[DLA 378-1] linux-2.6 security update

Package        : linux-2.6
Version        : 2.6.32-48squeeze18
CVE ID         : CVE-2015-7550 CVE-2015-8543 CVE-2015-8575
Debian Bug     : #808293

This update fixes the CVEs described below.

CVE-2015-7550

    Dmitry Vyukov discovered a race condition in the keyring subsystem
    that allows a local user to cause a denial of service (crash).

CVE-2015-8543

    It was discovered that a local user permitted to create raw sockets
    could cause a denial-of-service by specifying an invalid protocol
    number for the socket. The attacker must have the CAP_NET_RAW
    capability.

CVE-2015-8575

    David Miller discovered a flaw in the Bluetooth SCO sockets
    implementation that leads to an information leak to local users.

In addition, this update fixes a regression in the previous update:

#808293

    A regression in the UDP implementation prevented freeradius and
    some other applications from receiving data.

For the oldoldstable distribution (squeeze), these problems have been
fixed in version 2.6.32-48squeeze18.

For the oldstable distribution (wheezy), these problems have been
fixed in version 3.2.73-2+deb7u2.

For the stable distribution (jessie), these problems have been fixed
in version 3.16.7-ckt20-1+deb8u2 or earlier.

[DSA 3434-1] linux security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3434-1 security@debian.org
https://www.debian.org/security/ Ben Hutchings
January 05, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : linux
CVE ID : CVE-2015-7513 CVE-2015-7550 CVE-2015-8543 CVE-2015-8550
CVE-2015-8551 CVE-2015-8552 CVE-2015-8569 CVE-2015-8575
CVE-2015-8709
Debian Bug : 808293 808602 808953 808973

Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leak.

CVE-2015-7513

It was discovered that a local user permitted to use the x86 KVM
subsystem could configure the PIT emulation to cause a denial of
service (crash).

CVE-2015-7550

Dmitry Vyukov discovered a race condition in the keyring subsystem
that allows a local user to cause a denial of service (crash).

CVE-2015-8543

It was discovered that a local user permitted to create raw sockets
could cause a denial-of-service by specifying an invalid protocol
number for the socket. The attacker must have the CAP_NET_RAW
capability.

CVE-2015-8550

Felix Wilhelm of ERNW discovered that the Xen PV backend drivers
may read critical data from shared memory multiple times. This
flaw can be used by a guest kernel to cause a denial of service
(crash) on the host, or possibly for privilege escalation.

CVE-2015-8551 / CVE-2015-8552

Konrad Rzeszutek Wilk of Oracle discovered that the Xen PCI
backend driver does not adequately validate the device state when
a guest configures MSIs. This flaw can be used by a guest kernel
to cause a denial of service (crash or disk space exhaustion) on
the host.

CVE-2015-8569

Dmitry Vyukov discovered a flaw in the PPTP sockets implementation
that leads to an information leak to local users.

CVE-2015-8575

David Miller discovered a flaw in the Bluetooth SCO sockets
implementation that leads to an information leak to local users.

CVE-2015-8709

Jann Horn discovered a flaw in the permission checks for use of
the ptrace feature. A local user who has the CAP_SYS_PTRACE
capability within their own user namespace could use this flaw for
privilege escalation if a more privileged process ever enters that
user namespace. This affects at least the LXC system.

In addition, this update fixes some regressions in the previous update:

#808293

A regression in the UDP implementation prevented freeradius and
some other applications from receiving data.

#808602 / #808953

A regression in the USB XHCI driver prevented use of some devices
in USB 3 SuperSpeed ports.

#808973

A fix to the radeon driver interacted with an existing bug to
cause a crash at boot when using some AMD/ATI graphics cards.
This issue only affects wheezy.

For the oldstable distribution (wheezy), these problems have been fixed
in version 3.2.73-2+deb7u2. The oldstable distribution (wheezy) is not
affected by CVE-2015-8709.

For the stable distribution (jessie), these problems have been fixed in
version 3.16.7-ckt20-1+deb8u2. CVE-2015-8543 was already fixed in
version 3.16.7-ckt20-1+deb8u1.

For the unstable distribution (sid), these problems have been fixed in
version 4.3.3-3 or earlier.

We recommend that you upgrade your linux packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[DSA 3435-1] git security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3435-1 security@debian.org
https://www.debian.org/security/ Laszlo Boszormenyi (GCS)
January 05, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : git
CVE ID : CVE-2015-7545

Blake Burkhart discovered that the Git git-remote-ext helper incorrectly
handled recursive clones of git repositories. A remote attacker could
possibly use this issue to execute arbitary code by injecting commands
via crafted URLs.

For the oldstable distribution (wheezy), this problem has been fixed
in version 1:1.7.10.4-1+wheezy2.

For the stable distribution (jessie), this problem has been fixed in
version 1:2.1.4-2.1+deb8u1.

For the testing distribution (stretch), this problem has been fixed
in version 1:2.6.1-1.

For the unstable distribution (sid), this problem has been fixed in
version 1:2.6.1-1.

We recommend that you upgrade your git packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/