Debian 9 更新：9.2 发布

2017年10月07日

Debian 项目很高兴地宣布 Debian 9 稳定版本的第二次更新（代号 stretch）。此次小版本更新主要添加了对安全问题的修正补丁，以及为一些严重问题所作的调整。安全建议已单独发布，并会在适当的情况下予以引用。

请注意，此更新并不是 Debian 9 的新版本，其仅更新了所包含的一些软件包。没有必要丢弃旧的 stretch 的安装介质。在安装之后，只需使用最新的 Debian 镜像更新旧的软件包即可。

经常从 security.debian.org 安装更新的用户将不必更新许多软件包，因本更新中包含了 security.debian.org 的大多数更新。

新的安装镜像即将于常规的位置予以提供。

通过将软件包管理系统指向 Debian 的许多 HTTP 镜像站点之一，您可以将已有的系统升级至本次更新版本。详尽的镜像列表可以在以下网址处获得：

https://www.debian.org/mirror/list

这次小版本更新有一个特殊之处，即使用 apt-get 工具进行升级的用户需要确保使用 dist-upgrade 命令升级以得到最新的内核软件包。使用其它工具，例如apt 或 aptitude 工具的用户则应使用 upgrade 命令。

杂项错误修正

由于准备小版本更新时的疏忽，通常应当同时进行的对 base-files 软件包的更新（用于从文件上体现新版本版本号）不幸未能包含至本次发布中。该包的更新即将通过 stretch-updates 源发布并提供给用户使用。

此稳定版更新为以下软件包添加了一些重要的修正：

软件包	原因
apt	修复了 apt-daily-upgrade 中的一个问题；修复了镜像方法中一个可能的崩溃情况
at-spi2-core	修正了切换窗口时的崩溃
bareos	修复了升级时 bareos-dir logrotate 配置的权限问题；修复了使用 SHA1 签名时的文件破坏问题
bind9	导入 DNSSEC KSK-2017 支持
bridge-utils	修复了某些 vlan 界面无法创建的问题
caja	修复了加载背景图像时使用大量 CPU 的问题
chrony	不要将“burst”命令传至 chronyc
cross-gcc	修复了对 gcc 6.3.0-18 的过时支持
cvxopt	删除了不必要又无法工作的对 lpx_main() 的兼容层
db5.3	在 db_home 未设置时，不要访问 DB_CONFIG [CVE-2017-10140]
dbus	新上游稳定版发布版本
debian-edu-doc	Merge stretch related documentation and translation updates; update Debian Edu Stretch manual from the wiki; replace existing boot menu screenshots with recent ones from the wiki
debian-installer	将 Linux 内核 ABI 升至 4
debian-installer-netboot-images	针对 proposed-updates 源做重构建
desktop-base	Fix XML syntax errors in gnome wallpaper description files making Joy wallpapers unavailable by default; ensure postinst doesn’t fail on upgrade even when an incomplete theme pack is active
dns-root-data	将 root.hints 更新至 2017072601 版本；将 KSK-2017 的状态设置为有效（VALID）
dnsdist	安全修复 [CVE-2016-7069 CVE-2017-7557]
dnsviz	拣选上游与 root.hints 和 root.keys 相关的修正
dose3	Fix versioned provides support - packages that provide the same virtual package in different versions, or that provide the same versioned virtual package as a real package, are co-installable
ecl	添加对 libffi-dev 的缺失的依赖关系
erlang-p1-tls	修正 ECDH 曲线
evolution	Fix hang on right click in composer window
expect	Properly check for EOF, to avoid losing input
fife	修正内存泄漏
flatpak	New upstream stable release; prevent deploying files with inappropriate permissions; restore compatibility with libostree 2017.7
freerdp	启用 TLS >= 1.1 支持
gnome-exe-thumbnailer	Switch to msitools' msiinfo for ProductVersion fetching, replacing the insecure VBScript-based parsing [CVE-2017-11421]; fix unreadable white-on-white text on version labels
gnupg2	Fix dirmngr issues with broken reverse DNS, assertion when using tofu-default-policy ask, multiple issues with scdaemon, avoid spurious warnings when sharing a keybox with gpg >= 2.1.20
gnutls28	Fix OCSP verification errors, especially with ECDSA signatures
gosa-plugin-mailaddress	Fix parent constructor calls, for compatibility with PHP7
gsoap	Fix integer overflow via large XML document [CVE-2017-9765]
haveged	Start haveged.service after systemd-tmpfiles-setup.service has been run
ipsec-tools	安全修正 [CVE-2016-10396]
irssi	修复空指针解引用问题 [CVE-2017-10965]，nicklist 释放后使用的问题 [CVE-2017-10966]
kanatest	Remove DISABLE_DEPRECATED flags, they cause implicit pointer conversion and thus a segmentation fault on startup
kdepim	Fix send Later with Delay bypasses OpenPGP [CVE-2017-9604]
kf5-messagelib	Fix send Later with Delay bypasses OpenPGP [CVE-2017-9604]
krb5	Fix security issue where remote authenticated attackers can crash the KDC [CVE-2017-11368]; fix startup if getaddrinfo() returns a wildcard v6 address and handling of explicitly specified v4 wildcard address; fix SRV lookups to respect udp_preference_limit
lava-tool	添加原先缺失的对 python-simplejson 的依赖关系
librsb	Fix a few severe bugs leading to numerically wrong results
libselinux	Rebuild with new sbuild to fix changelog date
libsolv	修复对 Python 3 模块的依赖问题
libwpd	修复拒绝服务问题 [CVE-2017-14226]
linux	新上游稳定发布版本
linux-latest	更新至 4.9.0-4
lzma	Rebuild with new sbuild to fix changelog date
mailman	修正 contrib/SpamAssassin.py 中的破损依赖关系
mate-power-manager	在接到 DBus 信号名称未知时不要中止运行
mate-themes	Fix font colour of URL bar in Google Chrome
mate-tweak	添加缺失的对 python3-gi 的依赖关系
ncurses	Fix various crash bugs in the tic library and the tic binary [CVE-2017-10684 CVE-2017-10685 CVE-2017-11112 CVE-2017-11113 CVE-2017-13728 CVE-2017-13729 CVE-2017-13730 CVE-2017-13731 CVE-2017-13732 CVE-2017-13734 CVE-2017-13733]
nettle	Rebuild with new sbuild to fix changelog date
node-brace-expansion	Fix regular expression denial of service issue
node-dateformat	Set TZ=UTC for tests to fix build failure
ntp	构建并安装 /usr/bin/sntp
nvidia-graphics-drivers	New upstream long lived branch release 375.82 - security fixes [CVE-2017-6257 CVE-2017-6259], add support for the following GPUs: GeForce GTX 1080 with Max-Q Design, GeForce GTX 1070 with Max-Q Design, GeForce GTX 1060 with Max-Q Design; nvidia-kernel-dkms: Honor parallel setting from dkms
open-vm-tools	Randomly generate temporary directory name [CVE-2015-5191]
opendkim	Start as root and drop privileges in opendkim for proper key file ownership
openldap	Relax the dependency of libldap-2.4-2 on libldap-common to also permit later versions; fix upgrade failure when olcSuffix contains a backslash; avoid reading the value of the LDAP_OPT_X_TLS_REQUIRE_CERT option from previously freed memory; fix potential endless replication loop in a multi-master delta-syncrepl scenario with 3 or more nodes; fix memory corruption caused by calling sasl_client_init() multiple times and possibly concurrently
openvpn	Fix broken reconnects due to wrong push digest calculation
osinfo-db	更新发行版信息
pcb-rnd	Fix execution of code via a maliciously formed design file
postfix	New upstream stable version - send single character variable names to milters without {}; prevent MIME downgrade of Postfix-generated message/delivery status; work around Berkeley DB attempting to read settings from DB_CONFIG file
python-pampy	修复对 Python 3 模块的依赖问题
request-tracker4	Fix regression in previous security release where incorrect SHA256 passwords could trigger an error
ruby-gnome2	ruby-{gdk3,gtksourceview2,pango,poppler}: Add missing dependencies
samba	Ensure SMB signing enforced [CVE-2017-12150]; keep required encryption across SMB3 DFS redirects [CVE-2017-12151]; fix server memory information leak over SMB1 [CVE-2017-12163]; new upstream release; fix libpam-winbind.prerm to be multiarch-safe; add missing logrotate for /var/log/samba/log.samba; fix outdated DNS Root servers; fix Non-kerberos logins fails on winbind 4.X when krb5_auth is configured in PAM
smplayer	修复与 YouTube 的连接问题
speech-dispatcher	使 spd-conf 重新工作
suricata	Limit the number of recursive calls in the DER/ASN.1 decoder to avoid stack overflows
swift	新上游稳定发布版本
tbdialout	Include leading plus symbol when using tel: URI scheme
tiny-initramfs	添加先前缺失的对 cpio 的依赖关系
topal	Fix misuse of sed character class syntax
torsocks	Fix check_addr() to return either 0 or 1
trace-cmd	修复在处理特定 trace 文件时段错误的问题
unbound	Fix install of trust anchor when two anchors are present; depend on dns-root-data (>= 2017072601~) for KSK-2017
unknown-horizons	修正内存泄漏
up-imapproxy	修正 systemd 服务文件
vim	修复数个崩溃 / 非法内存访问问题 [CVE-2017-11109]
waagent	新上游发布版本，提供了对 Azure Stack 的支持
webkit2gtk	上游安全和错误修正发布版本 [CVE-2017-2538 CVE-2017-7052 CVE-2017-7018 CVE-2017-7030 CVE-2017-7034 CVE-2017-7037 CVE-2017-7039 CVE-2017-7046 CVE-2017-7048 CVE-2017-7055 CVE-2017-7056 CVE-2017-7061 CVE-2017-7064]
whois	Fix whois referrals for .com, .net, .jobs, .bz, .cc and .tv; add several new Indian TLD servers; update the list of gTLDs
wrk	修复构建失败问题
xfonts-ayu	修复生成粗体和斜体字体时原先存在的问题
xkeyboard-config	Move Indic layouts back to the main layout list, enabling their use again
yadm	Fix race condition which could allow access to private PGP and SSH keys [CVE-2017-11353]

安全更新

此修订版本将以下安全更新添加到了稳定发行版本中。安全团队已经分别为这些更新发布了通告：

通告编号	软件包
DSA-3881	firefox-esr
DSA-3898	expat
DSA-3904	bind9
DSA-3909	samba
DSA-3913	apache2
DSA-3914	imagemagick
DSA-3915	ruby-mixlib-archive
DSA-3916	atril
DSA-3917	catdoc
DSA-3919	openjdk-8
DSA-3920	qemu
DSA-3921	enigmail
DSA-3923	freerdp
DSA-3924	varnish
DSA-3925	qemu
DSA-3926	chromium-browser
DSA-3927	linux
DSA-3928	firefox-esr
DSA-3929	libsoup2.4
DSA-3930	freeradius
DSA-3931	ruby-rack-cors
DSA-3932	subversion
DSA-3934	git
DSA-3936	postgresql-9.6
DSA-3938	libgd2
DSA-3940	cvs
DSA-3941	iortcw
DSA-3942	supervisor
DSA-3946	libmspack
DSA-3947	newsbeuter
DSA-3948	ioquake3
DSA-3949	augeas
DSA-3950	libraw
DSA-3952	libxml2
DSA-3953	aodh
DSA-3955	mariadb-10.1
DSA-3956	connman
DSA-3957	ffmpeg
DSA-3958	fontforge
DSA-3959	libgcrypt20
DSA-3961	libgd2
DSA-3962	strongswan
DSA-3963	mercurial
DSA-3964	asterisk
DSA-3965	file
DSA-3966	ruby2.3
DSA-3967	mbedtls
DSA-3968	icedove
DSA-3969	xen
DSA-3970	emacs24
DSA-3971	tcpdump
DSA-3972	bluez
DSA-3973	wordpress-shibboleth
DSA-3974	tomcat8
DSA-3975	emacs25
DSA-3976	freexl
DSA-3977	newsbeuter
DSA-3978	gdk-pixbuf
DSA-3979	pyjwt
DSA-3980	apache2
DSA-3982	perl
DSA-3984	git
DSA-3985	chromium-browser
DSA-3986	ghostscript
DSA-3987	firefox-esr
DSA-3988	libidn2-0