring in qlcnic_83xx_process_rcv_ring_diag() - ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift() - [amd64] power: Fix kernel text mapping corruption during image restoration - [x86] amd_nb: Fix boot crash on non-AMD systems - bonding: prevent out of bound accesses - net/mlx5: Fix potential deadlock in command mode change - net/mlx5: Add timeout handle to commands with callback - block: fix use-after-free in sys_ioprio_get() (CVE-2016-7911) - ALSA: timer: Fix negative queue usage by racy accesses - qeth: delete napi struct when removing a qeth device - xenbus: don't bail early from xenbus_dev_request_and_reply() - ecryptfs: don't allow mmap when the lower fs doesn't support it - tmpfs: fix regression hang in fallocate undo - fs: limit filesystem stacking depth - proc: prevent stacking filesystems on top - [powerpc*] KVM: Book3S HV: Pull out TM state save/restore into separate procedures - [powerpc*] KVM: Book3S HV: Save/restore TM state in H_CEDE (CVE-2016-5412) https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.38 https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.39 - HID: uhid: fix timeout when probe races with IO - macvlan: Fix potential use-after free for broadcasts - netlabel: add address family checks to netlbl_{sock,req}_delattr() - em28xx-i2c: rt_mutex_trylock() returns zero on failure - PCI: Mark Atheros AR9485 and QCA9882 to avoid bus reset - [armhf] gpio: pca953x: Fix NBANK calculation for PCA9536 - random: print a warning for the first ten uninitialized random users - [x86] random: add interrupt callback to VMBus IRQ handler - sched/cputime: Fix prev steal time accouting during CPU hotplug - [armel/kirkwood,armhf] mvebu: fix HW I/O coherency related deadlocks - [armhf] usb: dwc3: fix for the isoc transfer EP_BUSY flag - crypto: gcm - Filter out async ghash if necessary - IB/mlx5: Fix MODIFY_QP command input structure - drm/nouveau: Don't leak runtime pm ref on driver unload - drm/radeon: Don't leak runtime pm ref on driver unload - drm/radeon: Don't leak runtime pm ref on driver load - tty/serial: atmel: fix RS485 half duplex with DMA - [armhf] serial: samsung: Fix ERR pointer dereference on deferred probe - [armhf] hwrng: omap - Fix assumption that runtime_get_sync will always succeed - hp-wmi: Fix wifi cannot be hard-unblocked - Input: xpad - validate USB endpoint count during probe - ath9k: Fix programming of minCCA power threshold - ext4: check for extents that wrap around - ext4: fix deadlock during page writeback - ext4: don't call ext4_should_journal_data() on the journal inode - batman-adv: Avoid nullptr dereference in bla after vlan_insert_tag - batman-adv: Avoid nullptr dereference in dat after vlan_insert_tag - batman-adv: Fix orig_node_vlan leak on orig_node_release - batman-adv: lock crc access in bridge loop avoidance - batman-adv: Fix non-atomic bla_claim::backbone_gw access - batman-adv: Fix reference leak in batadv_find_router - batman-adv: Free last_bonding_candidate on release of orig_node - ext4: validate s_reserved_gdt_blocks on mount - iwlwifi: pcie: fix access to scratch buffer - [mips*] Fix page table corruption on THP permission changes. - batman-adv: Fix speedy join in gateway client mode - drm/radeon: add a delay after ATPX dGPU power off - drm/radeon: Poll for both connect/disconnect on analog connectors - ALSA: ctl: Stop notification after disconnection - ALSA: pcm: Free chmap at PCM free callback, too - [armhf] net: mvneta: set real interrupt per packet for tx_done - ppp: defer netns reference release for ppp channel - rtc: ds1307: Fix relying on reset value for weekday - ngene: properly handle __user ptr - media: dvb_ringbuffer: Add memory barriers - [x86] quirks: Apply nvidia_bugs quirk only on root bus - [x86] quirks: Reintroduce scanning of secondary buses - [x86] quirks: Add early quirk to reset Apple AirPort card - posix_cpu_timer: Exit early when process has been reaped - ALSA: hda - fix use-after-free after module unload - svc: Avoid garbage replies when pc_func() returns rpc_drop_reply - NFS: Don't drop CB requests with invalid principals - qxl: check for kmap failures - cifs: Check for existing directory when opening file with O_CREAT - net: ethoc: Fix early error paths - [s390x] mm: fix gmap tlb flush issues - [armel,armhf] 8561/3: dma-mapping: Don't use outer_flush_range when the L2C is coherent - [x86] KVM: nVMX: fix lifetime issues for vmcs02 - [x86] KVM: nVMX: Fix memory corruption when using VMCS shadowing - ext4: fix reference counting bug on block allocation error - ext4: short-cut orphan cleanup on error - [powerpc*] tm: Fix stack pointer corruption in __tm_recheckpoint() - Bluetooth: Fix l2cap_sock_setsockopt() with optname BT_RCVMTU - xfrm: fix crash in XFRM_MSG_GETSA netlink handler - crypto: scatterwalk - Fix test in scatterwalk_done - mmc: block: fix packed command header endianness - crypto: nx - off by one bug in nx_of_update_msc() - tpm: read burstcount from TPM_STS in one 32-bit transaction - [arm64] debug: unmask PSTATE.D earlier - brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain - brcmsmac: Free packet if dma_mapping_error() fails in dma_rxfill - brcmsmac: Initialize power in brcms_c_stf_ss_algo_channel_get() - mtd: nand: fix bug writing 1 byte less than page size - target: Fix missing complete during ABORT_TASK + CMD_T_FABRIC_STOP - target: Fix race between iscsi-target connection shutdown + ABORT_TASK - target: Fix max_unmap_lba_count calc overflow - cifs: fix crash due to race in hmac(md5) handling - hwmon: (adt7411) set bit 3 in CFG1 register - iscsi-target: Fix panic when adding second TCP connection to iSCSI session - tty/vt/keyboard: fix OOB access in do_compute_shiftstate() - [mips*] bpf: fix off-by-one in ctx offset allocation - libceph: set 'exists' flag for newly up osd - libceph: apply new_state before new_up_client on incrementals - [x86] gpio: intel-mid: Remove potentially harmful code - nfs: don't create zero-length requests - radix-tree: fix radix_tree_iter_retry() for tagged iterators. - pps: do not crash when failed to register - [armhf] OMAP3: hwmod data: Add sysc information for DSI - net/irda: fix NULL pointer dereference on memory allocation failure - l2tp: Correctly return -EBADF from pppol2tp_getname. - ceph: Correctly return NXIO errors from ceph_llseek - CIFS: Fix a possible invalid memory access in smb2_query_symlink() - [mips*] KEYS: 64-bit MIPS needs to use compat_sys_keyctl for 32-bit userspace - drm/radeon: fix firmware info version checks - fuse: fsync() did not return IO errors - fuse: fuse_flush must check mapping->flags for errors - fuse: fix wrong assignment of ->flags in fuse_send_init() - ubi: Fix race condition between ubi device creation and udev - ubi: Make volume resize power cut aware - ubi: Be more paranoid while seaching for the most recent Fastmap - drm/nouveau/fbcon: fix font width not divisible by 8 - drm/nouveau/acpi: ensure matching ACPI handle and supported functions - drm/nouveau/acpi: check for function 0x1B before using it - tcp: consider recv buf for the initial window scale - ext4: validate that metadata blocks do not overlap superblock - ALSA: hda - On-board speaker fixup on ACER Veriton - [amd64] syscalls: Add compat_sys_keyctl for 32-bit userspace - balloon: check the number of available pages in leak balloon - dm flakey: error READ bios during the down_interval - mm/hugetlb: avoid soft lockup in set_max_huge_pages() - sysv, ipc: fix security-layer leaking - ALSA: hda: Fix krealloc() with __GFP_ZERO usage - block: fix use-after-free in seq file (CVE-2016-7910) - mac80211: fix purging multicast PS buffer queue - SUNRPC: allow for upcalls for same uid but different gss service - USB: serial: fix memleak in driver-registration error path - vfio/pci: Fix NULL pointer oops in error interrupt setup handling - [x86] drm/edid: Add 6 bpc quirk for display AEO model 0. - [x86] drm/i915/dp: Revert "drm/i915/dp: fall back to 18 bpp when sink capability is unknown" - [powerpc*] powernv: Fix MCE handler to avoid trashing CR0/CR1 registers. - netfilter: nf_ct_expect: remove the redundant slash when policy name is empty - netfilter: nfnetlink_queue: reject verdict request from different portid - [powerpc*] book3s: Fix MCE console messages for unrecoverable MCE. - USB: validate wMaxPacketValue entries in endpoint descriptors - cpuset: make sure new tasks conform to the current config of the cpuset - [s390x] dasd: fix hanging device after clear subchannel - [armhf] usb: dwc3: gadget: increment request->actual once - [x86] mm: Disable preemption during CR3 read+write - megaraid_sas: Fix probing cards without io port - PM / hibernate: Restore processor state before using per-CPU variables - ipv6: suppress sparse warnings in IP6_ECN_set_ce() - USB: serial: mos7720: fix non-atomic allocation in write path - USB: serial: mos7840: fix non-atomic allocation in write path - cdc-acm: fix wrong pipe type on rx interrupt xfers - scsi: fix upper bounds check of sense key in scsi_sense_key_string() - xhci: always handle "Command Ring Stopped" events - usb: xhci: Fix panic if disconnect - xhci: don't dereference a xhci member after removing xhci - [x86] KVM: nVMX: postpone VMCS changes on MSR_IA32_APICBASE write - bcache: register_bcache(): call blkdev_put() when cache_alloc() fails - bcache: RESERVE_PRIO is too small by one when prio_buckets() is a power of two. - drm/radeon: fix radeon_move_blit on 32bit systems - net/mlx5: Added missing check of msg length in verifying its signature - [x86] staging: comedi: daqboard2000: bug fix board type matching code - [x86] staging: comedi: ni_mio_common: fix AO inttrig backwards compatibility - [armhf] iio: adc: ti_am335x_adc: Protect FIFO1 from concurrent access - [powerpc*] pseries: use pci_host_bridge.release_fn() to kfree(phb) - [powerpc*] prom: Fix sub-processor option passed to ibm, client-architecture-support - drm: Reject page_flip for !DRIVER_MODESET - USB: fix typo in wMaxPacketSize validation - USB: avoid left shift by -1 - ubifs: Fix assertion in layout_in_gaps() - tun: fix transmit timestamp support - timekeeping: Cap array access in timekeeping_debug - [x86] apic: Do not init irq remapping if ioapic is disabled - usb: gadget: udc: core: don't starve DMA resources - qdisc: fix a module refcount leak in qdisc_create_dflt() - [armel/kirkwood] ib62x0: fix size of u-boot environment partition - batman-adv: Add missing refcnt for last_candidate - [armhf] clocksource/drivers/sun4i: Clear interrupts after stopping timer in probe function - printk: fix parsing of "brl=" option - fs/seq_file: fix out-of-bounds read - [powerpc*] powernv : Drop reference added by kset_find_obj() - ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE - ALSA: timer: fix NULL pointer dereference on memory allocation failure - NFSv4.x: Fix a refcount leak in nfs_callback_up_net - dm crypt: fix free of bad values after tfm allocation failure - kernfs: don't depend on d_find_any_alias() when generating notifications - ALSA: fireworks: accessing to user space outside spinlock - ipv6: add missing netconf notif when 'all' is updated - tcp: fastopen: fix rcv_wup initialization for TFO server on SYN/data - kernel/fork: fix CLONE_CHILD_CLEARTID regression in nscd - ALSA: timer: fix NULL pointer dereference in read()/ioctl() race - [x86] paravirt: Do not trace _paravirt_ident_*() functions - IB/core: Fix use after free in send_leave function - IB/ipoib: Fix memory corruption in ipoib cm mode connect flow - [x86] AMD: Apply erratum 665 on machines without a BIOS fix - l2tp: fix use-after-free during module unload - iio: fix pressure data output unit in hid-sensor-attributes - sched/core: Fix a race between try_to_wake_up() and a woken up task - [x86] efi/libstub: Allocate headspace in efi_get_memory_map() - iio:core: fix IIO_VAL_FRACTIONAL sign handling - Btrfs: add missing blk_finish_plug in btrfs_sync_log() - Btrfs: remove root_log_ctx from ctx list before btrfs_sync_log returns - ipv6: addrconf: fix dev refcont leak when DAD failed - crypto: cryptd - initialize child shash_desc on import - ALSA: timer: Fix zero-division by continue of uninitialized instance - ALSA: rawmidi: Fix possible deadlock with virmidi registration - xfrm_user: propagate sec ctx allocation errors - [armhf,arm64] kvm-arm: Unmap shadow pagetables properly - [arm64] spinlocks: implement smp_mb__before_spinlock() as smp_mb() - asm-generic: make copy_from_user() zero the destination properly - NFSv4.1: Fix the CREATE_SESSION slot number accounting - crypto: skcipher - Fix blkcipher walk OOM crash - [arm64] crypto: aes-ctr - fix NULL dereference in tail processing - nl80211: validate number of probe response CSA counters - asm-generic: make get_user() clear the destination on errors - [mips*] copy_from_user() must zero the destination on access_ok() failure - [powerpc] ppc32: fix copy_from_user() - [s390x] get_user() should zero on failure - [x86] perf/amd: Make HW_CACHE_REFERENCES and HW_CACHE_MISSES measure L2 - USB: change bInterval default to 10 ms - IB/ipoib: Don't allow MC joins during light MC flush - IB/mlx4: Fix incorrect MC join state bit-masking on SR-IOV - IB/mlx4: Fix code indentation in QP1 MAD flow - IB/mlx4: Use correct subnet-prefix in QP1 mads under SR-IOV - irda: Free skb on irda_accept error path. - xfrm: Fix memory leak of aead algorithm name - ocfs2/dlm: fix race between convert and migration - fsnotify: add a way to stop queueing events on group shutdown - ocfs2: fix start offset to ocfs2_zero_range_for_truncate() - fix fault_in_multipages_...() on architectures with no-op access_ok() - [x86] i2c-eg20t: fix race between i2c init and interrupt enable - btrfs: ensure that file descriptor used with subvol ioctls is a dir - can: dev: fix deadlock reported after bus-off - ip6_gre: Set flowi6_proto as IPPROTO_GRE in xmit path. - ip6_gre: fix flowi6_proto value in ip6gre_xmit_other() - tracing: Move mutex to protect against resetting of seq data - ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route - drm/radeon/si/dpm: add workaround for for Jet parts - mm,ksm: fix endless looping in allocating memory when ksm enable - [armel,armhf] 8617/1: dma: fix dma_max_pfn() - [mips*/5kc-malta] Fix IOCU disable switch read for MIPS64 - mm: workingset: fix crash in shadow node shrinker caused by replace_page_cache_page() - [armhf] 8618/1: decompressor: reset ttbcr fields to use TTBR0 on ARMv7 - [arm64] perf: reject groups spanning multiple HW PMUs (CVE-2015-8955) - firewire: net: guard against rx buffer overflows (CVE-2016-8633) - brcmfmac: avoid potential stack overflow in brcmf_cfg80211_start_ap() (CVE-2016-8658) - vfio/pci: Fix integer overflows, bitmask check (CVE-2016-9083, CVE-2016-9084) - fs: Give dentry to inode_change_ok() instead of inode - fs: Avoid premature clearing of capabilities (CVE-2015-1350) (Closes: #770492) - posix_acl: Clear SGID bit when setting file permissions (CVE-2016-7097) - staging: comedi: ni_mio_common: fix wrong insn_write handler - xenbus: don't BUG() on user mode induced condition - xenbus: don't look up transaction IDs for ordinary writes - compiler-gcc: disable -ftracer for __noclone functions - PM / devfreq: Fix incorrect type issue. - mm: filemap: don't plant shadow entries without radix tree node [ Aurelien Jarno ] * [mips*] Fix ptrace handling of any syscalls returning ENOSYS. [ Salvatore Bonaccorso ] * [x86] KVM: pass host_initiated to functions that read MSRs * [x86] KVM: VMX: Fix host initiated access to guest MSR_TSC_AUX (Closes: #838660) [ Ben Hutchings ] * [x86] video: Disable X86_SYSFB, FB_SIMPLE (Closes: #822575) * Revert "ecryptfs: forbid opening files without mmap handler", redundant with upstream fixes * fs: Move procfs/ecryptfs stacking check into ecryptfs, to avoid ABI change * [mips*] Fix ABI change in 3.16.37 * net/sched: Fix ABI change in 3.16.37 * SCSI: Fix ABI change in 3.16.37 * ubi: Avoid ABI change in 3.16.37 * i8042: Revert ABI break in 3.16.39 * fs: Fix ABI change in 3.16.39 * can: Ignore ABI change in 3.16.39 * [mips*] uaccess: Avoid ABI change in 3.16.39 * [arm64] Revert "arm64: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO" to avoid ABI change * [s390x] Revert "s390: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO" to avoid ABI change * Revert "block: fix bdi vs gendisk lifetime mismatch" to avoid ABI change * fsnotify: Ignore ABI change in 3.16.39 * Fix backport of "fs: Give dentry to inode_change_ok() instead of inode" in fuse, xfs * sg: Fix double-free when drives detach during SG_IO (CVE-2015-8962) * perf: Fix race in swevent hash (CVE-2015-8963) * tty: Prevent ldisc drivers from re-using stale tty fields (CVE-2015-8964) * usb: gadget: f_fs: Fix use-after-free (CVE-2016-7912) * HID: core: prevent out-of-bound readings (CVE-2016-7915) * netfilter: nfnetlink: correctly validate length of batch messages (CVE-2016-7917) * net: ping: check minimum size on ICMP header length (CVE-2016-8399) * net: Add __sock_queue_rcv_skb() * rose,dccp: limit sk_filter trim to payload * tcp: take care of truncations done by sk_filter() (CVE-2016-8645) * mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] (CVE-2016-8650) * packet: fix race condition in packet_set_ring (CVE-2016-8655) * [x86] Fix potential infoleak in older kernels (CVE-2016-9178) * sctp: validate chunk len before actually using it (CVE-2016-9555) * sg_write()/bsg_write() is not fit to be called under KERNEL_DS (CVE-2016-9576, CVE-2016-10088) * [x86] KVM: drop error recovery in em_jmp_far and em_ret_far (CVE-2016-9756) * net: avoid signed overflows for SO_{SND|RCV}BUFFORCE (CVE-2016-9793) * ALSA: pcm : Call kill_fasync() in stream lock (CVE-2016-9794) * security,perf: Allow unprivileged use of perf_event_open to be disabled (sysctl: kernel.perf_event_paranoid=3) * spi-nor: Add support for n25q256a11 SPI flash device (Closes: #843650) (thanks to Matt Sickler) * xen-blkfront: fix accounting of reqs when migrating (Closes: #843715) [ Julien Cristau ] * hwrng: Add chaoskey driver, backported from 4.8 (Closes: #839616) -- Ben Hutchings <ben(a)decadent.org.uk> Fri, 30 Dec 2016 19:42:20 +0000 --- Modifications pour nettle (libhogweed2 libnettle4) --- nettle (2.7.1-5+deb8u2) stable; urgency=medium * [SECURITY] cve-2016-6489.patch: Protect against potential side-channel attacks against exponentiation operations as described in CVE-2016-6489 "RSA code is vulnerable to cache sharing related attacks" (Closes: #832983). -- Magnus Holmgren <holmgren(a)debian.org> Sat, 05 Nov 2016 17:37:13 +0100 --- Modifications pour nss-pam-ldapd (libnss-ldapd libpam-ldapd nslcd nslcd-utils) --- nss-pam-ldapd (0.9.4-3+deb8u2) jessie; urgency=medium * Non-maintainer upload. * have init script stop action only return when nslcd has actually stopped (Closes: #814881) -- Salvatore Bonaccorso <carnil(a)debian.org> Wed, 09 Nov 2016 13:48:14 +0100 --- Modifications pour pam (libpam0g libpam-modules libpam-modules-bin libpam-runtime) --- pam (1.1.8-3.1+deb8u2) jessie; urgency=medium * Non-maintainer upload. * debian/patches-applied/pam-loginuid-in-containers: Updated with the version from Ubuntu, this should fix logins in containers (Closes: #726661) -- Evgeni Golov <evgeni(a)debian.org> Sat, 12 Nov 2016 08:38:19 +0100 --- Modifications pour sed --- sed (4.2.2-4+deb8u1) stable; urgency=medium [ Jérémy Bobbio ] * Ensure consistent permissions with different umasks. closes: #774347, #835516. -- Clint Adams <clint(a)debian.org> Fri, 09 Sep 2016 18:07:57 -0400 --- Modifications pour systemd (libpam-systemd libsystemd0 libudev1 systemd systemd-sysv udev) --- systemd (215-17+deb8u6) stable; urgency=medium [ Michael Biebl ] * Don't return any error in manager_dispatch_notify_fd(). If manager_dispatch_notify_fd() fails and returns an error then the handling of service notifications will be disabled entirely leading to a compromised system. For example pid1 won't be able to receive the WATCHDOG messages anymore and will kill all services supposed to send such messages. (CVE-2016-7796) (Closes: #839607) * core: Rework logic to determine when we decide to add automatic deps for mounts. This adds a concept of "extrinsic" mounts. If mounts are extrinsic we consider them managed by something else and do not add automatic ordering against umount.target, local-fs.target, remote-fs.target. Extrinsic mounts include API mounts such as everything below /proc, /sys, /dev. This avoids a crash in LXC containers where /dev/urandom is a bind mount from the host system and unmounting it leads to an assert in systemd. (Closes: #818978) * Various ordering fixes for ifupdown. Run ifup after all kernel modules have been loaded and all sysctl settings are applied. Update ifup@.service to add missing After= for the device unit we bind to. This ensures that the device unit is active when systemd tries to start the service. (Closes: #819314) * systemctl: Fix argument handling when invoked as shutdown. (Closes: #776997) [ Simon McVittie ] * localed: tolerate absence of /etc/default/keyboard. The debian-specific patch to read Debian config files was not tolerating the absence of /etc/default/keyboard. This causes systemd-localed to fail to start on systems where that file isn't populated (like embedded systems without keyboards). (Closes: #833849) [ Martin Pitt ] * systemctl, loginctl, etc.: Don't start polkit agent when running as root. (Closes: #774153, LP: #1565617) -- Michael Biebl <biebl(a)debian.org> Wed, 21 Dec 2016 21:33:51 +0100 --- Modifications pour base-files --- base-files (8+deb8u7) stable; urgency=low * Changed /etc/debian_version to 8.7, for Debian 8.7 point release. -- Santiago Vila <sanvila(a)debian.org> Wed, 28 Dec 2016 18:39:54 +0100 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on quigon.federez.net -- apticron

8 années, 3 mois

Undelivered Mail Returned to Sender

par MAILER-DAEMON＠nonagon.crans.org

8 années, 3 mois

14 Debian package update(s) for quigon.federez.net

par root＠quigon.rez-gif.supelec.fr

apticron report [Wed, 11 Jan 2017 23:38:21 +0100] ======================================================================== apticron has detected that some packages need upgrading on: quigon.federez.net [ 160.228.155.65 ] The following packages are currently pending an upgrade: bind9 1:9.9.5.dfsg-9+deb8u9 bind9-host 1:9.9.5.dfsg-9+deb8u9 bind9utils 1:9.9.5.dfsg-9+deb8u9 dnsutils 1:9.9.5.dfsg-9+deb8u9 libbind9-90 1:9.9.5.dfsg-9+deb8u9 libdns100 1:9.9.5.dfsg-9+deb8u9 libdns-export100 1:9.9.5.dfsg-9+deb8u9 libirs-export91 1:9.9.5.dfsg-9+deb8u9 libisc95 1:9.9.5.dfsg-9+deb8u9 libisccc90 1:9.9.5.dfsg-9+deb8u9 libisccfg90 1:9.9.5.dfsg-9+deb8u9 libisccfg-export90 1:9.9.5.dfsg-9+deb8u9 libisc-export95 1:9.9.5.dfsg-9+deb8u9 liblwres90 1:9.9.5.dfsg-9+deb8u9 ======================================================================== Package Details: Lecture des fichiers de modifications (« changelog »)... --- Modifications pour bind9 (bind9 bind9-host bind9utils dnsutils libbind9-90 libdns100 libdns-export100 libirs-export91 libisc95 libisccc90 libisccfg90 libisccfg-export90 libisc-export95 liblwres90) --- bind9 (1:9.9.5.dfsg-9+deb8u9) jessie-security; urgency=medium * Apply patches from ISC. * CVE-2016-9131: Assertion failure related to caching of TKEY records in upstream DNS responses. * CVE-2016-9147: Processing of RRSIG records in upstream DNS response without corresponding signed data could lead to an assertion failure. * CVE-2016-9444: Missing RRSIG records in the authority section of upstream responses could lead to an assertion failure. * RT #43779: Fix handling of CNAME/DNAME responses. (Regression due to the CVE-2016-8864 fix.) -- Florian Weimer <fw(a)deneb.enyo.de> Wed, 11 Jan 2017 11:50:31 +0100 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on quigon.federez.net -- apticron

8 années, 3 mois

Cron <root@hexagon> obnam --config /etc/obnam/to_quigon.profile backup 1>/dev/null

par root＠hexagon.federez.net