Uppdaterad Debian 10; 10.2 utgiven

16 november 2019

Debianprojektet presenterar stolt sin andra uppdatering till dess stabila utgåva Debian 10 (med kodnamnet buster). Denna punktutgåva lägger huvudsakligen till rättningar för säkerhetsproblem, tillsammans med ytterligare rättningar för allvarliga problem. Säkerhetsbulletiner har redan publicerats separat och refereras när de finns tillgängliga.

Vänligen notera att punktutgåvan inte innebär en ny version av Debian 10 utan endast uppdaterar några av de inkluderade paketen. Det behövs inte kastas bort gamla media av buster. Efter installationen kan paket uppgraderas till de aktuella versionerna genom att använda en uppdaterad Debianspegling..

Dom som frekvent installerar uppdateringar från security.debian.org kommer inte att behöva uppdatera många paket, och de flesta av sådana uppdateringar finns inkluderade i punktutgåvan.

Nya installationsavbildningar kommer snart att finnas tillgängliga på dom vanliga platserna.

En uppgradering av en existerande installation till denna revision kan utföras genom att peka pakethanteringssystemet på en av Debians många HTTP-speglingar. En utförlig lista på speglingar finns på:

https://www.debian.org/mirror/list

Blandade felrättningar

Denna uppdatering av den stabila utgåvan lägger till några viktiga felrättningar till följande paket:

Paket Orsak
aegisub Fix crash when selecting a language from the bottom of the Spell checker language list; fix crash when right-clicking in the subtitles text box
akonadi Fix various crashes / deadlock issues
base-files Update /etc/debian_version for the point release
capistrano Fix failure to remove old releases when there were too many
cron Stop using obsolete SELinux API
cyrus-imapd Fix data loss on upgrade from version 3.0.0 or earlier
debian-edu-config Handle newer Firefox ESR configuration files; add post-up stanza to /etc/network/interfaces eth0 entry conditionally
debian-installer Fix unreadable fonts on hidpi displays in netboot images booted with EFI
debian-installer-netboot-images Rebuild against proposed-updates
distro-info-data Add Ubuntu 20.04 LTS, Focal Fossa
dkimpy-milter New upstream stable release; fix sysvinit support; catch more ASCII encoding errors to improve resilience against bad data; fix message extraction so that signing in the same pass through the milter as verifying works correctly
emacs Update the EPLA packaging key
fence-agents Fix incomplete removal of fence_amt_ws
flatpak New upstream stable release
flightcrew Security fixes [CVE-2019-13032 CVE-2019-13241]
fonts-noto-cjk Fix over-aggressive font selection of Noto CJK fonts in modern web browsers under Chinese locale
freetype Properly handle phantom points for variable hinted fonts
gdb Rebuild against new libbabeltrace, with higher version number to avoid conflict with earlier upload
glib2.0 Ensure libdbus clients can authenticate with a GDBusServer like the one in ibus
gnome-shell New upstream stable release; fix truncation of long messages in Shell-modal dialogs; avoid crash on reallocation of dead actors
gnome-sound-recorder Fix crash when selecting a recording
gnustep-base Disable gdomap daemon that was accidentally enabled on upgrades from stretch
graphite-web Remove unused send_email function [CVE-2017-18638]; avoid hourly error in cron when there is no whisper database
inn2 Fix negotiation of DHE ciphersuites
libapache-mod-auth-kerb Fix use after free bug leading to crash
libdate-holidays-de-perl Mark International Childrens Day (Sep 20th) as a holiday in Thuringia from 2019 onwards
libdatetime-timezone-perl Update included data
libofx Fix null pointer dereference issue [CVE-2019-9656]
libreoffice Fix the postgresql driver with PostgreSQL 12
libsixel Fix several security issues [CVE-2018-19756 CVE-2018-19757 CVE-2018-19759 CVE-2018-19761 CVE-2018-19762 CVE-2018-19763 CVE-2019-3573 CVE-2019-3574]
libxslt Fix dangling pointer in xsltCopyText [CVE-2019-18197]
lucene-solr Disable obsolete call to ContextHandler in solr-jetty9.xml; fix Jetty permissions on SOLR index
mariadb-10.3 New upstream stable release
modsecurity-crs Fix PHP script upload rules [CVE-2019-13464]
mutter New upstream stable release
ncurses Fix several security issues [CVE-2019-17594 CVE-2019-17595] and other issues in tic
ndppd Avoid world writable PID file, that was breaking daemon init scripts
network-manager Fix file permissions for /var/lib/NetworkManager/secret_key and /var/lib/NetworkManager
node-fstream Fix arbitrary file overwrite issue [CVE-2019-13173]
node-set-value Fix prototype pollution [CVE-2019-10747]
node-yarnpkg Force using HTTPS for regular registries
nx-libs Fix regressions introduced in previous upload, affecting x2go
open-vm-tools Fix memory leaks and error handling
openvswitch Update debian/ifupdown.sh to allow setting-up the MTU; fix Python dependencies to use Python 3
picard Update translations to fix crash with Spanish locale
plasma-applet-redshift-control Fix manual mode when used with redshift versions above 1.12
postfix New upstream stable release; work around poor TCP loopback performance
python-cryptography Fix test suite failures when built against newer OpenSSL versions; fix a memory leak triggerable when parsing x509 certificate extensions like AIA
python-flask-rdf Add Depends on python{3,}-rdflib
python-oslo.messaging New upstream stable release; fix switch connection destination when a rabbitmq cluster node disappears
python-werkzeug Ensure Docker containers have unique debugger PINs [CVE-2019-14806]
python2.7 Fix several security issues [CVE-2018-20852 CVE-2019-10160 CVE-2019-16056 CVE-2019-16935 CVE-2019-9740 CVE-2019-9947]
quota Fix rpc.rquotad spinning at 100% CPU
rpcbind Allow remote calls to be enabled at run-time
shelldap Repair SASL authentications, add a 'sasluser' option
sogo Fix display of PGP-signed e-mails
spf-engine New upstream stable release; fix sysvinit support
standardskriver Fix deprecation warning from config.RawConfigParser; use external ip command rather than deprecated ifconfig command
swi-prolog Use HTTPS when contacting upstream pack servers
systemd core: never propagate reload failure to service result; fix sync_file_range failures in nspawn containers on arm, ppc; fix RootDirectory not working when used in combination with User; ensure that access controls on systemd-resolved's D-Bus interface are enforced correctly [CVE-2019-15718]; fix StopWhenUnneeded=true for mount units; make MountFlags=shared work again
tmpreaper Prevent breaking of systemd services that use PrivateTmp=true
trapperkeeper-webserver-jetty9-clojure Restore SSL compatibility with newer Jetty versions
tzdata New upstream release
ublock-origin New upstream version, compatible with Firefox ESR68
uim Resurrect libuim-data as a transitional package, fixing some issues after upgrades to buster
vanguards New upstream stable release; prevent a reload of tor's configuration via SIGHUP causing a denial-of-service for vanguards protections

Säkerhetsuppdateringar

Denna revision lägger till följande säkerhetsuppdateringar till den stabila utgåvan. Säkerhetsgruppen har redan släppt bulletiner för alla dessa uppdateringar:

Bulletin-ID Paket
DSA-4509 apache2
DSA-4511 nghttp2
DSA-4512 qemu
DSA-4514 varnish
DSA-4515 webkit2gtk
DSA-4516 firefox-esr
DSA-4517 exim4
DSA-4518 ghostscript
DSA-4519 libreoffice
DSA-4520 trafficserver
DSA-4521 docker.io
DSA-4523 thunderbird
DSA-4524 dino-im
DSA-4525 ibus
DSA-4526 opendmarc
DSA-4527 php7.3
DSA-4528 bird
DSA-4530 expat
DSA-4531 linux-signed-amd64
DSA-4531 linux-signed-i386
DSA-4531 linux
DSA-4531 linux-signed-arm64
DSA-4532 spip
DSA-4533 lemonldap-ng
DSA-4534 golang-1.11
DSA-4535 e2fsprogs
DSA-4536 exim4
DSA-4538 wpa
DSA-4539 openssl
DSA-4539 openssh
DSA-4541 libapreq2
DSA-4542 jackson-databind
DSA-4543 sudo
DSA-4544 unbound
DSA-4545 mediawiki
DSA-4547 tcpdump
DSA-4549 firefox-esr
DSA-4550 file
DSA-4551 golang-1.11
DSA-4553 php7.3
DSA-4554 ruby-loofah
DSA-4555 pam-python
DSA-4556 qtbase-opensource-src
DSA-4557 libarchive
DSA-4558 webkit2gtk
DSA-4559 proftpd-dfsg
DSA-4560 simplesamlphp
DSA-4561 fribidi
DSA-4562 chromium

Borttagna paket

Följande paket har tagits bort på grund av omständigheter utom vår kontroll:

Paket Orsak
firefox-esr [armel] No longer supportable due to nodejs build-dependency

Debianinstalleraren

Installeraren har uppdaterats för att inkludera rättningarna som har inkluderats i den stabila utgåvan med denna punktutgåva.

URLer

Den fullständiga listan på paket som har förändrats i denna revision:

http://ftp.debian.org/debian/dists/buster/ChangeLog

Den aktuella stabila utgåvan:

http://ftp.debian.org/debian/dists/stable/

Föreslagna uppdateringar till den stabila utgåvan:

http://ftp.debian.org/debian/dists/proposed-updates

Information om den stabila utgåvan (versionsfakta, kända problem osv.):

https://www.debian.org/releases/stable/

Säkerhetsbulletiner och information:

https://www.debian.org/security/

Om Debian

Debianprojektet är en grupp utvecklare av Fri mjukvara som donerar sin tid och kraft för att producera det helt fria operativsystemet Debian.

Kontaktinformation

För ytterligare information, vänligen besök Debians webbplats på https://www.debian.org/, skicka e-post till <press@debian.org>, eller kontakta gruppen för stabila utgåvor på <debian-release@lists.debian.org>.