apticron report [Wed, 06 Jan 2016 09:48:18 +0100]
========================================================================
apticron has detected that some packages need upgrading on:
hexagon.federez.net
[ 5.39.82.35 2001:41d0:8:9423::1 5.39.82.35 2001:41d0:8:9423::1 ]
The following packages are currently pending an upgrade:
git 1:2.1.4-2.1+deb8u1
git-man 1:2.1.4-2.1+deb8u1
linux-image-3.16.0-4-amd64 3.16.7-ckt20-1+deb8u2
linux-libc-dev 3.16.7-ckt20-1+deb8u2
========================================================================
Package Details:
Lecture des fichiers de modifications (« changelog »)...
--- Modifications pour git (git git-man) ---
git (1:2.1.4-2.1+deb8u1) jessie-security; urgency=high
* Non-maintainer upload by the Security Team.
* Fix CVE-2015-7545, arbitrary code execution issues via URLs with:
- 01-CVE-2015-7545-1.patch: add a protocol-whitelist environment
variable
- 02-CVE-2015-7545-2.patch: allow only certain protocols for submodule
fetches
- 03-CVE-2015-7545-3.patch: refactor protocol whitelist code
- 04-CVE-2015-7545-4.patch: limit redirection to protocol-whitelist
- 05-CVE-2015-7545-5.patch: limit redirection depth
* Make new tests executable.
-- Laszlo Boszormenyi (GCS) <gcs(a)debian.org> Wed, 16 Dec 2015 08:24:37 +0000
--- Modifications pour linux (linux-image-3.16.0-4-amd64 linux-libc-dev) ---
linux (3.16.7-ckt20-1+deb8u2) jessie-security; urgency=medium
* [xen] Fix race conditions in back-end drivers (CVE-2015-8550, XSA-155)
* [xen] pciback: Fix state validation in MSI control operations
(CVE-2015-8551, CVE-2015-8852, XSA-157)
* pptp: verify sockaddr_len in pptp_bind() and pptp_connect() (CVE-2015-8569)
* bluetooth: Validate socket address length in sco_sock_bind() (CVE-2015-8575)
* ptrace: being capable wrt a process requires mapped uids/gids
(CVE-2015-8709)
* KEYS: Fix race between read and revoke (CVE-2015-7550)
* [x86] KVM: Reload pit counters for all channels when restoring state
(CVE-2015-7513)
* udp: properly support MSG_PEEK with truncated buffers
(Closes: #808293, regression in 3.16.7-ckt17)
* Revert "xhci: don't finish a TD if we get a short transfer event mid TD"
(Closes: #808602, #808953, regression in 3.16.7-ckt20)
-- Ben Hutchings <ben(a)decadent.org.uk> Sat, 02 Jan 2016 03:31:39 +0000
========================================================================
You can perform the upgrade by issuing the command:
apt-get dist-upgrade
as root on hexagon.federez.net
--
apticron
apticron report [Tue, 05 Jan 2016 23:38:13 +0100]
========================================================================
apticron has detected that some packages need upgrading on:
quigon.federez.net
[ 160.228.155.65 ]
The following packages are currently pending an upgrade:
git 1:2.1.4-2.1+deb8u1
git-man 1:2.1.4-2.1+deb8u1
gitweb 1:2.1.4-2.1+deb8u1
linux-image-3.16.0-4-amd64 3.16.7-ckt20-1+deb8u2
linux-libc-dev 3.16.7-ckt20-1+deb8u2
========================================================================
Package Details:
Lecture des fichiers de modifications (« changelog »)...
--- Modifications pour git (git git-man gitweb) ---
git (1:2.1.4-2.1+deb8u1) jessie-security; urgency=high
* Non-maintainer upload by the Security Team.
* Fix CVE-2015-7545, arbitrary code execution issues via URLs with:
- 01-CVE-2015-7545-1.patch: add a protocol-whitelist environment
variable
- 02-CVE-2015-7545-2.patch: allow only certain protocols for submodule
fetches
- 03-CVE-2015-7545-3.patch: refactor protocol whitelist code
- 04-CVE-2015-7545-4.patch: limit redirection to protocol-whitelist
- 05-CVE-2015-7545-5.patch: limit redirection depth
* Make new tests executable.
-- Laszlo Boszormenyi (GCS) <gcs(a)debian.org> Wed, 16 Dec 2015 08:24:37 +0000
--- Modifications pour linux (linux-image-3.16.0-4-amd64 linux-libc-dev) ---
linux (3.16.7-ckt20-1+deb8u2) jessie-security; urgency=medium
* [xen] Fix race conditions in back-end drivers (CVE-2015-8550, XSA-155)
* [xen] pciback: Fix state validation in MSI control operations
(CVE-2015-8551, CVE-2015-8852, XSA-157)
* pptp: verify sockaddr_len in pptp_bind() and pptp_connect() (CVE-2015-8569)
* bluetooth: Validate socket address length in sco_sock_bind() (CVE-2015-8575)
* ptrace: being capable wrt a process requires mapped uids/gids
(CVE-2015-8709)
* KEYS: Fix race between read and revoke (CVE-2015-7550)
* [x86] KVM: Reload pit counters for all channels when restoring state
(CVE-2015-7513)
* udp: properly support MSG_PEEK with truncated buffers
(Closes: #808293, regression in 3.16.7-ckt17)
* Revert "xhci: don't finish a TD if we get a short transfer event mid TD"
(Closes: #808602, #808953, regression in 3.16.7-ckt20)
-- Ben Hutchings <ben(a)decadent.org.uk> Sat, 02 Jan 2016 03:31:39 +0000
========================================================================
You can perform the upgrade by issuing the command:
apt-get dist-upgrade
as root on quigon.federez.net
--
apticron
apticron report [Tue, 05 Jan 2016 20:44:27 +0100]
========================================================================
apticron has detected that some packages need upgrading on:
baldrick.crans.org
[ 138.231.142.239 2a01:240:fe3d:4:62:61ff:fe6c:6401 138.231.142.239 ]
[ 2a01:240:fe3d:4:62:61ff:fe6c:6401 ]
The following packages are currently pending an upgrade:
linux-image-3.16.0-4-amd64 3.16.7-ckt20-1+deb8u2
linux-libc-dev 3.16.7-ckt20-1+deb8u2
========================================================================
Package Details:
Lecture des fichiers de modifications (« changelog »)...
--- Modifications pour linux (linux-image-3.16.0-4-amd64 linux-libc-dev) ---
linux (3.16.7-ckt20-1+deb8u2) jessie-security; urgency=medium
* [xen] Fix race conditions in back-end drivers (CVE-2015-8550, XSA-155)
* [xen] pciback: Fix state validation in MSI control operations
(CVE-2015-8551, CVE-2015-8852, XSA-157)
* pptp: verify sockaddr_len in pptp_bind() and pptp_connect() (CVE-2015-8569)
* bluetooth: Validate socket address length in sco_sock_bind() (CVE-2015-8575)
* ptrace: being capable wrt a process requires mapped uids/gids
(CVE-2015-8709)
* KEYS: Fix race between read and revoke (CVE-2015-7550)
* [x86] KVM: Reload pit counters for all channels when restoring state
(CVE-2015-7513)
* udp: properly support MSG_PEEK with truncated buffers
(Closes: #808293, regression in 3.16.7-ckt17)
* Revert "xhci: don't finish a TD if we get a short transfer event mid TD"
(Closes: #808602, #808953, regression in 3.16.7-ckt20)
-- Ben Hutchings <ben(a)decadent.org.uk> Sat, 02 Jan 2016 03:31:39 +0000
========================================================================
You can perform the upgrade by issuing the command:
apt-get dist-upgrade
as root on baldrick.crans.org
--
apticron
apticron report [Wed, 23 Dec 2015 23:38:13 +0100]
========================================================================
apticron has detected that some packages need upgrading on:
quigon.federez.net
[ 160.228.155.65 ]
The following packages are currently pending an upgrade:
libxml2 2.9.1+dfsg1-5+deb8u1
========================================================================
Package Details:
Lecture des fichiers de modifications (« changelog »)...
--- Modifications pour libxml2 ---
libxml2 (2.9.1+dfsg1-5+deb8u1) jessie-security; urgency=high
* Non-maintainer upload by the Security Team.
* Add patches to address CVE-2015-7941.
CVE-2015-7941: Denial of service via out-of-bounds read. (Closes: #783010)
* Add 0058-CVE-2015-1819-Enforce-the-reader-to-run-in-constant-.patch.
CVE-2015-1819: Enforce the reader to run in constant memory.
(Closes: #782782)
* Add patches to address CVE-2015-8317.
CVE-2015-8317: Out-of-bounds heap read when parsing file with unfinished
xml declaration.
* Add patches to address CVE-2015-7942.
CVE-2015-7942: heap-based buffer overflow in
xmlParseConditionalSections(). (Closes: #802827)
* Add 0063-Fix-parsing-short-unclosed-comment-uninitialized-acc.patch patch.
Parsing an unclosed comment can result in `Conditional jump or move
depends on uninitialised value(s)` and unsafe memory access.
(Closes: #782985)
* Add 0064-CVE-2015-8035-Fix-XZ-compression-support-loop.patch patch.
CVE-2015-8035: DoS when parsing specially crafted XML document if XZ
support is enabled. (Closes: #803942)
* Add 0065-Avoid-extra-processing-of-MarkupDecl-when-EOF.patch patch.
CVE-2015-8241: Buffer overread with XML parser in xmlNextChar.
(Closes: #806384)
* Add 0066-Avoid-processing-entities-after-encoding-conversion-.patch patch.
CVE-2015-7498: Heap-based buffer overflow in xmlParseXmlDecl.
* Add 0067-CVE-2015-7497-Avoid-an-heap-buffer-overflow-in-xmlDi.patch patch.
CVE-2015-7497: Heap-based buffer overflow in xmlDictComputeFastQKey.
* Add 0068-CVE-2015-5312-Another-entity-expansion-issue.patch patch.
CVE-2015-5312: CPU exhaustion when processing specially crafted XML
input.
* Add patches to address CVE-2015-7499.
CVE-2015-7499: Heap-based buffer overflow in xmlGROW.
* Add 0071-CVE-2015-7500-Fix-memory-access-error-due-to-incorre.patch patch.
CVE-2015-7500: Heap buffer overflow in xmlParseMisc.
-- Salvatore Bonaccorso <carnil(a)debian.org> Sat, 19 Dec 2015 15:29:45 +0100
========================================================================
You can perform the upgrade by issuing the command:
apt-get dist-upgrade
as root on quigon.federez.net
--
apticron
apticron report [Wed, 23 Dec 2015 20:44:09 +0100]
========================================================================
apticron has detected that some packages need upgrading on:
baldrick.crans.org
[ 138.231.142.239 2a01:240:fe3d:4:62:61ff:fe6c:6401 138.231.142.239 ]
[ 2a01:240:fe3d:4:62:61ff:fe6c:6401 ]
The following packages are currently pending an upgrade:
libxml2 2.9.1+dfsg1-5+deb8u1
libxml2-dev 2.9.1+dfsg1-5+deb8u1
========================================================================
Package Details:
Lecture des fichiers de modifications (« changelog »)...
--- Modifications pour libxml2 (libxml2 libxml2-dev) ---
libxml2 (2.9.1+dfsg1-5+deb8u1) jessie-security; urgency=high
* Non-maintainer upload by the Security Team.
* Add patches to address CVE-2015-7941.
CVE-2015-7941: Denial of service via out-of-bounds read. (Closes: #783010)
* Add 0058-CVE-2015-1819-Enforce-the-reader-to-run-in-constant-.patch.
CVE-2015-1819: Enforce the reader to run in constant memory.
(Closes: #782782)
* Add patches to address CVE-2015-8317.
CVE-2015-8317: Out-of-bounds heap read when parsing file with unfinished
xml declaration.
* Add patches to address CVE-2015-7942.
CVE-2015-7942: heap-based buffer overflow in
xmlParseConditionalSections(). (Closes: #802827)
* Add 0063-Fix-parsing-short-unclosed-comment-uninitialized-acc.patch patch.
Parsing an unclosed comment can result in `Conditional jump or move
depends on uninitialised value(s)` and unsafe memory access.
(Closes: #782985)
* Add 0064-CVE-2015-8035-Fix-XZ-compression-support-loop.patch patch.
CVE-2015-8035: DoS when parsing specially crafted XML document if XZ
support is enabled. (Closes: #803942)
* Add 0065-Avoid-extra-processing-of-MarkupDecl-when-EOF.patch patch.
CVE-2015-8241: Buffer overread with XML parser in xmlNextChar.
(Closes: #806384)
* Add 0066-Avoid-processing-entities-after-encoding-conversion-.patch patch.
CVE-2015-7498: Heap-based buffer overflow in xmlParseXmlDecl.
* Add 0067-CVE-2015-7497-Avoid-an-heap-buffer-overflow-in-xmlDi.patch patch.
CVE-2015-7497: Heap-based buffer overflow in xmlDictComputeFastQKey.
* Add 0068-CVE-2015-5312-Another-entity-expansion-issue.patch patch.
CVE-2015-5312: CPU exhaustion when processing specially crafted XML
input.
* Add patches to address CVE-2015-7499.
CVE-2015-7499: Heap-based buffer overflow in xmlGROW.
* Add 0071-CVE-2015-7500-Fix-memory-access-error-due-to-incorre.patch patch.
CVE-2015-7500: Heap buffer overflow in xmlParseMisc.
-- Salvatore Bonaccorso <carnil(a)debian.org> Sat, 19 Dec 2015 15:29:45 +0100
========================================================================
You can perform the upgrade by issuing the command:
apt-get dist-upgrade
as root on baldrick.crans.org
--
apticron