[kernel-sec-discuss] r4835 - active

Salvatore Bonaccorso carnil at moszumanska.debian.org
Sat Jan 14 12:12:01 UTC 2017 

Author: carnil
Date: 2017-01-14 12:12:00 +0000 (Sat, 14 Jan 2017)
New Revision: 4835

Modified:
   active/CVE-2015-1350
   active/CVE-2015-8955
   active/CVE-2015-8962
   active/CVE-2015-8963
   active/CVE-2015-8964
   active/CVE-2016-10088
   active/CVE-2016-5412
   active/CVE-2016-7097
   active/CVE-2016-7910
   active/CVE-2016-7911
   active/CVE-2016-7912
   active/CVE-2016-7915
   active/CVE-2016-7917
   active/CVE-2016-8399
   active/CVE-2016-8633
   active/CVE-2016-8645
   active/CVE-2016-8650
   active/CVE-2016-8655
   active/CVE-2016-8658
   active/CVE-2016-9083
   active/CVE-2016-9084
   active/CVE-2016-9178
   active/CVE-2016-9555
   active/CVE-2016-9576
   active/CVE-2016-9754
   active/CVE-2016-9756
   active/CVE-2016-9793
   active/CVE-2016-9794
   active/CVE-2016-9806
Log:
Mark 3.16.39-1 as released

Modified: active/CVE-2015-1350
===================================================================
--- active/CVE-2015-1350	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2015-1350	2017-01-14 12:12:00 UTC (rev 4835)
@@ -10,7 +10,7 @@
 Bugs: 770492
 upstream: released (4.9-rc1) [030b533c4fd4d2ec3402363323de4bb2983c9cee]
 sid: released (4.8.11-1) [bugfix/all/xfs-Propagate-dentry-down-to-inode_change_ok.patch, bugfix/all/ceph-Propagate-dentry-down-to-inode_change_ok.patch, bugfix/all/fuse-Propagate-dentry-down-to-inode_change_ok.patch, bugfix/all/fs-Give-dentry-to-inode_change_ok-instead-of-inode.patch, bugfix/all/fs-Avoid-premature-clearing-of-capabilities.patch]
-3.16-jessie-security: pending (3.16.39-1)
+3.16-jessie-security: released (3.16.39-1)
 3.2-wheezy-security: released (3.2.84-1)
 3.16-upstream-stable: released (3.16.39) [fs-give-dentry-to-inode_change_ok-instead-of-inode.patch, fs-avoid-premature-clearing-of-capabilities.patch]
 3.2-upstream-stable: released (3.2.84) [fs-give-dentry-to-inode_change_ok-instead-of-inode.patch, fs-avoid-premature-clearing-of-capabilities.patch]

Modified: active/CVE-2015-8955
===================================================================
--- active/CVE-2015-8955	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2015-8955	2017-01-14 12:12:00 UTC (rev 4835)
@@ -7,5 +7,5 @@
 3.16-upstream-stable: released (3.16.39) [arm64-perf-reject-groups-spanning-multiple-hw-pmus.patch]
 3.2-upstream-stable: N/A "Vulnerable architecture not present"
 sid: released (4.1.3-1)
-3.16-jessie-security: pending (3.16.39-1)
+3.16-jessie-security: released (3.16.39-1)
 3.2-wheezy-security: N/A "Vulnerable architecture not present"

Modified: active/CVE-2015-8962
===================================================================
--- active/CVE-2015-8962	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2015-8962	2017-01-14 12:12:00 UTC (rev 4835)
@@ -6,5 +6,5 @@
 3.16-upstream-stable: needed
 3.2-upstream-stable: needed
 sid: released (4.4.2-1)
-3.16-jessie-security: pending (3.16.39-1) [bugfix/all/sg-fix-double-free-when-drives-detach-during-sg_io.patch]
+3.16-jessie-security: released (3.16.39-1) [bugfix/all/sg-fix-double-free-when-drives-detach-during-sg_io.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/sg-fix-double-free-when-drives-detach-during-sg_io.patch]

Modified: active/CVE-2015-8963
===================================================================
--- active/CVE-2015-8963	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2015-8963	2017-01-14 12:12:00 UTC (rev 4835)
@@ -6,5 +6,5 @@
 3.16-upstream-stable: needed
 3.2-upstream-stable: needed
 sid: released (4.4.2-1)
-3.16-jessie-security: pending (3.16.39-1) [bugfix/all/perf-fix-race-in-swevent-hash.patch]
+3.16-jessie-security: released (3.16.39-1) [bugfix/all/perf-fix-race-in-swevent-hash.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/perf-fix-race-in-swevent-hash.patch]

Modified: active/CVE-2015-8964
===================================================================
--- active/CVE-2015-8964	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2015-8964	2017-01-14 12:12:00 UTC (rev 4835)
@@ -14,5 +14,5 @@
 3.16-upstream-stable: needed
 3.2-upstream-stable: needed
 sid: released (4.5.1-1)
-3.16-jessie-security: pending (3.16.39-1) [bugfix/all/tty-prevent-ldisc-drivers-from-re-using-stale-tty-fi.patch]
+3.16-jessie-security: released (3.16.39-1) [bugfix/all/tty-prevent-ldisc-drivers-from-re-using-stale-tty-fi.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/tty-prevent-ldisc-drivers-from-re-using-stale-tty-fi.patch]

Modified: active/CVE-2016-10088
===================================================================
--- active/CVE-2016-10088	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-10088	2017-01-14 12:12:00 UTC (rev 4835)
@@ -10,5 +10,5 @@
 3.16-upstream-stable: needed
 3.2-upstream-stable: needed
 sid: released (4.8.15-2) [bugfix/all/sg_write-bsg_write-is-not-fit-to-be-called-under-KER.patch]
-3.16-jessie-security: pending (3.16.39-1) [bugfix/all/sg_write-bsg_write-is-not-fit-to-be-called-under-ker.patch]
+3.16-jessie-security: released (3.16.39-1) [bugfix/all/sg_write-bsg_write-is-not-fit-to-be-called-under-ker.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/sg_write-bsg_write-is-not-fit-to-be-called-under-ker.patch]

Modified: active/CVE-2016-5412
===================================================================
--- active/CVE-2016-5412	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-5412	2017-01-14 12:12:00 UTC (rev 4835)
@@ -10,5 +10,5 @@
 3.16-upstream-stable: released (3.16.37) [kvm-ppc-book3s-hv-pull-out-tm-state-save-restore-into-separate.patch, kvm-ppc-book3s-hv-save-restore-tm-state-in-h_cede.patch]
 3.2-upstream-stable: N/A "Transactional memory is not supported"
 sid: released (4.7.2-1)
-3.16-jessie-security: pending (3.16.39-1)
+3.16-jessie-security: released (3.16.39-1)
 3.2-wheezy-security: N/A "Transactional memory is not supported"

Modified: active/CVE-2016-7097
===================================================================
--- active/CVE-2016-7097	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-7097	2017-01-14 12:12:00 UTC (rev 4835)
@@ -9,5 +9,5 @@
 3.16-upstream-stable: released (3.16.39) [posix_acl-clear-sgid-bit-when-setting-file-permissions.patch]
 3.2-upstream-stable: released (3.2.84) [posix_acl-clear-sgid-bit-when-setting-file-permissions.patch]
 sid: released (4.7.8-1) [bugfix/all/posix_acl-clear-sgid-bit-when-setting-file-permissio.patch]
-3.16-jessie-security: pending (3.16.39-1)
+3.16-jessie-security: released (3.16.39-1)
 3.2-wheezy-security: released (3.2.84-1)

Modified: active/CVE-2016-7910
===================================================================
--- active/CVE-2016-7910	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-7910	2017-01-14 12:12:00 UTC (rev 4835)
@@ -6,5 +6,5 @@
 3.16-upstream-stable: released (3.16.39)
 3.2-upstream-stable: released (3.2.84)
 sid: released (4.7.2-1)
-3.16-jessie-security: pending (3.16.39-1)
+3.16-jessie-security: released (3.16.39-1)
 3.2-wheezy-security: released (3.2.84-1)

Modified: active/CVE-2016-7911
===================================================================
--- active/CVE-2016-7911	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-7911	2017-01-14 12:12:00 UTC (rev 4835)
@@ -7,5 +7,5 @@
 3.16-upstream-stable: released (3.16.37)
 3.2-upstream-stable: needed
 sid: released (4.7.2-1)
-3.16-jessie-security: pending (3.16.39-1)
+3.16-jessie-security: released (3.16.39-1)
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/block-fix-use-after-free-in-sys_ioprio_get.patch]

Modified: active/CVE-2016-7912
===================================================================
--- active/CVE-2016-7912	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-7912	2017-01-14 12:12:00 UTC (rev 4835)
@@ -8,5 +8,5 @@
 3.16-upstream-stable: needed
 3.2-upstream-stable: N/A "Vulnerable code not present"
 sid: released (4.5.3-1)
-3.16-jessie-security: pending (3.16.39-1) [bugfix/all/usb-gadget-f_fs-fix-use-after-free.patch]
+3.16-jessie-security: released (3.16.39-1) [bugfix/all/usb-gadget-f_fs-fix-use-after-free.patch]
 3.2-wheezy-security: N/A "Vulnerable code not present"

Modified: active/CVE-2016-7915
===================================================================
--- active/CVE-2016-7915	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-7915	2017-01-14 12:12:00 UTC (rev 4835)
@@ -6,5 +6,5 @@
 3.16-upstream-stable: needed
 3.2-upstream-stable: needed
 sid: released (4.6.1-1)
-3.16-jessie-security: pending (3.16.39-1) [bugfix/all/hid-core-prevent-out-of-bound-readings.patch]
+3.16-jessie-security: released (3.16.39-1) [bugfix/all/hid-core-prevent-out-of-bound-readings.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/hid-core-prevent-out-of-bound-readings.patch]

Modified: active/CVE-2016-7917
===================================================================
--- active/CVE-2016-7917	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-7917	2017-01-14 12:12:00 UTC (rev 4835)
@@ -15,5 +15,5 @@
 3.16-upstream-stable: needed
 3.2-upstream-stable: N/A "Vulnerable code not present"
 sid: released (4.5.1-1)
-3.16-jessie-security: pending (3.16.39-1) [bugfix/all/netfilter-nfnetlink-correctly-validate-length-of-bat.patch]
+3.16-jessie-security: released (3.16.39-1) [bugfix/all/netfilter-nfnetlink-correctly-validate-length-of-bat.patch]
 3.2-wheezy-security: N/A "Vulnerable code not present"

Modified: active/CVE-2016-8399
===================================================================
--- active/CVE-2016-8399	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-8399	2017-01-14 12:12:00 UTC (rev 4835)
@@ -9,5 +9,5 @@
 3.16-upstream-stable: needed
 3.2-upstream-stable: needed
 sid: released (4.8.15-1)
-3.16-jessie-security: pending (3.16.39-1) [bugfix/all/net-ping-check-minimum-size-on-icmp-header-length.patch]
+3.16-jessie-security: released (3.16.39-1) [bugfix/all/net-ping-check-minimum-size-on-icmp-header-length.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/net-ping-check-minimum-size-on-icmp-header-length.patch]

Modified: active/CVE-2016-8633
===================================================================
--- active/CVE-2016-8633	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-8633	2017-01-14 12:12:00 UTC (rev 4835)
@@ -7,5 +7,5 @@
 3.16-upstream-stable: released (3.16.39) [firewire-net-guard-against-rx-buffer-overflows.patch]
 3.2-upstream-stable: released (3.2.84) [firewire-net-guard-against-rx-buffer-overflows.patch]
 sid: released (4.8.7-1)
-3.16-jessie-security: pending (3.16.39-1)
+3.16-jessie-security: released (3.16.39-1)
 3.2-wheezy-security: released (3.2.84-1)

Modified: active/CVE-2016-8645
===================================================================
--- active/CVE-2016-8645	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-8645	2017-01-14 12:12:00 UTC (rev 4835)
@@ -21,5 +21,5 @@
 3.16-upstream-stable: needed
 3.2-upstream-stable: needed
 sid: released (4.8.11-1) [2b5f22e4f7fd208c8d392e5c3755cea1f562cb98]
-3.16-jessie-security: pending (3.16.39-1) [bugfix/all/tcp-take-care-of-truncations-done-by-sk_filter.patch]
+3.16-jessie-security: released (3.16.39-1) [bugfix/all/tcp-take-care-of-truncations-done-by-sk_filter.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/tcp-take-care-of-truncations-done-by-sk_filter.patch]

Modified: active/CVE-2016-8650
===================================================================
--- active/CVE-2016-8650	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-8650	2017-01-14 12:12:00 UTC (rev 4835)
@@ -8,5 +8,5 @@
 3.16-upstream-stable: needed
 3.2-upstream-stable: N/A "Vulnerable code introduced in 3.3-rc1 with cdec9cb5167ab1113ba9c58e395f664d9d3f9acb"
 sid: released (4.8.11-1) [bugfix/all/mpi-Fix-NULL-ptr-dereference-in-mpi_powm-ver-3.patch]
-3.16-jessie-security: pending (3.16.39-1) [bugfix/all/mpi-fix-null-ptr-dereference-in-mpi_powm-ver-3.patch]
+3.16-jessie-security: released (3.16.39-1) [bugfix/all/mpi-fix-null-ptr-dereference-in-mpi_powm-ver-3.patch]
 3.2-wheezy-security: N/A "Vulnerable code not present"

Modified: active/CVE-2016-8655
===================================================================
--- active/CVE-2016-8655	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-8655	2017-01-14 12:12:00 UTC (rev 4835)
@@ -10,5 +10,5 @@
 3.16-upstream-stable: needed
 3.2-upstream-stable: needed
 sid: released (4.8.15-1)
-3.16-jessie-security: pending (3.16.39-1) [bugfix/all/packet-fix-race-condition-in-packet_set_ring.patch]
+3.16-jessie-security: released (3.16.39-1) [bugfix/all/packet-fix-race-condition-in-packet_set_ring.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/packet-fix-race-condition-in-packet_set_ring.patch]

Modified: active/CVE-2016-8658
===================================================================
--- active/CVE-2016-8658	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-8658	2017-01-14 12:12:00 UTC (rev 4835)
@@ -11,5 +11,5 @@
 3.16-upstream-stable: released (3.16.39) [brcmfmac-avoid-potential-stack-overflow-in-brcmf_cfg80211_start_ap.patch]
 3.2-upstream-stable: N/A "Vulnerable code not present"
 sid: released (4.7.5-1)
-3.16-jessie-security: pending (3.16.39-1)
+3.16-jessie-security: released (3.16.39-1)
 3.2-wheezy-security: N/A "Vulnerable code not present"

Modified: active/CVE-2016-9083
===================================================================
--- active/CVE-2016-9083	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-9083	2017-01-14 12:12:00 UTC (rev 4835)
@@ -7,5 +7,5 @@
 3.16-upstream-stable: released (3.16.39) [vfio-pci-fix-integer-overflows-bitmask-check.patch]
 3.2-upstream-stable: N/A "Vulnerable code not present"
 sid: released (4.8.11-1) [bugfix/all/vfio-pci-Fix-integer-overflows-bitmask-check.patch]
-3.16-jessie-security: pending (3.16.39-1)
+3.16-jessie-security: released (3.16.39-1)
 3.2-wheezy-security: N/A "Vulnerable code not present"

Modified: active/CVE-2016-9084
===================================================================
--- active/CVE-2016-9084	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-9084	2017-01-14 12:12:00 UTC (rev 4835)
@@ -7,5 +7,5 @@
 3.16-upstream-stable: released (3.16.39) [vfio-pci-fix-integer-overflows-bitmask-check.patch]
 3.2-upstream-stable: N/A "Vulnerable code not present"
 sid: released (4.8.11-1) [bugfix/all/vfio-pci-Fix-integer-overflows-bitmask-check.patch]
-3.16-jessie-security: pending (3.16.39-1)
+3.16-jessie-security: released (3.16.39-1)
 3.2-wheezy-security: N/A "Vulnerable code not present"

Modified: active/CVE-2016-9178
===================================================================
--- active/CVE-2016-9178	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-9178	2017-01-14 12:12:00 UTC (rev 4835)
@@ -13,5 +13,5 @@
 3.16-upstream-stable: needed
 3.2-upstream-stable: needed
 sid: released (4.7.5-1)
-3.16-jessie-security: pending (3.16.39-1) [bugfix/x86/fix-potential-infoleak-in-older-kernels.patch]
+3.16-jessie-security: released (3.16.39-1) [bugfix/x86/fix-potential-infoleak-in-older-kernels.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/x86/fix-potential-infoleak-in-older-kernels.patch]

Modified: active/CVE-2016-9555
===================================================================
--- active/CVE-2016-9555	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-9555	2017-01-14 12:12:00 UTC (rev 4835)
@@ -6,5 +6,5 @@
 3.16-upstream-stable: needed
 3.2-upstream-stable: needed
 sid: released (4.8.11-1)
-3.16-jessie-security: pending (3.16.39-1) [bugfix/all/sctp-validate-chunk-len-before-actually-using-it.patch]
+3.16-jessie-security: released (3.16.39-1) [bugfix/all/sctp-validate-chunk-len-before-actually-using-it.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/sctp-validate-chunk-len-before-actually-using-it.patch]

Modified: active/CVE-2016-9576
===================================================================
--- active/CVE-2016-9576	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-9576	2017-01-14 12:12:00 UTC (rev 4835)
@@ -14,5 +14,5 @@
 3.16-upstream-stable: needed
 3.2-upstream-stable: needed
 sid: released (4.8.15-1)
-3.16-jessie-security: pending (3.16.39-1) [bugfix/all/sg_write-bsg_write-is-not-fit-to-be-called-under-ker.patch]
+3.16-jessie-security: released (3.16.39-1) [bugfix/all/sg_write-bsg_write-is-not-fit-to-be-called-under-ker.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/sg_write-bsg_write-is-not-fit-to-be-called-under-ker.patch]

Modified: active/CVE-2016-9754
===================================================================
--- active/CVE-2016-9754	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-9754	2017-01-14 12:12:00 UTC (rev 4835)
@@ -6,5 +6,5 @@
 3.16-upstream-stable: released (3.16.37) [e5e2cbc7f25c06266bba5072adab68cc64f71401]
 3.2-upstream-stable: N/A "Vulnerable code introduced in 3.5-rc1 with 83f40318dab00e3298a1f6d0b12ac025e84e478d
 sid: released (4.6.1-1)
-3.16-jessie-security: pending (3.16.39-1)
+3.16-jessie-security: released (3.16.39-1)
 3.2-wheezy-security: N/A "Vulnerable code not present"

Modified: active/CVE-2016-9756
===================================================================
--- active/CVE-2016-9756	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-9756	2017-01-14 12:12:00 UTC (rev 4835)
@@ -7,5 +7,5 @@
 3.16-upstream-stable: needed
 3.2-upstream-stable: needed
 sid: released (4.8.15-1)
-3.16-jessie-security: pending (3.16.39-1) [bugfix/x86/kvm-x86-drop-error-recovery-in-em_jmp_far-and-em_ret.patch]
+3.16-jessie-security: released (3.16.39-1) [bugfix/x86/kvm-x86-drop-error-recovery-in-em_jmp_far-and-em_ret.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/x86/kvm-x86-drop-error-recovery-in-em_jmp_far-and-em_ret.patch]

Modified: active/CVE-2016-9793
===================================================================
--- active/CVE-2016-9793	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-9793	2017-01-14 12:12:00 UTC (rev 4835)
@@ -9,5 +9,5 @@
 3.16-upstream-stable: needed
 3.2-upstream-stable: needed
 sid: released (4.8.15-1)
-3.16-jessie-security: pending (3.16.39-1) [bugfix/all/net-avoid-signed-overflows-for-so_-snd-rcv-bufforce.patch]
+3.16-jessie-security: released (3.16.39-1) [bugfix/all/net-avoid-signed-overflows-for-so_-snd-rcv-bufforce.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/net-avoid-signed-overflows-for-so_-snd-rcv-bufforce.patch]

Modified: active/CVE-2016-9794
===================================================================
--- active/CVE-2016-9794	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-9794	2017-01-14 12:12:00 UTC (rev 4835)
@@ -6,5 +6,5 @@
 3.16-upstream-stable: needed
 3.2-upstream-stable: needed
 sid: released (4.7.2-1)
-3.16-jessie-security: pending (3.16.39-1) [bugfix/all/alsa-pcm-call-kill_fasync-in-stream-lock.patch]
+3.16-jessie-security: released (3.16.39-1) [bugfix/all/alsa-pcm-call-kill_fasync-in-stream-lock.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/alsa-pcm-call-kill_fasync-in-stream-lock.patch]

Modified: active/CVE-2016-9806
===================================================================
--- active/CVE-2016-9806	2017-01-13 12:04:46 UTC (rev 4834)
+++ active/CVE-2016-9806	2017-01-14 12:12:00 UTC (rev 4835)
@@ -8,5 +8,5 @@
 3.16-upstream-stable: released (3.16.37)
 3.2-upstream-stable: N/A "Vulnerable code not present"
 sid: released (4.6.3-1)
-3.16-jessie-security: pending (3.16.39-1)
+3.16-jessie-security: released (3.16.39-1)
 3.2-wheezy-security: N/A "Vulnerable code not present"

More information about the kernel-sec-discuss mailing list