Monitoring Juin 2019

monitoring@federez.net

2 participants
17 discussions

6 Debian package update(s) for nonagon.federez.net

par club-federez＠crans.org

apticron report [Thu, 20 Jun 2019 18:49:14 +0200] ======================================================================== apticron has detected that some packages need upgrading on: nonagon.federez.net [ 185.230.78.42 2a0c:700:0:23:67:e5ff:fee9:3 ] The following packages are currently pending an upgrade: vim 2:8.0.0197-4+deb9u2 vim-common 2:8.0.0197-4+deb9u2 vim-nox 2:8.0.0197-4+deb9u2 vim-runtime 2:8.0.0197-4+deb9u2 vim-tiny 2:8.0.0197-4+deb9u2 xxd 2:8.0.0197-4+deb9u2 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour vim (vim vim-common vim-nox vim-runtime vim-tiny xxd) --- vim (2:8.0.0197-4+deb9u2) stretch-security; urgency=high * Backport patches to address CVE-2019-12735 (Closes: #930020) + 8.0.0649: when opening a help file the filetype is set several times + 8.0.0651: build failure without the auto command feature + 8.1.0066: nasty autocommand causes using freed memory + 8.1.0177: defining function in sandbox is inconsistent + 8.1.0189: function defined in sandbox not tested + 8.1.0205: invalid memory access with invalid modeline + 8.1.0206: duplicate test function name + 8.1.0208: file left behind after running individual test + 8.1.0506: modelinen test fails when run by root + 8.1.0538: evaluating a modeline might invoke using a shell command + 8.1.0539: cannot build without the sandbox + 8.1.0540: may evaluate insecure value when appending to option + 8.1.0544: setting 'filetype' in a modeline causes an error + 8.1.0546: modeline test with keymap fails + 8.1.0547: modeline test with keymap still fails + 8.1.0613: when executing an insecure function the secure flag is stuck + 8.1.1046: the "secure" variable is used inconsistently + 8.1.1365: source command doesn't check for the sandbox + 8.1.1366: using expressions in a modeline is unsafe + 8.1.1367: can set 'modelineexpr' in modeline + 8.1.1368: modeline test fails with python but without pythonhome + 8.1.1382: error when editing test files + 8.1.1401: misspelled mkspellmem and makespellmem * gbp.conf: Set debian-branch to debian/stretch * gbp.conf: Set upstream-tag to v%(version)s -- James McCoy <jamessan(a)debian.org> Sun, 16 Jun 2019 13:06:40 -0400 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on nonagon.federez.net -- apticron

5 années, 10 mois

6 Debian package update(s) for nonagon.federez.net

par club-federez＠crans.org

apticron report [Wed, 19 Jun 2019 18:49:15 +0200] ======================================================================== apticron has detected that some packages need upgrading on: nonagon.federez.net [ 185.230.78.42 2a0c:700:0:23:67:e5ff:fee9:3 ] The following packages are currently pending an upgrade: vim 2:8.0.0197-4+deb9u2 vim-common 2:8.0.0197-4+deb9u2 vim-nox 2:8.0.0197-4+deb9u2 vim-runtime 2:8.0.0197-4+deb9u2 vim-tiny 2:8.0.0197-4+deb9u2 xxd 2:8.0.0197-4+deb9u2 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour vim (vim vim-common vim-nox vim-runtime vim-tiny xxd) --- vim (2:8.0.0197-4+deb9u2) stretch-security; urgency=high * Backport patches to address CVE-2019-12735 (Closes: #930020) + 8.0.0649: when opening a help file the filetype is set several times + 8.0.0651: build failure without the auto command feature + 8.1.0066: nasty autocommand causes using freed memory + 8.1.0177: defining function in sandbox is inconsistent + 8.1.0189: function defined in sandbox not tested + 8.1.0205: invalid memory access with invalid modeline + 8.1.0206: duplicate test function name + 8.1.0208: file left behind after running individual test + 8.1.0506: modelinen test fails when run by root + 8.1.0538: evaluating a modeline might invoke using a shell command + 8.1.0539: cannot build without the sandbox + 8.1.0540: may evaluate insecure value when appending to option + 8.1.0544: setting 'filetype' in a modeline causes an error + 8.1.0546: modeline test with keymap fails + 8.1.0547: modeline test with keymap still fails + 8.1.0613: when executing an insecure function the secure flag is stuck + 8.1.1046: the "secure" variable is used inconsistently + 8.1.1365: source command doesn't check for the sandbox + 8.1.1366: using expressions in a modeline is unsafe + 8.1.1367: can set 'modelineexpr' in modeline + 8.1.1368: modeline test fails with python but without pythonhome + 8.1.1382: error when editing test files + 8.1.1401: misspelled mkspellmem and makespellmem * gbp.conf: Set debian-branch to debian/stretch * gbp.conf: Set upstream-tag to v%(version)s -- James McCoy <jamessan(a)debian.org> Sun, 16 Jun 2019 13:06:40 -0400 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on nonagon.federez.net -- apticron

5 années, 10 mois

6 Debian package update(s) for nonagon.federez.net

par club-federez＠crans.org

apticron report [Mon, 17 Jun 2019 18:49:16 +0200] ======================================================================== apticron has detected that some packages need upgrading on: nonagon.federez.net [ 185.230.78.42 2a0c:700:0:23:67:e5ff:fee9:3 ] The following packages are currently pending an upgrade: curl 7.64.0-4 dbus 1.10.28-0+deb9u1 libcurl4 7.64.0-4 libdbus-1-3 1.10.28-0+deb9u1 libssl1.1 1.1.1c-1 libssl-dev 1.1.1c-1 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour curl (curl libcurl4) --- curl (7.64.0-4) unstable; urgency=medium * Fix TFTP receive buffer overflow as per CVE-2019-5436 (Closes: #929351) https://curl.haxx.se/docs/CVE-2019-5436.html * Fix integer overflow in curl_url_set() as per CVE-2019-5435 (Closes: #929352) https://curl.haxx.se/docs/CVE-2019-5435.html -- Alessandro Ghedini <ghedo(a)debian.org> Fri, 14 Jun 2019 19:23:32 +0100 --- Modifications pour dbus (dbus libdbus-1-3) --- dbus (1.10.28-0+deb9u1) stretch-security; urgency=medium * New upstream stable release - CVE-2019-12749: Do not attempt to carry out DBUS_COOKIE_SHA1 authentication for identities that differ from the user running the DBusServer. Previously, a local attacker could manipulate symbolic links in their own home directory to bypass authentication and connect to a DBusServer with elevated privileges. The standard system and session dbus-daemons in their default configuration were immune to this attack because they did not allow DBUS_COOKIE_SHA1, but third-party users of DBusServer such as Upstart could be vulnerable. - Prevent reading up to 3 bytes beyond the end of a truncated message. This could in principle be an information leak or denial of service on the system bus, but is not believed to be exploitable to crash the system bus or leak interesting information in practice. - Stop the dbus-daemon leaking memory (an error message) if delivering the message that triggered auto-activation is forbidden. This is technically a denial of service because the dbus-daemon will run out of memory eventually, but it's a very slow and noisy one, because all the rejected messages are also very likely to have been logged to the system log, and its scope is typically limited by the finite number of activatable services available. - Remove __attribute__((__malloc__)) attribute on dbus_realloc(), which does not meet the criteria for that attribute in gcc 4.7+, potentially leading to miscompilation. - Fix build with gcc 8 -Werror=cast-function-type - Fix warning from gcc 8 about suspicious use of strncpy() when populating struct sockaddr_un - Fix installation of Ducktype documentation with newer yelp-build versions * d/control: Update Vcs-Git, Vcs-Browser -- Simon McVittie <smcv(a)debian.org> Sun, 09 Jun 2019 22:42:06 +0100 --- Modifications pour openssl (libssl1.1 libssl-dev) --- openssl (1.1.1c-1) unstable; urgency=medium * New upstream version - CVE-2019-1543 (Prevent over long nonces in ChaCha20-Poly1305) * Update symbol list -- Sebastian Andrzej Siewior <sebastian(a)breakpoint.cc> Thu, 30 May 2019 17:27:48 +0200 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on nonagon.federez.net -- apticron

5 années, 10 mois

4 Debian package update(s) for nonagon.federez.net

par club-federez＠crans.org

apticron report [Sun, 16 Jun 2019 18:49:12 +0200] ======================================================================== apticron has detected that some packages need upgrading on: nonagon.federez.net [ 185.230.78.42 2a0c:700:0:23:67:e5ff:fee9:3 ] The following packages are currently pending an upgrade: dbus 1.10.28-0+deb9u1 libdbus-1-3 1.10.28-0+deb9u1 libssl1.1 1.1.1c-1 libssl-dev 1.1.1c-1 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour dbus (dbus libdbus-1-3) --- dbus (1.10.28-0+deb9u1) stretch-security; urgency=medium * New upstream stable release - CVE-2019-12749: Do not attempt to carry out DBUS_COOKIE_SHA1 authentication for identities that differ from the user running the DBusServer. Previously, a local attacker could manipulate symbolic links in their own home directory to bypass authentication and connect to a DBusServer with elevated privileges. The standard system and session dbus-daemons in their default configuration were immune to this attack because they did not allow DBUS_COOKIE_SHA1, but third-party users of DBusServer such as Upstart could be vulnerable. - Prevent reading up to 3 bytes beyond the end of a truncated message. This could in principle be an information leak or denial of service on the system bus, but is not believed to be exploitable to crash the system bus or leak interesting information in practice. - Stop the dbus-daemon leaking memory (an error message) if delivering the message that triggered auto-activation is forbidden. This is technically a denial of service because the dbus-daemon will run out of memory eventually, but it's a very slow and noisy one, because all the rejected messages are also very likely to have been logged to the system log, and its scope is typically limited by the finite number of activatable services available. - Remove __attribute__((__malloc__)) attribute on dbus_realloc(), which does not meet the criteria for that attribute in gcc 4.7+, potentially leading to miscompilation. - Fix build with gcc 8 -Werror=cast-function-type - Fix warning from gcc 8 about suspicious use of strncpy() when populating struct sockaddr_un - Fix installation of Ducktype documentation with newer yelp-build versions * d/control: Update Vcs-Git, Vcs-Browser -- Simon McVittie <smcv(a)debian.org> Sun, 09 Jun 2019 22:42:06 +0100 --- Modifications pour openssl (libssl1.1 libssl-dev) --- openssl (1.1.1c-1) unstable; urgency=medium * New upstream version - CVE-2019-1543 (Prevent over long nonces in ChaCha20-Poly1305) * Update symbol list -- Sebastian Andrzej Siewior <sebastian(a)breakpoint.cc> Thu, 30 May 2019 17:27:48 +0200 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on nonagon.federez.net -- apticron

5 années, 10 mois

2 Debian package update(s) for nonagon.federez.net

par club-federez＠crans.org

apticron report [Sat, 15 Jun 2019 18:49:13 +0200] ======================================================================== apticron has detected that some packages need upgrading on: nonagon.federez.net [ 185.230.78.42 2a0c:700:0:23:67:e5ff:fee9:3 ] The following packages are currently pending an upgrade: dbus 1.10.28-0+deb9u1 libdbus-1-3 1.10.28-0+deb9u1 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour dbus (dbus libdbus-1-3) --- dbus (1.10.28-0+deb9u1) stretch-security; urgency=medium * New upstream stable release - CVE-2019-12749: Do not attempt to carry out DBUS_COOKIE_SHA1 authentication for identities that differ from the user running the DBusServer. Previously, a local attacker could manipulate symbolic links in their own home directory to bypass authentication and connect to a DBusServer with elevated privileges. The standard system and session dbus-daemons in their default configuration were immune to this attack because they did not allow DBUS_COOKIE_SHA1, but third-party users of DBusServer such as Upstart could be vulnerable. - Prevent reading up to 3 bytes beyond the end of a truncated message. This could in principle be an information leak or denial of service on the system bus, but is not believed to be exploitable to crash the system bus or leak interesting information in practice. - Stop the dbus-daemon leaking memory (an error message) if delivering the message that triggered auto-activation is forbidden. This is technically a denial of service because the dbus-daemon will run out of memory eventually, but it's a very slow and noisy one, because all the rejected messages are also very likely to have been logged to the system log, and its scope is typically limited by the finite number of activatable services available. - Remove __attribute__((__malloc__)) attribute on dbus_realloc(), which does not meet the criteria for that attribute in gcc 4.7+, potentially leading to miscompilation. - Fix build with gcc 8 -Werror=cast-function-type - Fix warning from gcc 8 about suspicious use of strncpy() when populating struct sockaddr_un - Fix installation of Ducktype documentation with newer yelp-build versions * d/control: Update Vcs-Git, Vcs-Browser -- Simon McVittie <smcv(a)debian.org> Sun, 09 Jun 2019 22:42:06 +0100 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on nonagon.federez.net -- apticron

5 années, 10 mois

2 Debian package update(s) for nonagon.federez.net

par club-federez＠crans.org

apticron report [Fri, 14 Jun 2019 18:49:14 +0200] ======================================================================== apticron has detected that some packages need upgrading on: nonagon.federez.net [ 185.230.78.42 2a0c:700:0:23:67:e5ff:fee9:3 ] The following packages are currently pending an upgrade: dbus 1.10.28-0+deb9u1 libdbus-1-3 1.10.28-0+deb9u1 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour dbus (dbus libdbus-1-3) --- dbus (1.10.28-0+deb9u1) stretch-security; urgency=medium * New upstream stable release - CVE-2019-12749: Do not attempt to carry out DBUS_COOKIE_SHA1 authentication for identities that differ from the user running the DBusServer. Previously, a local attacker could manipulate symbolic links in their own home directory to bypass authentication and connect to a DBusServer with elevated privileges. The standard system and session dbus-daemons in their default configuration were immune to this attack because they did not allow DBUS_COOKIE_SHA1, but third-party users of DBusServer such as Upstart could be vulnerable. - Prevent reading up to 3 bytes beyond the end of a truncated message. This could in principle be an information leak or denial of service on the system bus, but is not believed to be exploitable to crash the system bus or leak interesting information in practice. - Stop the dbus-daemon leaking memory (an error message) if delivering the message that triggered auto-activation is forbidden. This is technically a denial of service because the dbus-daemon will run out of memory eventually, but it's a very slow and noisy one, because all the rejected messages are also very likely to have been logged to the system log, and its scope is typically limited by the finite number of activatable services available. - Remove __attribute__((__malloc__)) attribute on dbus_realloc(), which does not meet the criteria for that attribute in gcc 4.7+, potentially leading to miscompilation. - Fix build with gcc 8 -Werror=cast-function-type - Fix warning from gcc 8 about suspicious use of strncpy() when populating struct sockaddr_un - Fix installation of Ducktype documentation with newer yelp-build versions * d/control: Update Vcs-Git, Vcs-Browser -- Simon McVittie <smcv(a)debian.org> Sun, 09 Jun 2019 22:42:06 +0100 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on nonagon.federez.net -- apticron

5 années, 10 mois

Cron <root@dodecagon> test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )

par root＠federez.net

/etc/cron.weekly/ssl-cert-check: ERROR: The file named /var/tmp/cert.C9iKTJ is unreadable or doesn't exist ERROR: Please check to make sure the certificate for xmpp.federez.net:443 is valid ERROR: The file named /var/tmp/cert.C9iKTJ is unreadable or doesn't exist ERROR: Please check to make sure the certificate for xmpp.federez.net:5223 is valid ERROR: The file named /var/tmp/cert.C9iKTJ is unreadable or doesn't exist ERROR: Please check to make sure the certificate for xmpp.federez.net:5280 is valid

5 années, 10 mois

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

Monitoring Juin 2019