- 论坛徽章:
- 223
|
------------------------------------------------------------------------The Debian Project https://www.debian.org/Updated Debian 8: 8.7 released press@debian.orgJanuary 14th, 2017 https://www.debian.org/News/2017 ... ----------------The Debian project is pleased to announce the seventh update of itsstable distribution Debian 8 (codename "jessie"). This update mainlyadds corrections for security problems to the stable release, along witha few adjustments for serious problems. Security advisories were alreadypublished separately and are referenced where available.Please note that this update does not constitute a new version of Debian8 but only updates some of the packages included. There is no need tothrow away old "jessie" CDs or DVDs but only to update via an up-to-dateDebian mirror after an installation, to cause any out of date packagesto be updated.Those who frequently install updates from security.debian.org won't haveto update many packages and most updates from security.debian.org areincluded in this update.New installation media and CD and DVD images containing updated packageswill be available soon at the regular locations.Upgrading to this revision online is usually done by pointing theaptitude (or apt) package tool (see the sources.list(5) manual page) toone of Debian's many FTP or HTTP mirrors. A comprehensive list ofmirrors is available at:https://www.debian.org/mirror/listMiscellaneous Bugfixes----------------------This stable update adds a few important corrections to the followingpackages:+--------------------------+------------------------------------------+| Package | Reason |+--------------------------+------------------------------------------+| ark [1] | Stop crashing on exit when being used || | solely as a KPart || | || asterisk [2] | Fix security issue due to non-printable || | ASCII chars treated as whitespace || | [CVE-2016-9938] || | || asused [3] | Use created fields instead of changed, || | in line with changes to source data || | || base-files [4] | Change /etc/debian_version to 8.7 || | || bash [5] | Fix arbitrary code execution via || | malicious hostname [CVE-2016-0634] and || | specially crafted SHELLOPTS+PS4 || | variables allows command substitution || | [CVE-2016-7543] || | || ca-certificates [6] | Update Mozilla certificate authority || | bundle to version 2.9; postinst: run || | update-certificates without hooks to || | initially populate /etc/ssl/certs || | || cairo [7] | Fix DoS via using SVG to generate || | invalid pointers [CVE-2016-9082] || | || ccache [8] | [amd64] Rebuild in a clean environment || | || ceph [9] | Fix short CORS request issue [CVE-2016- || | 9579], mon DoS [CVE-2016-5009], || | anonymous read on ACL [CVE-2016-7031], || | RGW DoS [CVE-2016-8626] || | || chirp [10] | Disable reporting of telemetry by || | default || | || cyrus-imapd-2.4 [11] | Fix LIST GROUP support || | || darktable [12] | Fix integer overflow in ljpeg_start() || | [CVE-2015-3885] || | || dbus [13] | Fix potential format string || | vulnerability; dbus.prerm: ensure that || | dbus.socket is stopped before removal || | || debian-edu-doc [14] | Update Debian Edu Jessie manual from the || | wiki; fix (da|nl) Jessie manual PO files || | to get the PDF manuals built; || | translation updates || | || debian-edu-install [15] | Update version number to 8+edu1 || | || debian-installer [16] | Rebuild for the point release || | || debian-installer- | Rebuild for the point release || netboot-images [17] | || | || duck [18] | Fix loading of code from untrusted || | location [CVE-2016-1239] || | || e2fsprogs [19] | Rebuild against dietlibc || | 0.33~cvs20120325-6+deb8u1, to pick up || | included security fixes || | || ebook-speaker [20] | Fix hint about installing html2text to || | read html files || | || elog [21] | Fix posting entry as arbitrary username || | [CVE-2016-6342] || | || evolution-data- | Fix premature drop of connection with || server [22] | reduced TCP window sizes and resulting || | loss of data || | || exim4 [23] | Fix GnuTLS memory leak || | || file [24] | Fix memory leak in magic loader || | || ganeti-instance- | Fix losetup invocations by replacing -s || debootstrap [25] | with --show || | || glibc [26] | Do not unconditionally use the fsqrt || | instruction on 64-bit PowerPC CPUs; fix || | a regression introduced by cvs-resolv- || | ipv6-nameservers.diff in hesiod; disable || | lock elision (aka Intel TSX) on x86 || | architectures || | || glusterfs [27] | Quota: Fix could not start auxiliary || | mount issue || | || gnutls28 [28] | Fix incorrect certificate validation || | when using OCSP responses [GNUTLS- || | SA-2016-3 / CVE-2016-7444]; ensure || | compatibility with CVE-2016-6489-patched || | nettle || | || hplip [29] | Use full gpg key fingerprint when || | fetching key from keyservers [CVE-2015- || | 0839] || | || ieee-data [30] | Disable monthly update cron job || | || intel-microcode [31] | Update microcode || | || irssi [32] | Fix information exposure issue via || | buf.pl and /upgrade [CVE-2016-7553]; fix || | NULL pointer dereference in the nickcmp || | function [CVE-2017-5193], use-after-free || | when receiving invalid nick message || | [CVE-2017-5194] and out-of-bounds read || | in certain incomplete control codes || | [CVE-2017-5195] || | || isenkram [33] | Download firmware using curl; use HTTPS || | when downloading modaliases; change || | mirror from http.debian.net to || | httpredir.debian.org || | || jq [34] | Fix heap buffer overflow [CVE-2015-8863] || | and stack exhaustion [CVE-2016-4074] || | || libclamunrar [35] | Fix out-of-band access || | || libdatetime-timezone- | Update to 2016h; update included data to || perl [36] | 2016i; update to 2016j; update to 2016g || | || libfcgi-perl [37] | Fix "numerous connections cause || | segfault DoS" [CVE-2012-6687] || | || libio-socket-ssl- | Fix issue with incorrect "unreadable || perl [38] | SSL_key_file" error when using || | filesystem ACLs || | || libmateweather [39] | Switch from discontinued || | weather.noaa.gov to aviationweather.gov || | || libphp-adodb [40] | Fix XSS vulnerability [CVE-2016-4855] || | and SQL injection issue [CVE-2016-7405] || | || libpng [41] | Fix null pointer deference issue || | [CVE-2016-10087] || | || libwmf [42] | Fix allocating huge block of memory || | [CVE-2016-9011] || | || linkchecker [43] | Fix HTTPS checks || | || linux [44] | Update to stable 3.16.39; add chaoskey || | driver, backported from 4.8, support for || | n25q256a11 SPI flash device; || | security,perf: Allow unprivileged use of || | perf_event_open to be disabled; several || | bug and security fixes || | || lxc [45] | Attach: do not send procfd to attached || | process [CVE-2016-8649]; remount bind || | mounts if read-only flag is provided; || | fix Alpine Linux container creation || | || mapserver [46] | Fix FTBFS with php >= 5.6.25; fix || | information leak via error messages || | [CVE-2016-9839] || | || mdadm [47] | Allow '--grow --continue' to || | successfully reshape an array when using || | backup space on a 'spare' device || | || metar [48] | Update report URL || | || minissdpd [49] | Fix improper validation of array index || | vulnerability [CVE-2016-3178 CVE-2016- || | 3179] || | || monotone [50] | Change the sigpipe test case to write 1M || | of test data to increase chances of || | overflowing the pipe buffer || | || most [51] | Fix shell injection attack when opening || | lzma-compressed files [CVE-2016-1253] || | || mpg123 [52] | Fix DoS with crafted ID3v2 tags || | || musl [53] | Fix integer overflow [CVE-2016-8859] || | || nbd [54] | Stop mixing global flags into the flags || | field that gets sent to the kernel, so || | that connecting to nbd-server >= 3.9 || | does not cause every export to be || | (incorrectly) marked as read-only || | || nettle [55] | Protect against potential side-channel || | attacks against exponentiation || | operations [CVE-2016-6489] || | || nss-pam-ldapd [56] | Have init script stop action only return || | when nslcd has actually stopped || | || nvidia-graphics- | Update to new driver version, including || drivers [57] | security fixes [CVE-2016-8826 CVE-2016- || | 7382 CVE-2016-7389] || | || nvidia-graphics-drivers- | Update to new driver version, including || legacy-304xx [58] | security fixes [CVE-2016-8826 CVE-2016- || | 7382 CVE-2016-7389] || | || nvidia-graphics- | Rebuild against nvidia-kernel-source || modules [59] | 340.101 || | || openbox [60] | Add libxcursor-dev build-dependency to || | fix loading of startup notifications; || | replace getgrent with getgroups so as || | not to enumerate all groups at startup || | || opendkim [61] | Fix relaxed canonicalization of folded || | headers, which broke signatures || | || pam [62] | Fix handling of loginuid in containers || | || pgpdump [63] | Fix endless loop parsing specially || | crafted input in read_binary [CVE-2016- || | 4021] and buffer overrun in read_radix64 || | || postgresql-9.4 [64] | New upstream release || | || postgresql-common [65] | Pg_upgradecluster: Properly upgrade || | databases with non-login role owners; || | pg_ctlcluster: Protect against symlink || | in /var/log/postgresql/ allowing the || | creation of arbitrary files elsewhere || | [CVE-2016-1255] || | || potrace [66] | Security fixes [CVE-2016-8694 CVE-2016- || | 8695 CVE-2016-8696 CVE-2016-8697 || | CVE-2016-8698 CVE-2016-8699 CVE-2016- || | 8700 CVE-2016-8701 CVE-2016-8702 || | CVE-2016-8703] || | || python-crypto [67] | Raise a warning when IV is used with ECB || | or CTR and ignore the IV [CVE-2013-7459] || | || python-werkzeug [68] | Fix XSS issue in debugger || | || qtbase-opensource- | Prevent bad-ptrs deref in || src [69] | QNetworkConfigurationManagerPrivate; fix || | X11 tray icons on some desktops || | || rawtherapee [70] | Fix buffer overflow in dcraw [CVE-2015- || | 8366] || | || redmine [71] | Handle dependency check failure when || | triggered, to avoid breaking in the || | middle of dist-upgrades; avoid opening || | database configuration that are not || | readable || | || samba [72] | Fix "client side SMB2/3 required || | signing can be downgraded" [CVE-2016- || | 2119], various regressions introduced by || | the 4.2.10 security fixes, segfault with || | clustering || | || sed [73] | Ensure consistent permissions with || | different umasks || | || shutter [74] | Fix insecure usage of system() || | [CVE-2015-0854] || | || sniffit [75] | Security fix [CVE-2014-5439] || | || suckless-tools [76] | Fix SEGV in slock when user's account || | has been disabled [CVE-2016-6866] || | || sympa [77] | Fix logrotate configuration so that || | sympa is not left in a confused state || | when systemd is used || | || systemd [78] | Don't return any error in || | manager_dispatch_notify_fd() [CVE-2016- || | 7796]; core: Rework logic to determine || | when we decide to add automatic deps for || | mounts; various ordering fixes for || | ifupdown; systemctl: Fix argument || | handling when invoked as shutdown; || | localed: tolerate absence of /etc/ || | default/keyboard; systemctl, loginctl, || | etc.: Don't start polkit agent when || | running as root || | || tevent [79] | New upstream version, required for samba || | || tre [80] | Fix regex integer overflow in buffer || | size computations [CVE-2016-8859] || | || tzdata [81] | Update included data to 2016h; update to || | 2016g; update to 2016j; update included || | data to 2016i || | || unrtf [82] | Fix buffer overflow in various cmd_ || | functions [CVE-2016-10091] || | || w3m [83] | Several security fixes [CVE-2016-9430 || | CVE-2016-9434 CVE-2016-9438 CVE-2016- || | 9440 CVE-2016-9441 CVE-2016-9423 || | CVE-2016-9431 CVE-2016-9424 CVE-2016- || | 9432 CVE-2016-9433 CVE-2016-9437 || | CVE-2016-9422 CVE-2016-9435 CVE-2016- || | 9436 CVE-2016-9426 CVE-2016-9425 || | CVE-2016-9428 CVE-2016-9442 CVE-2016- || | 9443 CVE-2016-9429 CVE-2016-9621 || | CVE-2016-9439 CVE-2016-9622 CVE-2016- || | 9623 CVE-2016-9624 CVE-2016-9625 || | CVE-2016-9626 CVE-2016-9627 CVE-2016- || | 9628 CVE-2016-9629 CVE-2016-9631 || | CVE-2016-9630 CVE-2016-9632 CVE-2016- || | 9633] || | || wireless-regdb [84] | Update included data || | || wot [85] | Remove plugin due to privacy issues || | || xwax [86] | Replace ffmpeg with avconv from libav- || | tools || | || zookeeper [87] | Fix buffer overflow via the input || | command when using the "cmd:" batch || | mode syntax [CVE-2016-5017] || | |+--------------------------+------------------------------------------+
|
|
免费注册
发表于 2017-01-15 11:29