1 Nov
2019
1 Nov
'19
21:38
apticron report [Fri, 01 Nov 2019 21:38:04 +0100]
========================================================================
apticron has detected that some packages need upgrading on:
quigon.federez.net
[ 160.228.155.65 ]
The following packages are currently pending an upgrade:
apache2 2.4.25-3+deb9u9
apache2-bin 2.4.25-3+deb9u9
apache2-data 2.4.25-3+deb9u9
apache2-utils 2.4.25-3+deb9u9
e2fslibs 1.43.4-2+deb9u1
e2fsprogs 1.43.4-2+deb9u1
file 1:5.30-1+deb9u3
libapache2-mod-php7.0 7.0.33-0+deb9u6
libcomerr2 1.43.4-2+deb9u1
libdatetime-timezone-perl 1:2.09-1+2019c
libexpat1 2.2.0-2+deb9u3
libexpat1-dev 2.2.0-2+deb9u3
libmagic1 1:5.30-1+deb9u3
libmagic-mgc 1:5.30-1+deb9u3
libss2 1.43.4-2+deb9u1
libssl1.0.2 1.0.2t-1~deb9u1
libssl1.1 1.1.0l-1~deb9u1
libssl-dev 1.1.0l-1~deb9u1
linux-image-4.9.0-11-amd64 4.9.189-3+deb9u1
linux-libc-dev 4.9.189-3+deb9u1
openssl 1.1.0l-1~deb9u1
php7.0 7.0.33-0+deb9u6
php7.0-cli 7.0.33-0+deb9u6
php7.0-common 7.0.33-0+deb9u6
php7.0-json 7.0.33-0+deb9u6
php7.0-ldap 7.0.33-0+deb9u6
php7.0-opcache 7.0.33-0+deb9u6
php7.0-readline 7.0.33-0+deb9u6
python3-acme 0.28.0-1~deb9u2
python-acme 0.28.0-1~deb9u2
sudo 1.8.19p1-2.1+deb9u1
tcpdump 4.9.3-1~deb9u1
tzdata 2019c-0+deb9u1
========================================================================
Package Details:
apt-listchanges : Lecture des fichiers de modifications (« changelog »)...
apt-listchanges : journaux des modifications (« changelogs »)
-------------------------------------------------------------
--- Modifications pour e2fsprogs (e2fslibs e2fsprogs libcomerr2 libss2) ---
e2fsprogs (1.43.4-2+deb9u1) stretch-security; urgency=high
* Fix CVE-2019-5094: potential buffer overrun in e2fsck (Closes: #941139)
-- Theodore Y. Ts'o <tytso(a)mit.edu> Wed, 25 Sep 2019 19:17:45 -0400
--- Modifications pour expat (libexpat1 libexpat1-dev) ---
expat (2.2.0-2+deb9u3) stretch-security; urgency=high
* Non-maintainer upload by the Security Team.
* xmlparse.c: Deny internal entities closing the doctype (CVE-2019-15903)
(Closes: #939394)
-- Salvatore Bonaccorso <carnil(a)debian.org> Thu, 19 Sep 2019 23:43:05 +0200
--- Modifications pour file (file libmagic1 libmagic-mgc) ---
file (1:5.30-1+deb9u3) stretch-security; urgency=high
* Cherry-pick commit to restrict the number of CDF_VECTOR elements.
Closes: #942830 [CVE-2019-18218]
-- Christoph Biedl <debian.axhn(a)manchmal.in-ulm.de> Tue, 22 Oct 2019 22:20:07
+0200
--- Modifications pour linux (linux-image-4.9.0-11-amd64 linux-libc-dev) ---
linux (4.9.189-3+deb9u1) stretch-security; urgency=high
* vhost: make sure log_num < in_num (CVE-2019-14835)
* ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit (CVE-2019-15117)
* ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
(CVE-2019-15118)
* [x86] ptrace: fix up botched merge of spectrev1 fix (CVE-2019-15902)
* KVM: coalesced_mmio: add bounds checking (CVE-2019-14821)
-- Salvatore Bonaccorso <carnil(a)debian.org> Fri, 20 Sep 2019 13:03:45 +0200
--- Modifications pour sudo ---
sudo (1.8.19p1-2.1+deb9u1) stretch-security; urgency=high
* Non-maintainer upload by the Security Team.
* Treat an ID of -1 as invalid since that means "no change" (CVE-2019-14287)
* Fix test failure in plugins/sudoers/regress/testsudoers/test5.sh
-- Salvatore Bonaccorso <carnil(a)debian.org> Sat, 12 Oct 2019 16:20:21 +0200
--- Modifications pour tcpdump ---
tcpdump (4.9.3-1~deb9u1) stretch-security; urgency=high
* New upstream release, with fixes for 24 different CVEs (closes: #941698).
This is an upstream update on top of the 4.9.2-1~deb9u1 package.
* Disable tests that require a newer libpcap version.
-- Romain Francoise <rfrancoise(a)debian.org> Sat, 19 Oct 2019 17:18:00 +0200
--- Modifications pour apache2 (apache2 apache2-bin apache2-data apache2-utils) ---
apache2 (2.4.25-3+deb9u9) stretch-security; urgency=medium
[ Xavier Guimard ]
* Use correct patch for CVE-2019-10092. This fixes a regression in
mod_proxy_balancer (Closes: #941202)
-- Stefan Fritsch <sf(a)debian.org> Sun, 13 Oct 2019 17:43:54 +0200
--- Modifications pour libdatetime-timezone-perl ---
libdatetime-timezone-perl (1:2.09-1+2019c) stretch; urgency=medium
* Update to Olson database version 2019c.
This update contains contemporary changes for Fiji and Norfolk Island.
-- gregor herrmann <gregoa(a)debian.org> Sat, 14 Sep 2019 16:09:21 +0200
--- Modifications pour openssl (libssl1.1 libssl-dev openssl) ---
openssl (1.1.0l-1~deb9u1) stretch-security; urgency=medium
* Import 1.1.0l
- CVE-2019-1547 (Compute ECC cofactors if not provided during EC_GROUP
construction).
- CVE-2019-1563 (Fixed a padding oracle in PKCS7_dataDecode and
CMS_decrypt_set1_pkey).
-- Sebastian Andrzej Siewior <sebastian(a)breakpoint.cc> Fri, 27 Sep 2019 21:46:29
+0200
--- Modifications pour openssl1.0 (libssl1.0.2) ---
openssl1.0 (1.0.2t-1~deb9u1) stretch-security; urgency=medium
* Import 1.0.2t
- CVE-2019-1547 (Compute ECC cofactors if not provided during EC_GROUP
construction).
- CVE-2019-1563 (Fixed a padding oracle in PKCS7_dataDecode and
CMS_decrypt_set1_pkey).
-- Sebastian Andrzej Siewior <sebastian(a)breakpoint.cc> Fri, 27 Sep 2019 21:49:56
+0200
--- Modifications pour php7.0 (libapache2-mod-php7.0 php7.0 php7.0-cli php7.0-common
php7.0-json php7.0-ldap php7.0-opcache php7.0-readline) ---
php7.0 (7.0.33-0+deb9u6) stretch-security; urgency=medium
* Backported from 7.1.33
- FPM:
. Fixed bug #78599 (env_path_info underflow in fpm_main.c can lead to
RCE). (CVE-2019-11043)
-- Ondřej Surý <ondrej(a)debian.org> Thu, 24 Oct 2019 20:50:20 +0200
php7.0 (7.0.33-0+deb9u5) stretch-security; urgency=medium
* Backported security fixes from PHP 7.1.29:
- EXIF:
. Fixed bug #77950 (Heap-buffer-overflow in _estrndup via
exif_process_IFD_TAG).
- Mail:
. Fixed bug #77821 (Potential heap corruption in TSendMail()).
* Backported from 7.1.30
- EXIF:
. Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16).
(CVE-2019-11040)
- GD:
. Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm).
(CVE-2019-11038)
- Iconv:
. Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode()
due to integer overflow). (CVE-2019-11039).
- SQLite:
. Fixed bug #77967 (Bypassing open_basedir restrictions via file uris).
* Backported from 7.1.31
- EXIF:
. Fixed bug #78256 (heap-buffer-overflow on exif_process_user_comment).
(CVE-2019-11042)
. Fixed bug #78222 (heap-buffer-overflow on exif_scan_thumbnail).
(CVE-2019-11041)
- Phar:
. Fixed bug #77919 (Potential UAF in Phar RSHUTDOWN).
- SQLite:
. Upgraded to SQLite 3.28.0.
* Backported from 7.1.32
- mbstring:
. Fixed CVE-2019-13224 (don't allow different encodings for onig_new_deluxe)
- pcre:
. Fixed bug #75457 (heap use-after-free in pcrelib)
-- Ondřej Surý <ondrej(a)sury.org> Wed, 18 Sep 2019 11:55:34 +0200
php7.0 (7.0.33-0+deb9u4) stretch-security; urgency=medium
* Update d/watch for new php.net pages
* Backported from 7.1.28
- EXIF:
. (CVE-2019-11034) Fixed bug #77753 (Heap-buffer-overflow in
php_ifd_get32s).
. (CVE-2019-11035) Fixed bug #77831 (Heap-buffer-overflow in
exif_iif_add_value).
- SQLite3:
. Added sqlite3.defensive INI directive.
* Backported from PHP 7.1.29
- EXIF:
. (CVE-2019-11036) Fixed bug #77950 (Heap-buffer-overflow in
_estrndup via exif_process_IFD_TAG).
- Mail:
. Fixed bug #77821 (Potential heap corruption in TSendMail()).
* Backported from 7.1.30
- EXIF:
. (CVE-2019-11040) Fixed bug #77988 (heap-buffer-overflow on
php_jpg_get16).
- GD:
. (CVE-2019-11038) Fixed bug #77973 (Uninitialized read in
gdImageCreateFromXbm).
- Iconv:
. (CVE-2019-11039) Fixed bug #78069 (Out-of-bounds read in
iconv.c:_php_iconv_mime_decode() due to integer overflow).
- SQLite:
. Fixed bug #77967 (Bypassing open_basedir restrictions via file
uris).
-- Ondřej Surý <ondrej(a)sury.org> Sun, 09 Jun 2019 11:25:27 +0200
--- Modifications pour python-acme (python3-acme python-acme) ---
python-acme (0.28.0-1~deb9u2) stretch; urgency=medium
* This stretch update is to switch to using a POST-as-GET protocol
before the November 1, 2019 deadline when Let's Encrypt will begin
refusing requests using the (old) GET protocol. (Closes: #932248)
-- Harlan Lieberman-Berg <hlieberman(a)debian.org> Wed, 31 Jul 2019 22:26:45 -0400
--- Modifications pour tzdata ---
tzdata (2019c-0+deb9u1) stretch; urgency=medium
* New upstream version, affecting the following future timestamps:
- Fiji's next DST transitions will be 2019-11-10 and 2020-01-12
instead of 2019-11-03 and 2020-01-19.
- Norfolk Island will observe Australian-style DST starting in
spring 2019. The first transition is on 2019-10-06.
-- Aurelien Jarno <aurel32(a)debian.org> Wed, 18 Sep 2019 00:40:44 +0200
========================================================================
You can perform the upgrade by issuing the command:
apt-get dist-upgrade
as root on quigon.federez.net
--
apticron