linux (3.13.0-133.182) trusty; urgency=low

  * linux: 3.13.0-133.182 -proposed tracker (LP: #1718159)

  [ Stefan Bader ]
  * CVE-2016-8633
    - firewire: net: guard against rx buffer overflows

  * CVE-2017-14106
    - tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0

 -- Juerg Haefliger <juerg.haefliger@canonical.com>  Tue, 19 Sep 2017 13:11:55 +0200

linux (3.13.0-132.181) trusty; urgency=low

  * linux: 3.13.0-132.181 -proposed tracker (LP: #1716634)

  * CVE-2017-1000251
    - Bluetooth: Properly check L2CAP config option output buffer length

 -- Juerg Haefliger <juerg.haefliger@canonical.com>  Wed, 13 Sep 2017 13:34:29 +0200

linux (3.13.0-131.180) trusty; urgency=low

  * linux: 3.13.0-131.180 -proposed tracker (LP: #1715439)

  * CVE-2016-7097
    - posix_acl: Clear SGID bit when setting file permissions

  * CVE-2016-9083
    - vfio/pci: Fix integer overflows, bitmask check

  * CVE-2016-9084
    - vfio/pci: Fix integer overflows, bitmask check

  * CVE-2016-9604
    - KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings

  * CVE-2016-9191
    - sysctl: Drop reference added by grab_header in proc_sys_readdir

  * CVE-2016-9178
    - fix minor infoleak in get_user_ex()

  * CVE-2016-8650
    - mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]

  * CVE-2016-10044
    - vfs: Commit to never having exectuables on proc and sysfs.
    - aio: mark AIO pseudo-fs noexec

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Thu, 07 Sep 2017 10:14:05 +0200

linux (3.13.0-130.179) trusty; urgency=low

  * linux: 3.13.0-130.179 -proposed tracker (LP: #1713456)

  * CVE-2016-10200
    - l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{, 6}_bind()

  * CVE-2016-9754
    - ring-buffer: Prevent overflow of size in ring_buffer_resize()

  * CVE-2017-5970
    - ipv4: keep skb->dst around in presence of IP options

  * CVE-2017-6346
    - packet: fix races in fanout_add()

  * CVE-2017-6214
    - tcp: avoid infinite loop in tcp_splice_read()

  * CVE-2017-6951
    - KEYS: Change the name of the dead type to ".dead" to prevent user access

  * CVE-2017-7472
    - KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings

  * CVE-2017-7187
    - scsi: sg: check length passed to SG_NEXT_CMD_LEN

  * CVE-2017-7541
    - brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()

  * sort ABI files with C.UTF-8 locale (LP: #1712345)
    - [Packaging] sort ABI files with C.UTF-8 locale

  * Please only recommend or suggest initramfs-tools | linux-initramfs-tool for
    kernels able to boot without initramfs (LP: #1700972)
    - [Debian] Don't depend on initramfs-tools

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Tue, 29 Aug 2017 17:04:34 +0200

linux (3.13.0-129.178) trusty; urgency=low

  * linux: 3.13.0-129.178 -proposed tracker (LP: #1709292)

  * CVE-2017-1000112
    - Revert "udp: consistently apply ufo or fragmentation"
    - udp: consistently apply ufo or fragmentation

  * CVE-2017-1000111
    - Revert "net-packet: fix race in packet_set_ring on PACKET_RESERVE"
    - packet: fix tp_reserve race in packet_set_ring

  * Adt tests of src:linux time out often on armhf lxc containers (LP: #1705495)
    - [Packaging] tests -- reduce rebuild test to one flavour

  * CVE-2016-7914
    - assoc_array: don't call compare_object() on a node

  * CVE-2017-7616
    - mm/mempolicy.c: fix error handling in set_mempolicy and mbind.

  * CVE-2017-7261
    - drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()

  * CVE-2017-7273
    - HID: hid-cypress: validate length of report

  * CVE-2017-7487
    - ipx: call ipxitf_put() in ioctl error path

  * CVE-2017-7495
    - ext4: fix data exposure after a crash

 -- Stefan Bader <stefan.bader@canonical.com>  Fri, 11 Aug 2017 14:01:56 +0200

linux (3.13.0-128.177) trusty; urgency=low

  * CVE-2017-1000112
    - ipv4: Should use consistent conditional judgement for ip fragment in
      __ip_append_data and ip_finish_output
    - ipv6: Don't use ufo handling on later transformed packets
    - ipv6: Should use consistent conditional judgement for ip6 fragment between
      __ip6_append_data and ip6_finish_output
    - udp: avoid ufo handling on IP payload compression packets
    - net: account for current skb length when deciding about UFO
    - udp: consistently apply ufo or fragmentation

  * CVE-2017-1000111
    - net-packet: fix race in packet_set_ring on PACKET_RESERVE

 -- Stefan Bader <stefan.bader@canonical.com>  Mon, 07 Aug 2017 14:20:13 +0200

linux (3.13.0-126.175) trusty; urgency=low

  * linux: 3.13.0-126.175 -proposed tracker (LP: #1704994)

  * CVE-2017-1000364
    - mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in the stack
    - mm/mmap.c: expand_downwards: don't require the gap if !vm_prev

  * CVE-2017-7482
    - rxrpc: Fix several cases where a padded len isn't checked in ticket decode

  * CVE-2017-1000365
    - fs/exec.c: account for argv/envp pointers

  * CVE-2016-8405
    - fbdev: color map copying bounds checking

  * CVE-2017-2618
    - selinux: fix off-by-one in setprocattr

  * update ENA driver to 1.2.0k from net-next (LP: #1701575)
    - lib: devres: add a helper function for ioremap_wc
    - net: ena: remove superfluous check in ena_remove()
    - net: ena: fix rare uncompleted admin command false alarm
    - net: ena: add missing return when ena_com_get_io_handlers() fails
    - net: ena: fix race condition between submit and completion admin command
    - net: ena: add missing unmap bars on device removal
    - net: ena: fix theoretical Rx hang on low memory systems
    - net: ena: disable admin msix while working in polling mode
    - net: ena: bug fix in lost tx packets detection mechanism
    - net: ena: update ena driver to version 1.1.7
    - net: ena: change return value for unsupported features unsupported return
      value
    - net: ena: add hardware hints capability to the driver
    - net: ena: change sizeof() argument to be the type pointer
    - net: ena: add reset reason for each device FLR
    - net: ena: add support for out of order rx buffers refill
    - net: ena: separate skb allocation to dedicated function
    - net: ena: use lower_32_bits()/upper_32_bits() to split dma address
    - net: ena: update driver's rx drop statistics
    - net: ena: update ena driver to version 1.2.0

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Thu, 20 Jul 2017 18:13:17 +0200

linux (3.13.0-125.174) trusty; urgency=low

  * linux: 3.13.0-125.174 -proposed tracker (LP: #1703396)

  * NULL pointer dereference triggered by openvswitch autopkg testcase
    (LP: #1703401)
    - Revert "rtnl/do_setlink(): notify when a netdev is modified"
    - Revert "rtnl/do_setlink(): last arg is now a set of flags"
    - Revert "rtnl/do_setlink(): set modified when IFLA_LINKMODE is updated"
    - Revert "rtnl/do_setlink(): set modified when IFLA_TXQLEN is updated"
    - Revert "rtnetlink: provide api for getting and setting slave info"

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Mon, 10 Jul 2017 13:02:31 -0300

linux (3.13.0-124.173) trusty; urgency=low

  * linux: 3.13.0-124.173 -proposed tracker (LP: #1701042)

  * CVE-2017-7895
    - nfsd: Remove assignments inside conditions
    - svcrdma: Do not add XDR padding to xdr_buf page vector
    - nfsd4: minor NFSv2/v3 write decoding cleanup
    - nfsd: stricter decoding of write-like NFSv2/v3 ops

  * CVE-2017-9605
    - drm/vmwgfx: Make sure backup_handle is always valid

  * CVE-2017-1000380
    - ALSA: timer: Fix race between read and ioctl
    - ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT

  * linux <3.18: netlink notification is missing when an interface is modified
    (LP: #1690094)
    - rtnetlink: provide api for getting and setting slave info
    - rtnl/do_setlink(): set modified when IFLA_TXQLEN is updated
    - rtnl/do_setlink(): set modified when IFLA_LINKMODE is updated
    - rtnl/do_setlink(): last arg is now a set of flags
    - rtnl/do_setlink(): notify when a netdev is modified

  * CVE-2015-8944
    - Make file credentials available to the seqfile interfaces
    - /proc/iomem: only expose physical resource addresses to privileged users

  * CVE-2016-10088
    - sg_write()/bsg_write() is not fit to be called under KERNEL_DS

  * CVE-2017-7346
    - drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()

  * CVE-2015-8966
    - arm: fix handling of F_OFD_... in oabi_fcntl64()

  * Missing IOTLB flush causes DMAR errors with SR-IOV (LP: #1697053)
    - iommu/vt-d: Fix missing IOTLB flush in intel_iommu_unmap()

  * CVE-2017-8924
    - USB: serial: io_ti: fix information leak in completion handler

  * CVE-2017-8925
    - USB: serial: omninet: fix reference leaks at open

  * CVE-2015-8967
    - arm64: make sys_call_table const

  * CVE-2015-8964
    - tty: Prevent ldisc drivers from re-using stale tty fields

  * CVE-2015-8955
    - arm64: perf: reject groups spanning multiple HW PMUs

  * CVE-2015-8962
    - sg: Fix double-free when drives detach during SG_IO

  * CVE-2015-8963
    - perf: Fix race in swevent hash

  * CVE-2017-9074
    - ipv6: Check ip6_find_1stfragopt() return value properly.

  * CVE-2014-9900
    - net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Thu, 29 Jun 2017 11:41:06 -0300

linux (3.13.0-123.172) trusty; urgency=low

  * linux: 3.13.0-123.172 -proposed tracker (LP: #1700558)

  * CVE-2017-1000364
    - Revert "UBUNTU: SAUCE: mm: Only expand stack if guard area is hit"
    - Revert "mm: do not collapse stack gap into THP"
    - Revert "mm: enlarge stack guard gap"
    - mm: vma_adjust: remove superfluous confusing update in remove_next == 1 case
    - mm: larger stack guard gap, between vmas
    - mm: fix new crash in unmapped_area_topdown()
    - Allow stack to grow up to address space limit

 -- Stefan Bader <stefan.bader@canonical.com>  Wed, 21 Jun 2017 11:39:15 +0200

# For older changelog entries, run 'apt-get changelog linux-tools-3.13.0-133'
