Debian 9 更新：9.2 發佈

2017年10月07日

Debian 項目很高興地宣佈 Debian 9 穩定版本的第二次更新（代號 stretch）。此次小版本更新主要添加了對安全問題的修正補丁，以及為一些嚴重問題所作的調整。安全建議已單獨發佈，並會在適當的情況下予以引用。

請注意，此更新並不是 Debian 9 的新版本，其僅更新了所包含的一些套件。沒有必要丟棄舊的 stretch 的安裝介質。在安裝之後，只需使用最新的 Debian 映射站台更新舊的套件即可。

經常從 security.debian.org 安裝更新的使用者將不必更新許多套件，因本更新中包含了 security.debian.org 的大多數更新。

新的安裝映射站台即將於常規的位置予以提供。

透過將套件管理系統指向 Debian 的許多 HTTP 映射站台之一，您可以將已有的系統升級至本次更新版本。詳盡的映射站台列表可以在以下網址處獲得：

https://www.debian.org/mirror/list

這次小版本更新有一個特殊之處，即使用 apt-get 工具進行升級的使用者需要確保使用 dist-upgrade 命令升級以得到最新的核心套件。使用其它工具，例如apt 或 aptitude 工具的使用者則應使用 upgrade 命令。

雜項錯誤修正

由於準備小版本更新時的疏忽，通常應當同時進行的對 base-files 套件的更新（用於從文件上體現新版本版本號）不幸未能包含至本次發佈中。該包的更新即將經由 stretch-updates 源發佈並提供給使用者使用。

此穩定版更新為以下套件添加了一些重要的修正：

套件	原因
apt	修復了 apt-daily-upgrade 中的一個問題；修復了映射站台方法中一個可能的崩潰情況
at-spi2-core	修正了切換視窗時的崩潰
bareos	修復了升級時 bareos-dir logrotate 配置的權限問題；修復了使用 SHA1 簽名時的文件破壞問題
bind9	導入 DNSSEC KSK-2017 支持
bridge-utils	修復了某些 vlan 介面無法創建的問題
caja	修復了加載背景圖像時使用大量 CPU 的問題
chrony	不要將“burst”命令傳至 chronyc
cross-gcc	修復了對 gcc 6.3.0-18 的過時支持
cvxopt	移除了不必要又無法工作的對 lpx_main() 的兼容層
db5.3	在 db_home 未設置時，不要訪問 DB_CONFIG [CVE-2017-10140]
dbus	新上游穩定版發佈版本
debian-edu-doc	Merge stretch related documentation and translation updates; update Debian Edu Stretch manual from the wiki; replace existing boot menu screenshots with recent ones from the wiki
debian-installer	將 Linux 核心 ABI 升至 4
debian-installer-netboot-images	針對 proposed-updates 源做重構建
desktop-base	Fix XML syntax errors in gnome wallpaper description files making Joy wallpapers unavailable by default; ensure postinst doesn’t fail on upgrade even when an incomplete theme pack is active
dns-root-data	將 root.hints 更新至 2017072601 版本；將 KSK-2017 的狀態設置為有效（VALID）
dnsdist	安全修復 [CVE-2016-7069 CVE-2017-7557]
dnsviz	揀選上游與 root.hints 和 root.keys 相關的修正
dose3	Fix versioned provides support - packages that provide the same virtual package in different versions, or that provide the same versioned virtual package as a real package, are co-installable
ecl	添加對 libffi-dev 的缺失的依賴關係
erlang-p1-tls	修正 ECDH 曲線
evolution	Fix hang on right click in composer window
expect	Properly check for EOF, to avoid losing input
fife	修正記憶體洩漏
flatpak	New upstream stable release; prevent deploying files with inappropriate permissions; restore compatibility with libostree 2017.7
freerdp	啟用 TLS >= 1.1 支持
gnome-exe-thumbnailer	Switch to msitools' msiinfo for ProductVersion fetching, replacing the insecure VBScript-based parsing [CVE-2017-11421]; fix unreadable white-on-white text on version labels
gnupg2	Fix dirmngr issues with broken reverse DNS, assertion when using tofu-default-policy ask, multiple issues with scdaemon, avoid spurious warnings when sharing a keybox with gpg >= 2.1.20
gnutls28	Fix OCSP verification errors, especially with ECDSA signatures
gosa-plugin-mailaddress	Fix parent constructor calls, for compatibility with PHP7
gsoap	Fix integer overflow via large XML document [CVE-2017-9765]
haveged	Start haveged.service after systemd-tmpfiles-setup.service has been run
ipsec-tools	安全修正 [CVE-2016-10396]
irssi	修復空指針解引用問題 [CVE-2017-10965]，nicklist 釋放後使用的問題 [CVE-2017-10966]
kanatest	Remove DISABLE_DEPRECATED flags, they cause implicit pointer conversion and thus a segmentation fault on startup
kdepim	Fix send Later with Delay bypasses OpenPGP [CVE-2017-9604]
kf5-messagelib	Fix send Later with Delay bypasses OpenPGP [CVE-2017-9604]
krb5	Fix security issue where remote authenticated attackers can crash the KDC [CVE-2017-11368]; fix startup if getaddrinfo() returns a wildcard v6 address and handling of explicitly specified v4 wildcard address; fix SRV lookups to respect udp_preference_limit
lava-tool	添加原先缺失的對 python-simplejson 的依賴關係
librsb	Fix a few severe bugs leading to numerically wrong results
libselinux	Rebuild with new sbuild to fix changelog date
libsolv	修復對 Python 3 模塊的依賴問題
libwpd	修復拒絕服務問題 [CVE-2017-14226]
linux	新上游穩定發佈版本
linux-latest	更新至 4.9.0-4
lzma	Rebuild with new sbuild to fix changelog date
mailman	修正 contrib/SpamAssassin.py 中的破損依賴關係
mate-power-manager	在接到 DBus 信號名稱未知時不要中止運行
mate-themes	Fix font colour of URL bar in Google Chrome
mate-tweak	添加缺失的對 python3-gi 的依賴關係
ncurses	Fix various crash bugs in the tic library and the tic binary [CVE-2017-10684 CVE-2017-10685 CVE-2017-11112 CVE-2017-11113 CVE-2017-13728 CVE-2017-13729 CVE-2017-13730 CVE-2017-13731 CVE-2017-13732 CVE-2017-13734 CVE-2017-13733]
nettle	Rebuild with new sbuild to fix changelog date
node-brace-expansion	Fix regular expression denial of service issue
node-dateformat	Set TZ=UTC for tests to fix build failure
ntp	構建並安裝 /usr/bin/sntp
nvidia-graphics-drivers	New upstream long lived branch release 375.82 - security fixes [CVE-2017-6257 CVE-2017-6259], add support for the following GPUs: GeForce GTX 1080 with Max-Q Design, GeForce GTX 1070 with Max-Q Design, GeForce GTX 1060 with Max-Q Design; nvidia-kernel-dkms: Honor parallel setting from dkms
open-vm-tools	Randomly generate temporary directory name [CVE-2015-5191]
opendkim	Start as root and drop privileges in opendkim for proper key file ownership
openldap	Relax the dependency of libldap-2.4-2 on libldap-common to also permit later versions; fix upgrade failure when olcSuffix contains a backslash; avoid reading the value of the LDAP_OPT_X_TLS_REQUIRE_CERT option from previously freed memory; fix potential endless replication loop in a multi-master delta-syncrepl scenario with 3 or more nodes; fix memory corruption caused by calling sasl_client_init() multiple times and possibly concurrently
openvpn	Fix broken reconnects due to wrong push digest calculation
osinfo-db	更新發行版信息
pcb-rnd	Fix execution of code via a maliciously formed design file
postfix	New upstream stable version - send single character variable names to milters without {}; prevent MIME downgrade of Postfix-generated message/delivery status; work around Berkeley DB attempting to read settings from DB_CONFIG file
python-pampy	修復對 Python 3 模塊的依賴問題
request-tracker4	Fix regression in previous security release where incorrect SHA256 passwords could trigger an error
ruby-gnome2	ruby-{gdk3,gtksourceview2,pango,poppler}: Add missing dependencies
samba	Ensure SMB signing enforced [CVE-2017-12150]; keep required encryption across SMB3 DFS redirects [CVE-2017-12151]; fix server memory information leak over SMB1 [CVE-2017-12163]; new upstream release; fix libpam-winbind.prerm to be multiarch-safe; add missing logrotate for /var/log/samba/log.samba; fix outdated DNS Root servers; fix Non-kerberos logins fails on winbind 4.X when krb5_auth is configured in PAM
smplayer	修復與 YouTube 的連接問題
speech-dispatcher	使 spd-conf 重新工作
suricata	Limit the number of recursive calls in the DER/ASN.1 decoder to avoid stack overflows
swift	新上游穩定發佈版本
tbdialout	Include leading plus symbol when using tel: URI scheme
tiny-initramfs	添加先前缺失的對 cpio 的依賴關係
topal	Fix misuse of sed character class syntax
torsocks	Fix check_addr() to return either 0 or 1
trace-cmd	修復在處理特定 trace 文件時段錯誤的問題
unbound	Fix install of trust anchor when two anchors are present; depend on dns-root-data (>= 2017072601~) for KSK-2017
unknown-horizons	修正記憶體洩漏
up-imapproxy	修正 systemd 服務文件
vim	修復數個崩潰 / 非法記憶體訪問問題 [CVE-2017-11109]
waagent	新上游發佈版本，提供了對 Azure Stack 的支持
webkit2gtk	上游安全和錯誤修正發佈版本 [CVE-2017-2538 CVE-2017-7052 CVE-2017-7018 CVE-2017-7030 CVE-2017-7034 CVE-2017-7037 CVE-2017-7039 CVE-2017-7046 CVE-2017-7048 CVE-2017-7055 CVE-2017-7056 CVE-2017-7061 CVE-2017-7064]
whois	Fix whois referrals for .com, .net, .jobs, .bz, .cc and .tv; add several new Indian TLD servers; update the list of gTLDs
wrk	修復構建失敗問題
xfonts-ayu	修復生成粗體和斜體字型時原先存在的問題
xkeyboard-config	Move Indic layouts back to the main layout list, enabling their use again
yadm	Fix race condition which could allow access to private PGP and SSH keys [CVE-2017-11353]

安全更新

此修訂版本將以下安全更新添加到了穩定發行版本中。安全團隊已經分別為這些更新發布了通告：

通告編號	套件
DSA-3881	firefox-esr
DSA-3898	expat
DSA-3904	bind9
DSA-3909	samba
DSA-3913	apache2
DSA-3914	imagemagick
DSA-3915	ruby-mixlib-archive
DSA-3916	atril
DSA-3917	catdoc
DSA-3919	openjdk-8
DSA-3920	qemu
DSA-3921	enigmail
DSA-3923	freerdp
DSA-3924	varnish
DSA-3925	qemu
DSA-3926	chromium-browser
DSA-3927	linux
DSA-3928	firefox-esr
DSA-3929	libsoup2.4
DSA-3930	freeradius
DSA-3931	ruby-rack-cors
DSA-3932	subversion
DSA-3934	git
DSA-3936	postgresql-9.6
DSA-3938	libgd2
DSA-3940	cvs
DSA-3941	iortcw
DSA-3942	supervisor
DSA-3946	libmspack
DSA-3947	newsbeuter
DSA-3948	ioquake3
DSA-3949	augeas
DSA-3950	libraw
DSA-3952	libxml2
DSA-3953	aodh
DSA-3955	mariadb-10.1
DSA-3956	connman
DSA-3957	ffmpeg
DSA-3958	fontforge
DSA-3959	libgcrypt20
DSA-3961	libgd2
DSA-3962	strongswan
DSA-3963	mercurial
DSA-3964	asterisk
DSA-3965	file
DSA-3966	ruby2.3
DSA-3967	mbedtls
DSA-3968	icedove
DSA-3969	xen
DSA-3970	emacs24
DSA-3971	tcpdump
DSA-3972	bluez
DSA-3973	wordpress-shibboleth
DSA-3974	tomcat8
DSA-3975	emacs25
DSA-3976	freexl
DSA-3977	newsbeuter
DSA-3978	gdk-pixbuf
DSA-3979	pyjwt
DSA-3980	apache2
DSA-3982	perl
DSA-3984	git
DSA-3985	chromium-browser
DSA-3986	ghostscript
DSA-3987	firefox-esr
DSA-3988	libidn2-0