14 Jan
2017
14 Jan
'17
23:38
apticron report [Sat, 14 Jan 2017 23:38:26 +0100]
========================================================================
apticron has detected that some packages need upgrading on:
quigon.federez.net
[ 160.228.155.65 ]
The following packages are currently pending an upgrade:
base-files 8+deb8u7
bash 4.3-11+deb8u1
ca-certificates 20141019+deb8u2
dbus 1.8.22-0+deb8u1
e2fslibs 1.42.12-2+b1
e2fsprogs 1.42.12-2+b1
file 1:5.22+15-2+deb8u3
libc6 2.19-18+deb8u7
libc6-dev 2.19-18+deb8u7
libcairo2 1.14.0-2.1+deb8u2
libc-bin 2.19-18+deb8u7
libc-dev-bin 2.19-18+deb8u7
libcomerr2 1.42.12-2+b1
libdbus-1-3 1.8.22-0+deb8u1
libfcgi-perl 0.77-1+deb8u1
libgnutls-deb0-28 3.3.8-6+deb8u4
libgnutls-openssl27 3.3.8-6+deb8u4
libhogweed2 2.7.1-5+deb8u2
libio-socket-ssl-perl 2.002-2+deb8u2
libmagic1 1:5.22+15-2+deb8u3
libnettle4 2.7.1-5+deb8u2
libnss-ldapd 0.9.4-3+deb8u2
libpam0g 1.1.8-3.1+deb8u2
libpam-ldapd 0.9.4-3+deb8u2
libpam-modules 1.1.8-3.1+deb8u2
libpam-modules-bin 1.1.8-3.1+deb8u2
libpam-runtime 1.1.8-3.1+deb8u2
libpam-systemd 215-17+deb8u6
libpng12-0 1.2.50-2+deb8u3
libss2 1.42.12-2+b1
libsystemd0 215-17+deb8u6
libudev1 215-17+deb8u6
libwmf0.2-7 0.2.8.4-10.3+deb8u2
linux-image-3.16.0-4-amd64 3.16.39-1
linux-libc-dev 3.16.39-1
locales 2.19-18+deb8u7
multiarch-support 2.19-18+deb8u7
nscd 2.19-18+deb8u7
nslcd 0.9.4-3+deb8u2
nslcd-utils 0.9.4-3+deb8u2
python-crypto 2.6.1-5+deb8u1
sed 4.2.2-4+deb8u1
systemd 215-17+deb8u6
systemd-sysv 215-17+deb8u6
udev 215-17+deb8u6
========================================================================
Package Details:
Lecture des fichiers de modifications (« changelog »)...
--- Nouveautés pour ca-certificates ---
ca-certificates (20141019+deb8u2) stable; urgency=medium
Update Mozilla certificate authority bundle to version 2.9.
The following certificate authorities were added (+):
+ "Certplus Root CA G1"
+ "Certplus Root CA G2"
+ "Certum Trusted Network CA 2"
+ "Hellenic Academic and Research Institutions ECC RootCA 2015"
+ "Hellenic Academic and Research Institutions RootCA 2015"
+ "ISRG Root X1"
+ "OpenTrust Root CA G1"
+ "OpenTrust Root CA G2"
+ "OpenTrust Root CA G3"
+ "SZAFIR ROOT CA2"
The following certificate authorities were removed (-):
- "CA Disig"
- "NetLock Business (Class B) Root"
- "NetLock Express (Class C) Root"
- "NetLock Notary (Class A) Root"
- "NetLock Qualified (Class QA) Root"
- "Sonera Class 1 Root CA"
- "Staat der Nederlanden Root CA"
- "Verisign Class 1 Public Primary Certification Authority - G2"
- "Verisign Class 3 Public Primary Certification Authority"
- "Verisign Class 3 Public Primary Certification Authority - G2"
-- Michael Shuler <michael(a)pbandjelly.org> Fri, 18 Nov 2016 09:09:47 -0600
--- Modifications pour e2fsprogs (e2fslibs e2fsprogs libcomerr2 libss2) ---
e2fsprogs (1.42.12-2+b1) jessie; urgency=low, binary-only=yes
* Binary-only non-maintainer upload for amd64; no source changes.
* Rebuild against dietlibc 0.33~cvs20120325-6+deb8u1
-- amd64 Build Daemon (binet) <buildd-binet(a)buildd.debian.org> Sat, 04 Jun 2016
11:58:06 -0400
--- Modifications pour python-crypto ---
python-crypto (2.6.1-5+deb8u1) jessie; urgency=high
* debian/patches/CVE-2013-7459.patch: Raise a warning when IV is used with
ECB or CTR and ignored the IV in that case. Thanks to Salvatore Bonaccorso
for the initial patch. (CVE-2013-7459) (Closes:
#849495)
-- Sebastian Ramacher <sramacher(a)debian.org> Tue, 03 Jan 2017 13:56:09 +0100
--- Modifications pour bash ---
bash (4.3-11+deb8u1) jessie; urgency=medium
* Non-maintainer upload.
* CVE-2016-0634: Arbitrary code execution via malicious hostname
* CVE-2016-7543: Specially crafted SHELLOPTS+PS4 variables allows command
substitution
-- Salvatore Bonaccorso <carnil(a)debian.org> Sun, 09 Oct 2016 17:35:21 +0200
--- Modifications pour ca-certificates ---
ca-certificates (20141019+deb8u2) stable; urgency=medium
[ Michael Shuler ]
* mozilla/{certdata.txt,nssckbi.h}:
Update Mozilla certificate authority bundle to version 2.9.
Thanks for the initial 2.7 patch, Jonathan Wiltshire. Closes: #828845
The following certificate authorities were added (+):
+ "Certplus Root CA G1"
+ "Certplus Root CA G2"
+ "Certum Trusted Network CA 2"
+ "Hellenic Academic and Research Institutions ECC RootCA 2015"
+ "Hellenic Academic and Research Institutions RootCA 2015"
+ "ISRG Root X1"
+ "OpenTrust Root CA G1"
+ "OpenTrust Root CA G2"
+ "OpenTrust Root CA G3"
+ "SZAFIR ROOT CA2"
The following certificate authorities were removed (-):
- "CA Disig"
- "NetLock Business (Class B) Root"
- "NetLock Express (Class C) Root"
- "NetLock Notary (Class A) Root"
- "NetLock Qualified (Class QA) Root"
- "Sonera Class 1 Root CA"
- "Staat der Nederlanden Root CA"
- "Verisign Class 1 Public Primary Certification Authority - G2"
- "Verisign Class 3 Public Primary Certification Authority"
- "Verisign Class 3 Public Primary Certification Authority - G2"
[ Andreas Beckmann ]
* debian/postinst:
Run update-certificates without hooks to initially populate
/etc/ssl/certs. (The hooks are deferred to the noawait trigger.)
Closes: #825730
-- Michael Shuler <michael(a)pbandjelly.org> Fri, 18 Nov 2016 09:09:47 -0600
--- Modifications pour cairo (libcairo2) ---
cairo (1.14.0-2.1+deb8u2) jessie; urgency=medium
* Non-maintainer upload.
* CVE-2016-9082: DoS attack based on using SVG to generate invalid pointers
from a _cairo_image_surface in write_png.
(Closes: #842289)
-- Salvatore Bonaccorso <carnil(a)debian.org> Fri, 30 Dec 2016 07:30:39 +0100
--- Modifications pour dbus (dbus libdbus-1-3) ---
dbus (1.8.22-0+deb8u1) jessie; urgency=medium
* New upstream bugfix release
- fix a potential format string vulnerability, which is not believed
to be exploitable in practice
* dbus.prerm: ensure that dbus.socket is stopped before removal,
so that a new connection to the bus won't cause dbus.service to be
restarted (Closes: #813970)
-- Simon McVittie <smcv(a)debian.org> Mon, 10 Oct 2016 11:42:50 +0100
--- Modifications pour file (file libmagic1) ---
file (1:5.22+15-2+deb8u3) stable; urgency=medium
* Fix memory leak in magic loader. Closes: #840754
-- Christoph Biedl <debian.axhn(a)manchmal.in-ulm.de> Sun, 04 Dec 2016 10:00:07
+0100
--- Modifications pour glibc (libc6 libc6-dev libc-bin libc-dev-bin locales
multiarch-support nscd) ---
glibc (2.19-18+deb8u7) stable; urgency=medium
[ Aurelien Jarno ]
* Update from upstream stable branch:
- Do not unconditionally use the fsqrt instruction on 64-bit PowerPC
CPUs. Closes: #843904.
* debian/patches/any/cvs-hesiod-resolver.diff: patch from upstream to
fix a regression introduced by cvs-resolv-ipv6-nameservers.diff in
hesiod. Closes: #821358.
* debian/sysdeps/{amd64,i386,x32}.mk: disable lock elision (aka Intel TSX)
on x86 architectures. This causes programs (wrongly) unlocking an already
unlocked mutex to abort. More importantly most of the other distributions
decided to disable it, so we don't want to be the only distribution left
testing this code path.
-- Aurelien Jarno <aurel32(a)debian.org> Thu, 24 Nov 2016 23:48:11 +0100
--- Modifications pour gnutls28 (libgnutls-deb0-28 libgnutls-openssl27) ---
gnutls28 (3.3.8-6+deb8u4) jessie; urgency=medium
[ Salvatore Bonaccorso ]
* CVE-2016-7444: Incorrect certificate validation when using OCSP responses
(GNUTLS-SA-2016-3). See #840191.
[ Andreas Metzler ]
* Cherry pick 53_nettle-use-rsa_-_key_prepare-on-key-import.patch
from upstream GIT, which should allow gnutls continue to work with
CVE-2016-6489-patched nettle. See #832983.
-- Andreas Metzler <ametzler(a)debian.org> Sun, 30 Oct 2016 07:39:08 +0100
--- Modifications pour libfcgi-perl ---
libfcgi-perl (0.77-1+deb8u1) jessie; urgency=medium
* Team upload.
* CVE-2012-6687: numerous connections cause segfault DoS (Closes: #815840)
-- Salvatore Bonaccorso <carnil(a)debian.org> Tue, 27 Dec 2016 08:06:30 +0100
--- Modifications pour libio-socket-ssl-perl ---
libio-socket-ssl-perl (2.002-2+deb8u2) jessie; urgency=medium
* Add 0001-remove-r-for-checking-SSL_-cert-key-_file-since-this.patch.
Removes the -r check for for checking SSL_{cert,key}_file since this
will an usable error later anyway. Addresses "Cannot use SSL_key_file
with ACL permissions".
Thanks to Michael Braun and Steffen Ullrich. (Closes: #839576)
-- Salvatore Bonaccorso <carnil(a)debian.org> Sat, 08 Oct 2016 17:26:51 +0200
--- Modifications pour libpng (libpng12-0) ---
libpng (1.2.50-2+deb8u3) jessie; urgency=medium
* debian/patches/CVE-2016-10087.patch:
- cherry-pick upstream fix for CVE-2016-10087
-- Gianfranco Costamagna <locutusofborg(a)debian.org> Mon, 02 Jan 2017 18:21:33
+0100
--- Modifications pour libwmf (libwmf0.2-7) ---
libwmf (0.2.8.4-10.3+deb8u2) stable; urgency=medium
* LTS Team upload.
* Fix allocating huge block of memory (CVE-2016-9011) (Closes: #842090)
-- Balint Reczey <balint(a)balintreczey.hu> Wed, 02 Nov 2016 12:56:21 +0100
--- Modifications pour linux (linux-image-3.16.0-4-amd64 linux-libc-dev) ---
linux (3.16.39-1) jessie; urgency=medium
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.37
- [x86] iommu/vt-d: Ratelimit fault handler
- xfs: disallow rw remount on fs with unknown ro-compat features
- Bluetooth: vhci: fix open_timeout vs. hdev race
- [x86] drm/i915: Prevent machine death on Ivybridge context switching
- scsi: Add intermediate STARGET_REMOVE state to scsi_target_state
(Closes: #834513)
- Revert "scsi: fix soft lockup in scsi_remove_target() on module removal"
- Bluetooth: vhci: Fix race at creating hci device
- EDAC: Increment correct counter in edac_inc_ue_error()
- ext4: fix data exposure after a crash
- [armhf] crypto: s5p-sss - Fix missed interrupts when working with
8 kB blocks
- [armhf] crypto: s5p-sss - fix incorrect usage of scatterlists api
- btrfs: bugfix: handle FS_IOC32_{GETFLAGS,SETFLAGS,GETVERSION} in
btrfs_ioctl
- [arm*] KVM: Enforce Break-Before-Make on Stage-2 page tables
- aacraid: Relinquish CPU during timeout wait
- aacraid: Fix for aac_command_thread hang
- ext4: fix hang when processing corrupted orphaned inode list
- ext4: clean up error handling when orphan list is corrupted
- Revert "tty: Fix pty master poll() after slave closes v2"
- Fix OpenSSH pty regression on close
- cpufreq: Fix GOV_LIMITS handling for the userspace governor
- ACPI / sysfs: fix error code in get_status()
- ext4: fix oops on corrupted filesystem
- [arm64] Ensure pmd_present() returns false after pmd_mknotpresent()
- [armhf] dts: exynos: Add interrupt line to MAX8997 PMIC on
exynos4210-trats
- [mips*] Fix siginfo.h to use strict posix types
- USB: serial: keyspan,muxport,quatech2: fix use-after-free in probe
error path
- irqchip/gic: Ensure ordering between read of INTACK and shared data
- [powerpc*] mm/hash64: Fix subpage protection with 4K HPTE config
- rtlwifi: Fix logic error in enter/exit power-save mode
- sched/loadavg: Fix loadavg artifacts on fully idle and on fully loaded
systems
- [mips*] Fix race condition in lazy cache flushing.
- ring-buffer: Use long for nr_pages to avoid overflow failures
- ring-buffer: Prevent overflow of size in ring_buffer_resize()
- RDMA/iw_cxgb4: Always wake up waiter in c4iw_peer_abort_intr()
- IB/core: Fix a potential array overrun in CMA and SA agent
- i40e: fix an uninitialized variable bug
- mmc: mmc: Fix partition switch timeout for some eMMCs
- net/mlx4_core: Fix access to uninitialized index
- [x86] PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs
- PCI: Disable all BAR sizing for devices with non-compliant BARs
- netlink: Fix dump skb leak/double free (CVE-2016-9806)
- sched/preempt: Fix preempt_count manipulations
- fs/cifs: correctly do anonymous authentication
- fs/cifs: remove directory incorrectly tries to set delete on close on
non-empty directories
- sunrpc: Update RPCBIND_MAXNETIDLEN
- cpuidle: Fix cpuidle_state_is_coupled() argument in cpuidle_enter()
- batman-adv: fix skb deref after free
- batman-adv: Fix unexpected free of bcast_own on add_if error
- batman-adv: Fix integer overflow in batadv_iv_ogm_calc_tq
- xfs: xfs_iflush_cluster fails to abort on error
- xfs: fix inode validity check in xfs_iflush_cluster
- xfs: skip stale inodes in xfs_iflush_cluster
- crypto: public_key: select CRYPTO_AKCIPHER
- net: ehea: avoid null pointer dereference
- cifs: Create dedicated keyring for spnego operations
- Input: uinput - handle compat ioctl for UI_SET_PHYS
- PM / sleep: Handle failures in device_suspend_late() consistently
- tuntap: correctly wake up process during uninit
- scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands
- [x86] drm/i915: Don't leave old junk in ilk active watermarks on readout
- mmc: longer timeout for long read time quirk
- sunrpc: fix stripping of padded MIC tokens
- wait/ptrace: assume __WALL if the child is traced
- xen/events: Don't move disabled irqs
- UBI: do propagate positive error codes up
- UBI: fix missing brace control flow
- UBI: Fix static volume checks when Fastmap is used
- RDMA/cxgb3: device driver frees DMA memory with different size
- [x86] ALSA: hda - Fix headset mic detection problem for one Dell machine
- [x86] crypto: ccp - Fix AES XTS error for request sizes above 4096
- sfc: on MC reset, clear PIO buffer linkage in TXQs
- Input: xpad - prevent spurious input from wired Xbox 360 controllers
- Input: pwm-beeper - remove useless call to pwm_config()
- Input: pwm-beeper - fix - scheduling while atomic
- [mips*] fix read_msa_* & write_msa_* functions on non-MSA toolchains
- hpfs: fix remount failure when there are no options changed
- hpfs: implement the show_options method
- [powerpc*] pseries/eeh: Handle RTAS delay requests in configure_bridge
- [powerpc*] Fix definition of SIAR and SDAR registers
- [powerpc*] Use privileged SPR number for MMCR2
- mac80211_hwsim: Add missing check for HWSIM_ATTR_SIGNAL
- mac80211: mesh: flush mesh paths unconditionally
- [arm64] Provide "model name" in /proc/cpuinfo for PER_LINUX32 tasks
- scsi: Add QEMU CD-ROM to VPD Inquiry Blacklist
- ACPI / processor: Avoid reserving IO regions too early
- drm/nouveau/fbcon: fix out-of-bounds memory accesses
- [armel,armhf] fix PTRACE_SETVFPREGS on SMP systems
- KVM: irqfd: fix NULL pointer dereference in kvm_irq_map_gsi
- [x86] KVM: fix OOPS after invalid KVM_SET_DEBUGREGS
- ALSA: hda - Fix headset mic detection problem for Dell machine
- [powerpc*] pseries: Fix PCI config address for DDW
- mnt: fs_fully_visible test the proper mount for MNT_LOCKED
- IB/IPoIB: Fix race between ipoib_remove_one to sysfs functions
- IB/mlx5: Return PORT_ERR in Active to Initializing tranisition
- IB/mlx5: Fix returned values of query QP
- IB/IPoIB: Don't update neigh validity for unresolved entries
- tcp: record TLP and ER timer stats in v6 stats
- of: fix autoloading due to broken modalias with no 'compatible'
- [x86] cpufreq: intel_pstate: Fix ->set_policy() interface for no_turbo
- fs: fix d_walk()/non-delayed __d_free() race
- net/mlx5: Fix the size of modify QP mailbox
- net/mlx5: Fix masking of reserved bits in XRCD number
- uvc: Forward compat ioctls to their handlers directly
- [armhf] mfd: omap-usb-tll: Fix scheduling while atomic BUG
- [armhf] usb: dwc3: exynos: Fix deferred probing storm.
- usb: f_fs: off by one bug in _ffs_func_bind()
- usb: gadget: fix spinlock dead lock in gadgetfs
- usb: gadget: avoid exposing kernel stack
- HID: elo: kill not flush the work
- usb: xhci-plat: properly handle probe deferral for devm_clk_get()
- USB: quirks: Fix entries on wrong list in 3.16.y
- [armhf] usb: musb: Ensure rx reinit occurs for shared_fifo endpoints
- [armhf] usb: musb: Stop bulk endpoint while queue is rotated
- iio: Fix error handling in iio_trigger_attach_poll_func
- scsi: fix race between simultaneous decrements of ->host_failed
- [armel,armhf] 8578/1: mm: ensure pmd_present only checks the valid bit
- [armel,armhf] 8579/1: mm: Fix definition of pmd_mknotpresent
- drm/radeon: fix asic initialization for virtualized environments
- [armhf] spi: sun4i: fix FIFO limit
- [armhf] spi: sunxi: fix transfer timeout
- [x86] kprobes: Clear TF bit in fault on single-stepping
- kernel/sysrq, watchdog, sched/core: Reset watchdog on all CPUs while
processing sysrq-w
- ipv6: fix endianness error in icmpv6_err
- net_sched: introduce qdisc_replace() helper
- net_sched: update hierarchical backlog too
- netem: fix a use after free
- net_sched: fix pfifo_head_drop behavior vs backlog
- [x86] drm/i915/ilk: Don't disable SSC source if it's in use
- base: make module_create_drivers_dir race-free
- kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES
- [armhf] memory: omap-gpmc: Fix omap gpmc EXTRADELAY timing
- IB/mlx4: Properly initialize GRH TClass and FlowLabel in AHs
- isa: Call isa_bus_init before dependent ISA bus drivers register
- [x86] hwmon: (dell-smm) Restrict fan control and serial number to
CAP_SYS_ADMIN by default
- tracing: Handle NULL formats in hold_module_trace_bprintk_format()
- [arm64] mm: remove page_mapping check in __sync_icache_dcache
- pinctrl: single: Fix missing flush of posted write for a wakeirq
- net/mlx4_en: Fix the return value of a failure in VLAN VID add/kill
- ubi: Make recover_peb power cut aware
- mm: Export migrate_page_move_mapping and migrate_page_copy
- UBIFS: Implement ->migratepage()
- [ppc64el] bpf/jit: Disable classic BPF JIT on ppc64le
- can: fix oops caused by wrong rtnl dellink usage
- xen/pciback: Fix conf_space read/write overlap check.
- IB/mlx5: Fix post send fence logic
- IB/mlx4: Fix the SQ size of an RC QP
- IB/mlx4: Fix error flow when sending mads under SRIOV
- IB/mlx4: Verify port number in flow steering create flow
- IB/mlx4: Fix memory leak if QP creation failed
- Input: wacom_w8001 - w8001_MAX_LENGTH should be 13
- cifs: use CIFS_MAX_DOMAINNAME_LEN when converting the domain name
- cifs: dynamic allocation of ntlmssp blob
- ALSA: dummy: Fix a use-after-free at closing
- cifs: Fix reconnect to not defer smb3 session reconnect long after socket
reconnect
- tmpfs: don't undo fallocate past its last page
- fs/nilfs2: fix potential underflow in call to crc32_le
- staging: iio: accel: fix error check
- [armhf,arm64] KVM: Stop leaking vcpu pid references
- make nfs_atomic_open() call d_drop() on all ->open_context() errors.
- USB: don't free bandwidth_mutex too early
- ALSA: echoaudio: Fix memory allocation
- [s390x] fix test_fp_ctl inline assembly contraints
- net: bgmac: Start transmit queue in bgmac_open
- net: bgmac: Remove superflous netif_carrier_on()
- mac80211: Fix mesh estab_plinks counting in STA removal case
- Bridge: Fix ipv6 mc snooping if bridge has no ipv6 address
- NFS: Fix another OPEN_DOWNGRADE bug
- ipr: Clear interrupt on croc/crocodile when running with LSI
- [powerpc*] tm: Avoid SLB faults in treclaim/trecheckpoint when RI=0
- net: phy: Manage fixed PHY address space using IDA
- batman-adv: Fix memory leak on tt add with invalid vlan
- batman-adv: replace WARN with rate limited output on non-existing VLAN
- batman-adv: Fix use-after-free/double-free of tt_req_node
- batman-adv: Fix ICMP RR ethernet access after skb_linearize
- batman-adv: Clean up untagged vlan when destroying via rtnl-link
- qlcnic: use the correct ring in qlcnic_83xx_process_rcv_ring_diag()
- ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift()
- [amd64] power: Fix kernel text mapping corruption during image
restoration
- [x86] amd_nb: Fix boot crash on non-AMD systems
- bonding: prevent out of bound accesses
- net/mlx5: Fix potential deadlock in command mode change
- net/mlx5: Add timeout handle to commands with callback
- block: fix use-after-free in sys_ioprio_get() (CVE-2016-7911)
- ALSA: timer: Fix negative queue usage by racy accesses
- qeth: delete napi struct when removing a qeth device
- xenbus: don't bail early from xenbus_dev_request_and_reply()
- ecryptfs: don't allow mmap when the lower fs doesn't support it
- tmpfs: fix regression hang in fallocate undo
- fs: limit filesystem stacking depth
- proc: prevent stacking filesystems on top
- [powerpc*] KVM: Book3S HV: Pull out TM state save/restore into separate
procedures
- [powerpc*] KVM: Book3S HV: Save/restore TM state in H_CEDE (CVE-2016-5412)
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.38
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.39
- HID: uhid: fix timeout when probe races with IO
- macvlan: Fix potential use-after free for broadcasts
- netlabel: add address family checks to netlbl_{sock,req}_delattr()
- em28xx-i2c: rt_mutex_trylock() returns zero on failure
- PCI: Mark Atheros AR9485 and QCA9882 to avoid bus reset
- [armhf] gpio: pca953x: Fix NBANK calculation for PCA9536
- random: print a warning for the first ten uninitialized random users
- [x86] random: add interrupt callback to VMBus IRQ handler
- sched/cputime: Fix prev steal time accouting during CPU hotplug
- [armel/kirkwood,armhf] mvebu: fix HW I/O coherency related deadlocks
- [armhf] usb: dwc3: fix for the isoc transfer EP_BUSY flag
- crypto: gcm - Filter out async ghash if necessary
- IB/mlx5: Fix MODIFY_QP command input structure
- drm/nouveau: Don't leak runtime pm ref on driver unload
- drm/radeon: Don't leak runtime pm ref on driver unload
- drm/radeon: Don't leak runtime pm ref on driver load
- tty/serial: atmel: fix RS485 half duplex with DMA
- [armhf] serial: samsung: Fix ERR pointer dereference on deferred probe
- [armhf] hwrng: omap - Fix assumption that runtime_get_sync will always
succeed
- hp-wmi: Fix wifi cannot be hard-unblocked
- Input: xpad - validate USB endpoint count during probe
- ath9k: Fix programming of minCCA power threshold
- ext4: check for extents that wrap around
- ext4: fix deadlock during page writeback
- ext4: don't call ext4_should_journal_data() on the journal inode
- batman-adv: Avoid nullptr dereference in bla after vlan_insert_tag
- batman-adv: Avoid nullptr dereference in dat after vlan_insert_tag
- batman-adv: Fix orig_node_vlan leak on orig_node_release
- batman-adv: lock crc access in bridge loop avoidance
- batman-adv: Fix non-atomic bla_claim::backbone_gw access
- batman-adv: Fix reference leak in batadv_find_router
- batman-adv: Free last_bonding_candidate on release of orig_node
- ext4: validate s_reserved_gdt_blocks on mount
- iwlwifi: pcie: fix access to scratch buffer
- [mips*] Fix page table corruption on THP permission changes.
- batman-adv: Fix speedy join in gateway client mode
- drm/radeon: add a delay after ATPX dGPU power off
- drm/radeon: Poll for both connect/disconnect on analog connectors
- ALSA: ctl: Stop notification after disconnection
- ALSA: pcm: Free chmap at PCM free callback, too
- [armhf] net: mvneta: set real interrupt per packet for tx_done
- ppp: defer netns reference release for ppp channel
- rtc: ds1307: Fix relying on reset value for weekday
- ngene: properly handle __user ptr
- media: dvb_ringbuffer: Add memory barriers
- [x86] quirks: Apply nvidia_bugs quirk only on root bus
- [x86] quirks: Reintroduce scanning of secondary buses
- [x86] quirks: Add early quirk to reset Apple AirPort card
- posix_cpu_timer: Exit early when process has been reaped
- ALSA: hda - fix use-after-free after module unload
- svc: Avoid garbage replies when pc_func() returns rpc_drop_reply
- NFS: Don't drop CB requests with invalid principals
- qxl: check for kmap failures
- cifs: Check for existing directory when opening file with O_CREAT
- net: ethoc: Fix early error paths
- [s390x] mm: fix gmap tlb flush issues
- [armel,armhf] 8561/3: dma-mapping: Don't use outer_flush_range when the
L2C is coherent
- [x86] KVM: nVMX: fix lifetime issues for vmcs02
- [x86] KVM: nVMX: Fix memory corruption when using VMCS shadowing
- ext4: fix reference counting bug on block allocation error
- ext4: short-cut orphan cleanup on error
- [powerpc*] tm: Fix stack pointer corruption in __tm_recheckpoint()
- Bluetooth: Fix l2cap_sock_setsockopt() with optname BT_RCVMTU
- xfrm: fix crash in XFRM_MSG_GETSA netlink handler
- crypto: scatterwalk - Fix test in scatterwalk_done
- mmc: block: fix packed command header endianness
- crypto: nx - off by one bug in nx_of_update_msc()
- tpm: read burstcount from TPM_STS in one 32-bit transaction
- [arm64] debug: unmask PSTATE.D earlier
- brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain
- brcmsmac: Free packet if dma_mapping_error() fails in dma_rxfill
- brcmsmac: Initialize power in brcms_c_stf_ss_algo_channel_get()
- mtd: nand: fix bug writing 1 byte less than page size
- target: Fix missing complete during ABORT_TASK + CMD_T_FABRIC_STOP
- target: Fix race between iscsi-target connection shutdown + ABORT_TASK
- target: Fix max_unmap_lba_count calc overflow
- cifs: fix crash due to race in hmac(md5) handling
- hwmon: (adt7411) set bit 3 in CFG1 register
- iscsi-target: Fix panic when adding second TCP connection to iSCSI session
- tty/vt/keyboard: fix OOB access in do_compute_shiftstate()
- [mips*] bpf: fix off-by-one in ctx offset allocation
- libceph: set 'exists' flag for newly up osd
- libceph: apply new_state before new_up_client on incrementals
- [x86] gpio: intel-mid: Remove potentially harmful code
- nfs: don't create zero-length requests
- radix-tree: fix radix_tree_iter_retry() for tagged iterators.
- pps: do not crash when failed to register
- [armhf] OMAP3: hwmod data: Add sysc information for DSI
- net/irda: fix NULL pointer dereference on memory allocation failure
- l2tp: Correctly return -EBADF from pppol2tp_getname.
- ceph: Correctly return NXIO errors from ceph_llseek
- CIFS: Fix a possible invalid memory access in smb2_query_symlink()
- [mips*] KEYS: 64-bit MIPS needs to use compat_sys_keyctl for 32-bit
userspace
- drm/radeon: fix firmware info version checks
- fuse: fsync() did not return IO errors
- fuse: fuse_flush must check mapping->flags for errors
- fuse: fix wrong assignment of ->flags in fuse_send_init()
- ubi: Fix race condition between ubi device creation and udev
- ubi: Make volume resize power cut aware
- ubi: Be more paranoid while seaching for the most recent Fastmap
- drm/nouveau/fbcon: fix font width not divisible by 8
- drm/nouveau/acpi: ensure matching ACPI handle and supported functions
- drm/nouveau/acpi: check for function 0x1B before using it
- tcp: consider recv buf for the initial window scale
- ext4: validate that metadata blocks do not overlap superblock
- ALSA: hda - On-board speaker fixup on ACER Veriton
- [amd64] syscalls: Add compat_sys_keyctl for 32-bit userspace
- balloon: check the number of available pages in leak balloon
- dm flakey: error READ bios during the down_interval
- mm/hugetlb: avoid soft lockup in set_max_huge_pages()
- sysv, ipc: fix security-layer leaking
- ALSA: hda: Fix krealloc() with __GFP_ZERO usage
- block: fix use-after-free in seq file (CVE-2016-7910)
- mac80211: fix purging multicast PS buffer queue
- SUNRPC: allow for upcalls for same uid but different gss service
- USB: serial: fix memleak in driver-registration error path
- vfio/pci: Fix NULL pointer oops in error interrupt setup handling
- [x86] drm/edid: Add 6 bpc quirk for display AEO model 0.
- [x86] drm/i915/dp: Revert "drm/i915/dp: fall back to 18 bpp when sink
capability is unknown"
- [powerpc*] powernv: Fix MCE handler to avoid trashing CR0/CR1 registers.
- netfilter: nf_ct_expect: remove the redundant slash when policy name is
empty
- netfilter: nfnetlink_queue: reject verdict request from different portid
- [powerpc*] book3s: Fix MCE console messages for unrecoverable MCE.
- USB: validate wMaxPacketValue entries in endpoint descriptors
- cpuset: make sure new tasks conform to the current config of the cpuset
- [s390x] dasd: fix hanging device after clear subchannel
- [armhf] usb: dwc3: gadget: increment request->actual once
- [x86] mm: Disable preemption during CR3 read+write
- megaraid_sas: Fix probing cards without io port
- PM / hibernate: Restore processor state before using per-CPU variables
- ipv6: suppress sparse warnings in IP6_ECN_set_ce()
- USB: serial: mos7720: fix non-atomic allocation in write path
- USB: serial: mos7840: fix non-atomic allocation in write path
- cdc-acm: fix wrong pipe type on rx interrupt xfers
- scsi: fix upper bounds check of sense key in scsi_sense_key_string()
- xhci: always handle "Command Ring Stopped" events
- usb: xhci: Fix panic if disconnect
- xhci: don't dereference a xhci member after removing xhci
- [x86] KVM: nVMX: postpone VMCS changes on MSR_IA32_APICBASE write
- bcache: register_bcache(): call blkdev_put() when cache_alloc() fails
- bcache: RESERVE_PRIO is too small by one when prio_buckets() is a power
of two.
- drm/radeon: fix radeon_move_blit on 32bit systems
- net/mlx5: Added missing check of msg length in verifying its signature
- [x86] staging: comedi: daqboard2000: bug fix board type matching code
- [x86] staging: comedi: ni_mio_common: fix AO inttrig backwards
compatibility
- [armhf] iio: adc: ti_am335x_adc: Protect FIFO1 from concurrent access
- [powerpc*] pseries: use pci_host_bridge.release_fn() to kfree(phb)
- [powerpc*] prom: Fix sub-processor option passed to ibm,
client-architecture-support
- drm: Reject page_flip for !DRIVER_MODESET
- USB: fix typo in wMaxPacketSize validation
- USB: avoid left shift by -1
- ubifs: Fix assertion in layout_in_gaps()
- tun: fix transmit timestamp support
- timekeeping: Cap array access in timekeeping_debug
- [x86] apic: Do not init irq remapping if ioapic is disabled
- usb: gadget: udc: core: don't starve DMA resources
- qdisc: fix a module refcount leak in qdisc_create_dflt()
- [armel/kirkwood] ib62x0: fix size of u-boot environment partition
- batman-adv: Add missing refcnt for last_candidate
- [armhf] clocksource/drivers/sun4i: Clear interrupts after stopping timer
in probe function
- printk: fix parsing of "brl=" option
- fs/seq_file: fix out-of-bounds read
- [powerpc*] powernv : Drop reference added by kset_find_obj()
- ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE
- ALSA: timer: fix NULL pointer dereference on memory allocation failure
- NFSv4.x: Fix a refcount leak in nfs_callback_up_net
- dm crypt: fix free of bad values after tfm allocation failure
- kernfs: don't depend on d_find_any_alias() when generating notifications
- ALSA: fireworks: accessing to user space outside spinlock
- ipv6: add missing netconf notif when 'all' is updated
- tcp: fastopen: fix rcv_wup initialization for TFO server on SYN/data
- kernel/fork: fix CLONE_CHILD_CLEARTID regression in nscd
- ALSA: timer: fix NULL pointer dereference in read()/ioctl() race
- [x86] paravirt: Do not trace _paravirt_ident_*() functions
- IB/core: Fix use after free in send_leave function
- IB/ipoib: Fix memory corruption in ipoib cm mode connect flow
- [x86] AMD: Apply erratum 665 on machines without a BIOS fix
- l2tp: fix use-after-free during module unload
- iio: fix pressure data output unit in hid-sensor-attributes
- sched/core: Fix a race between try_to_wake_up() and a woken up task
- [x86] efi/libstub: Allocate headspace in efi_get_memory_map()
- iio:core: fix IIO_VAL_FRACTIONAL sign handling
- Btrfs: add missing blk_finish_plug in btrfs_sync_log()
- Btrfs: remove root_log_ctx from ctx list before btrfs_sync_log returns
- ipv6: addrconf: fix dev refcont leak when DAD failed
- crypto: cryptd - initialize child shash_desc on import
- ALSA: timer: Fix zero-division by continue of uninitialized instance
- ALSA: rawmidi: Fix possible deadlock with virmidi registration
- xfrm_user: propagate sec ctx allocation errors
- [armhf,arm64] kvm-arm: Unmap shadow pagetables properly
- [arm64] spinlocks: implement smp_mb__before_spinlock() as smp_mb()
- asm-generic: make copy_from_user() zero the destination properly
- NFSv4.1: Fix the CREATE_SESSION slot number accounting
- crypto: skcipher - Fix blkcipher walk OOM crash
- [arm64] crypto: aes-ctr - fix NULL dereference in tail processing
- nl80211: validate number of probe response CSA counters
- asm-generic: make get_user() clear the destination on errors
- [mips*] copy_from_user() must zero the destination on access_ok() failure
- [powerpc] ppc32: fix copy_from_user()
- [s390x] get_user() should zero on failure
- [x86] perf/amd: Make HW_CACHE_REFERENCES and HW_CACHE_MISSES measure L2
- USB: change bInterval default to 10 ms
- IB/ipoib: Don't allow MC joins during light MC flush
- IB/mlx4: Fix incorrect MC join state bit-masking on SR-IOV
- IB/mlx4: Fix code indentation in QP1 MAD flow
- IB/mlx4: Use correct subnet-prefix in QP1 mads under SR-IOV
- irda: Free skb on irda_accept error path.
- xfrm: Fix memory leak of aead algorithm name
- ocfs2/dlm: fix race between convert and migration
- fsnotify: add a way to stop queueing events on group shutdown
- ocfs2: fix start offset to ocfs2_zero_range_for_truncate()
- fix fault_in_multipages_...() on architectures with no-op access_ok()
- [x86] i2c-eg20t: fix race between i2c init and interrupt enable
- btrfs: ensure that file descriptor used with subvol ioctls is a dir
- can: dev: fix deadlock reported after bus-off
- ip6_gre: Set flowi6_proto as IPPROTO_GRE in xmit path.
- ip6_gre: fix flowi6_proto value in ip6gre_xmit_other()
- tracing: Move mutex to protect against resetting of seq data
- ipmr, ip6mr: fix scheduling while atomic and a deadlock with
ipmr_get_route
- drm/radeon/si/dpm: add workaround for for Jet parts
- mm,ksm: fix endless looping in allocating memory when ksm enable
- [armel,armhf] 8617/1: dma: fix dma_max_pfn()
- [mips*/5kc-malta] Fix IOCU disable switch read for MIPS64
- mm: workingset: fix crash in shadow node shrinker caused by
replace_page_cache_page()
- [armhf] 8618/1: decompressor: reset ttbcr fields to use TTBR0 on ARMv7
- [arm64] perf: reject groups spanning multiple HW PMUs (CVE-2015-8955)
- firewire: net: guard against rx buffer overflows (CVE-2016-8633)
- brcmfmac: avoid potential stack overflow in brcmf_cfg80211_start_ap()
(CVE-2016-8658)
- vfio/pci: Fix integer overflows, bitmask check (CVE-2016-9083,
CVE-2016-9084)
- fs: Give dentry to inode_change_ok() instead of inode
- fs: Avoid premature clearing of capabilities (CVE-2015-1350)
(Closes: #770492)
- posix_acl: Clear SGID bit when setting file permissions (CVE-2016-7097)
- staging: comedi: ni_mio_common: fix wrong insn_write handler
- xenbus: don't BUG() on user mode induced condition
- xenbus: don't look up transaction IDs for ordinary writes
- compiler-gcc: disable -ftracer for __noclone functions
- PM / devfreq: Fix incorrect type issue.
- mm: filemap: don't plant shadow entries without radix tree node
[ Aurelien Jarno ]
* [mips*] Fix ptrace handling of any syscalls returning ENOSYS.
[ Salvatore Bonaccorso ]
* [x86] KVM: pass host_initiated to functions that read MSRs
* [x86] KVM: VMX: Fix host initiated access to guest MSR_TSC_AUX
(Closes: #838660)
[ Ben Hutchings ]
* [x86] video: Disable X86_SYSFB, FB_SIMPLE (Closes: #822575)
* Revert "ecryptfs: forbid opening files without mmap handler", redundant
with upstream fixes
* fs: Move procfs/ecryptfs stacking check into ecryptfs, to avoid ABI change
* [mips*] Fix ABI change in 3.16.37
* net/sched: Fix ABI change in 3.16.37
* SCSI: Fix ABI change in 3.16.37
* ubi: Avoid ABI change in 3.16.37
* i8042: Revert ABI break in 3.16.39
* fs: Fix ABI change in 3.16.39
* can: Ignore ABI change in 3.16.39
* [mips*] uaccess: Avoid ABI change in 3.16.39
* [arm64] Revert "arm64: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO" to
avoid ABI change
* [s390x] Revert "s390: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO" to
avoid ABI change
* Revert "block: fix bdi vs gendisk lifetime mismatch" to avoid ABI change
* fsnotify: Ignore ABI change in 3.16.39
* Fix backport of "fs: Give dentry to inode_change_ok() instead of inode"
in fuse, xfs
* sg: Fix double-free when drives detach during SG_IO (CVE-2015-8962)
* perf: Fix race in swevent hash (CVE-2015-8963)
* tty: Prevent ldisc drivers from re-using stale tty fields (CVE-2015-8964)
* usb: gadget: f_fs: Fix use-after-free (CVE-2016-7912)
* HID: core: prevent out-of-bound readings (CVE-2016-7915)
* netfilter: nfnetlink: correctly validate length of batch messages
(CVE-2016-7917)
* net: ping: check minimum size on ICMP header length (CVE-2016-8399)
* net: Add __sock_queue_rcv_skb()
* rose,dccp: limit sk_filter trim to payload
* tcp: take care of truncations done by sk_filter() (CVE-2016-8645)
* mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] (CVE-2016-8650)
* packet: fix race condition in packet_set_ring (CVE-2016-8655)
* [x86] Fix potential infoleak in older kernels (CVE-2016-9178)
* sctp: validate chunk len before actually using it (CVE-2016-9555)
* sg_write()/bsg_write() is not fit to be called under KERNEL_DS
(CVE-2016-9576, CVE-2016-10088)
* [x86] KVM: drop error recovery in em_jmp_far and em_ret_far (CVE-2016-9756)
* net: avoid signed overflows for SO_{SND|RCV}BUFFORCE (CVE-2016-9793)
* ALSA: pcm : Call kill_fasync() in stream lock (CVE-2016-9794)
* security,perf: Allow unprivileged use of perf_event_open to be disabled
(sysctl: kernel.perf_event_paranoid=3)
* spi-nor: Add support for n25q256a11 SPI flash device (Closes: #843650)
(thanks to Matt Sickler)
* xen-blkfront: fix accounting of reqs when migrating (Closes: #843715)
[ Julien Cristau ]
* hwrng: Add chaoskey driver, backported from 4.8 (Closes: #839616)
-- Ben Hutchings <ben(a)decadent.org.uk> Fri, 30 Dec 2016 19:42:20 +0000
--- Modifications pour nettle (libhogweed2 libnettle4) ---
nettle (2.7.1-5+deb8u2) stable; urgency=medium
* [SECURITY] cve-2016-6489.patch: Protect against potential side-channel
attacks against exponentiation operations as described in
CVE-2016-6489 "RSA code is vulnerable to cache sharing related
attacks" (Closes: #832983).
-- Magnus Holmgren <holmgren(a)debian.org> Sat, 05 Nov 2016 17:37:13 +0100
--- Modifications pour nss-pam-ldapd (libnss-ldapd libpam-ldapd nslcd nslcd-utils) ---
nss-pam-ldapd (0.9.4-3+deb8u2) jessie; urgency=medium
* Non-maintainer upload.
* have init script stop action only return when nslcd has actually stopped
(Closes: #814881)
-- Salvatore Bonaccorso <carnil(a)debian.org> Wed, 09 Nov 2016 13:48:14 +0100
--- Modifications pour pam (libpam0g libpam-modules libpam-modules-bin libpam-runtime) ---
pam (1.1.8-3.1+deb8u2) jessie; urgency=medium
* Non-maintainer upload.
* debian/patches-applied/pam-loginuid-in-containers: Updated with the version
from Ubuntu, this should fix logins in containers (Closes: #726661)
-- Evgeni Golov <evgeni(a)debian.org> Sat, 12 Nov 2016 08:38:19 +0100
--- Modifications pour sed ---
sed (4.2.2-4+deb8u1) stable; urgency=medium
[ Jérémy Bobbio ]
* Ensure consistent permissions with different umasks.
closes: #774347, #835516.
-- Clint Adams <clint(a)debian.org> Fri, 09 Sep 2016 18:07:57 -0400
--- Modifications pour systemd (libpam-systemd libsystemd0 libudev1 systemd systemd-sysv
udev) ---
systemd (215-17+deb8u6) stable; urgency=medium
[ Michael Biebl ]
* Don't return any error in manager_dispatch_notify_fd().
If manager_dispatch_notify_fd() fails and returns an error then the
handling of service notifications will be disabled entirely leading to a
compromised system.
For example pid1 won't be able to receive the WATCHDOG messages anymore
and will kill all services supposed to send such messages. (CVE-2016-7796)
(Closes: #839607)
* core: Rework logic to determine when we decide to add automatic deps for
mounts.
This adds a concept of "extrinsic" mounts. If mounts are extrinsic we
consider them managed by something else and do not add automatic ordering
against umount.target, local-fs.target, remote-fs.target.
Extrinsic mounts include API mounts such as everything below /proc, /sys,
/dev. This avoids a crash in LXC containers where /dev/urandom is a bind
mount from the host system and unmounting it leads to an assert in
systemd. (Closes: #818978)
* Various ordering fixes for ifupdown.
Run ifup after all kernel modules have been loaded and all sysctl settings
are applied. Update ifup@.service to add missing After= for the device
unit we bind to. This ensures that the device unit is active when systemd
tries to start the service. (Closes: #819314)
* systemctl: Fix argument handling when invoked as shutdown.
(Closes: #776997)
[ Simon McVittie ]
* localed: tolerate absence of /etc/default/keyboard.
The debian-specific patch to read Debian config files was not tolerating
the absence of /etc/default/keyboard. This causes systemd-localed to fail
to start on systems where that file isn't populated (like embedded systems
without keyboards). (Closes: #833849)
[ Martin Pitt ]
* systemctl, loginctl, etc.: Don't start polkit agent when running as root.
(Closes: #774153, LP: #1565617)
-- Michael Biebl <biebl(a)debian.org> Wed, 21 Dec 2016 21:33:51 +0100
--- Modifications pour base-files ---
base-files (8+deb8u7) stable; urgency=low
* Changed /etc/debian_version to 8.7, for Debian 8.7 point release.
-- Santiago Vila <sanvila(a)debian.org> Wed, 28 Dec 2016 18:39:54 +0100
========================================================================
You can perform the upgrade by issuing the command:
apt-get dist-upgrade
as root on quigon.federez.net
--
apticron