Re: [Monitoring] 17 Debian package update(s) for nonagon.federez.net

apticron report [Wed, 01 May 2019 18:49:12 +0200] ======================================================================== apticron has detected that some packages need upgrading on: nonagon.federez.net [ 185.230.78.42 2a0c:700:0:23:67:e5ff:fee9:3 ] The following packages are currently pending an upgrade: base-files 9.9+deb9u9 libjs-jquery 3.1.1-2+deb9u1 libmariadbclient18 10.1.38-0+deb9u1 libpng16-16 1.6.28-1+deb9u1 linux-libc-dev 4.9.168-1 mariadb-client-10.1 10.1.38-0+deb9u1 mariadb-client-core-10.1 10.1.38-0+deb9u1 mariadb-common 10.1.38-0+deb9u1 postfix 3.1.12-0+deb9u1 postfix-sqlite 3.1.12-0+deb9u1 publicsuffix 20190415.1030-0+deb9u1 python3-cryptography 1.7.1-3+deb9u1 python-cryptography 1.7.1-3+deb9u1 python-pip 9.0.1-2+deb9u1 python-pip-whl 9.0.1-2+deb9u1 rsync 3.1.2-1+deb9u2 unzip 6.0-21+deb9u1 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour libpng1.6 (libpng16-16) --- libpng1.6 (1.6.28-1+deb9u1) stretch-security; urgency=high * Non-maintainer upload by the Security Team. * Call png_image_free_function without guarding it with png_safe_execute (CVE-2019-7317) (Closes: #921355) -- Salvatore Bonaccorso <carnil(a)debian.org> Thu, 18 Apr 2019 22:12:35 +0200 --- Modifications pour base-files --- base-files (9.9+deb9u9) stretch; urgency=medium * Change /etc/debian_version to 9.9, for Debian 9.9 point release. -- Santiago Vila <sanvila(a)debian.org> Thu, 28 Mar 2019 10:12:44 +0100 --- Modifications pour jquery (libjs-jquery) --- jquery (3.1.1-2+deb9u1) stretch; urgency=medium * Team upload * Add patch to prevent Object.prototype pollution (Closes: #927385, CVE-2019-11358) * Disable check-against-upstream-build test (autopkgtest) since file is now patched -- Xavier Guimard <yadd(a)debian.org> Thu, 18 Apr 2019 22:57:29 +0200 --- Modifications pour linux (linux-libc-dev) --- linux (4.9.168-1) stretch; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.162 - Revert "loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl()" - Revert "loop: Get rid of loop_index_mutex" - Revert "loop: Fold __loop_release into loop_release" - scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached - [arm64] drm/msm: Unblock writer if reader closes file - [x86] ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field - [x86] ALSA: compress: prevent potential divide by zero bugs - [x86] thermal: int340x_thermal: Fix a NULL vs IS_ERR() check - [arm64,armhf] usb: dwc3: gadget: synchronize_irq dwc irq in suspend - [arm64,armhf] usb: dwc3: gadget: Fix the uninitialized link_state when udc starts - usb: gadget: Potential NULL dereference on allocation error - ASoC: dapm: change snprintf to scnprintf for possible overflow - [armhf] ASoC: imx-audmux: change snprintf to scnprintf for possible overflow - [x86] drivers: thermal: int340x_thermal: Fix sysfs race condition - mac80211: fix miscounting of ttl-dropped frames - locking/rwsem: Fix (possible) missed wakeup - direct-io: allow direct writes to empty inodes - scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state() - net: usb: asix: ax88772_bind return error when hw_reset fail - [ppc64el] ibmveth: Do not process frames after calling napi_reschedule - mac80211: don't initiate TDLS connection if station is not associated to AP - mac80211: Add attribute aligned(2) to struct 'action' - cfg80211: extend range deviation for DMG - [x86] svm: Fix AVIC incomplete IPI emulation - [x86] KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1 - [powerpc*] Always initialize input array when calling epapr_hypercall() - [arm64] mmc: spi: Fix card detection during probe - mm: enforce min addr even if capable() in expand_downwards() (CVE-2019-9213) - [x86] uaccess: Don't leak the AC flag into __put_user() value evaluation https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.163 - USB: serial: option: add Telit ME910 ECM composition - USB: serial: cp210x: add ID for Ingenico 3070 - USB: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485 - cpufreq: Use struct kobj_attribute instead of struct global_attr - ncpfs: fix build warning of strncpy - [x86] staging: comedi: ni_660x: fix missing break in switch statement - ip6mr: Do not call __IP6_INC_STATS() from preemptible context - net-sysfs: Fix mem leak in netdev_register_kobject - sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79 - team: Free BPF filter when unregistering netdev - bnxt_en: Drop oversize TX packets to prevent errors. - [x86] hv_netvsc: Fix IP header checksum for coalesced packets - [armhf] net: dsa: mv88e6xxx: Fix u64 statistics - net: netem: fix skb length BUG_ON in __skb_to_sgvec - net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails - net: sit: fix memory leak in sit_init_net() - xen-netback: don't populate the hash cache on XenBus disconnect - xen-netback: fix occasional leak of grant ref mappings under memory pressure - net: Add __icmp_send helper. - tun: fix blocking read - tun: remove unnecessary memory barrier - net: phy: Micrel KSZ8061: link failure after cable connect - [x86] CPU/AMD: Set the CPB bit unconditionally on F17h - applicom: Fix potential Spectre v1 vulnerabilities - [mips*] irq: Allocate accurate order pages for irq stack - hugetlbfs: fix races and page leaks during migration - exec: Fix mem leak in kernel_read_file (CVE-2019-8980) - media: uvcvideo: Fix 'type' check leading to overflow - vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel - perf core: Fix perf_proc_update_handler() bug - perf tools: Handle TOPOLOGY headers with no CPU - IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM - [amd64] iommu/amd: Call free_iova_fast with pfn in map_sg - [amd64] iommu/amd: Unmap all mapped pages in error path of map_sg - ipvs: Fix signed integer overflow when setsockopt timeout - [amd64] iommu/amd: Fix IOMMU page flush when detach device from a domain - [arm64] net: hns: Fix for missing of_node_put() after of_parse_phandle() - [arm64] net: hns: Fix wrong read accesses via Clause 45 MDIO protocol - [armhf] net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup() - nfs: Fix NULL pointer dereference of dev_name - qed: Fix VF probe failure while FLR - scsi: libfc: free skb when receiving invalid flogi resp - [x86] platform: Fix unmet dependency warning for SAMSUNG_Q10 - cifs: fix computation for MAX_SMB2_HDR_SIZE - [arm64] kprobe: Always blacklist the KVM world-switch code - [x86] kexec: Don't setup EFI info if EFI runtime is not enabled - mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone - mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone - fs/drop_caches.c: avoid softlockups in drop_pagecache_sb() - autofs: drop dentry reference only when it is never used - autofs: fix error return in autofs_fill_super() - vsock/virtio: fix kernel panic after device hot-unplug - vsock/virtio: reset connected sockets on device removal - netfilter: nf_nat: skip nat clash resolution for same-origin entries - [s390x] qeth: fix use-after-free in error path - perf symbols: Filter out hidden symbols from labels - [mips*] Remove function size check in get_frame_info() - fs: ratelimit __find_get_block_slow() failure message. - Input: wacom_serial4 - add support for Wacom ArtPad II tablet - Input: elan_i2c - add id for touchpad found in Lenovo s21e-20 - [x86] iscsi_ibft: Fix missing break in switch statement - scsi: aacraid: Fix missing break in switch statement - futex,rt_mutex: Restructure rt_mutex_finish_proxy_lock() - [armhf] dts: exynos: Fix pinctrl definition for eMMC RTSN line on Odroid X2/U3 - drm: disable uncached DMA optimization for ARM and arm64 - [armhf] dts: exynos: Do not ignore real-world fuse values for thermal zone 0 on Exynos5420 - [x86] perf/x86/intel: Make cpuc allocations consistent - [x86] perf/x86/intel: Generalize dynamic constraint creation - [x86] Add TSX Force Abort CPUID/MSR https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.164 - ACPICA: Reference Counts: increase max to 0x4000 for large servers - KEYS: restrict /proc/keys by credentials at open time - l2tp: fix infoleak in l2tp_ip6_recvmsg() - net: sit: fix UBSAN Undefined behaviour in check_6rd - pptp: dst_release sk_dst_cache in pptp_sock_destruct - route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race - tcp: handle inet_csk_reqsk_queue_add() failures - vxlan: test dev->flags & IFF_UP before calling gro_cells_receive() - net/mlx4_core: Fix reset flow when in command polling mode - net/mlx4_core: Fix locking in SRIOV mode when switching between events and polling - net/mlx4_core: Fix qp mtt size calculation - mdio_bus: Fix use-after-free on device_register fails - net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255 - af_unix: missing barriers in some of unix_sock ->addr and ->path accesses - ipvlan: disallow userns cap_net_admin to change global mode/flags - vxlan: Fix GRO cells race condition between receive and link delete - rxrpc: Fix client call queueing, waiting for channel - gro_cells: make sure device is up in gro_cells_receive() - tcp/dccp: remove reqsk_put() from inet_child_forget() - [x86] perf: Fixup typo in stub functions - ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56 - md: It's wrong to add len to sector_nr in raid10 reshape twice - of: Support const and non-const use for to_of_node() - vhost/vsock: fix vhost vsock cid hashing inconsistent https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.165 - media: videobuf2-v4l2: drop WARN_ON in vb2_warn_zero_bytesused() - 9p: use inode->i_lock to protect i_size_write() under 32-bit - 9p/net: fix memory leak in p9_client_create - [armhf] iio: adc: exynos-adc: Fix NULL pointer exception on unbind - crypto: ahash - fix another early termination in hash walk - [armhf] gpu: ipu-v3: Fix i.MX51 CSI control registers offset - [armhf] gpu: ipu-v3: Fix CSI offsets for imx53 - [s390x] dasd: fix using offset into zero size array error - [armhf] OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized - floppy: check_events callback should not return a negative number - mm/gup: fix gup_pmd_range() for dax - mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs - [arm64] net: hns: Fix object reference leaks in hns_dsaf_roce_reset() - [armhf] clk: sunxi: A31: Fix wrong AHB gate number - assoc_array: Fix shortcut creation - scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task - [arm64] pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins - qmi_wwan: apply SET_DTR quirk to Sierra WP7607 - [armel] net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe() - [x86] ASoC: topology: free created components in tplg load error - [arm64] Relax GIC version check during early boot - [armhf] net: marvell: mvneta: fix DMA debug warning - tmpfs: fix link accounting when a tmpfile is linked in - mac80211_hwsim: propagate genlmsg_reply return code - [arm64] net: thunderx: make CFG_DONE message to run through generic send-ack sequence - nfp: bpf: fix code-gen bug on BPF_ALU | BPF_XOR | BPF_K - nfp: bpf: fix ALU32 high bits clearance bug - net: set static variable an initial value in atl2_probe() - tmpfs: fix uninitialized return value in shmem_link - [x86] libnvdimm/label: Clear 'updating' flag after label-set update - [x86] libnvdimm/pmem: Honor force_raw for legacy pmem regions - [amd64] libnvdimm: Fix altmap reservation size calculation - crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails - [arm64] crypto: aes-ccm - fix logical bug in AAD MAC handling - CIFS: Do not reset lease state to NONE on lease break - CIFS: Fix read after write for files with read caching - tracing: Do not free iter->trace in fail path of tracing_open_pipe() - [amd64,arm64,i386] ACPI / device_sysfs: Avoid OF modalias creation for removed device - [armhf] spi: ti-qspi: Fix mmap read when more than one CS in use - [armhf] regulator: s2mps11: Fix steps for buck7, buck8 and LDO35 - [armhf] regulator: s2mpa01: Fix step values for some LDOs - [armhf] clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR - [armhf] clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown - [s390x] virtio: handle find on invalid queue gracefully - scsi: virtio_scsi: don't send sc payload with tmfs - scsi: sd: Optimal I/O size should be a multiple of physical block size - scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock - fs/devpts: always delete dcache dentry-s in dput() - splice: don't merge into linked buffers - btrfs: ensure that a DUP or RAID1 block group has exactly two stripes - crypto: pcbc - remove bogus memcpy()s with src == dest - libertas_tf: don't set URB_ZERO_PACKET on IN USB transfer - [arm64,armhf] cpufreq: tegra124: add missing of_node_put() - ext4: fix crash during online resizing - [armhf] clk: clk-twl6040: Fix imprecise external abort for pdmclk - [x86] nfit: acpi_nfit_ctl(): Check out_obj->type in the right place - mm: hwpoison: fix thp split handing in soft_offline_in_use_page() (CVE-2019-10124) - mm/vmalloc: fix size check for remap_vmalloc_range_partial() - kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv - device property: Fix the length used in PROPERTY_ENTRY_STRING() - [x86] intel_th: Don't reference unassigned outputs - parport_pc: fix find_superio io compare code, should use equal test. - [arm64,armhf] i2c: tegra: fix maximum transfer size - [x86] drm/i915: Relax mmap VMA check - [arm64] serial: uartps: Fix stuck ISR if RX disabled with non-empty FIFO - serial: 8250_of: assume reg-shift of 2 for mrvl,mmp-uart - 8250: FIX Fourth port offset of Pericom PI7C9X7954 boards - serial: 8250_pci: Fix number of ports for ACCES serial cards - serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pci_pericom_setup() - jbd2: clear dirty flag when revoking a buffer from an older transaction - jbd2: fix compile warning when using JBUFFER_TRACE - [powerpc] Clear on-stack exception marker upon exception return - [ppc64el] powernv: Make opal log only readable by root - [ppc64el] Fix 32-bit KVM-PR lockup and host crash with MacOS guest - [ppc64el] ptrace: Simplify vr_get/set() to avoid GCC warning - dm: fix to_sector() for 32bit - NFS: Fix I/O request leakages - NFS: Fix an I/O request leakage in nfs_do_recoalesce - NFS: Don't recoalesce on error in nfs_pageio_complete_mirror() - nfsd: fix memory corruption caused by readdir - nfsd: fix wrong check in write_v4_end_grace() - PM / wakeup: Rework wakeup source timer cancellation - bcache: never writeback a discard operation - [x86] perf intel-pt: Fix CYC timestamp calculation after OVF - perf auxtrace: Define auxtrace record alignment - [x86] perf intel-pt: Fix overlap calculation for padding - [x86] perf intel-pt: Fix divide by zero when TSC is not available - md: Fix failed allocation of md_register_thread - rcu: Do RCU GP kthread self-wakeup from softirq and interrupt - media: uvcvideo: Avoid NULL pointer dereference at the end of streaming - drm/radeon/evergreen_cs: fix missing break in switch statement - [x86] KVM: nVMX: Sign extend displacements of VMX instr's mem operands - [x86] KVM: nVMX: Ignore limit checks on VMX instructions using flat segments - [x86] KVM: Fix residual mmio emulation request to userspace https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.166 - [x86] drm/vmwgfx: Don't double-free the mode stored in par->set_mode - [amd64] iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE - libceph: wait for latest osdmap in ceph_monc_blacklist_add() - udf: Fix crash on IO error during truncate - [mips*] Ensure ELF appended dtb is relocated - [mips*] Fix kernel crash for R6 in jump label branch function - futex: Ensure that futex address is aligned in handle_futex_death() - objtool: Move objtool_file struct off the stack - ext4: fix NULL pointer dereference while journal is aborted - ext4: fix data corruption caused by unaligned direct AIO - ext4: brelse all indirect buffer in ext4_ind_remove_space() - media: v4l2-ctrls.c/uvc: zero v4l2_event - Bluetooth: Fix decrementing reference count twice in releasing socket - ALSA: hda - Record the current power state before suspend/resume calls - ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec - tcp/dccp: drop SYN packets if accept queue is full - vfs: Hang/soft lockup in d_invalidate with simultaneous calls - [arm64] traps: disable irq in die() - lib/int_sqrt: optimize small argument - scsi: ufs: fix wrong command type of UTRD for UFSHCI v2.1 - rtc: Fix overflow when converting time64_t to rtc_time - [armhf] pwm-backlight: Enable/disable the PWM before/after LCD enable toggle. - ath10k: avoid possible string overflow https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.167 - Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt (CVE-2019-3460) - Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer (CVE-2019-3459) - cfg80211: size various nl80211 messages correctly - [arm64,armhf] stmmac: copy unicast mac address to MAC registers - dccp: do not use ipv6 header for ipv4 flow - mISDN: hfcpci: Test both vendor & device ID for Digium HFC4S - net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec - net: rose: fix a possible stack overflow - packets: Always register packet sk in the same order - tcp: do not use ipv6 header for ipv4 flow - vxlan: Don't call gro_cells_destroy() before device is unregistered - sctp: get sctphdr by offset in sctp_compute_cksum - tun: properly test for IFF_UP - tun: add a missing rcu_read_unlock() in error path - btrfs: remove WARN_ON in log_dir_items - btrfs: raid56: properly unmap parity page in finish_parity_scrub() - [powerpc*] bpf: Fix generation of load/store DW instructions - NFSv4.1 don't free interrupted slot on open - ALSA: rawmidi: Fix potential Spectre v1 vulnerability - ALSA: pcm: Fix possible OOB access in PCM oss plugins - ALSA: pcm: Don't suspend stream in unrecoverable PCM state - fs/open.c: allow opening only regular files during execve() - scsi: sd: Fix a race between closing an sd device and sd I/O - scsi: sd: Quiesce warning if device does not report optimal I/O size - [s390x] scsi: zfcp: fix rport unblock if deleted SCSI devices on Scsi_Host - [s390x] scsi: zfcp: fix scsi_eh host reset with port_forced ERP for non-NPIV FCP devices - [x86] staging: comedi: ni_mio_common: Fix divide-by-zero for DIO cmdtest - USB: serial: cp210x: add new device id - USB: serial: ftdi_sio: add additional NovaTech products - USB: serial: mos7720: fix mos_parport refcount imbalance on error path - USB: serial: option: set driver_info for SIM5218 and compatibles - USB: serial: option: add Olicard 600 - fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links - usb: common: Consider only available nodes for dr_mode - [x86] perf intel-pt: Fix TSC slip - cpu/hotplug: Prevent crash when CPU bringup fails on CONFIG_HOTPLUG_CPU=n - KVM: Reject device ioctls from processes other than the VM's creator - [x86] KVM: Emulate MSR_IA32_ARCH_CAPABILITIES on AMD hosts - USB: gadget: f_hid: fix deadlock in f_hidg_write() - xhci: Fix port resume done detection for SS ports with LPM enabled - [arm64] support keyctl() system call in 32-bit mode https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.168 - [arm64] debug: Don't propagate UNKNOWN FAR into si_code for debug signals - ext4: cleanup bh release code in ext4_ind_remove_space() - lib/int_sqrt: optimize initial value compute - mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified - i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA - CIFS: fix POSIX lock leak and invalid ptr deref - tracing: kdb: Fix ftdump to not sleep - [armhf] gpio: gpio-omap: fix level interrupt idling - include/linux/relay.h: fix percpu annotation in struct rchan - sysctl: handle overflow for file-max - [arm64] scsi: hisi_sas: Set PHY linkrate when disconnected - [armhf,ppc64el] mm/cma.c: cma_declare_contiguous: correct err handling - mm/page_ext.c: fix an imbalance with kmemleak - mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512! - mm/slab.c: kmemleak no scan alien caches - ocfs2: fix a panic problem caused by o2cb_ctl - fs/file.c: initialize init_files.resize_wait - cifs: use correct format characters - dm thin: add sanity checks to thin-pool and external snapshot creation - cifs: Fix NULL pointer dereference of devname - jbd2: fix invalid descriptor block checksum - fs: fix guard_bio_eod to check for real EOD errors - wil6210: check null pointer in _wil_cfg80211_merge_extra_ies - [arm64,armhf] usb: chipidea: Grab the (legacy) USB PHY by phandle first - scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c - [armel,armhf] 8840/1: use a raw_spinlock_t in unwind - [armhf] mmc: omap: fix the maximum timeout setting - e1000e: Fix -Wformat-truncation warnings - IB/mlx4: Increase the timeout for CM cache - scsi: megaraid_sas: return error when create DMA pool failed - [armhf] SoC: imx-sgtl5000: add missing put_device() - vfs: fix preadv64v2 and pwritev64v2 compat syscalls with offset == -1 - [amd64] HID: intel-ish-hid: avoid binding wrong ishtp_cl_device - [armhf] leds: lp55xx: fix null deref on firmware load failure - iwlwifi: pcie: fix emergency path - [x86] ACPI / video: Refactor and fix dmi_is_desktop() - kprobes: Prohibit probing on bsearch() - ALSA: PCM: check if ops are defined before suspending PCM - usb: f_fs: Avoid crash due to out-of-scope stack ptr access - bcache: fix input overflow to cache set sysfs file io_error_halflife - bcache: fix input overflow to sequential_cutoff - bcache: improve sysfs_strtoul_clamp() - genirq: Avoid summation loops for /proc/stat - iw_cxgb4: fix srqidx leak during connection abort - fbdev: fbmem: fix memory access if logo is bigger than the screen - cdrom: Fix race condition in cdrom_sysctl_register - e1000e: fix cyclic resets at link up with active tx - efi/memattr: Don't bail on zero VA if it equals the region's PA - [arm64] so