Monitoring Novembre 2019

monitoring@federez.net

7 participants
41 discussions

2 Debian package update(s) for quigon.federez.net

par root＠quigon.federez.net

apticron report [Wed, 13 Nov 2019 21:38:04 +0100] ======================================================================== apticron has detected that some packages need upgrading on: quigon.federez.net [ 160.228.155.65 ] The following packages are currently pending an upgrade: linux-image-4.9.0-11-amd64 4.9.189-3+deb9u2 linux-libc-dev 4.9.189-3+deb9u2 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour linux (linux-image-4.9.0-11-amd64 linux-libc-dev) --- linux (4.9.189-3+deb9u2) stretch-security; urgency=high * [x86] Add mitigation for TSX Asynchronous Abort (CVE-2019-11135): - KVM: x86: use Intel speculation bugs and features as derived in generic x86 code - x86/msr: Add the IA32_TSX_CTRL MSR - x86/cpu: Add a helper function x86_read_arch_cap_msr() - x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default - x86/speculation/taa: Add mitigation for TSX Async Abort - x86/speculation/taa: Add sysfs reporting for TSX Async Abort - kvm/x86: Export MDS_NO=0 to guests when TSX is enabled - x86/tsx: Add "auto" option to the tsx= cmdline parameter - x86/speculation/taa: Add documentation for TSX Async Abort - x86/tsx: Add config options to set tsx=on|off|auto - x86/speculation/taa: Fix printing of TAA_MSG_SMT on IBRS_ALL CPUs TSX is now disabled by default; see Documentation/hw-vuln/tsx_async_abort.rst * [x86] KVM: Add mitigation for Machine Check Error on Page Size Change (aka iTLB multi-hit, CVE-2018-12207): - KVM: x86: simplify ept_misconfig - KVM: x86: extend usage of RET_MMIO_PF_* constants - KVM: MMU: drop vcpu param in gpte_access - kvm: Convert kvm_lock to a mutex - kvm: x86: Do not release the page inside mmu_set_spte() - KVM: x86: make FNAME(fetch) and __direct_map more similar - KVM: x86: remove now unneeded hugepage gfn adjustment - KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON - KVM: x86: Add is_executable_pte() - KVM: x86: add tracepoints around __direct_map and FNAME(fetch) - KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is active - x86/bugs: Add ITLB_MULTIHIT bug infrastructure - cpu/speculation: Uninline and export CPU mitigations helpers - kvm: mmu: ITLB_MULTIHIT mitigation - kvm: Add helper function for creating VM worker threads - kvm: x86: mmu: Recovery of shattered NX large pages - Documentation: Add ITLB_MULTIHIT documentation * [x86] i915: Mitigate local privilege escalation on gen9 (CVE-2019-0155): - drm/i915: kick out cmd_parser specific structs from i915_drv.h - drm/i915: cleanup use of INSTR_CLIENT_MASK - drm/i915: return EACCES for check_cmd() failures - drm/i915: don't whitelist oacontrol in cmd parser - drm/i915: Use the precomputed value for whether to enable command parsing - drm/i915/cmdparser: Limit clflush to active cachelines - drm/i915/gtt: Add read only pages to gen8_pte_encode - drm/i915/gtt: Read-only pages for insert_entries on bdw+ - drm/i915/gtt: Disable read-only support under GVT - drm/i915: Prevent writing into a read-only object via a GGTT mmap - drm/i915/cmdparser: Check reg_table_count before derefencing. - drm/i915/cmdparser: Do not check past the cmd length. - drm/i915: Silence smatch for cmdparser - drm/i915: Move engine->needs_cmd_parser to engine->flags - drm/i915: Rename gen7 cmdparser tables - drm/i915: Disable Secure Batches for gen6+ - drm/i915: Remove Master tables from cmdparser - drm/i915: Add support for mandatory cmdparsing - drm/i915: Support ro ppgtt mapped cmdparser shadow buffers - drm/i915: Allow parsing of unsized batches - drm/i915: Add gen9 BCS cmdparsing - drm/i915/cmdparser: Use explicit goto for error paths - drm/i915/cmdparser: Add support for backward jumps - drm/i915/cmdparser: Ignore Length operands during command matching - drm/i915/cmdparser: Fix jump whitelist clearing * [x86] i915: Mitigate local denial-of-service on gen8/gen9 (CVE-2019-0154): - drm/i915: Lower RM timeout to avoid DSI hard hangs - drm/i915/gen8+: Add RC6 CTX corruption WA * drm/i915: Avoid ABI change for CVE-2019-0155 -- Ben Hutchings <ben(a)decadent.org.uk> Mon, 11 Nov 2019 12:18:59 +0000 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on quigon.federez.net -- apticron

5 années, 5 mois

*** SECURITY information for ldap.federez.net ***

par chirac＠federez.net

ldap.federez.net : Nov 13 13:14:06 : chirac : 1 incorrect password attempt ; TTY=pts/1 ; PWD=/home/chirac ; USER=root ; COMMAND=/usr/sbin/service freeradius restart

5 années, 5 mois

1 Debian package update(s) for nonagon.federez.net

par club-federez＠crans.org

apticron report [Wed, 13 Nov 2019 12:49:11 +0100] ======================================================================== apticron has detected that some packages need upgrading on: nonagon.federez.net [ 185.230.78.42 2a0c:700:0:23:67:e5ff:fee9:3 ] The following packages are currently pending an upgrade: linux-libc-dev 4.9.189-3+deb9u2 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour linux (linux-libc-dev) --- linux (4.9.189-3+deb9u2) stretch-security; urgency=high * [x86] Add mitigation for TSX Asynchronous Abort (CVE-2019-11135): - KVM: x86: use Intel speculation bugs and features as derived in generic x86 code - x86/msr: Add the IA32_TSX_CTRL MSR - x86/cpu: Add a helper function x86_read_arch_cap_msr() - x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default - x86/speculation/taa: Add mitigation for TSX Async Abort - x86/speculation/taa: Add sysfs reporting for TSX Async Abort - kvm/x86: Export MDS_NO=0 to guests when TSX is enabled - x86/tsx: Add "auto" option to the tsx= cmdline parameter - x86/speculation/taa: Add documentation for TSX Async Abort - x86/tsx: Add config options to set tsx=on|off|auto - x86/speculation/taa: Fix printing of TAA_MSG_SMT on IBRS_ALL CPUs TSX is now disabled by default; see Documentation/hw-vuln/tsx_async_abort.rst * [x86] KVM: Add mitigation for Machine Check Error on Page Size Change (aka iTLB multi-hit, CVE-2018-12207): - KVM: x86: simplify ept_misconfig - KVM: x86: extend usage of RET_MMIO_PF_* constants - KVM: MMU: drop vcpu param in gpte_access - kvm: Convert kvm_lock to a mutex - kvm: x86: Do not release the page inside mmu_set_spte() - KVM: x86: make FNAME(fetch) and __direct_map more similar - KVM: x86: remove now unneeded hugepage gfn adjustment - KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON - KVM: x86: Add is_executable_pte() - KVM: x86: add tracepoints around __direct_map and FNAME(fetch) - KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is active - x86/bugs: Add ITLB_MULTIHIT bug infrastructure - cpu/speculation: Uninline and export CPU mitigations helpers - kvm: mmu: ITLB_MULTIHIT mitigation - kvm: Add helper function for creating VM worker threads - kvm: x86: mmu: Recovery of shattered NX large pages - Documentation: Add ITLB_MULTIHIT documentation * [x86] i915: Mitigate local privilege escalation on gen9 (CVE-2019-0155): - drm/i915: kick out cmd_parser specific structs from i915_drv.h - drm/i915: cleanup use of INSTR_CLIENT_MASK - drm/i915: return EACCES for check_cmd() failures - drm/i915: don't whitelist oacontrol in cmd parser - drm/i915: Use the precomputed value for whether to enable command parsing - drm/i915/cmdparser: Limit clflush to active cachelines - drm/i915/gtt: Add read only pages to gen8_pte_encode - drm/i915/gtt: Read-only pages for insert_entries on bdw+ - drm/i915/gtt: Disable read-only support under GVT - drm/i915: Prevent writing into a read-only object via a GGTT mmap - drm/i915/cmdparser: Check reg_table_count before derefencing. - drm/i915/cmdparser: Do not check past the cmd length. - drm/i915: Silence smatch for cmdparser - drm/i915: Move engine->needs_cmd_parser to engine->flags - drm/i915: Rename gen7 cmdparser tables - drm/i915: Disable Secure Batches for gen6+ - drm/i915: Remove Master tables from cmdparser - drm/i915: Add support for mandatory cmdparsing - drm/i915: Support ro ppgtt mapped cmdparser shadow buffers - drm/i915: Allow parsing of unsized batches - drm/i915: Add gen9 BCS cmdparsing - drm/i915/cmdparser: Use explicit goto for error paths - drm/i915/cmdparser: Add support for backward jumps - drm/i915/cmdparser: Ignore Length operands during command matching - drm/i915/cmdparser: Fix jump whitelist clearing * [x86] i915: Mitigate local denial-of-service on gen8/gen9 (CVE-2019-0154): - drm/i915: Lower RM timeout to avoid DSI hard hangs - drm/i915/gen8+: Add RC6 CTX corruption WA * drm/i915: Avoid ABI change for CVE-2019-0155 -- Ben Hutchings <ben(a)decadent.org.uk> Mon, 11 Nov 2019 12:18:59 +0000 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on nonagon.federez.net -- apticron

5 années, 5 mois

Cron <root@dodecagon> test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )

par root＠federez.net

/etc/cron.daily/spamassassin: channel: SHA512 verification failed, channel failed sa-update failed for unknown reasons

5 années, 5 mois

2 Debian package update(s) for quigon.federez.net

par root＠quigon.federez.net

apticron report [Tue, 12 Nov 2019 21:38:08 +0100] ======================================================================== apticron has detected that some packages need upgrading on: quigon.federez.net [ 160.228.155.65 ] The following packages are currently pending an upgrade: linux-image-4.9.0-11-amd64 4.9.189-3+deb9u2 linux-libc-dev 4.9.189-3+deb9u2 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour linux (linux-image-4.9.0-11-amd64 linux-libc-dev) --- linux (4.9.189-3+deb9u2) stretch-security; urgency=high * [x86] Add mitigation for TSX Asynchronous Abort (CVE-2019-11135): - KVM: x86: use Intel speculation bugs and features as derived in generic x86 code - x86/msr: Add the IA32_TSX_CTRL MSR - x86/cpu: Add a helper function x86_read_arch_cap_msr() - x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default - x86/speculation/taa: Add mitigation for TSX Async Abort - x86/speculation/taa: Add sysfs reporting for TSX Async Abort - kvm/x86: Export MDS_NO=0 to guests when TSX is enabled - x86/tsx: Add "auto" option to the tsx= cmdline parameter - x86/speculation/taa: Add documentation for TSX Async Abort - x86/tsx: Add config options to set tsx=on|off|auto - x86/speculation/taa: Fix printing of TAA_MSG_SMT on IBRS_ALL CPUs TSX is now disabled by default; see Documentation/hw-vuln/tsx_async_abort.rst * [x86] KVM: Add mitigation for Machine Check Error on Page Size Change (aka iTLB multi-hit, CVE-2018-12207): - KVM: x86: simplify ept_misconfig - KVM: x86: extend usage of RET_MMIO_PF_* constants - KVM: MMU: drop vcpu param in gpte_access - kvm: Convert kvm_lock to a mutex - kvm: x86: Do not release the page inside mmu_set_spte() - KVM: x86: make FNAME(fetch) and __direct_map more similar - KVM: x86: remove now unneeded hugepage gfn adjustment - KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON - KVM: x86: Add is_executable_pte() - KVM: x86: add tracepoints around __direct_map and FNAME(fetch) - KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is active - x86/bugs: Add ITLB_MULTIHIT bug infrastructure - cpu/speculation: Uninline and export CPU mitigations helpers - kvm: mmu: ITLB_MULTIHIT mitigation - kvm: Add helper function for creating VM worker threads - kvm: x86: mmu: Recovery of shattered NX large pages - Documentation: Add ITLB_MULTIHIT documentation * [x86] i915: Mitigate local privilege escalation on gen9 (CVE-2019-0155): - drm/i915: kick out cmd_parser specific structs from i915_drv.h - drm/i915: cleanup use of INSTR_CLIENT_MASK - drm/i915: return EACCES for check_cmd() failures - drm/i915: don't whitelist oacontrol in cmd parser - drm/i915: Use the precomputed value for whether to enable command parsing - drm/i915/cmdparser: Limit clflush to active cachelines - drm/i915/gtt: Add read only pages to gen8_pte_encode - drm/i915/gtt: Read-only pages for insert_entries on bdw+ - drm/i915/gtt: Disable read-only support under GVT - drm/i915: Prevent writing into a read-only object via a GGTT mmap - drm/i915/cmdparser: Check reg_table_count before derefencing. - drm/i915/cmdparser: Do not check past the cmd length. - drm/i915: Silence smatch for cmdparser - drm/i915: Move engine->needs_cmd_parser to engine->flags - drm/i915: Rename gen7 cmdparser tables - drm/i915: Disable Secure Batches for gen6+ - drm/i915: Remove Master tables from cmdparser - drm/i915: Add support for mandatory cmdparsing - drm/i915: Support ro ppgtt mapped cmdparser shadow buffers - drm/i915: Allow parsing of unsized batches - drm/i915: Add gen9 BCS cmdparsing - drm/i915/cmdparser: Use explicit goto for error paths - drm/i915/cmdparser: Add support for backward jumps - drm/i915/cmdparser: Ignore Length operands during command matching - drm/i915/cmdparser: Fix jump whitelist clearing * [x86] i915: Mitigate local denial-of-service on gen8/gen9 (CVE-2019-0154): - drm/i915: Lower RM timeout to avoid DSI hard hangs - drm/i915/gen8+: Add RC6 CTX corruption WA * drm/i915: Avoid ABI change for CVE-2019-0155 -- Ben Hutchings <ben(a)decadent.org.uk> Mon, 11 Nov 2019 12:18:59 +0000 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on quigon.federez.net -- apticron

5 années, 5 mois

monit alert -- Exists amavis

par monit＠quigon.federez.net

Exists Service amavis Date: Tue, 05 Nov 2019 01:28:49 Action: alert Host: quigon.federez.net Description: process is running with pid 4353 Monit, unique employé de federez,

5 années, 5 mois

33 Debian package update(s) for quigon.federez.net

par root＠quigon.federez.net

apticron report [Mon, 04 Nov 2019 21:38:04 +0100] ======================================================================== apticron has detected that some packages need upgrading on: quigon.federez.net [ 160.228.155.65 ] The following packages are currently pending an upgrade: apache2 2.4.25-3+deb9u9 apache2-bin 2.4.25-3+deb9u9 apache2-data 2.4.25-3+deb9u9 apache2-utils 2.4.25-3+deb9u9 e2fslibs 1.43.4-2+deb9u1 e2fsprogs 1.43.4-2+deb9u1 file 1:5.30-1+deb9u3 libapache2-mod-php7.0 7.0.33-0+deb9u6 libcomerr2 1.43.4-2+deb9u1 libdatetime-timezone-perl 1:2.09-1+2019c libexpat1 2.2.0-2+deb9u3 libexpat1-dev 2.2.0-2+deb9u3 libmagic1 1:5.30-1+deb9u3 libmagic-mgc 1:5.30-1+deb9u3 libss2 1.43.4-2+deb9u1 libssl1.0.2 1.0.2t-1~deb9u1 libssl1.1 1.1.0l-1~deb9u1 libssl-dev 1.1.0l-1~deb9u1 linux-image-4.9.0-11-amd64 4.9.189-3+deb9u1 linux-libc-dev 4.9.189-3+deb9u1 openssl 1.1.0l-1~deb9u1 php7.0 7.0.33-0+deb9u6 php7.0-cli 7.0.33-0+deb9u6 php7.0-common 7.0.33-0+deb9u6 php7.0-json 7.0.33-0+deb9u6 php7.0-ldap 7.0.33-0+deb9u6 php7.0-opcache 7.0.33-0+deb9u6 php7.0-readline 7.0.33-0+deb9u6 python3-acme 0.28.0-1~deb9u2 python-acme 0.28.0-1~deb9u2 sudo 1.8.19p1-2.1+deb9u1 tcpdump 4.9.3-1~deb9u1 tzdata 2019c-0+deb9u1 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour e2fsprogs (e2fslibs e2fsprogs libcomerr2 libss2) --- e2fsprogs (1.43.4-2+deb9u1) stretch-security; urgency=high * Fix CVE-2019-5094: potential buffer overrun in e2fsck (Closes: #941139) -- Theodore Y. Ts'o <tytso(a)mit.edu> Wed, 25 Sep 2019 19:17:45 -0400 --- Modifications pour expat (libexpat1 libexpat1-dev) --- expat (2.2.0-2+deb9u3) stretch-security; urgency=high * Non-maintainer upload by the Security Team. * xmlparse.c: Deny internal entities closing the doctype (CVE-2019-15903) (Closes: #939394) -- Salvatore Bonaccorso <carnil(a)debian.org> Thu, 19 Sep 2019 23:43:05 +0200 --- Modifications pour file (file libmagic1 libmagic-mgc) --- file (1:5.30-1+deb9u3) stretch-security; urgency=high * Cherry-pick commit to restrict the number of CDF_VECTOR elements. Closes: #942830 [CVE-2019-18218] -- Christoph Biedl <debian.axhn(a)manchmal.in-ulm.de> Tue, 22 Oct 2019 22:20:07 +0200 --- Modifications pour linux (linux-image-4.9.0-11-amd64 linux-libc-dev) --- linux (4.9.189-3+deb9u1) stretch-security; urgency=high * vhost: make sure log_num < in_num (CVE-2019-14835) * ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit (CVE-2019-15117) * ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term (CVE-2019-15118) * [x86] ptrace: fix up botched merge of spectrev1 fix (CVE-2019-15902) * KVM: coalesced_mmio: add bounds checking (CVE-2019-14821) -- Salvatore Bonaccorso <carnil(a)debian.org> Fri, 20 Sep 2019 13:03:45 +0200 --- Modifications pour sudo --- sudo (1.8.19p1-2.1+deb9u1) stretch-security; urgency=high * Non-maintainer upload by the Security Team. * Treat an ID of -1 as invalid since that means "no change" (CVE-2019-14287) * Fix test failure in plugins/sudoers/regress/testsudoers/test5.sh -- Salvatore Bonaccorso <carnil(a)debian.org> Sat, 12 Oct 2019 16:20:21 +0200 --- Modifications pour tcpdump --- tcpdump (4.9.3-1~deb9u1) stretch-security; urgency=high * New upstream release, with fixes for 24 different CVEs (closes: #941698). This is an upstream update on top of the 4.9.2-1~deb9u1 package. * Disable tests that require a newer libpcap version. -- Romain Francoise <rfrancoise(a)debian.org> Sat, 19 Oct 2019 17:18:00 +0200 --- Modifications pour apache2 (apache2 apache2-bin apache2-data apache2-utils) --- apache2 (2.4.25-3+deb9u9) stretch-security; urgency=medium [ Xavier Guimard ] * Use correct patch for CVE-2019-10092. This fixes a regression in mod_proxy_balancer (Closes: #941202) -- Stefan Fritsch <sf(a)debian.org> Sun, 13 Oct 2019 17:43:54 +0200 --- Modifications pour libdatetime-timezone-perl --- libdatetime-timezone-perl (1:2.09-1+2019c) stretch; urgency=medium * Update to Olson database version 2019c. This update contains contemporary changes for Fiji and Norfolk Island. -- gregor herrmann <gregoa(a)debian.org> Sat, 14 Sep 2019 16:09:21 +0200 --- Modifications pour openssl (libssl1.1 libssl-dev openssl) --- openssl (1.1.0l-1~deb9u1) stretch-security; urgency=medium * Import 1.1.0l - CVE-2019-1547 (Compute ECC cofactors if not provided during EC_GROUP construction). - CVE-2019-1563 (Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey). -- Sebastian Andrzej Siewior <sebastian(a)breakpoint.cc> Fri, 27 Sep 2019 21:46:29 +0200 --- Modifications pour openssl1.0 (libssl1.0.2) --- openssl1.0 (1.0.2t-1~deb9u1) stretch-security; urgency=medium * Import 1.0.2t - CVE-2019-1547 (Compute ECC cofactors if not provided during EC_GROUP construction). - CVE-2019-1563 (Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey). -- Sebastian Andrzej Siewior <sebastian(a)breakpoint.cc> Fri, 27 Sep 2019 21:49:56 +0200 --- Modifications pour php7.0 (libapache2-mod-php7.0 php7.0 php7.0-cli php7.0-common php7.0-json php7.0-ldap php7.0-opcache php7.0-readline) --- php7.0 (7.0.33-0+deb9u6) stretch-security; urgency=medium * Backported from 7.1.33 - FPM: . Fixed bug #78599 (env_path_info underflow in fpm_main.c can lead to RCE). (CVE-2019-11043) -- Ondřej Surý <ondrej(a)debian.org> Thu, 24 Oct 2019 20:50:20 +0200 php7.0 (7.0.33-0+deb9u5) stretch-security; urgency=medium * Backported security fixes from PHP 7.1.29: - EXIF: . Fixed bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG). - Mail: . Fixed bug #77821 (Potential heap corruption in TSendMail()). * Backported from 7.1.30 - EXIF: . Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16). (CVE-2019-11040) - GD: . Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm). (CVE-2019-11038) - Iconv: . Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow). (CVE-2019-11039). - SQLite: . Fixed bug #77967 (Bypassing open_basedir restrictions via file uris). * Backported from 7.1.31 - EXIF: . Fixed bug #78256 (heap-buffer-overflow on exif_process_user_comment). (CVE-2019-11042) . Fixed bug #78222 (heap-buffer-overflow on exif_scan_thumbnail). (CVE-2019-11041) - Phar: . Fixed bug #77919 (Potential UAF in Phar RSHUTDOWN). - SQLite: . Upgraded to SQLite 3.28.0. * Backported from 7.1.32 - mbstring: . Fixed CVE-2019-13224 (don't allow different encodings for onig_new_deluxe) - pcre: . Fixed bug #75457 (heap use-after-free in pcrelib) -- Ondřej Surý <ondrej(a)sury.org> Wed, 18 Sep 2019 11:55:34 +0200 php7.0 (7.0.33-0+deb9u4) stretch-security; urgency=medium * Update d/watch for new php.net pages * Backported from 7.1.28 - EXIF: . (CVE-2019-11034) Fixed bug #77753 (Heap-buffer-overflow in php_ifd_get32s). . (CVE-2019-11035) Fixed bug #77831 (Heap-buffer-overflow in exif_iif_add_value). - SQLite3: . Added sqlite3.defensive INI directive. * Backported from PHP 7.1.29 - EXIF: . (CVE-2019-11036) Fixed bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG). - Mail: . Fixed bug #77821 (Potential heap corruption in TSendMail()). * Backported from 7.1.30 - EXIF: . (CVE-2019-11040) Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16). - GD: . (CVE-2019-11038) Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm). - Iconv: . (CVE-2019-11039) Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow). - SQLite: . Fixed bug #77967 (Bypassing open_basedir restrictions via file uris). -- Ondřej Surý <ondrej(a)sury.org> Sun, 09 Jun 2019 11:25:27 +0200 --- Modifications pour python-acme (python3-acme python-acme) --- python-acme (0.28.0-1~deb9u2) stretch; urgency=medium * This stretch update is to switch to using a POST-as-GET protocol before the November 1, 2019 deadline when Let's Encrypt will begin refusing requests using the (old) GET protocol. (Closes: #932248) -- Harlan Lieberman-Berg <hlieberman(a)debian.org> Wed, 31 Jul 2019 22:26:45 -0400 --- Modifications pour tzdata --- tzdata (2019c-0+deb9u1) stretch; urgency=medium * New upstream version, affecting the following future timestamps: - Fiji's next DST transitions will be 2019-11-10 and 2020-01-12 instead of 2019-11-03 and 2020-01-19. - Norfolk Island will observe Australian-style DST starting in spring 2019. The first transition is on 2019-10-06. -- Aurelien Jarno <aurel32(a)debian.org> Wed, 18 Sep 2019 00:40:44 +0200 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on quigon.federez.net -- apticron

5 années, 5 mois

33 Debian package update(s) for quigon.federez.net

par root＠quigon.federez.net

apticron report [Sun, 03 Nov 2019 21:38:04 +0100] ======================================================================== apticron has detected that some packages need upgrading on: quigon.federez.net [ 160.228.155.65 ] The following packages are currently pending an upgrade: apache2 2.4.25-3+deb9u9 apache2-bin 2.4.25-3+deb9u9 apache2-data 2.4.25-3+deb9u9 apache2-utils 2.4.25-3+deb9u9 e2fslibs 1.43.4-2+deb9u1 e2fsprogs 1.43.4-2+deb9u1 file 1:5.30-1+deb9u3 libapache2-mod-php7.0 7.0.33-0+deb9u6 libcomerr2 1.43.4-2+deb9u1 libdatetime-timezone-perl 1:2.09-1+2019c libexpat1 2.2.0-2+deb9u3 libexpat1-dev 2.2.0-2+deb9u3 libmagic1 1:5.30-1+deb9u3 libmagic-mgc 1:5.30-1+deb9u3 libss2 1.43.4-2+deb9u1 libssl1.0.2 1.0.2t-1~deb9u1 libssl1.1 1.1.0l-1~deb9u1 libssl-dev 1.1.0l-1~deb9u1 linux-image-4.9.0-11-amd64 4.9.189-3+deb9u1 linux-libc-dev 4.9.189-3+deb9u1 openssl 1.1.0l-1~deb9u1 php7.0 7.0.33-0+deb9u6 php7.0-cli 7.0.33-0+deb9u6 php7.0-common 7.0.33-0+deb9u6 php7.0-json 7.0.33-0+deb9u6 php7.0-ldap 7.0.33-0+deb9u6 php7.0-opcache 7.0.33-0+deb9u6 php7.0-readline 7.0.33-0+deb9u6 python3-acme 0.28.0-1~deb9u2 python-acme 0.28.0-1~deb9u2 sudo 1.8.19p1-2.1+deb9u1 tcpdump 4.9.3-1~deb9u1 tzdata 2019c-0+deb9u1 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour e2fsprogs (e2fslibs e2fsprogs libcomerr2 libss2) --- e2fsprogs (1.43.4-2+deb9u1) stretch-security; urgency=high * Fix CVE-2019-5094: potential buffer overrun in e2fsck (Closes: #941139) -- Theodore Y. Ts'o <tytso(a)mit.edu> Wed, 25 Sep 2019 19:17:45 -0400 --- Modifications pour expat (libexpat1 libexpat1-dev) --- expat (2.2.0-2+deb9u3) stretch-security; urgency=high * Non-maintainer upload by the Security Team. * xmlparse.c: Deny internal entities closing the doctype (CVE-2019-15903) (Closes: #939394) -- Salvatore Bonaccorso <carnil(a)debian.org> Thu, 19 Sep 2019 23:43:05 +0200 --- Modifications pour file (file libmagic1 libmagic-mgc) --- file (1:5.30-1+deb9u3) stretch-security; urgency=high * Cherry-pick commit to restrict the number of CDF_VECTOR elements. Closes: #942830 [CVE-2019-18218] -- Christoph Biedl <debian.axhn(a)manchmal.in-ulm.de> Tue, 22 Oct 2019 22:20:07 +0200 --- Modifications pour linux (linux-image-4.9.0-11-amd64 linux-libc-dev) --- linux (4.9.189-3+deb9u1) stretch-security; urgency=high * vhost: make sure log_num < in_num (CVE-2019-14835) * ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit (CVE-2019-15117) * ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term (CVE-2019-15118) * [x86] ptrace: fix up botched merge of spectrev1 fix (CVE-2019-15902) * KVM: coalesced_mmio: add bounds checking (CVE-2019-14821) -- Salvatore Bonaccorso <carnil(a)debian.org> Fri, 20 Sep 2019 13:03:45 +0200 --- Modifications pour sudo --- sudo (1.8.19p1-2.1+deb9u1) stretch-security; urgency=high * Non-maintainer upload by the Security Team. * Treat an ID of -1 as invalid since that means "no change" (CVE-2019-14287) * Fix test failure in plugins/sudoers/regress/testsudoers/test5.sh -- Salvatore Bonaccorso <carnil(a)debian.org> Sat, 12 Oct 2019 16:20:21 +0200 --- Modifications pour tcpdump --- tcpdump (4.9.3-1~deb9u1) stretch-security; urgency=high * New upstream release, with fixes for 24 different CVEs (closes: #941698). This is an upstream update on top of the 4.9.2-1~deb9u1 package. * Disable tests that require a newer libpcap version. -- Romain Francoise <rfrancoise(a)debian.org> Sat, 19 Oct 2019 17:18:00 +0200 --- Modifications pour apache2 (apache2 apache2-bin apache2-data apache2-utils) --- apache2 (2.4.25-3+deb9u9) stretch-security; urgency=medium [ Xavier Guimard ] * Use correct patch for CVE-2019-10092. This fixes a regression in mod_proxy_balancer (Closes: #941202) -- Stefan Fritsch <sf(a)debian.org> Sun, 13 Oct 2019 17:43:54 +0200 --- Modifications pour libdatetime-timezone-perl --- libdatetime-timezone-perl (1:2.09-1+2019c) stretch; urgency=medium * Update to Olson database version 2019c. This update contains contemporary changes for Fiji and Norfolk Island. -- gregor herrmann <gregoa(a)debian.org> Sat, 14 Sep 2019 16:09:21 +0200 --- Modifications pour openssl (libssl1.1 libssl-dev openssl) --- openssl (1.1.0l-1~deb9u1) stretch-security; urgency=medium * Import 1.1.0l - CVE-2019-1547 (Compute ECC cofactors if not provided during EC_GROUP construction). - CVE-2019-1563 (Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey). -- Sebastian Andrzej Siewior <sebastian(a)breakpoint.cc> Fri, 27 Sep 2019 21:46:29 +0200 --- Modifications pour openssl1.0 (libssl1.0.2) --- openssl1.0 (1.0.2t-1~deb9u1) stretch-security; urgency=medium * Import 1.0.2t - CVE-2019-1547 (Compute ECC cofactors if not provided during EC_GROUP construction). - CVE-2019-1563 (Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey). -- Sebastian Andrzej Siewior <sebastian(a)breakpoint.cc> Fri, 27 Sep 2019 21:49:56 +0200 --- Modifications pour php7.0 (libapache2-mod-php7.0 php7.0 php7.0-cli php7.0-common php7.0-json php7.0-ldap php7.0-opcache php7.0-readline) --- php7.0 (7.0.33-0+deb9u6) stretch-security; urgency=medium * Backported from 7.1.33 - FPM: . Fixed bug #78599 (env_path_info underflow in fpm_main.c can lead to RCE). (CVE-2019-11043) -- Ondřej Surý <ondrej(a)debian.org> Thu, 24 Oct 2019 20:50:20 +0200 php7.0 (7.0.33-0+deb9u5) stretch-security; urgency=medium * Backported security fixes from PHP 7.1.29: - EXIF: . Fixed bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG). - Mail: . Fixed bug #77821 (Potential heap corruption in TSendMail()). * Backported from 7.1.30 - EXIF: . Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16). (CVE-2019-11040) - GD: . Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm). (CVE-2019-11038) - Iconv: . Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow). (CVE-2019-11039). - SQLite: . Fixed bug #77967 (Bypassing open_basedir restrictions via file uris). * Backported from 7.1.31 - EXIF: . Fixed bug #78256 (heap-buffer-overflow on exif_process_user_comment). (CVE-2019-11042) . Fixed bug #78222 (heap-buffer-overflow on exif_scan_thumbnail). (CVE-2019-11041) - Phar: . Fixed bug #77919 (Potential UAF in Phar RSHUTDOWN). - SQLite: . Upgraded to SQLite 3.28.0. * Backported from 7.1.32 - mbstring: . Fixed CVE-2019-13224 (don't allow different encodings for onig_new_deluxe) - pcre: . Fixed bug #75457 (heap use-after-free in pcrelib) -- Ondřej Surý <ondrej(a)sury.org> Wed, 18 Sep 2019 11:55:34 +0200 php7.0 (7.0.33-0+deb9u4) stretch-security; urgency=medium * Update d/watch for new php.net pages * Backported from 7.1.28 - EXIF: . (CVE-2019-11034) Fixed bug #77753 (Heap-buffer-overflow in php_ifd_get32s). . (CVE-2019-11035) Fixed bug #77831 (Heap-buffer-overflow in exif_iif_add_value). - SQLite3: . Added sqlite3.defensive INI directive. * Backported from PHP 7.1.29 - EXIF: . (CVE-2019-11036) Fixed bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG). - Mail: . Fixed bug #77821 (Potential heap corruption in TSendMail()). * Backported from 7.1.30 - EXIF: . (CVE-2019-11040) Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16). - GD: . (CVE-2019-11038) Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm). - Iconv: . (CVE-2019-11039) Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow). - SQLite: . Fixed bug #77967 (Bypassing open_basedir restrictions via file uris). -- Ondřej Surý <ondrej(a)sury.org> Sun, 09 Jun 2019 11:25:27 +0200 --- Modifications pour python-acme (python3-acme python-acme) --- python-acme (0.28.0-1~deb9u2) stretch; urgency=medium * This stretch update is to switch to using a POST-as-GET protocol before the November 1, 2019 deadline when Let's Encrypt will begin refusing requests using the (old) GET protocol. (Closes: #932248) -- Harlan Lieberman-Berg <hlieberman(a)debian.org> Wed, 31 Jul 2019 22:26:45 -0400 --- Modifications pour tzdata --- tzdata (2019c-0+deb9u1) stretch; urgency=medium * New upstream version, affecting the following future timestamps: - Fiji's next DST transitions will be 2019-11-10 and 2020-01-12 instead of 2019-11-03 and 2020-01-19. - Norfolk Island will observe Australian-style DST starting in spring 2019. The first transition is on 2019-10-06. -- Aurelien Jarno <aurel32(a)debian.org> Wed, 18 Sep 2019 00:40:44 +0200 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on quigon.federez.net -- apticron

5 années, 5 mois

33 Debian package update(s) for quigon.federez.net

par root＠quigon.federez.net

apticron report [Sat, 02 Nov 2019 21:38:04 +0100] ======================================================================== apticron has detected that some packages need upgrading on: quigon.federez.net [ 160.228.155.65 ] The following packages are currently pending an upgrade: apache2 2.4.25-3+deb9u9 apache2-bin 2.4.25-3+deb9u9 apache2-data 2.4.25-3+deb9u9 apache2-utils 2.4.25-3+deb9u9 e2fslibs 1.43.4-2+deb9u1 e2fsprogs 1.43.4-2+deb9u1 file 1:5.30-1+deb9u3 libapache2-mod-php7.0 7.0.33-0+deb9u6 libcomerr2 1.43.4-2+deb9u1 libdatetime-timezone-perl 1:2.09-1+2019c libexpat1 2.2.0-2+deb9u3 libexpat1-dev 2.2.0-2+deb9u3 libmagic1 1:5.30-1+deb9u3 libmagic-mgc 1:5.30-1+deb9u3 libss2 1.43.4-2+deb9u1 libssl1.0.2 1.0.2t-1~deb9u1 libssl1.1 1.1.0l-1~deb9u1 libssl-dev 1.1.0l-1~deb9u1 linux-image-4.9.0-11-amd64 4.9.189-3+deb9u1 linux-libc-dev 4.9.189-3+deb9u1 openssl 1.1.0l-1~deb9u1 php7.0 7.0.33-0+deb9u6 php7.0-cli 7.0.33-0+deb9u6 php7.0-common 7.0.33-0+deb9u6 php7.0-json 7.0.33-0+deb9u6 php7.0-ldap 7.0.33-0+deb9u6 php7.0-opcache 7.0.33-0+deb9u6 php7.0-readline 7.0.33-0+deb9u6 python3-acme 0.28.0-1~deb9u2 python-acme 0.28.0-1~deb9u2 sudo 1.8.19p1-2.1+deb9u1 tcpdump 4.9.3-1~deb9u1 tzdata 2019c-0+deb9u1 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour e2fsprogs (e2fslibs e2fsprogs libcomerr2 libss2) --- e2fsprogs (1.43.4-2+deb9u1) stretch-security; urgency=high * Fix CVE-2019-5094: potential buffer overrun in e2fsck (Closes: #941139) -- Theodore Y. Ts'o <tytso(a)mit.edu> Wed, 25 Sep 2019 19:17:45 -0400 --- Modifications pour expat (libexpat1 libexpat1-dev) --- expat (2.2.0-2+deb9u3) stretch-security; urgency=high * Non-maintainer upload by the Security Team. * xmlparse.c: Deny internal entities closing the doctype (CVE-2019-15903) (Closes: #939394) -- Salvatore Bonaccorso <carnil(a)debian.org> Thu, 19 Sep 2019 23:43:05 +0200 --- Modifications pour file (file libmagic1 libmagic-mgc) --- file (1:5.30-1+deb9u3) stretch-security; urgency=high * Cherry-pick commit to restrict the number of CDF_VECTOR elements. Closes: #942830 [CVE-2019-18218] -- Christoph Biedl <debian.axhn(a)manchmal.in-ulm.de> Tue, 22 Oct 2019 22:20:07 +0200 --- Modifications pour linux (linux-image-4.9.0-11-amd64 linux-libc-dev) --- linux (4.9.189-3+deb9u1) stretch-security; urgency=high * vhost: make sure log_num < in_num (CVE-2019-14835) * ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit (CVE-2019-15117) * ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term (CVE-2019-15118) * [x86] ptrace: fix up botched merge of spectrev1 fix (CVE-2019-15902) * KVM: coalesced_mmio: add bounds checking (CVE-2019-14821) -- Salvatore Bonaccorso <carnil(a)debian.org> Fri, 20 Sep 2019 13:03:45 +0200 --- Modifications pour sudo --- sudo (1.8.19p1-2.1+deb9u1) stretch-security; urgency=high * Non-maintainer upload by the Security Team. * Treat an ID of -1 as invalid since that means "no change" (CVE-2019-14287) * Fix test failure in plugins/sudoers/regress/testsudoers/test5.sh -- Salvatore Bonaccorso <carnil(a)debian.org> Sat, 12 Oct 2019 16:20:21 +0200 --- Modifications pour tcpdump --- tcpdump (4.9.3-1~deb9u1) stretch-security; urgency=high * New upstream release, with fixes for 24 different CVEs (closes: #941698). This is an upstream update on top of the 4.9.2-1~deb9u1 package. * Disable tests that require a newer libpcap version. -- Romain Francoise <rfrancoise(a)debian.org> Sat, 19 Oct 2019 17:18:00 +0200 --- Modifications pour apache2 (apache2 apache2-bin apache2-data apache2-utils) --- apache2 (2.4.25-3+deb9u9) stretch-security; urgency=medium [ Xavier Guimard ] * Use correct patch for CVE-2019-10092. This fixes a regression in mod_proxy_balancer (Closes: #941202) -- Stefan Fritsch <sf(a)debian.org> Sun, 13 Oct 2019 17:43:54 +0200 --- Modifications pour libdatetime-timezone-perl --- libdatetime-timezone-perl (1:2.09-1+2019c) stretch; urgency=medium * Update to Olson database version 2019c. This update contains contemporary changes for Fiji and Norfolk Island. -- gregor herrmann <gregoa(a)debian.org> Sat, 14 Sep 2019 16:09:21 +0200 --- Modifications pour openssl (libssl1.1 libssl-dev openssl) --- openssl (1.1.0l-1~deb9u1) stretch-security; urgency=medium * Import 1.1.0l - CVE-2019-1547 (Compute ECC cofactors if not provided during EC_GROUP construction). - CVE-2019-1563 (Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey). -- Sebastian Andrzej Siewior <sebastian(a)breakpoint.cc> Fri, 27 Sep 2019 21:46:29 +0200 --- Modifications pour openssl1.0 (libssl1.0.2) --- openssl1.0 (1.0.2t-1~deb9u1) stretch-security; urgency=medium * Import 1.0.2t - CVE-2019-1547 (Compute ECC cofactors if not provided during EC_GROUP construction). - CVE-2019-1563 (Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey). -- Sebastian Andrzej Siewior <sebastian(a)breakpoint.cc> Fri, 27 Sep 2019 21:49:56 +0200 --- Modifications pour php7.0 (libapache2-mod-php7.0 php7.0 php7.0-cli php7.0-common php7.0-json php7.0-ldap php7.0-opcache php7.0-readline) --- php7.0 (7.0.33-0+deb9u6) stretch-security; urgency=medium * Backported from 7.1.33 - FPM: . Fixed bug #78599 (env_path_info underflow in fpm_main.c can lead to RCE). (CVE-2019-11043) -- Ondřej Surý <ondrej(a)debian.org> Thu, 24 Oct 2019 20:50:20 +0200 php7.0 (7.0.33-0+deb9u5) stretch-security; urgency=medium * Backported security fixes from PHP 7.1.29: - EXIF: . Fixed bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG). - Mail: . Fixed bug #77821 (Potential heap corruption in TSendMail()). * Backported from 7.1.30 - EXIF: . Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16). (CVE-2019-11040) - GD: . Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm). (CVE-2019-11038) - Iconv: . Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow). (CVE-2019-11039). - SQLite: . Fixed bug #77967 (Bypassing open_basedir restrictions via file uris). * Backported from 7.1.31 - EXIF: . Fixed bug #78256 (heap-buffer-overflow on exif_process_user_comment). (CVE-2019-11042) . Fixed bug #78222 (heap-buffer-overflow on exif_scan_thumbnail). (CVE-2019-11041) - Phar: . Fixed bug #77919 (Potential UAF in Phar RSHUTDOWN). - SQLite: . Upgraded to SQLite 3.28.0. * Backported from 7.1.32 - mbstring: . Fixed CVE-2019-13224 (don't allow different encodings for onig_new_deluxe) - pcre: . Fixed bug #75457 (heap use-after-free in pcrelib) -- Ondřej Surý <ondrej(a)sury.org> Wed, 18 Sep 2019 11:55:34 +0200 php7.0 (7.0.33-0+deb9u4) stretch-security; urgency=medium * Update d/watch for new php.net pages * Backported from 7.1.28 - EXIF: . (CVE-2019-11034) Fixed bug #77753 (Heap-buffer-overflow in php_ifd_get32s). . (CVE-2019-11035) Fixed bug #77831 (Heap-buffer-overflow in exif_iif_add_value). - SQLite3: . Added sqlite3.defensive INI directive. * Backported from PHP 7.1.29 - EXIF: . (CVE-2019-11036) Fixed bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG). - Mail: . Fixed bug #77821 (Potential heap corruption in TSendMail()). * Backported from 7.1.30 - EXIF: . (CVE-2019-11040) Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16). - GD: . (CVE-2019-11038) Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm). - Iconv: . (CVE-2019-11039) Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow). - SQLite: . Fixed bug #77967 (Bypassing open_basedir restrictions via file uris). -- Ondřej Surý <ondrej(a)sury.org> Sun, 09 Jun 2019 11:25:27 +0200 --- Modifications pour python-acme (python3-acme python-acme) --- python-acme (0.28.0-1~deb9u2) stretch; urgency=medium * This stretch update is to switch to using a POST-as-GET protocol before the November 1, 2019 deadline when Let's Encrypt will begin refusing requests using the (old) GET protocol. (Closes: #932248) -- Harlan Lieberman-Berg <hlieberman(a)debian.org> Wed, 31 Jul 2019 22:26:45 -0400 --- Modifications pour tzdata --- tzdata (2019c-0+deb9u1) stretch; urgency=medium * New upstream version, affecting the following future timestamps: - Fiji's next DST transitions will be 2019-11-10 and 2020-01-12 instead of 2019-11-03 and 2020-01-19. - Norfolk Island will observe Australian-style DST starting in spring 2019. The first transition is on 2019-10-06. -- Aurelien Jarno <aurel32(a)debian.org> Wed, 18 Sep 2019 00:40:44 +0200 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on quigon.federez.net -- apticron

5 années, 5 mois

33 Debian package update(s) for quigon.federez.net

par root＠quigon.federez.net

apticron report [Fri, 01 Nov 2019 21:38:04 +0100] ======================================================================== apticron has detected that some packages need upgrading on: quigon.federez.net [ 160.228.155.65 ] The following packages are currently pending an upgrade: apache2 2.4.25-3+deb9u9 apache2-bin 2.4.25-3+deb9u9 apache2-data 2.4.25-3+deb9u9 apache2-utils 2.4.25-3+deb9u9 e2fslibs 1.43.4-2+deb9u1 e2fsprogs 1.43.4-2+deb9u1 file 1:5.30-1+deb9u3 libapache2-mod-php7.0 7.0.33-0+deb9u6 libcomerr2 1.43.4-2+deb9u1 libdatetime-timezone-perl 1:2.09-1+2019c libexpat1 2.2.0-2+deb9u3 libexpat1-dev 2.2.0-2+deb9u3 libmagic1 1:5.30-1+deb9u3 libmagic-mgc 1:5.30-1+deb9u3 libss2 1.43.4-2+deb9u1 libssl1.0.2 1.0.2t-1~deb9u1 libssl1.1 1.1.0l-1~deb9u1 libssl-dev 1.1.0l-1~deb9u1 linux-image-4.9.0-11-amd64 4.9.189-3+deb9u1 linux-libc-dev 4.9.189-3+deb9u1 openssl 1.1.0l-1~deb9u1 php7.0 7.0.33-0+deb9u6 php7.0-cli 7.0.33-0+deb9u6 php7.0-common 7.0.33-0+deb9u6 php7.0-json 7.0.33-0+deb9u6 php7.0-ldap 7.0.33-0+deb9u6 php7.0-opcache 7.0.33-0+deb9u6 php7.0-readline 7.0.33-0+deb9u6 python3-acme 0.28.0-1~deb9u2 python-acme 0.28.0-1~deb9u2 sudo 1.8.19p1-2.1+deb9u1 tcpdump 4.9.3-1~deb9u1 tzdata 2019c-0+deb9u1 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour e2fsprogs (e2fslibs e2fsprogs libcomerr2 libss2) --- e2fsprogs (1.43.4-2+deb9u1) stretch-security; urgency=high * Fix CVE-2019-5094: potential buffer overrun in e2fsck (Closes: #941139) -- Theodore Y. Ts'o <tytso(a)mit.edu> Wed, 25 Sep 2019 19:17:45 -0400 --- Modifications pour expat (libexpat1 libexpat1-dev) --- expat (2.2.0-2+deb9u3) stretch-security; urgency=high * Non-maintainer upload by the Security Team. * xmlparse.c: Deny internal entities closing the doctype (CVE-2019-15903) (Closes: #939394) -- Salvatore Bonaccorso <carnil(a)debian.org> Thu, 19 Sep 2019 23:43:05 +0200 --- Modifications pour file (file libmagic1 libmagic-mgc) --- file (1:5.30-1+deb9u3) stretch-security; urgency=high * Cherry-pick commit to restrict the number of CDF_VECTOR elements. Closes: #942830 [CVE-2019-18218] -- Christoph Biedl <debian.axhn(a)manchmal.in-ulm.de> Tue, 22 Oct 2019 22:20:07 +0200 --- Modifications pour linux (linux-image-4.9.0-11-amd64 linux-libc-dev) --- linux (4.9.189-3+deb9u1) stretch-security; urgency=high * vhost: make sure log_num < in_num (CVE-2019-14835) * ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit (CVE-2019-15117) * ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term (CVE-2019-15118) * [x86] ptrace: fix up botched merge of spectrev1 fix (CVE-2019-15902) * KVM: coalesced_mmio: add bounds checking (CVE-2019-14821) -- Salvatore Bonaccorso <carnil(a)debian.org> Fri, 20 Sep 2019 13:03:45 +0200 --- Modifications pour sudo --- sudo (1.8.19p1-2.1+deb9u1) stretch-security; urgency=high * Non-maintainer upload by the Security Team. * Treat an ID of -1 as invalid since that means "no change" (CVE-2019-14287) * Fix test failure in plugins/sudoers/regress/testsudoers/test5.sh -- Salvatore Bonaccorso <carnil(a)debian.org> Sat, 12 Oct 2019 16:20:21 +0200 --- Modifications pour tcpdump --- tcpdump (4.9.3-1~deb9u1) stretch-security; urgency=high * New upstream release, with fixes for 24 different CVEs (closes: #941698). This is an upstream update on top of the 4.9.2-1~deb9u1 package. * Disable tests that require a newer libpcap version. -- Romain Francoise <rfrancoise(a)debian.org> Sat, 19 Oct 2019 17:18:00 +0200 --- Modifications pour apache2 (apache2 apache2-bin apache2-data apache2-utils) --- apache2 (2.4.25-3+deb9u9) stretch-security; urgency=medium [ Xavier Guimard ] * Use correct patch for CVE-2019-10092. This fixes a regression in mod_proxy_balancer (Closes: #941202) -- Stefan Fritsch <sf(a)debian.org> Sun, 13 Oct 2019 17:43:54 +0200 --- Modifications pour libdatetime-timezone-perl --- libdatetime-timezone-perl (1:2.09-1+2019c) stretch; urgency=medium * Update to Olson database version 2019c. This update contains contemporary changes for Fiji and Norfolk Island. -- gregor herrmann <gregoa(a)debian.org> Sat, 14 Sep 2019 16:09:21 +0200 --- Modifications pour openssl (libssl1.1 libssl-dev openssl) --- openssl (1.1.0l-1~deb9u1) stretch-security; urgency=medium * Import 1.1.0l - CVE-2019-1547 (Compute ECC cofactors if not provided during EC_GROUP construction). - CVE-2019-1563 (Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey). -- Sebastian Andrzej Siewior <sebastian(a)breakpoint.cc> Fri, 27 Sep 2019 21:46:29 +0200 --- Modifications pour openssl1.0 (libssl1.0.2) --- openssl1.0 (1.0.2t-1~deb9u1) stretch-security; urgency=medium * Import 1.0.2t - CVE-2019-1547 (Compute ECC cofactors if not provided during EC_GROUP construction). - CVE-2019-1563 (Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey). -- Sebastian Andrzej Siewior <sebastian(a)breakpoint.cc> Fri, 27 Sep 2019 21:49:56 +0200 --- Modifications pour php7.0 (libapache2-mod-php7.0 php7.0 php7.0-cli php7.0-common php7.0-json php7.0-ldap php7.0-opcache php7.0-readline) --- php7.0 (7.0.33-0+deb9u6) stretch-security; urgency=medium * Backported from 7.1.33 - FPM: . Fixed bug #78599 (env_path_info underflow in fpm_main.c can lead to RCE). (CVE-2019-11043) -- Ondřej Surý <ondrej(a)debian.org> Thu, 24 Oct 2019 20:50:20 +0200 php7.0 (7.0.33-0+deb9u5) stretch-security; urgency=medium * Backported security fixes from PHP 7.1.29: - EXIF: . Fixed bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG). - Mail: . Fixed bug #77821 (Potential heap corruption in TSendMail()). * Backported from 7.1.30 - EXIF: . Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16). (CVE-2019-11040) - GD: . Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm). (CVE-2019-11038) - Iconv: . Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow). (CVE-2019-11039). - SQLite: . Fixed bug #77967 (Bypassing open_basedir restrictions via file uris). * Backported from 7.1.31 - EXIF: . Fixed bug #78256 (heap-buffer-overflow on exif_process_user_comment). (CVE-2019-11042) . Fixed bug #78222 (heap-buffer-overflow on exif_scan_thumbnail). (CVE-2019-11041) - Phar: . Fixed bug #77919 (Potential UAF in Phar RSHUTDOWN). - SQLite: . Upgraded to SQLite 3.28.0. * Backported from 7.1.32 - mbstring: . Fixed CVE-2019-13224 (don't allow different encodings for onig_new_deluxe) - pcre: . Fixed bug #75457 (heap use-after-free in pcrelib) -- Ondřej Surý <ondrej(a)sury.org> Wed, 18 Sep 2019 11:55:34 +0200 php7.0 (7.0.33-0+deb9u4) stretch-security; urgency=medium * Update d/watch for new php.net pages * Backported from 7.1.28 - EXIF: . (CVE-2019-11034) Fixed bug #77753 (Heap-buffer-overflow in php_ifd_get32s). . (CVE-2019-11035) Fixed bug #77831 (Heap-buffer-overflow in exif_iif_add_value). - SQLite3: . Added sqlite3.defensive INI directive. * Backported from PHP 7.1.29 - EXIF: . (CVE-2019-11036) Fixed bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG). - Mail: . Fixed bug #77821 (Potential heap corruption in TSendMail()). * Backported from 7.1.30 - EXIF: . (CVE-2019-11040) Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16). - GD: . (CVE-2019-11038) Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm). - Iconv: . (CVE-2019-11039) Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow). - SQLite: . Fixed bug #77967 (Bypassing open_basedir restrictions via file uris). -- Ondřej Surý <ondrej(a)sury.org> Sun, 09 Jun 2019 11:25:27 +0200 --- Modifications pour python-acme (python3-acme python-acme) --- python-acme (0.28.0-1~deb9u2) stretch; urgency=medium * This stretch update is to switch to using a POST-as-GET protocol before the November 1, 2019 deadline when Let's Encrypt will begin refusing requests using the (old) GET protocol. (Closes: #932248) -- Harlan Lieberman-Berg <hlieberman(a)debian.org> Wed, 31 Jul 2019 22:26:45 -0400 --- Modifications pour tzdata --- tzdata (2019c-0+deb9u1) stretch; urgency=medium * New upstream version, affecting the following future timestamps: - Fiji's next DST transitions will be 2019-11-10 and 2020-01-12 instead of 2019-11-03 and 2020-01-19. - Norfolk Island will observe Australian-style DST starting in spring 2019. The first transition is on 2019-10-06. -- Aurelien Jarno <aurel32(a)debian.org> Wed, 18 Sep 2019 00:40:44 +0200 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on quigon.federez.net -- apticron

5 années, 5 mois

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

Monitoring Novembre 2019