A last update for Debian 6 LTS, and 3 updates for Debian 7/8:

[DLA 445-2] squid3 regression update
[DSA 3426-2] ctdb regression update
[DSA 3502-1] roundup security update
[DSA 3503-1] linux security update

[DLA 445-2] squid3 regression update

Package : squid3
Version : 3.1.6-1.2+squeeze7
CVE ID : CVE-2016-2569
Debian Bug : 816601

The backported patch to solve CVE-2016-2569 yielded to failed assertions
that made squid3 to crash when closing connections. The fix for this CVE
strongly relies on exception handling present in more recent versions of
squid3, that I failed to identify in the previous update. I have
reverted the patch to take the safest position, taking into account that
Squeeze users should migrate to a supported version of Debian. This
post-EOL update is intended to keep a functional squid3 package in the
archive.

[DSA 3426-2] ctdb regression update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3426-2 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
March 03, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : ctdb
Debian Bug : 813406

The update for linux issued as DSA-3426-1 and DSA-3434-1 to address
CVE-2015-8543 uncovered a bug in ctdb, a clustered database to store
temporary data, leading to broken clusters. Updated packages are now
available to address this problem.

For the oldstable distribution (wheezy), this problem has been fixed
in version 1.12+git20120201-5.

For the stable distribution (jessie), this problem has been fixed in
version 2.5.4+debian0-4+deb8u1.

We recommend that you upgrade your ctdb packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[DSA 3502-1] roundup security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3502-1 security@debian.org
https://www.debian.org/security/ Yves-Alexis Perez
March 03, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : roundup
CVE ID : CVE-2014-6276

Ralf Schlatterbeck discovered an information leak in roundup, a
web-based issue tracking system. An authenticated attacker could use it
to see sensitive details about other users, including their hashed
password.

After applying the update, which will fix the shipped templates, the
site administrator should ensure the instanced versions (in
/var/lib/roundup usually) are also updated, either by patching them
manually or by recreating them.

More info can be found in the upstream documentation at
http://www.roundup-tracker.org/docs/upgrading.html#user-data-visibility

For the oldstable distribution (wheezy), this problem has been fixed
in version 1.4.20-1.1+deb7u1.

For the stable distribution (jessie), this problem has been fixed in
version 1.4.20-1.1+deb8u1.

For the testing (stretch) and unstable (sid) distribution, this problem has not
yet been fixed.

We recommend that you upgrade your roundup packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[DSA 3503-1] linux security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3503-1 security@debian.org
https://www.debian.org/security/ Ben Hutchings
March 03, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : linux
CVE ID : CVE-2013-4312 CVE-2015-7566 CVE-2015-8767 CVE-2015-8785
CVE-2015-8812 CVE-2015-8816 CVE-2015-8830 CVE-2016-0723
CVE-2016-0774 CVE-2016-2069 CVE-2016-2384 CVE-2016-2543
CVE-2016-2544 CVE-2016-2545 CVE-2016-2546 CVE-2016-2547
CVE-2016-2548 CVE-2016-2549 CVE-2016-2550

Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service, information
leak or data loss.

CVE-2013-4312

Tetsuo Handa discovered that users can use pipes queued on local
(Unix) sockets to allocate an unfair share of kernel memory, leading
to denial-of-service (resource exhaustion).

This issue was previously mitigated for the stable suite by limiting
the total number of files queued by each user on local sockets. The
new kernel version in both suites includes that mitigation plus
limits on the total size of pipe buffers allocated for each user.

CVE-2015-7566

Ralf Spenneberg of OpenSource Security reported that the visor
driver crashes when a specially crafted USB device without bulk-out
endpoint is detected.

CVE-2015-8767

An SCTP denial-of-service was discovered which can be triggered by a
local attacker during a heartbeat timeout event after the 4-way
handshake.

CVE-2015-8785

It was discovered that local users permitted to write to a file on a
FUSE filesystem could cause a denial of service (unkillable loop in
the kernel).

CVE-2015-8812

A flaw was found in the iw_cxgb3 Infiniband driver. Whenever it
could not send a packet because the network was congested, it would
free the packet buffer but later attempt to send the packet again.
This use-after-free could result in a denial of service (crash or
hang), data loss or privilege escalation.

CVE-2015-8816

A use-after-free vulnerability was discovered in the USB hub driver.
This may be used by a physically present user for privilege
escalation.

CVE-2015-8830

Ben Hawkes of Google Project Zero reported that the AIO interface
permitted reading or writing 2 GiB of data or more in a single
chunk, which could lead to an integer overflow when applied to
certain filesystems, socket or device types. The full security
impact has not been evaluated.

CVE-2016-0723

A use-after-free vulnerability was discovered in the TIOCGETD ioctl.
A local attacker could use this flaw for denial-of-service.

CVE-2016-0774

It was found that the fix for CVE-2015-1805 in kernel versions older
than Linux 3.16 did not correctly handle the case of a partially
failed atomic read. A local, unprivileged user could use this flaw
to crash the system or leak kernel memory to user space.

CVE-2016-2069

Andy Lutomirski discovered a race condition in flushing of the TLB
when switching tasks on an x86 system. On an SMP system this could
possibly lead to a crash, information leak or privilege escalation.

CVE-2016-2384

Andrey Konovalov found that a crafted USB MIDI device with an
invalid USB descriptor could trigger a double-free. This may be used
by a physically present user for privilege escalation.

CVE-2016-2543

Dmitry Vyukov found that the core sound sequencer driver (snd-seq)
lacked a necessary check for a null pointer, allowing a user
with access to a sound sequencer device to cause a denial-of-
service (crash).

CVE-2016-2544, CVE-2016-2546, CVE-2016-2547, CVE-2016-2548

Dmitry Vyukov found various race conditions in the sound subsystem
(ALSA)'s management of timers. A user with access to sound devices
could use these to cause a denial-of-service (crash or hang) or
possibly for privilege escalation.

CVE-2016-2545

Dmitry Vyukov found a flaw in list manipulation in the sound
subsystem (ALSA)'s management of timers. A user with access to sound
devices could use this to cause a denial-of-service (crash or hang)
or possibly for privilege escalation.

CVE-2016-2549

Dmitry Vyukov found a potential deadlock in the sound subsystem
(ALSA)'s use of high resolution timers. A user with access to sound
devices could use this to cause a denial-of-service (hang).

CVE-2016-2550

The original mitigation of CVE-2013-4312, limiting the total number
of files a user could queue on local sockets, was flawed. A user
given a local socket opened by another user, for example through the
systemd socket activation mechanism, could make use of the other
user's quota, again leading to a denial-of-service (resource
exhaustion). This is fixed by accounting queued files to the sender
rather than the socket opener.

For the oldstable distribution (wheezy), these problems have been fixed
in version 3.2.73-2+deb7u3. The oldstable distribution (wheezy) is not
affected by CVE-2015-8830.

For the stable distribution (jessie), these problems have been fixed in
version 3.16.7-ckt20-1+deb8u4. CVE-2015-7566, CVE-2015-8767 and
CVE-2016-0723 were already fixed in DSA-3448-1. CVE-2016-0774 does not
affect the stable distribution.

We recommend that you upgrade your linux packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/