------------------------------------------------------------------------
The Debian Project https://www.debian.org/ Updated Debian 8: 8.3 released press@debian.org January 23rd, 2016 https://www.debian.org/News/2016/20160123 ------------------------------------------------------------------------


The Debian project is pleased to announce the third update of its stable distribution Debian 8 (codename "jessie"). This update mainly adds
corrections for security problems to the stable release, along with a
few adjustments for serious problems. Security advisories were published separately and are referenced where applicable.

Please note that this update does not constitute a new version of Debian
8 but only updates some of the packages included. There is no need to
throw away old "jessie" CDs or DVDs but only to update via an up-to-date
Debian mirror after an installation, to cause any out of date packages
to be updated.

Those who frequently install updates from security.debian.org won't have
to update many packages and most updates from security.debian.org are
included in this update.

New installation media and CD and DVD images containing updated packages
will be available soon at the regular locations.

Upgrading to this revision online is usually done by pointing the
aptitude (or apt) package tool (see the sources.list(5) manual page) to
one of Debian's many FTP or HTTP mirrors. A comprehensive list of
mirrors is available at:

https://www.debian.org/mirror/list



Miscellaneous Bugfixes
----------------------

This stable update adds important corrections to the following packages:

+-------------------------+-------------------------------------------+
| Package | Reason | +-------------------------+-------------------------------------------+
| android-platform- | [i386] rebuild to fix dependency on |
| frameworks-base [1] | android-libhost |
| | |
| apache2 [2] | Fix split-logfile to work with current |
| | perl, secondary-init-script to not source |
| | the main init script with 'set -e', tests |
| | on deferred MPM switch; add versioned |
| | Replaces / Breaks for libapache2-mod- |
| | macro |
| | |
| apt [3] | Hide first pdiff merge failure debug |
| | message; fix marking of deps of pkgs in |
| | APT::Never-MarkAuto-Sections as manual; |
| | do not parse Status fields from remote |
| | sources |
| | |
| apt-dater-host [4] | Fix kernel version detection |
| | |
| apt-offline [5] | Add missing dependency on python-apt |
| | |
| arb [6] | Skip compiler version check |
| | |
| augeas [7] | HTTPD lense: include /etc/apache2/conf- |
| | available directory, allow EOL comments |
| | after section tags |
| | |
| base-files [8] | Update for the 8.3 point release; os- |
| | release: drop trailing slash in |
| | SUPPORT_URL variable |
| | |
| bcfg2 [9] | Support Django 1.7 |
| | |
| ben [10] | Fix buildd.debian.org compact links; |
| | ignore potential errors when deleting |
| | lock file; call dose-debcheck with --deb- |
| | native-arch |
| | |
| ca-certificates [11] | Update Mozilla certificate authority |
| | bundle to version 2.6 |
| | |
| ceph [12] | URL-encode bucket name [CVE-2015-5245] |
| | |
| charybdis [13] | Security fix [CVE-2015-5290]; initialise |
| | gnutls properly |
| | |
| chrony [14] | Build depend on libcap-dev, to allow |
| | dropping of privileges |
| | |
| commons-httpclient [15] | Ensure HTTPS calls use |
| | http.socket.timeout during SSL Handshake |
| | [CVE-2015-5262] |
| | |
| cpuset [16] | Update filesystem namespace prefix patch |
| | |
| curlftpfs [17] | Avoid unsafe cast for getpass() on 64-bit |
| | architectures |
| | |
| dbconfig-common [18] | Fix permissions of PostgreSQL backup |
| | files |
| | |
| debian-handbook [19] | Update for Jessie |
| | |
| debian-installer [20] | Re-introduce installer images for QNAP |
| | TS-x09; provide u-boot images for plug |
| | computers; add the part_gpt module into |
| | the core grub image; add beep to UEFI x86 |
| | boot menu; add 's' shortcut for speech to |
| | UEFI x86 boot menu; exclude usb-serial- |
| | modules from the armel network-console |
| | image and usb-modules explicitly on |
| | armel/orion5x network-console; drop the |
| | file extension from the initrd for QNAP |
| | devices; adjust p-u support to handle |
| | file:// instead of (f|ht)tp:// only |
| | |
| debian-installer- | Rebuild for the point release |
| netboot-images [21] | |
| | |
| docbook2x [22] | Do not install info/dir.gz files |
| | |
| doctrine [23] | Fix directory permissions issue |
| | [CVE-2015-5723] |
| | |
| drbd-utils [24] | Fix drbdadm adjust with IPv6 peer |
| | addresses |
| | |
| ejabberd [25] | Fix broken LDAP queries |
| | |
| exfat-utils [26] | Fix buffer overflow and infinite loop |
| | |
| exim4 [27] | Fix some MIME ACL related crashes; fix a |
| | bug causing duplicate deliveries, |
| | especially on TLS connections |
| | |
| fglrx-driver [28] | New upstream release; fix security issue |
| | [CVE-2015-7724] |
| | |
| file [29] | Fix --parameter handling |
| | |
| flash-kernel [30] | Avoid waiting for Ctrl-C if any debconf |
| | frontend is in use |
| | |
| fuse-exfat [31] | Fix buffer overflow and infinite loop |
| | |
| ganglia-modules- | Only restart the ganglia service after |
| linux [32] | installation if it was previously running |
| | |
| getmail4 [33] | Set poplib._MAXLINE=1MB |
| | |
| glance [34] | Prevent image status being directly |
| | modified via v1 API [CVE-2015-5251] |
| | |
| glibc [35] | Fix getaddrinfo sometimes returning |
| | uninitialized data with nscd; fix data |
| | corruption while reading the NSS files |
| | database [CVE-2015-5277]; fix buffer |
| | overflow (read past end of buffer) in |
| | internal_fnmatch; fix _IO_wstr_overflow |
| | integer overflow; fix unexpected closing |
| | of nss_files databases after lookups, |
| | causing denial of service [CVE-2014- |
| | 8121]; fix NSCD netgroup cache; |
| | unconditionally disable LD_POINTER_GUARD; |
| | mangle function pointers in |
| | tls_dtor_list; fix memory allocations |
| | issues that can lead to buffer overflows |
| | on the stack; update TSX blacklist to |
| | also include some Broadwell CPUs |
| | |
| gnome-orca [36] | Ensure correct focus on password entry, |
| | so characters are not echoed |
| | |
| gnome-shell-extension- | Display a warning if API key has not been |
| weather [37] | supplied by the user, since querying |
| | openweathermap.org no longer works |
| | without such a key |
| | |
| gummi [38] | Avoid predictable naming of temporary |
| | files [CVE 2015-7758] |
| | |
| human-icon-theme [39] | debian/clean-up.sh: do not run processes |
| | in background |
| | |
| ieee-data [40] | Update included data files, adding |
| | mam.txt and oui36.txt; stop downloading |
| | via HTTPS, as neither wget nor curl |
| | support TLS AIA, as now used by |
| | standards.ieee.org |
| | |
| intel-microcode [41] | Update included microcode |
| | |
| iptables- | Stop rules files being world-readable; |
| persistent [42] | rewrite README |
| | |
| isc-dhcp [43] | Fix error when maximum lease time is used |
| | on 64-bit systems |
| | |
| keepassx [44] | Fix storage of passwords in clear text |
| | [CVE-2015-8378] |
| | |
| libapache-mod- | Switch B-D from libtool to libtool-bin to |
| fastcgi [45] | fix build failure |
| | |
| libapache2-mod- | Fix crashes in modperl_interp_unselect() |
| perl2 [46] | |
| | |
| libcgi-session- | Untaint raw data coming from session |
| perl [47] | storage backends, fixing a regression |
| | caused by CVE-2015-8607 fixes in perl |
| | |
| libdatetime-timezone- | New upstream release |
| perl [48] | |
| | |
| libencode-perl [49] | Correctly handle a lack of BOM when |
| | decoding |
| | |
| libhtml-scrubber- | Fix cross-site scripting vulnerability in |
| perl [50] | comments [CVE-2015-5667] |
| | |
| libinfinity [51] | Fix possible crashes when an entry is |
| | removed from the document browser and |
| | when access control lists are enabled |
| | |
| libiptables-parse- | Fix use of predictable names for |
| perl [52] | temporary files [CVE-2015-8326] |
| | |
| libraw [53] | Fix index overflow in smal_decode_segment |
| | [CVE-2015-8366]; fix memory objects are |
| | not intialized properly [CVE-2015-8367] |
| | |
| libssh [54] | Fix "null pointer dereference due to a |
| | logical error in the handling of a |
| | SSH_MSG_NEWKEYS and KEXDH_REPLY |
| | packets" [CVE-2015-3146] |
| | |
| linux [55] | Update to upstream release 3.16.7-ctk20; |
| | nbd: restore request timeout detection; |
| | [x86] enable PINCTRL_BAYTRAIL; [mips*/ |
| | octeon] enable CAVIUM_CN63XXP1; |
| | firmware_class: fix condition in |
| | directory search loop; [x86] KVM: svm: |
| | unconditionally intercept #DB [CVE-2015- |
| | 8104] |
| | |
| linux-tools [56] | Add new hyperv-daemons package |
| | |
| lldpd [57] | Fix a segfault and an assertion error |
| | when receiving incorrectly formed LLDP |
| | management addresses |
| | |
| madfuload [58] | Use autoreconf -fi to fix build failure |
| | with automake 1.14 |
| | |
| mdadm [59] | Disable incremental assembly, as it can |
| | cause issues booting a degraded RAID |
| | |
| mkvmlinuz [60] | Direct run-parts output to stderr |
| | |
| monit [61] | Fix umask-related regression from 5.8.1 |
| | |
| mpm-itk [62] | Fix an issue where closing of connections |
| | was attempted in the parent. This would |
| | result in "Connection: close" not being |
| | honoured, and various odd effects with |
| | SSL keepalive in certain browsers |
| | |
| multipath-tools [63] | Fix discovery of devices with blank sysfs |
| | attribute; add documentation to cover |
| | additional friendly names scenarios; |
| | init: fix stop failure when no root |
| | device is found; use 'SCSI_IDENT_.*' as |
| | the default property whitelist |
| | |
| netcfg [64] | Fix is_layer3_qeth on s390x to avoid |
| | bailing out if the network driver is not |
| | qeth |
| | |
| nvidia-graphics- | New upstream release [CVE-2015-5950]; fix |
| drivers [65] | Unsanitized User Mode Input issue |
| | [CVE-2015-7869] |
| | |
| nvidia-graphics- | New upstream release; fix unsanitized |
| drivers- | User Mode Input issue [CVE-2015-7869] |
| legacy-304xx [66] | |
| | |
| nvidia-graphics- | Rebuild against nvidia-kernel-source |
| modules [67] | 340.96 |
| | |
| openldap [68] | Fix a crash when adding a large attribute |
| | value with the auditlog overlay enabled |
| | |
| openvpn [69] | Add --no-block to if-up.d script to avoid |
| | hanging boot on interfaces with openvpn |
| | instances |
| | |
| owncloud [70] | Fix local file inclusion on Microsoft |
| | Windows Platform [CVE-2015-4716], |
| | resource exhaustion when sanitizing |
| | filenames [CVE-2015-4717], command |
| | injection when using external SMB storage |
| | [CVE-2015-4718], calendar export: |
| | Authorization Bypass Through User- |
| | Controlled Key [CVE-2015-6670]; fix |
| | reflected XSS in OCS provider discovery |
| | [oc-sa-2016-001] [CVE-2016-1498], |
| | disclosure of files that begin with \ ".v |
| | \" due to unchecked return value [oc- |
| | sa-2016-003] [CVE-2016-1500], information |
| | exposure via directory listing in the |
| | file scanner [oc-sa-2016-002] [CVE-2016- |
| | 1499], installation path disclosure |
| | through error message [oc-sa-2016-004] |
| | [CVE-2016-1501] |
| | |
| pam [71] | Fix DoS / user enumeration due to |
| | blocking pipe in pam_unix [CVE-2015-3238] |
| | |
| pcre3 [72] | Fix security issues [CVE-2015-2325 |
| | CVE-2015-2326 CVE-2015-3210 CVE-2015-5073 |
| | CVE-2015-8384 CVE-2015-8388] |
| | |
| pdns [73] | Fix upgrades with default configuration |
| | |
| perl [74] | Correctly handle a lack of BOM when |
| | decoding |
| | |
| php-auth-sasl [75] | Rebuild with pkg-php-tools 1.28 to |
| | correct PHP dependencies |
| | |
| php-doctrine- | Fix directory permissions issue |
| annotations [76] | [CVE-2015-5723] |
| | |
| php-doctrine-cache [77] | Fix file / directory permissions issue |
| | [CVE-2015-5723] |
| | |
| php-doctrine- | Fix file permissions issue [CVE-2015- |
| common [78] | 5723] |
| | |
| php-dropbox [79] | Refuse to handle any files containing an |
| | @ [CVE-2015-4715] |
| | |
| php-mail- | Rebuild with pkg-php-tools 1.28 to |
| mimedecode [80] | correct PHP dependencies |
| | |
| php5 [81] | New upstream release |
| | |
| plowshare4 [82] | Disable Javascript support |
| | |
| postgresql-9.1 [83] | New upstream release |
| | |
| pykerberos [84] | Add KDC authenticity verification support |
| | [CVE-2015-3206] |
| | |
| python-yaql [85] | Remove broken python3-yaql package |
| | |
| qpsmtpd [86] | Fix compatibility issue with newer |
| | Net::DNS versions |
| | |
| quassel [87] | Fix remote DoS in quassel core, using /op |
| | * command [CVE-2015-8547] |
| | |
| redis [88] | Ensure that a valid runtime directory is |
| | created when running under systemd |
| | |
| redmine [89] | Fix upgrades when there are locally- |
| | installed plugins; fix moving issues |
| | across projects |
| | |
| rsyslog [90] | Fix crash in imfile module when using |
| | inotify mode; prevent a segfault in |
| | dynafile creation |
| | |
| ruby-bson [91] | Fix DoS and possible injection [CVE-2015- |
| | 4410] |
| | |
| s390-dasd [92] | If no channel is found, exit cleanly. |
| | This allows s390-dasd to step out of the |
| | way on VMs with virtio disks |
| | |
| shadow [93] | Fix error handling in busy user detection |
| | |
| sparse [94] | Fix build failure with llvm-3.5 |
| | |
| spip [95] | Fix cross-site scripting issue |
| | |
| stk [96] | Install missing SKINI.{msg,tbl} include |
| | files |
| | |
| sus [97] | Update checksums for upstream tarball |
| | |
| swift [98] | Fix unauthorized delete of versioned |
| | Swift object [CVE-2015-1856]; fix |
| | information leak via Swift tempurls |
| | [CVE-2015-5223]; fix service name of |
| | object-expirer in init script; add |
| | container-sync init script; |
| | "standardise" user addition |
| | |
| systemd [99] | Fix namespace breakage due to incorrect |
| | path sorting; don't timeout after 90 |
| | seconds when no password was entered for |
| | cryptsetup devices; only set the kernel's |
| | timezone when the RTC runs in local time, |
| | avoiding possible jumps backward in time; |
| | fix incorrect handling of comma separator |
| | in systemd-delta; make DHCP broadcast |
| | behaviour configurable in systemd- |
| | networkd |
| | |
| tangerine-icon- | debian/clean-up.sh: do not run processes |
| theme [100] | in background |
| | |
| torbrowser- | Really apply patches from 0.1.9-1+deb8u1; |
| launcher [101] | stop confining start-tor-browser script |
| | with AppArmor; set usr.bin.torbrowser- |
| | launcher AppArmor profiles to complain |
| | mode |
| | |
| ttylog [102] | Fix truncation of device name when |
| | selecting device |
| | |
| tzdata [103] | New upstream release |
| | |
| uqm [104] | Add missing -lm flag, fixing build |
| | failure |
| | |
| vlc [105] | New upstream stable release |
| | |
| webkitgtk [106] | New upstream stable release; fix "late |
| | TLS certificate verification" [CVE-2015- |
| | 2330] |
| | |
| wxmaxima [107] | Prevent crash on encountering parenthesis |
| | in dialogues |
| | |
| zendframework [108] | Fix entropy issue with captcha [ZF2015- |
| | 09] |
| | | +-------------------------+-------------------------------------------+

1: https://packages.debian.org/src:android-platform-frameworks-base
2: https://packages.debian.org/src:apache2
3: https://packages.debian.org/src:apt
4: https://packages.debian.org/src:apt-dater-host
5: https://packages.debian.org/src:apt-offline
6: https://packages.debian.org/src:arb
7: https://packages.debian.org/src:augeas
8: https://packages.debian.org/src:base-files
9: https://packages.debian.org/src:bcfg2
10: https://packages.debian.org/src:ben
11: https://packages.debian.org/src:ca-certificates
12: https://packages.debian.org/src:ceph
13: https://packages.debian.org/src:charybdis
14: https://packages.debian.org/src:chrony
15: https://packages.debian.org/src:commons-httpclient
16: https://packages.debian.org/src:cpuset
17: https://packages.debian.org/src:curlftpfs
18: https://packages.debian.org/src:dbconfig-common
19: https://packages.debian.org/src:debian-handbook
20: https://packages.debian.org/src:debian-installer
21: https://packages.debian.org/src:debian-installer-netboot-images
22: https://packages.debian.org/src:docbook2x
23: https://packages.debian.org/src:doctrine
24: https://packages.debian.org/src:drbd-utils
25: https://packages.debian.org/src:ejabberd
26: https://packages.debian.org/src:exfat-utils
27: https://packages.debian.org/src:exim4

[continued in next message]

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)