linux (4.9.30-2+deb9u3) stretch-security; urgency=high

linux (4.9.30-2+deb9u3) stretch-security; urgency=high

  * [x86] drm/vmwgfx: limit the number of mip levels in
    vmw_gb_surface_define_ioctl() (CVE-2017-7346)
  * rxrpc: Fix several cases where a padded len isn't checked in ticket decode
    (CVE-2017-7482)
  * brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()
    (CVE-2017-7541)
  * ipv6: avoid overflow of offset in ip6_find_1stfragopt (CVE-2017-7542)
  * [x86] drm/vmwgfx: Make sure backup_handle is always valid (CVE-2017-9605)
  * drm/virtio: don't leak bo on drm_gem_object_init failure (CVE-2017-10810)
  * xen-blkback: don't leak stack data via response ring (CVE-2017-10911)
  * mqueue: fix a use-after-free in sys_mq_notify() (CVE-2017-11176)
  * fs/exec.c: account for argv/envp pointers (CVE-2017-1000365)
  * dentry name snapshots (CVE-2017-7533)

[dgit import unpatched linux 4.9.30-2+deb9u3]