28 Avr
2015
28 Avr
'15
10:48
apticron report [Tue, 28 Apr 2015 10:48:16 +0200]
========================================================================
apticron has detected that some packages need upgrading on:
hexagon.federez.net
[ 5.39.82.35 2001:41d0:8:9423::1 5.39.82.35 2001:41d0:8:9423::1 ]
The following packages are currently pending an upgrade:
linux-headers-3.2.0-4-amd64 3.2.68-1+deb7u1
linux-headers-3.2.0-4-common 3.2.68-1+deb7u1
linux-image-3.2.0-4-amd64 3.2.68-1+deb7u1
linux-libc-dev 3.2.68-1+deb7u1
========================================================================
Package Details:
Lecture des fichiers de modifications (« changelog »)...
--- Modifications pour linux (linux-headers-3.2.0-4-amd64 linux-headers-3.2.0-4-common
linux-image-3.2.0-4-amd64 linux-libc-dev) ---
linux (3.2.68-1+deb7u1) wheezy-security; urgency=high
* IB/core: Prevent integer overflow in ib_umem_get address arithmetic
(CVE-2014-8159)
* netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len
(CVE-2014-9715)
* net: llc: use correct size for sysctl timeout entries (CVE-2015-2041)
* net: rds: use correct size for max unacked packets and bytes
(CVE-2015-2042)
* xen-pciback: limit guest control of command register (CVE-2015-2150)
* [amd64] asm/entry: Remove a bogus 'ret_from_fork' optimization
(CVE-2015-2830)
* ipv6: Don't reduce hop limit for an interface (CVE-2015-2922)
* [x86] crypto: aesni - fix memory usage in GCM decryption (Closes: #782561)
(CVE-2015-3331)
* fs: take i_mutex during prepare_binprm for set[ug]id executables
(CVE-2015-3339)
-- Ben Hutchings <ben(a)decadent.org.uk> Fri, 24 Apr 2015 16:21:37 +0100
linux (3.2.68-1) wheezy; urgency=medium
* New upstream stable update:
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.66
- net: sctp: fix memory leak in auth key management
- tcp: md5: remove spinlock usage in fast path
- tcp: md5: do not use alloc_percpu()
- ipv4: dst_entry leak in ip_send_unicast_reply()
- net: sctp: use MAX_HEADER for headroom reserve in output path
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.67
- eCryptfs: Force RO mount when encrypted view is enabled
- ipv4: Remove all uses of LL_ALLOCATED_SPACE
- ipv6: Remove all uses of LL_ALLOCATED_SPACE
- ipv6: mld: fix add_grhead skb_over_panic for devs with large MTUs
- [s390*] KVM: flush CPU on load control
- UBI: Fix invalid vfree()
- drbd: merge_bvec_fn: properly remap bvm->bi_bdev
- PCI: Restore detection of read-only BARs
- genhd: check for int overflow in disk_expand_part_tbl()
- USB: cdc-acm: check for valid interfaces
- dm space map metadata: fix sm_bootstrap_get_nr_blocks()
- [x86] iommu/vt-d: Fix an off-by-one bug in __domain_mapping()
- KEYS: Fix stale key registration at error path
- Btrfs: fix fs corruption on transaction abort if device supports discard
- ncpfs: return proper error from NCP_IOC_SETROOT ioctl
- mac80211: fix multicast LED blinking and counter (regression in 3.2.65)
- genirq: Prevent proc race against freeing of irq descriptors
- decompress_bunzip2: off by one in get_next_block()
- [x86] tls: Disallow unusual TLS segments
- iscsi-target: Fail connection on short sendmsg writes
- ceph: introduce global empty snap context
- [x86] tls: Don't validate lm in set_thread_area() after all
- ocfs2: fix journal commit deadlock
- udf: Verify i_size when loading inode
- udf: Verify symlink size before loading it
- udf: Treat symlink component of type 2 as /
- udf: Check path length when reading symlink
- udf: Check component length before reading it
- crypto: af_alg - fix backlog handling
- Revert "tcp: Apply device TSO segment limit earlier"
(regression in 3.2.30)
- virtio_pci: defer kfree until release callback
- mm: propagate error from stack expansion even for guard page
- time: settimeofday: Validate the values of tv from user
- regulator: core: fix race condition in regulator_put()
- mm: prevent endless growth of anon_vma hierarchy
- mm: protect set_page_dirty() from ongoing truncation
- HID: roccat: potential out of bounds in pyra_sysfs_write_settings()
- USB: console: fix potential use after free
- mm: Don't count the stack guard page towards RLIMIT_STACK
- mm: fix corner case in anon_vma endless growing prevention
- can: dev: fix crtlmode_supported check
- net: sctp: fix race for one-to-many sockets in sendmsg's auto associate
- libata: allow sata_sil24 to opt-out of tag ordered submission
(regression in 3.2.62)
- nl80211: fix per-station group key get/del and memory leak
- vm: add VM_FAULT_SIGSEGV handling support
- vm: make stack guard page errors return VM_FAULT_SIGSEGV rather than
SIGBUS
- ACPI / EC: Fix regression due to conflicting firmware behavior between
Samsung and Acer. (regression in 3.2.63)
- [s390*] 3215: fix tty output containing tabs (Closes: #758264)
- fsnotify: next_i is freed during fsnotify_unmount_inodes.
- PCI: Handle read-only BARs on AMD CS553x devices
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.68
- mm: pagewalk: call pte_hole() for VM_PFNMAP during walk_page_range
(regression in 3.2.46)
- nilfs2: fix deadlock of segment constructor over I_SYNC flag
- staging: comedi: cb_pcidas64: fix incorrect AI range code handling
- time: adjtimex: Validate the ADJ_FREQUENCY values
- ntp: Fixup adjtimex freq validation on 32-bit systems
- Bluetooth: ath3k: workaround the compatibility issue with xHCI controller
(maybe fixes #778463)
[ Ben Hutchings ]
* drm, agp: Update to 3.4.106:
- [x86] drm/vmwgfx: Filter out modes those cannot be supported by the
current VRAM size.
- drm/radeon: add missing crtc unlock when setting up the MC
* [rt] Update to 3.2.68-rt99:
- Replace the plist functions with rt_mutex_enqueue{_pi}() and
rt_mutex_dequeue{_pi}() like upstream -rt does
- rtmutex: Simplify rtmutex_slowtrylock()
- rtmutex: Simplify and document try_to_take_rtmutex()
- rtmutex: No need to keep task ref for lock owner check
- rtmutex: Clarify the boost/deboost part
- rtmutex: Document pi chain walk
- rtmutex: Simplify remove_waiter()
- rtmutex: Confine deadlock logic to futex
- rtmutex: Cleanup deadlock detector debug logic
- rtmutex: Avoid pointless requeueing in the deadlock detection chain walk
- futex: Make unlock_pi more robust
- futex: Use futex_top_waiter() in lookup_pi_state()
- futex: Split out the waiter check from lookup_pi_state()
- futex: Split out the first waiter attachment from lookup_pi_state()
- futex: Simplify futex_lock_pi_atomic() and make it more robust
- rt-mutex: avoid a NULL pointer dereference on deadlock
- x86: UV: raw_spinlock conversion
- scheduling while atomic in cgroup code
- work-simple: Simple work queue implemenation
- sunrpc: make svc_xprt_do_enqueue() use get_cpu_light()
- fs,btrfs: fix rt deadlock on extent_buffer->lock
* hpsa: Update device ID tables (Closes: #781548)
* NFSv4: Fix oops in nfs4_handle_exception when server returns
NFS4ERR_OPENMODE (Closes: #731439)
* netfilter: ipset: Check and reject crazy /0 input parameters
(Closes: #732689)
-- Ben Hutchings <ben(a)decadent.org.uk> Tue, 31 Mar 2015 09:30:16 +0100
========================================================================
You can perform the upgrade by issuing the command:
apt-get dist-upgrade
as root on hexagon.federez.net
--
apticron