Debian 8.7 released

PackageReasonarkStop crashing on exit when being used solely as a KPartasteriskFix security issue due to non-printable ASCII chars treated as whitespace [CVE-2016-9938]asusedUse created fields instead of changed, in line with changes to source database-filesChange /etc/debian_version to 8.7bashFix arbitrary code execution via malicious hostname [CVE-2016-0634] and specially crafted SHELLOPTS+PS4 variables allows command substitution [CVE-2016-7543]ca-certificatesUpdate Mozilla certificate authority bundle to version 2.9; postinst: run update-certificates without hooks to initially populate /etc/ssl/certscairoFix DoS via using SVG to generate invalid pointers [CVE-2016-9082]ccache[amd64] Rebuild in a clean environmentcephFix short CORS request issue [CVE-2016-9579], mon DoS [CVE-2016-5009], anonymous read on ACL [CVE-2016-7031], RGW DoS [CVE-2016-8626]chirpDisable reporting of telemetry by defaultcyrus-imapd-2.4Fix LIST GROUP supportdarktableFix integer overflow in ljpeg_start() [CVE-2015-3885]dbusFix potential format string vulnerability; dbus.prerm: ensure that dbus.socket is stopped before removaldebian-edu-docUpdate Debian Edu Jessie manual from the wiki; fix (da|nl) Jessie manual PO files to get the PDF manuals built; translation updatesdebian-edu-installUpdate version number to 8+edu1debian-installerRebuild for the point releasedebian-installer-netboot-imagesRebuild for the point releaseduckFix loading of code from untrusted location [CVE-2016-1239]e2fsprogsRebuild against dietlibc 0.33~cvs20120325-6+deb8u1, to pick up included security fixesebook-speakerFix hint about installing html2text to read html fileselogFix posting entry as arbitrary username [CVE-2016-6342]evolution-data-serverFix premature drop of connection with reduced TCP window sizes and resulting loss of dataexim4Fix GnuTLS memory leakfileFix memory leak in magic loaderganeti-instance-debootstrapFix losetup invocations by replacing -s with --showglibcDo not unconditionally use the fsqrt instruction on 64-bit PowerPC CPUs; fix a regression introduced by cvs-resolv-ipv6-nameservers.diff in hesiod; disable lock elision (aka Intel TSX) on x86 architecturesglusterfsQuota: Fix could not start auxiliary mount issuegnutls28Fix incorrect certificate validation when using OCSP responses [GNUTLS-SA-2016-3 / CVE-2016-7444]; ensure compatibility with CVE-2016-6489-patched nettlehplipUse full gpg key fingerprint when fetching key from keyservers [CVE-2015-0839]ieee-dataDisable monthly update cron jobintel-microcodeUpdate microcodeirssiFix information exposure issue via buf.pl and /upgrade [CVE-2016-7553]; fix NULL pointer dereference in the nickcmp function [CVE-2017-5193], use-after-free when receiving invalid nick message [CVE-2017-5194] and out-of-bounds read in certain incomplete control codes [CVE-2017-5195]isenkramDownload firmware using curl; use HTTPS when downloading modaliases; change mirror from http.debian.net to httpredir.debian.orgjqFix heap buffer overflow [CVE-2015-8863] and stack exhaustion [CVE-2016-4074]libclamunrarFix out-of-band accesslibdatetime-timezone-perlUpdate to 2016h; update included data to 2016i; update to 2016j; update to 2016glibfcgi-perlFix numerous connections cause segfault DoS [CVE-2012-6687]libio-socket-ssl-perlFix issue with incorrect unreadable SSL_key_file error when using filesystem ACLslibmateweatherSwitch from discontinued weather.noaa.gov to aviationweather.govlibphp-adodbFix XSS vulnerability [CVE-2016-4855] and SQL injection issue [CVE-2016-7405]libpngFix null pointer deference issue [CVE-2016-10087]libwmfFix allocating huge block of memory [CVE-2016-9011]linkcheckerFix HTTPS checkslinuxUpdate to stable 3.16.39; add chaoskey driver, backported from 4.8, support for n25q256a11 SPI flash device; security,perf: Allow unprivileged use of perf_event_open to be disabled; several bug and security fixeslxcAttach: do not send procfd to attached process [CVE-2016-8649]; remount bind mounts if read-only flag is provided; fix Alpine Linux container creationmapserverFix FTBFS with php >= 5.6.25; fix information leak via error messages [CVE-2016-9839]mdadmAllow '--grow --continue' to successfully reshape an array when using backup space on a 'spare' devicemetarUpdate report URLminissdpdFix improper validation of array index vulnerability [CVE-2016-3178 CVE-2016-3179]monotoneChange the sigpipe test case to write 1M of test data to increase chances of overflowing the pipe buffermostFix shell injection attack when opening lzma-compressed files [CVE-2016-1253]mpg123Fix DoS with crafted ID3v2 tagsmuslFix integer overflow [CVE-2016-8859]nbdStop mixing global flags into the flags field that gets sent to the kernel, so that connecting to nbd-server >= 3.9 does not cause every export to be (incorrectly) marked as read-onlynettleProtect against potential side-channel attacks against exponentiation operations [CVE-2016-6489]nss-pam-ldapdHave init script stop action only return when nslcd has actually stoppednvidia-graphics-driversUpdate to new driver version, including security fixes [CVE-2016-8826 CVE-2016-7382 CVE-2016-7389]nvidia-graphics-drivers-legacy-304xxUpdate to new driver version, including security fixes [CVE-2016-8826 CVE-2016-7382 CVE-2016-7389]nvidia-graphics-modulesRebuild against nvidia-kernel-source 340.101openboxAdd libxcursor-dev build-dependency to fix loading of startup notifications; replace getgrent with getgroups so as not to enumerate all groups at startupopendkimFix relaxed canonicalization of folded headers, which broke signaturespamFix handling of loginuid in containerspgpdumpFix endless loop parsing specially crafted input in read_binary [CVE-2016-4021] and buffer overrun in read_radix64postgresql-9.4New upstream releasepostgresql-commonPg_upgradecluster: Properly upgrade databases with non-login role owners; pg_ctlcluster: Protect against symlink in /var/log/postgresql/ allowing the creation of arbitrary files elsewhere [CVE-2016-1255]potraceSecurity fixes [CVE-2016-8694 CVE-2016-8695 CVE-2016-8696 CVE-2016-8697 CVE-2016-8698 CVE-2016-8699 CVE-2016-8700 CVE-2016-8701 CVE-2016-8702 CVE-2016-8703]python-cryptoRaise a warning when IV is used with ECB or CTR and ignore the IV [CVE-2013-7459]python-werkzeugFix XSS issue in debuggerqtbase-opensource-srcPrevent bad-ptrs deref in QNetworkConfigurationManagerPrivate; fix X11 tray icons on some desktopsrawtherapeeFix buffer overflow in dcraw [CVE-2015-8366]redmineHandle dependency check failure when triggered, to avoid breaking in the middle of dist-upgrades; avoid opening database configuration that are not readablesambaFix client side SMB2/3 required signing can be downgraded [CVE-2016-2119], various regressions introduced by the 4.2.10 security fixes, segfault with clusteringsedEnsure consistent permissions with different umasksshutterFix insecure usage of system() [CVE-2015-0854]sniffitSecurity fix [CVE-2014-5439]suckless-toolsFix SEGV in slock when user's account has been disabled [CVE-2016-6866]sympaFix logrotate configuration so that sympa is not left in a confused state when systemd is usedsystemdDon't return any error in manager_dispatch_notify_fd() [CVE-2016-7796]; core: Rework logic to determine when we decide to add automatic deps for mounts; various ordering fixes for ifupdown; systemctl: Fix argument handling when invoked as shutdown; localed: tolerate absence of /etc/default/keyboard; systemctl, loginctl, etc.: Don't start polkit agent when running as rootteventNew upstream version, required for sambatreFix regex integer overflow in buffer size computations [CVE-2016-8859]tzdataUpdate included data to 2016h; update to 2016g; update to 2016j; update included data to 2016iunrtfFix buffer overflow in various cmd_ functions [CVE-2016-10091]w3mSeveral security fixes [CVE-2016-9430 CVE-2016-9434 CVE-2016-9438 CVE-2016-9440 CVE-2016-9441 CVE-2016-9423 CVE-2016-9431 CVE-2016-9424 CVE-2016-9432 CVE-2016-9433 CVE-2016-9437 CVE-2016-9422 CVE-2016-9435 CVE-2016-9436 CVE-2016-9426 CVE-2016-9425 CVE-2016-9428 CVE-2016-9442 CVE-2016-9443 CVE-2016-9429 CVE-2016-9621 CVE-2016-9439 CVE-2016-9622 CVE-2016-9623 CVE-2016-9624 CVE-2016-9625 CVE-2016-9626 CVE-2016-9627 CVE-2016-9628 CVE-2016-9629 CVE-2016-9631 CVE-2016-9630 CVE-2016-9632 CVE-2016-9633]wireless-regdbUpdate included datawotRemove plugin due to privacy issuesxwaxReplace ffmpeg with avconv from libav-toolszookeeperFix buffer overflow via the input command when using the cmd: batch mode syntax [CVE-2016-5017]