11 Mai
2017
11 Mai
'17
00:38
apticron report [Thu, 11 May 2017 00:38:20 +0200]
========================================================================
apticron has detected that some packages need upgrading on:
quigon.federez.net
[ 160.228.155.65 ]
The following packages are currently pending an upgrade:
base-files 8+deb8u8
binutils 2.25-5+deb8u1
ca-certificates 20141019+deb8u3
git 1:2.1.4-2.1+deb8u3
git-man 1:2.1.4-2.1+deb8u3
gitweb 1:2.1.4-2.1+deb8u3
initramfs-tools 0.120+deb8u3
irqbalance 1.0.6-3+deb8u1
libc6 2.19-18+deb8u9
libc6-dev 2.19-18+deb8u9
libc-bin 2.19-18+deb8u9
libc-dev-bin 2.19-18+deb8u9
libgnutls-deb0-28 3.3.8-6+deb8u5
libgnutls-openssl27 3.3.8-6+deb8u5
libmilter1.0.1 8.14.4-8+deb8u2
libpam-systemd 215-17+deb8u7
libsystemd0 215-17+deb8u7
libudev1 215-17+deb8u7
libxslt1.1 1.1.28-2+deb8u3
linux-image-3.16.0-4-amd64 3.16.43-2
linux-libc-dev 3.16.43-2
locales 2.19-18+deb8u9
multiarch-support 2.19-18+deb8u9
nscd 2.19-18+deb8u9
postfix 2.11.3-1+deb8u2
systemd 215-17+deb8u7
systemd-sysv 215-17+deb8u7
udev 215-17+deb8u7
unzip 6.0-16+deb8u3
vim 2:7.4.488-7+deb8u3
vim-common 2:7.4.488-7+deb8u3
vim-nox 2:7.4.488-7+deb8u3
vim-runtime 2:7.4.488-7+deb8u3
vim-tiny 2:7.4.488-7+deb8u3
wget 1.16-1+deb8u2
========================================================================
Package Details:
Lecture des fichiers de modifications (« changelog »)...
--- Modifications pour git (git git-man gitweb) ---
git (1:2.1.4-2.1+deb8u3) jessie-security; urgency=high
* Do not allow git helpers run via git-shell to launch a pager
(CVE-2017-8386).
-- Jonathan Nieder <jrnieder(a)gmail.com> Tue, 09 May 2017 16:18:46 -0700
--- Modifications pour linux (linux-image-3.16.0-4-amd64 linux-libc-dev) ---
linux (3.16.43-2) jessie; urgency=high
* mm/huge_memory.c: fix up "mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for
thp" backport (Closes: #861313)
-- Ben Hutchings <ben(a)decadent.org.uk> Sun, 30 Apr 2017 03:37:58 +0100
linux (3.16.43-1) jessie; urgency=medium
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.40
- [x86] drm/i915/vlv: Make intel_crt_reset() per-encoder
- [x86] drm/i915/vlv: Reset the ADPA in vlv_display_power_well_init()
- fbdev/efifb: Fix 16 color palette entry calculation
- [s390*] zfcp: fix fc_host port_type with NPIV
- [s390*] zfcp: fix ELS/GS request&response length for hardware data router
- [s390*] zfcp: close window with unblocked rport during rport gone
- [s390*] zfcp: retain trace level for SCSI and HBA FSF response records
- [s390*] zfcp: restore: Dont use 0 to indicate invalid LUN in rec trace
- [s390*] zfcp: trace on request for open and close of WKA port
- [s390*] zfcp: restore tracing of handle for port and LUN with HBA records
- [s390*] zfcp: fix D_ID field with actual value on tracing SAN responses
- [s390*] zfcp: fix payload trace length for SAN request&response
- [s390*] zfcp: trace full payload of all SAN records (req,resp,iels)
- clk: divider: Fix clk_divider_round_rate() to use clk_readl()
- [x86] dumpstack: Fix x86_32 kernel_stack_pointer() previous stack access
- PCI: Mark Atheros AR9580 to avoid bus reset
- netfilter: restart search if moved to other chain
- uio: fix dmem_region_start computation
- platform: don't return 0 from platform_get_irq[_byname]() on error
- [arm64] debug: avoid resetting stepping state machine when TIF_SINGLESTEP
- ASoC: dapm: Fix value setting for _ENUM_DOUBLE MUX's second channel
- genirq/generic_chip: Add irq_unmap callback
- rtlwifi: Update regulatory database
- rtlwifi: Fix missing country code for Great Britain
- pwm: Unexport children before chip removal
- cx231xx: don't return error on success
- cx231xx: fix GPIOs for Pixelview SBTVD hybrid
- ext4: reinforce check of i_dtime when clearing high fields of uid and gid
- pstore/core: drop cmpxchg based updates
- pstore/ram: Use memcpy_toio instead of memcpy
- pstore/ram: Use memcpy_fromio() to save old buffer
- ipv4: accept u8 in IP_TOS ancillary data
- [armhf] phy: sun4i-usb: Use spinlock to guard phyctl register access
- dm: mark request_queue dead before destroying the DM device
- dm mpath: check if path's request_queue is dying in activate_path()
- ext4: bugfix for mmaped pages in mpage_release_unused_pages()
- [armhf] dts: exynos: Fix mismatched value for SD4 pull up/down
configuration on exynos4210
- reiserfs: Unlock superblock before calling reiserfs_quota_on_mount()
- sctp: do not return the transmit err back to sctp_sendmsg
- pkt_sched: fq: use proper locking in fq_dump_stats()
- [x86] iommu/amd: Free domain id when free a domain of struct
dma_ops_domain
- [powerpc*] nvram: Fix an incorrect partition merge
- ALSA: ali5451: Fix out-of-bound position reporting
- usb: misc: legousbtower: Fix NULL pointer deference
- net/mlx4_en: Fix wrong indentation
- net/mlx4_core: Fix deadlock when switching between polling and event fw
commands
- drm/radeon: narrow asic_init for virtualization
- [powerpc*] eeh: Null check uses of eeh_pe_bus_get
- ALSA: usb-audio: Extend DragonFly dB scale quirk to cover other variants
- netfilter: nft_exthdr: Add size check on u8 nft_exthdr attributes
- netfilter: nf_tables: validate maximum value of u32 netlink attributes
- svcrdma: Tail iovec leaves an orphaned DMA mapping
- blkcg: Annotate blkg_hint correctly
- ALSA: hda - Adding one more ALC255 pin definition for headset problem
- mmc: block: don't use CMD23 with very old MMC cards
- [powerpc*] KVM: Book3S: Treat VTB as a per-subcore register, not
per-thread
- [powerpc*] KVM: BookE: Fix a sanity check
- [powerpc*] KVM: Book3s PR: Allow access to unprivileged MMCR2 register
- NFSv4: Open state recovery must account for file permission changes
- Revert "usbtmc: convert to devm_kzalloc"
- drm/radeon/si/dpm: fix phase shedding setup
- [powerpc*/*64*] vdso64: Use double word compare on pointers
- ext4: release bh in make_indexed_dir
- [s390*] con3270: fix use of uninitialised data
- [s390*] con3270: fix insufficient space padding
- fuse: invalidate dir dentry after chmod
- fuse: fix killing s[ug]id in setattr
- fuse: listxattr: verify xattr list
- crypto: gcm - Fix IV buffer size in crypto_gcm_setkey
- staging: rtl8188eu: fix missing unlock on error in rtw_resume_process()
- staging: rtl8188eu: fix double unlock error in rtw_resume_process()
- UBI: fastmap: scrub PEB when bitflips are detected in a free PEB EC header
- ubi: Deal with interrupted erasures in WL
- ubi: Fix races around ubi_refill_pools()
- ubi: Fix Fastmap's update_vol()
- i40e: avoid NULL pointer dereference and recursive errors on early PCI
error
- [powerpc*] powernv: Use CPU-endian PEST in pnv_pci_dump_p7ioc_diag_data()
- mfd: rtsx_usb: Avoid setting ucr->current_sg.status
- async_pq_val: fix DMA memory leak
- mm: filemap: fix mapping->nrpages double accounting in fuse
- netlink: do not enter direct reclaim from netlink_dump()
- IB/srp: Fix infinite loop when FMR sg[0].offset != 0
- [x86] Input: elantech - add Fujitsu Lifebook E556 to force crc_enabled
- mm/hugetlb: fix memory offline with hugepage size > memory block size
- mm/hugetlb: check for reserved hugepages during memory offline
- vfs,mm: fix a dead loop in truncate_inode_pages_range()
- [powerpc*] pseries: Fix stack corruption in htpe code
- [powerpc*/*64*] Fix incorrect return value from __copy_tofrom_user
- [x86] panic: replace smp_send_stop() with kdump friendly version in panic
path
- [mips*] panic: replace smp_send_stop() with kdump friendly version in
panic path
- compiler: Allow 1- and 2-byte smp_load_acquire() and smp_store_release()
- ipc: remove use of seq_printf return value
- ipc/sem.c: fix complex_count vs. simple op race
- [mips*] ptrace: Fix regs_return_value for kernel context
- cifs: Display number of credits available
- cifs: Limit the overall credit acquired
- cifs: Set previous session id correctly on SMB3 reconnect
- cifs: SMB3: GUIDs should be constructed as random but valid uuids
- cifs: Clarify locking of cifs file and tcon structures and make more
granular
- cifs: Do not send SMB3 SET_INFO request if nothing is changing
- cifs: Cleanup missing frees on some ioctls
- fs/super.c: fix race between freeze_super() and thaw_super()
- scsi: Fix use-after-free
- mac80211: discard multicast and 4-addr A-MSDUs
- jbd2: fix incorrect unlock on j_list_lock
- drm/radeon: change vblank_time's calculation method to reduce
computational error.
- ipv6: correctly add local routes when lo goes up
- [s390*] scsi: zfcp: spin_lock_irqsave() is not nestable
- mmc: sdhci: cast unsigned int to unsigned long long to avoid unexpeted
error
- mmc: rtsx_usb_sdmmc: Avoid keeping the device runtime resumed when unused
- mmc: rtsx_usb_sdmmc: Handle runtime PM while changing the led
- memstick: rtsx_usb_ms: Runtime resume the device when polling for cards
- memstick: rtsx_usb_ms: Manage runtime PM when accessing the device
- [arm64] kernel: Init MDCR_EL2 even in the absence of a PMU
- netfilter: nf_tables: underflow in nft_parse_u32_check()
- ALSA: hda - allow 40 bit DMA mask for NVidia devices
- isofs: Do not return EACCES for unknown filesystems
- bridge: multicast: restore perm router ports on multicast enable
- hwrng: core - Don't use a stack buffer in add_early_randomness()
- [x86] Input: i8042 - add XMG C504 to keyboard reset table
- ubifs: Fix xattr_names length in exit paths
- ubifs: Abort readdir upon error
- target: Make EXTENDED_COPY 0xe4 failure return COPY TARGET DEVICE NOT
REACHABLE
- target: Don't override EXTENDED_COPY xcopy_pt_cmd SCSI status code
- [x86] xhci: add restart quirk for Intel Wildcatpoint PCH
- xhci: workaround for hosts missing CAS bit
- USB: serial: fix potential NULL-dereference at probe
- drm/radeon/si_dpm: Limit clocks on HD86xx part
- [arm64] KVM: Take S1 walks into account when determining S2 write faults
- [powerpc*] Convert cmp to cmpd in idle enter sequence
- ipv4: use the right lock for ping_group_range
- ACPI / APEI: Fix incorrect return value of ghes_proc()
- dm table: fix missing dm_put_target_type() in dm_table_add_target()
- [x86] mei: txe: don't clean an unprocessed interrupt cause.
- scsi: megaraid_sas: Fix data integrity failure for JBOD (passthrough)
devices
- [x86] hv: do not lose pending heartbeat vmbus packets
- ALSA: hda - Fix surround output pins for ASRock B150M mobo
- drm/radeon: drop register readback in cayman_cp_int_cntl_setup
- drm/radeon/si_dpm: workaround for SI kickers
- scsi: scsi_debug: Fix memory leak if LBP enabled and module is unloaded
- scsi: arcmsr: Send SYNCHRONIZE_CACHE command to firmware
- tty: vt, fix bogus division in csi_J
- tty: limit terminal size to 4M chars
- vt: clear selection before resizing
- netfilter: nf_conntrack_sip: extend request line validation
- netfilter: nf_tables: fix type mismatch with error return from
nft_parse_u32_check
- btrfs: fix races on root_log_ctx lists
- lib/genalloc.c: start search from start of chunk
- [s390*] hypfs: Use get_free_page() instead of kmalloc to ensure page
alignment
- [x86] KVM: fix wbinvd_dirty_mask use-after-free
- GenWQE: Fix bad page access during abort of resource allocation
- ubifs: Fix regression in ubifs_readdir()
- md: be careful not lot leak internal curr_resync value into metadata.
- net/mlx5: Avoid passing dma address 0 to firmware
- packet: on direct_xmit, limit tso and csum to supported devices
- net/mlx4_core: Fix the resource-type enum in res tracker to conform to FW
spec
- net/mlx4_en: Resolve dividing by zero in 32-bit system
- net/mlx4_en: Process all completions in RX rings after port goes up
- net/mlx4_en: Fix potential deadlock in port statistics flow
- [x86] iommu/vt-d: Fix IOMMU lookup for SR-IOV Virtual Functions
- virtio: console: Unlock vqs while freeing buffers
- netfilter: nf_tables: destroy the set if fail to add transaction
- [x86] mei: bus: fix received data size check in NFC fixup
- ipv6: Don't use ufo handling on later transformed packets
- can: bcm: fix warning in bcm_connect/proc_register
- bgmac: stop clearing DMA receive control register right after it is set
- uwb: fix device reference leaks
- [armel,armhf] gpio/mvebu: Use irq_domain_add_linear
- PM / sleep: fix device reference leak in test_suspend
- ip6_tunnel: Clear IP6CB in ip6tunnel_xmit()
- firewire: net: fix fragmented datagram_size off-by-one
- ipv4: allow local fragmentation in ip_finish_output_gso()
- i2c: core: fix NULL pointer dereference under race condition
- iio: hid-sensors: Fix compilation warning
- iio: hid-sensors: Increase the precision of scale to fix wrong reading
interpretation.
- [armhf] net: ethernet: ti: cpsw: fix device and of_node leaks
- scsi: megaraid_sas: fix macro MEGASAS_IS_LOGICAL to avoid regression
- rtnl: reset calcit fptr in rtnl_unregister()
- USB: cdc-acm: fix TIOCMIWAIT
- PM / sleep: don't suspend parent when async child suspend_{noirq, late}
fails
- [x86] ALSA: hda - Fix mic regression by ASRock mobo fixup
- swapfile: fix memory corruption via malformed swapfile
- coredump: fix unfreezable coredumping task
- dib0700: fix nec repeat handling
- scsi: mpt3sas: Fix secure erase premature termination
- neigh: check error pointer instead of NULL for ipv4_neigh_lookup()
- ipv4: use new_gw for redirect neigh lookup
- fuse: fix fuse_write_end() if zero bytes were copied
- [armhf] usb: chipidea: move the lock initialization to core file
- rtnetlink: fix rtnl_vfinfo_size
- mfd: core: Fix device reference leak in mfd_clone_cell
- nvme/pci: Don't free queues on error
- IB/uverbs: Fix leak of XRC target QPs
- IB/cm: Mark stale CM id's whenever the mad agent was unregistered
- IB/core: Avoid unsigned int overflow in sg_alloc_table
- IB/mlx5: Use cache line size to select CQE stride
- IB/mlx5: Resolve soft lock on massive reg MRs
- IB/mlx5: Fix NULL pointer dereference on debug print
- IB/mlx4: Fix create CQ error flow
- mwifiex: printk() overflow with 32-byte SSIDs
- of_mdio: fix node leak in of_phy_register_fixed_link error path
- cfg80211: limit scan results cache size
- [armhf] net: ethernet: ti: cpsw: fix bad register access in probe error
path
- [armhf] net: ethernet: ti: cpsw: fix mdio device reference leak
- [armhf] net: ethernet: ti: cpsw: fix secondary-emac probe error path
- KVM: Disable irq while unregistering user notifier
- [x86] KVM: fix missed SRCU usage in kvm_lapic_set_vapic_addr
- ext4: sanity check the block and cluster size at mount time
- l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind()
(CVE-2016-10200)
- apparmor: fix change_hat not finding hat after policy replacement
- [x86] traps: Ignore high word of regs->cs in early_fixup_exception()
- xc2028: Fix use-after-free bug properly
- [armhf] net: ethernet: mvneta: Remove IFF_UNICAST_FLT which is not
implemented
- net/mlx4: Fix uninitialized fields in rule when adding promiscuous mode
to device managed flow steering
- pwm: Fix device reference leak
- netfilter: arp_tables: fix invoking 32bit "iptable -P INPUT ACCEPT"
failed in 64bit kernel
- [powerpc*] eeh: Fix deadlock when PE frozen state can't be cleared
- batman-adv: Check for alloc errors when preparing TT local data
- locking/rtmutex: Prevent dequeue vs. unlock race
- ipv4: Set skb->protocol properly for local output
- ipv6: Set skb->protocol properly for local output
- tipc: check minimum bearer MTU
- [x86] perf: Fix full width counter, counter overflow
- fuse: fix clearing suid, sgid for chown()
- can: raw: raw_setsockopt: limit number of can_filter that can be set
- can: peak: fix bad memory access and free sequence
- ser_gigaset: return -ENOMEM on error instead of success
- vfs,mm: fix return value of read() at s_maxbytes
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.41
- mnt: Add a per mount namespace limit on the number of mounts
(CVE-2016-6213)
- ext4: validate s_first_meta_bg at mount time (CVE-2016-10208)
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.42
- net/sched: em_meta: Fix 'meta vlan' to correctly recognize zero VID frames
- ite-cir: initialize use_demodulator before using it
- usb: gadget: composite: correctly initialize ep->maxpacket
- usb: gadget: composite: always set ep->mult to a sensible value
- [armhf] usb: dwc3: gadget: set PCM1 field of isochronous-first TRBs
- [amd64] drm/gma500: Add compat ioctl
- enic: set skb->hash type properly
- xfs: fix up xfs_swap_extent_forks inline extent handling
- scsi: megaraid_sas: For SRIOV enabled firmware, ensure VF driver waits
for 30secs before reset
- PCI: Check for PME in targeted sleep state
- USB: UHCI: report non-PME wakeup signalling for Intel hardware
- [armhf] dts: imx6q-cm-fx6: fix fec pinctrl
- [powerpc] ibmebus: Fix device reference leaks in sysfs interface
- [powerpc] ibmebus: Fix further device reference leaks
- [powerpc*] pci/rpadlpar: Fix device reference leaks
- usb: xhci-mem: use passed in GFP flags instead of GFP_KERNEL
- dm rq: fix a race condition in rq_completed()
- ext4: fix mballoc breakage with 64k block size
- ext4: fix stack memory corruption with 64k block size
- IB/core: Save QP in ib_flow structure
- IB/mlx5: Put non zero value in max_ah
- IB/mlx5: Wait for all async command completions to complete
- IB/IPoIB: Remove can't use GFP_NOIO warning
- IB/mlx4: Set traffic class in AH
- IB/mlx4: Put non zero value in max_ah device attribute
- IB/mlx4: Fix port query for 56Gb Ethernet links
- scsi: mvsas: fix command_active typo
- ssb: Fix error routine when fallback SPROM fails
- usb: hub: Fix auto-remount of safely removed or ejected USB-3 devices
- [armhf] USB: phy: am335x-control: fix device and of_node leaks
- ext4: fix in-superblock mount options processing
- ext4: use more strict checks for inodes_per_block on mount
- ext4: add sanity checking to count_overhead()
- [powerpc*] KVM: Book3S HV: Save/restore XER in checkpointed register state
- dm crypt: mark key as invalid until properly loaded
- f2fs: set ->owner for debugfs status file's file_operations
- xen/gntdev: Use VM_MIXEDMAP instead of VM_IO to avoid NUMA balancing
- ALSA: usb-audio: Fix bogus error return in snd_usb_create_stream()
- md/raid5: limit request size according to implementation limits
- thermal: hwmon: Properly report critical temperature in sysfs
- USB: serial: kl5kusb105: fix open error path
- USB: serial: kl5kusb105: abort on open exception path
- [powerpc] ps3: Fix system hang with GCC 5 builds
- Btrfs: fix tree search logic when replaying directory entry deletes
- [armhf,arm64] bus: vexpress-config: fix device reference leak
- block: protect iterate_bdevs() against concurrent close
- NFS: Fix a performance regression in readdir
- xfs: set AGI buffer type in xlog_recover_clear_agi_bucket
- mmc: sdhci: Fix recovery from tuning timeout
- CIFS: Fix missing nls unload in smb2_reconnect()
- CIFS: Fix a possible memory corruption in push locks
- CIFS: Fix a possible memory corruption during reconnect
- [x86] ALSA: hda - Add inverted internal mic for Asus Aspire 4830T
- [x86] ALSA: hda - Add the top speaker pin config for HP Spectre x360
- [x86] ALSA: hda - Gate the mic jack on HP Z1 Gen3 AiO
- drm/radeon: Hide the HW cursor while it's out of bounds
- drm/radeon: Use mode h/vdisplay fields to hide out of bounds HW cursor
- drm/radeon: add additional pci revision to dpm workaround
- [armhf] xen: Use alloc_percpu rather than __alloc_percpu
- clk: clk-wm831x: fix a logic error
- hotplug: Make register and unregister notifier API symmetric
- iw_cxgb4: Fix error return code in c4iw_rdev_open()
- dm space map metadata: fix 'struct sm_metadata' leak on failed create
- md: MD_RECOVERY_NEEDED is set for mddev->recovery
- cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts
- hwmon: (ds620) Fix overflows seen when writing temperature limits
- [i386] ftrace: Set ftrace_stub to weak to prevent gcc from using short
jumps to it
- fgraph: Handle a case where a tracer ignores set_graph_notrace
- nfs_write_end(): fix handling of short copies
- ext4: reject inodes with negative size
- ext4: return -ENOMEM instead of success
- [s390*] vmlogrdr: fix IUCV buffer allocation
- [armhf] hwmon: (g762) Fix overflows and crash seen when writing limit
attributes
- ALSA: hiface: Fix M2Tech hiFace driver sampling rate change
- libceph: verify authorize reply on connect
- fs/notify/inode_mark.c: use list_next_entry in fsnotify_unmount_inodes
- fsnotify: Fix possible use-after-free in inode iteration on umount
- IB/mlx4: When no DMFS for IPoIB, don't allow NET_IF QPs
- IB/mlx4: Fix out-of-range array index in destroy qp flow
- Btrfs: delayed-inode: replace root args iff only fs_info used
- btrfs: limit async_work allocation and worker func duration
- block_dev: don't test bdev->bd_contains when it is not stable
- IB/mad: Fix an array index check
- IPoIB: Avoid reading an uninitialized member variable
- IB/multicast: Check ib_find_pkey() return value
- [s390x] scsi: zfcp: fix use-after-"free" in FC ingress path after TMF
- [s390x] scsi: zfcp: do not trace pure benign residual HBA responses at
default level
- [s390x] scsi: zfcp: fix rport unblock race with LUN recovery
- scsi: avoid a permanent stop of the scsi device's request queue
- target/iscsi: Fix double free in lio_target_tiqn_addtpg()
- [x86] drivers/gpu/drm/ast: Fix infinite loop if read fails
- NFSv4.1: nfs4_fl_prepare_ds must be careful about reporting success.
- [x86] drm/i915/dsi: Do not clear DPOUNIT_CLOCK_GATE_DISABLE from
vlv_init_display_clock_gating
- fs: exec: apply CLOEXEC before changing dumpable task flags
- [x86] Input: i8042 - add Pegatron touchpad to noloop table
- net, sched: fix soft lockup in tc_classify
- [armhf] net: stmmac: Fix race between stmmac_drv_probe and stmmac_open
- [armhf net: stmmac: Fix error path after register_netdev move
- net/mlx4_core: Use-after-free causes a resource leak in flow-steering
detach
- net/mlx4_en: Fix bad WQE issue
- net/mlx4: Remove BUG_ON from ICM allocation routine
- [armhf] usb: dwc3: ep0: add dwc3_ep0_prepare_one_trb()
- [armhf] usb: dwc3: ep0: explicitly call dwc3_ep0_prepare_one_trb()
- [armhf] usb: dwc3: gadget: always unmap EP0 requests
- [armhf] usb: gadget: composite: Test get_alt() presence instead of
set_alt()
- [armhf] usb: gadgetfs: restrict upper bound on device configuration size
- [armhf] USB: gadgetfs: fix unbounded memory allocation bug
- [armhf] USB: gadgetfs: fix use-after-free bug
- [armhf] USB: gadgetfs: fix checks of wTotalLength in config descriptors
- btrfs: fix error handling when run_delayed_extent_op fails
- btrfs: fix locking when we put back a delayed ref that's too new
- xhci: free xhci virtual devices with leaf nodes first
- usb: xhci: fix possible wild pointer
- usb: host: xhci: Fix possible wild pointer when handling abort command
- xhci: Handle command completion and timeout race
- usb: xhci: hold lock over xhci_abort_cmd_ring()
- USB: serial: cyberjack: fix NULL-deref at open
- USB: serial: garmin_gps: fix memory leak on failed URB submit
- USB: serial: io_edgeport: fix NULL-deref at open
- USB: serial: io_ti: fix NULL-deref at open
- USB: serial: io_ti: fix another NULL-deref at open
- USB: serial: iuu_phoenix: fix NULL-deref at open
- USB: serial: keyspan_pda: verify endpoints at probe
- USB: serial: kobil_sct: fix NULL-deref in write
- USB: serial: mos7720: fix NULL-deref at open
- USB: serial: mos7720: fix use-after-free on probe errors
- USB: serial: mos7720: fix parport use-after-free on probe errors
- USB: serial: mos7720: fix parallel probe
- USB: serial: mos7840: fix NULL-deref at open
- USB: serial: mos7840: fix misleading interrupt-URB comment
- USB: serial: omninet: fix NULL-derefs at open and disconnect
- USB: serial: oti6858: fix NULL-deref at open
- USB: serial: pl2303: fix NULL-deref at open
- USB: serial: quatech2: fix sleep-while-atomic in close
- USB: serial: spcp8x5: fix NULL-deref at open
- USB: serial: ti_usb_3410_5052: fix NULL-deref at open
- [x86] iommu/amd: Fix the left value check of cmd buffer
- [x86] mei: move write cb to completion on credentials failures
- ALSA: hda - Apply asus-mode8 fixup to ASUS X71SL
- [x86] cpu: Fix bootup crashes by sanitizing the argument of the
'clearcpuid=' command-line option
- [armhf] usb: musb: Fix trying to free already-free IRQ 4
- usb: hub: Move hub_port_disable() to fix warning if PM is disabled
- USB: fix problems with duplicate endpoint addresses
- selftests: do not require bash to run netsocktests testcase
- HID: hid-cypress: validate length of report (CVE-2017-7273)
- ata: sata_mv:- Handle return value of devm_ioremap.
- drm/radeon: drop verde dpm quirks
- [x86] boot: Add missing declaration of string functions
- USB: ch341: remove redundant close from open error path
- USB: ch341: set tty baud speed according to tty struct
- USB: serial: ch341: add register and USB request definitions
- USB: serial: ch341: reinitialize chip on reconfiguration
- USB: serial: ch341: fix initial modem-control state
- USB: serial: ch341: fix open and resume after B0
- USB: serial: ch341: fix modem-control and B0 handling
- USB: serial: ch341: fix open error handling
- USB: serial: ch341: fix resume after reset
- USB: serial: ch341: fix baud rate and line-control handling
- gro: Enter slow-path if there is no tailroom
- gro: Disable frag0 optimization on IPv6 ext headers
- ocfs2: fix crash caused by stale lvb with fsdlm plugin
- mm/hugetlb.c: fix reservation race when freeing surplus pages
- sysrq: attach sysrq handler correctly for 32-bit kernel
- USB: serial: ch341: fix control-message error handling
- gro: use min_t() in skb_gro_reset_offset()
- [x86] PCI: Ignore _CRS on Supermicro X8DTH-i/6/iF/6F
- xhci: fix deadlock at host remove by running watchdog correctly
- [x86] KVM: flush pending lapic jump label updates on module unload
- i2c: fix kernel memory disclosure in dev interface
- svcrpc: don't leak contexts on PROC_DESTROY
- netfilter: rpfilter: fix incorrect loopback packet judgment
- be2net: fix status check in be_cmd_pmac_add()
- net/mlx4_core: Fix racy CQ (Completion Queue) free
- net/mlx4_core: Fix when to save some qp context flags for dynamic VST to
VGT transitions
- net/mlx4_core: Eliminate warning messages for SRQ_LIMIT under SRIOV
- clocksource/exynos_mct: Clear interrupt when cpu is shut down
- ubifs: Fix journal replay wrt. xattr nodes
- qla2xxx: Fix crash due to null pointer access
- can: c_can_pci: fix null-pointer-deref in c_can_start() - set device
pointer
- ceph: fix bad endianness handling in parse_reply_info_extra
- [arm64] ptrace: Preserve previous registers for short regset write
- [arm64] ptrace: Avoid uninitialised struct padding in fpr_set()
- [arm64] ptrace: Reject attempts to set incomplete hardware breakpoint
fields
- net: fix harmonize_features() vs NETIF_F_HIGHDMA
- [arm64] avoid returning from bad_mode
- tcp: initialize max window for a new fastopen socket
- nbd: fix use-after-free of rq/bio in the xmit path
- nbd: only set MSG_MORE when we have more to send
- [powerpc*] ptrace: Preserve previous fprs/vsrs on short regset write
- [powerpc*] Ignore reserved field in DCSR and PVR reads and writes
- [x86] platform: intel_mid_powerbtn: Set IRQ_ONESHOT
- crypto: api - Clear CRYPTO_ALG_DEAD bit before registering an alg
- [arm64] crypto: aes-blk - honour iv_out requirement in CBC and CTR modes
- [powerpc*] Add missing error check to prom_find_boot_cpu()
- nfs: Don't increment lock sequence ID after NFS4ERR_MOVED
- ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit()
- SUNRPC: cleanup ida information when removing sunrpc module
- netfilter: nft_log: restrict the log prefix length to 127
- mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp
- [x86] drm/i915: Don't leak edid in intel_crt_detect_ddc()
- sysctl: fix proc_doulongvec_ms_jiffies_minmax()
- nfs: Fix "Don't increment lock sequence ID after NFS4ERR_MOVED"
- can: bcm: fix hrtimer/tasklet termination in bcm op removal
- perf/core: Fix PERF_RECORD_MMAP2 prot/flags for anonymous memory
- [armel,armhf] 8643/3: ptrace: Preserve previous registers for short
regset write
- drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval
- mmc: sdhci: Ignore unexpected CARD_INT interrupts
- svcrpc: fix oops in absence of krb5 module
- net: use a work queue to defer net_disable_timestamp() work
- mm, fs: check for fatal signals in do_generic_file_read()
- netlabel: out of bound access in cipso_v4_validate()
- mac80211: Fix adding of mesh vendor IEs
- ALSA: seq: Don't handle loop timeout at snd_seq_pool_done()
- [x86] drm/i915: fix use-after-free in page_flip_completed()
- ALSA: seq: Fix race at creating a queue
- target: Use correct SCSI status during EXTENDED_COPY exception
- target: Fix early transport_generic_handle_tmr abort scenario
- target: Fix COMPARE_AND_WRITE ref leak for non GOOD status
- btrfs: fix btrfs_compat_ioctl failures on non-compat ioctls
- ping: fix a null pointer dereference
- [s390x] scsi: zfcp: fix use-after-free by not tracing WKA port open/close
on failed send
- xen-netfront: Delete rx_refill_timer in xennet_disconnect_backend()
- l2tp: do not use udp_ioctl()
- futex: Move futex_init() to core_initcall
- mmc: core: fix multi-bit bus width without high-speed mode
- vfs: fix uninitialized flags in splice_to_pipe()
- packet: call fanout_release, while UNREGISTERING a netdev
- packet: Do not call fanout_release from atomic contexts
- printk: use rcuidle console tracepoint
- sg: Fix missing sanity check in /dev/sg
- sched/cputime: Fix invalid gtime in proc
- decnet: Do not build routes to devices without decnet private data.
- route: do not cache fib route info on local routes with oif
- sch_htb: update backlog as well
- sch_dsmark: update backlog as well
- netem: Segment GSO packets on enqueue
- [x86] VSOCK: do not disconnect socket when peer has shutdown SEND only
- net: bridge: fix old ioctl unlocked net device walk
- udp: prevent skbs lingering in tunnel socket queues
- ipv6: Skip XFRM lookup if dst_entry in socket cache is valid
- sit: correct IP protocol used in ipip6_err
- ipmr/ip6mr: Initialize the last assert time of mfc entries.
- net: alx: Work around the DMA RX overflow issue
- cdc_ncm: workaround for EM7455 "silent" data interface
- bonding: set carrier off for devices created through netlink
- net: fix sk_mem_reclaim_partial()
- tcp: fix overflow in __tcp_retransmit_skb()
- net: avoid sk_forward_alloc overflows
- tcp: fix wrong checksum calculation on MTU probing
- net: Add netdev all_adj_list refcnt propagation to fix panic
- net: sctp, forbid negative length
- net: clear sk_err_soft in sk_clone_lock()
- net: mangle zero checksum in skb_checksum_help()
- dccp: do not send reset to already closed sockets
- dccp: fix out of bound access in dccp_v4_err()
- ipv6: dccp: fix out of bound access in dccp_v6_err()
- ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped
- sctp: assign assoc_id earlier in __sctp_connect
- sock: fix sendmmsg for partial sendmsg
- ip6_tunnel: disable caching when the traffic class is inherited
- net: sky2: Fix shutdown crash
- net/sched: pedit: make sure that offset is valid
- net/dccp: fix use-after-free in dccp_invalid_packet
- [x86] netvsc: reduce maximum GSO size
- ipv6: handle -EFAULT from skb_copy_bits
- drop_monitor: add missing call to genlmsg_end
- drop_monitor: consider inserted data in genlmsg_end
- igmp: Make igmp group member RFC 3376 compliant
- r8152: fix the sw rx checksum is unavailable
- tcp: fix tcp_fastopen unaligned access complaints on sparc
- ipv6: addrconf: Avoid addrconf_disable_change() using RCU read-side lock
- net: socket: fix recvmmsg not returning error from sock_error
- can: Fix kernel panic at security_sock_rcv_skb
- ipv6: fix ip6_tnl_parse_tlv_enc_lim()
- ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim()
- tcp: fix 0 divide in __tcp_select_window()
- tun: Fix TUN_PKT_STRIP setting
- tun: read vnet_hdr_sz once
- macvtap: read vnet_hdr_size once
- mlx4: Invoke softirqs after napi_reschedule
- sit: fix a double free on error path
- igmp: do not remove igmp souce list info when set link down
- mld: do not remove mld souce list info when set link down
- igmp, mld: Fix memory leak in igmpv3/mld_del_delrec()
- [x86] Revert "KVM: x86: expose MSR_TSC_AUX to userspace"
(regression in 3.16.7-ckt24)
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.43
- crypto: improve gcc optimization flags for serpent and wp512
- mmc: sunxi: avoid invalid pointer calculation
- [mips*] Zero variable read by get_user / __get_user in case of an error.
- netlink: remove mmapped netlink support
- vfs: Commit to never having exectuables on proc and sysfs.
- aio: mark AIO pseudo-fs noexec (CVE-2016-10044)
- keys: Guard against null match function in keyring_search_aux()
(CVE-2017-2647 / CVE-2017-6951)
[ Ben Hutchings ]
* locking/mutex: Don't assume TASK_RUNNING (Closes: #841171)
* can, tcp: Ignore ABI changes
* [arm64] ptrace: Avoid ABI change in 3.16.42
* [x86] Revert "x86/panic: replace smp_send_stop() with kdump friendly
version in panic path" to avoid ABI change
* net: Avoid ABI change for "net: fix sk_mem_reclaim_partial()"
* vfs: Avoid ABI change for "mnt: Add a per mount namespace limit ..."
* mmc: Avoid ABI change for "mmc: core: Annotate cmd_hdr as __le32"
* ext4: fix fencepost in s_first_meta_bg validation (regression in 3.16.41)
* timer: Restrict timer_stats to initial PID namespace (CVE-2017-5967)
* mbcache: Reschedule before restarting iteration in mb_cache_entry_alloc()
(mitigates CVE-2015-8952)
* [powerpc/powerpc64,ppc64*] Enable SCSI_IBMVFC as module (Closes: #859523)
- udeb: Add ibmvfc to scsi-modules
* mm: Make PIE address randomisation independent of mmap (Closes: #797530)
- [armel,armhf] factor out mmap ASLR into mmap_rnd
- [arm64] ASLR: Don't randomise text when randomise_va_space == 0
- [arm64] standardize mmap_rnd() usage
- [mips*] extract logic for mmap_rnd()
- [powerpc*] Use generic PIE randomization
- [powerpc*] standardize mmap_rnd() usage
- [s390*] Change randomize_et_dyn() to take void and use mmap_rnd()
- [s390*] standardize mmap_rnd() usage
- mm: expose arch_mmap_rnd when available
- [s390*] redefine randomize_et_dyn for ELF_ET_DYN_BASE
- mm: split ET_DYN ASLR from mmap ASLR
- mm: fold arch_randomize_brk into ARCH_HAS_ELF_RANDOMIZE
* ping: implement proper locking (CVE-2017-2671)
* xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window
(CVE-2017-7184)
* xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder (CVE-2017-7184)
* [x86] drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()
(CVE-2017-7261)
* [x86] drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()
(CVE-2017-7294)
* net/packet: Fix integer overflow in various range checks (CVE-2017-7308)
* mm/mempolicy.c: fix error handling in set_mempolicy and mbind
(CVE-2017-7616)
* crypto: ahash - Fix EINPROGRESS notification callback (CVE-2017-7618)
* USB: iowarrior: fix NULL-deref at probe (CVE-2016-2188)
* ixgbe: do not call check_link for ethtool in ixgbe_get_settings()
(Closes: #851952)
* Fix bugs in ipv6 peer address cleanup (Closes: #854348):
- ipv6: fix a refcnt leak with peer addr
- ipv6: use addrconf_get_prefix_route() to remove peer addr
* KEYS: special dot prefixed keyring name bug fix
* KEYS: Reinstate EPERM for a key type name beginning with a '.'
* KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings
(CVE-2016-9604)
* KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings
(CVE-2017-7472)
[ Salvatore Bonaccorso ]
* sunrpc: fix refcounting problems with auth_gss messages.
Thanks to Raphael Geissert <geissert(a)debian.org> (Closes: #852708)
-- Ben Hutchings <ben(a)decadent.org.uk> Sat, 22 Apr 2017 03:50:23 +0100
--- Modifications pour binutils ---
binutils (2.25-5+deb8u1) stable; urgency=medium
* Apply patch from upstream to fix gold on arm64. The ABI specifies
using a pagesize of 64k for ELF binaries. Closes: #850814
-- Steve McIntyre <93sam(a)debian.org> Thu, 12 Jan 2017 10:36:22 +0000
--- Modifications pour ca-certificates ---
ca-certificates (20141019+deb8u3) jessie; urgency=medium
[ Michael Shuler ]
* sbin/update-ca-certificates:
Update local certificates directory when calling --fresh. Closes: #783615
[ Andreas Beckmann ]
* Backport another commit to make running update-certificates without hooks
actually work (instead of showing a usage message). Closes: #825730
-- Andreas Beckmann <anbe(a)debian.org> Sat, 29 Apr 2017 01:19:23 +0200
--- Modifications pour glibc (libc6 libc6-dev libc-bin libc-dev-bin locales
multiarch-support nscd) ---
glibc (2.19-18+deb8u9) stable; urgency=medium
* Remove patches/any/cvs-resolv-internal-qtype.diff, it breaks the
libnss/libnss-dns ABI. Reopens: #796106.
-- Aurelien Jarno <aurel32(a)debian.org> Thu, 27 Apr 2017 23:00:02 +0200
glibc (2.19-18+deb8u8) stable; urgency=medium
[ Aurelien Jarno ]
* Update from upstream stable branch:
- Fix PowerPC sqrt inaccuracy. Closes: #855606.
* patches/any/cvs-resolv-internal-qtype.diff: patch from upstream to fix a
NULL pointer dereference in libresolv when receiving a T_UNSPEC internal
QTYPE (CVE-2015-5180). Closes: #796106.
-- Aurelien Jarno <aurel32(a)debian.org> Mon, 24 Apr 2017 06:41:38 +0200
--- Modifications pour gnutls28 (libgnutls-deb0-28 libgnutls-openssl27) ---
gnutls28 (3.3.8-6+deb8u5) jessie; urgency=medium
* Pull multiple fixes from gnutls_3_3_x branch:
+ 55_00_pkcs12-fixed-the-calculation-of-p_size.patch
Fixed issue in PKCS#12 password encoding, which truncated
passwords over 32-characters. Reported by Mario Klebsch.
+ 55_01_gnutls_x509_ext_import_proxy-fix-issue-reading-the-p.patch
Fix double free in certificate information printing. If the PKIX
extension proxy was set with a policy language set but no policy
specified, that could lead to a double free. [GNUTLS-SA-2017-1]
CVE-2017-5334
+ 55_02_auth-rsa-eliminated-memory-leak-on-pkcs-1-formatting.patch
Addressed memory leak in server side error path (issue found using
oss-fuzz project)
+ 55_03_opencdk-Fixes-to-prevent-undefined-behavior-found-wi.patch
55_04_Do-not-infinite-loop-if-an-EOF-occurs-while-skipping.patch
55_05_Attempt-to-fix-a-leak-in-OpenPGP-cert-parsing.patch
55_06_Corrected-a-leak-in-OpenPGP-sub-packet-parsing.patch
55_07_opencdk-read_attribute-added-more-precise-checks-whe.patch
55_08_opencdk-cdk_pk_get_keyid-fix-stack-overflow.patch
55_09_opencdk-added-error-checking-in-the-stream-reading-f.patch
55_10_opencdk-improved-error-code-checking-in-the-stream-r.patch
55_11_opencdk-read-packet.c-corrected-typo-in-type-cast.patch
Addressed memory leaks and an infinite loop in OpenPGP certificate
parsing. Fixes by Alex Gaynor. (issues found using oss-fuzz project)
Addressed invalid memory accesses in OpenPGP certificate parsing.
(issues found using oss-fuzz project) [GNUTLS-SA-2017-2]
CVE-2017-5335 / CVE-2017-5336 / CVE-2017-5337
+ 55_12_gnutls_pkcs11_obj_list_import_url2-Always-return-an-.patch
When returning success, but no elements,
gnutls_pkcs11_obj_list_import_url4, could have returned zero number of
elements with a pointer that was uninitialized. Ensure that an
initialized (i.e., null in that case), pointer is always returned.
+ 55_13_cdk_pkt_read-enforce-packet-limits.patch Addressed integer
overflow resulting to invalid memory write in OpenPGP certificate
parsing. Issue found using oss-fuzz project:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420
[GNUTLS-SA-2017-3A] CVE-2017-7869
+ 55_14_opencdk-read_attribute-account-buffer-size.patch Addressed read
of 1 byte past the end of buffer in OpenPGP certificate parsing. Issue
found using oss-fuzz project:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=391
(This patch is from gnutls_3_5_x branch.)
+ 55_15_opencdk-do-not-parse-any-secret-keys-in-packet-when-.patch
Addressed crashes in OpenPGP certificate parsing, related to private key
parser. No longer allow OpenPGP certificates (public keys) to contain
private key sub-packets. Issue found using oss-fuzz project:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=354
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=360
[GNUTLS-SA-2017-3B]
+ 55_16_Enforce-the-max-packet-length-for-OpenPGP-subpackets.patch
Addressed large allocation in OpenPGP certificate parsing, that could
lead in out-of-memory condition. Issue found using oss-fuzz project, and
was fixed by Alex Gaynor:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=392
[GNUTLS-SA-2017-3C]
-- Andreas Metzler <ametzler(a)debian.org> Thu, 27 Apr 2017 18:10:51 +0200
--- Modifications pour initramfs-tools ---
initramfs-tools (0.120+deb8u3) jessie; urgency=medium
* [6661d01] hook-functions: Include drivers for all keyboards when
MODULES=dep (Closes: #639876)
* [6afc19f] auto_add_modules: Include most USB host drivers (Closes: #762634)
* [eb35e9a] auto_add_modules: Include all bus driver modules
* [c9636d5] Remove code that prunes 'broken' symlinks and sometimes /etc/mtab
(Closes: #845581)
* [50b90a9] auto_add_modules: Add all I2C bus and mux drivers when
MODULES=most (Closes: #825687)
* [94d23b8] hook-functions: Stop force-loading drivers found through sysfs
when MODULES=dep (Closes: #792910)
-- Ben Hutchings <ben(a)decadent.org.uk> Sat, 18 Feb 2017 20:43:30 +0000
--- Modifications pour irqbalance ---
irqbalance (1.0.6-3+deb8u1) jessie; urgency=medium
* Non-maintainer upload.
* Only warn once for affinity hint subset empty irqs (Closes: #784391)
-- Salvatore Bonaccorso <carnil(a)debian.org> Thu, 16 Mar 2017 11:14:03 +0100
--- Modifications pour libxslt (libxslt1.1) ---
libxslt (1.1.28-2+deb8u3) jessie; urgency=medium
* Non-maintainer upload.
* Check for integer overflow in xsltAddTextString (CVE-2017-5029)
(Closes: #858546)
-- Salvatore Bonaccorso <carnil(a)debian.org> Fri, 14 Apr 2017 08:28:09 +0200
--- Modifications pour postfix ---
postfix (2.11.3-1+deb8u2) stable; urgency=medium
* Add fixes in makedefs to recognize Linux 4 as the LINUX3 system type so
the package will build with both jessie and jessie-bpo/stretch kernels
-- Scott Kitterman <scott(a)kitterman.com> Sat, 29 Apr 2017 11:38:28 -0400
postfix (2.11.3-1+deb8u1) stable; urgency=medium
* Add delmap to .prerm for all packages that contain map data types exposed
through external .so files so that upgrades to stretch (where the
associated files have moved) will be functional (Closes: #859805)
-- Scott Kitterman <scott(a)kitterman.com> Mon, 24 Apr 2017 13:15:36 -0400
--- Modifications pour sendmail (libmilter1.0.1) ---
sendmail (8.14.4-8+deb8u2) jessie; urgency=medium
* QA upload.
* Only touch files as smmsp:smmsp in /var/run/sendmail/stampdir (writable by
group smmsp) to avoid possible privilege escalation. (Closes: #841257)
* Use lockfile-create (from lockfile-progs) instead of touch to manage the
cronjob lockfiles.
* sendmail-base: Add Depends: netbase for /etc/services.
-- Andreas Beckmann <anbe(a)debian.org> Mon, 06 Feb 2017 00:16:03 +0100
--- Modifications pour systemd (libpam-systemd libsystemd0 libudev1 systemd systemd-sysv
udev) ---
systemd (215-17+deb8u7) stable; urgency=medium
* bus: Fix bus_print_property() to use "int" for booleans.
This fixes the problem that on big endian architectures, like mips or
powerpc, boolean properties that were retrieved via sd-bus were always
set to 0 (no). (Closes: #774430)
* systemctl: Add is-enabled support for SysV init scripts.
The update-rc.d utility does not provide is-enabled, so implement it
ourselves in systemctl using the same logic as systemd-sysv-install from
Stretch. (Closes: #809405)
* core: If the start command vanishes during runtime don't hit an assert.
This can happen when the configuration is changed and reloaded while we
are executing a service. Let's not hit an assert in this case.
(Closes: #856985)
* automount: If an automount unit is masked, don't react to activation
anymore.
Otherwise we'll hit an assert sooner or later. (Closes: #856035)
-- Michael Biebl <biebl(a)debian.org> Fri, 10 Mar 2017 06:02:49 +0100
--- Modifications pour unzip ---
unzip (6.0-16+deb8u3) jessie; urgency=medium
* Update patch 12-cve-2014-9636-test-compr-eb to follow revised
patch "unzip-6.0_overflow3.diff" from mancha (patch author).
* Fix CVE-2014-9913, buffer overflow in unzip. Closes: #847485.
Patch by the author.
* Fix CVE-2016-9844, buffer overflow in zipinfo. Closes: #847486.
Patch by the author.
-- Santiago Vila <sanvila(a)debian.org> Sat, 28 Jan 2017 14:03:06 +0100
--- Modifications pour vim (vim vim-common vim-nox vim-runtime vim-tiny) ---
vim (2:7.4.488-7+deb8u3) jessie; urgency=medium
* Backport upstream patches v8.0.0377 & v8.0.0378, to fix buffer overflows
when reading corrupted undo files. (Closes: #856266, CVE-2017-6349,
CVE-2017-6350)
-- James McCoy <jamessan(a)debian.org> Mon, 06 Mar 2017 23:52:28 -0500
--- Modifications pour wget ---
wget (1.16-1+deb8u2) jessie; urgency=medium
* added upstream patch to fix CVE-2017-6508 closes: Bug#857073
-- Noël Köthe <noel(a)debian.org> Sat, 18 Mar 2017 15:39:29 +0100
--- Modifications pour base-files ---
base-files (8+deb8u8) stable; urgency=low
* Changed /etc/debian_version to 8.8, for Debian 8.8 point release.
-- Santiago Vila <sanvila(a)debian.org> Thu, 20 Apr 2017 23:42:50 +0200
========================================================================
You can perform the upgrade by issuing the command:
apt-get dist-upgrade
as root on quigon.federez.net
--
apticron