Hot answers tagged

81

How brave do you feel? It's safest to make a fresh install on a new SD card. The braver way I'd use is: Backup any files which are important to you. With your new or existing install. sudo apt-get update sudo apt-get upgrade sudo apt-get dist-upgrade to make sure wheezy is fully up to date. Edit /etc/apt/sources.list and change wheezy to jessie. There ...


62

Instead of a manual cron, you can install unattended-upgrades, which is useful to ensure the latest kernels are installed. It's mostly designed for security. apt-get install unattended-upgrades There are some bits that can be adjusted/configured, but the default is fine.


61

According to ARM themselves, the processor cores used in all models before the Pi 4 are not vulnerable. The majority of Arm processors are not impacted by any variation of this side-channel speculation mechanism. A definitive list of the small subset of Arm-designed processors that are susceptible can be found below. [see link for the table] The ...


39

I hope this may help others in the next time: Basically, an upgrade works like this: adjusting the sources to "jessie" update the package lists and upgrade the packages adjusting the sources You can either simply replace every "wheezy" in /etc/apt/sources.list (and /etc/apt/sources.list.d/*) with "jessie" Or you use sed to do the work for you: sudo sed -...


28

In its default configuration, unattended-upgrades is broken in Raspbian Buster. It won't install crucial updates for the kernel and other software. Your options are: Recommended Option: Install and fix unattended-upgrades: sudo apt install unattended-upgrades echo 'Unattended-Upgrade::Origins-Pattern { // Fix missing Rasbian sources. "origin=...


27

The core affected package is libssl1.0.0, which if you can, just replace with the patched version, restart everything. You can try to download a binary, and manually install an arm-hf, using dpkg with the version 1.0.1e-2+deb7u5 for wheezy. You can also use the jessie repository, just for this single one time update, which should get you version 1.0.1g-1. ...


25

raspbian package repo contains raspberrypi-bootloader package which contains firmware, kernel and kernel modules that rpi-update downloads. The version is not the latest, but files should be fine and stable. Now it shows a 20130902 version, so it's about 2 months old. The package is installed by default and is updated when a new version arrives in repo. So ...


22

The Pi (all versions) is not vulnerable. Spectre and Meltdown both require out-of-order execution. The Cortex-A7 used in the early Pi 2 and the Cortex A53 used in the later Pi 2 and the Pi 3 is a strictly in-order architecture. The ARM11 used in the Pi 1 is partially out-of-order, but not in a way that permits Spectre or Meltdown to work. ARM confirms ...


21

This vulnerability can be trivially tested: To test whether your version of sudo is vulnerable, the following command can be used: sudoedit -s / A vulnerable version of sudo will either prompt for a password or display an error similar to: sudoedit: /: not a regular file A patched version of sudo will simply display a usage statement, for example: ...


20

Why? Just because it takes a while for distributions to integrate new versions. Here's what I did to install Python 3.8.5 on my rpi: sudo apt-get install -y build-essential tk-dev libncurses5-dev \ libncursesw5-dev libreadline6-dev libdb5.3-dev libgdbm-dev libsqlite3-dev \ libssl-dev libbz2-dev libexpat1-dev liblzma-dev zlib1g-dev libffi-dev version=3.8.5 ...


20

While there are exceptions, generally stable releases of Linux distros backport important security fixes rather than packaging new upstream versions. They do this because the new upstream versions usually contain unrelated changes and every additional change brings more risk of regressions. Unfortunately in most cases (again there are exceptions), the output ...


15

Yes, your Pis are vulnerable until the patched versions of the Debian packages are available for Raspbian. Edit: The patched versions are now available for Raspbian.


13

To update your system to latest versions of the userland software you need to run the update before the upgrade - the update actually downloads the new package listings so that upgrade can go get them and install them (as explained in Debian Linux documentation): sudo apt-get update sudo apt-get upgrade Furthermore you may need to run a dist-upgrade to ...


12

Meanwhile the kernel is part of the raspberrypi-kernel-package in Raspbian. So rpi-update is not needed anymore to update the kernel. There are two kernels in the package, that means it works on every hardware-version of the Pi (ARMv6, ARMv7 and ARMv8 Just use this fancy one-liner to keep your Pi up-to-date: apt-get update && apt-get dist-upgrade ...


12

The most important lines are: "origin=Raspbian,codename=${distro_codename},label=Raspbian"; "origin=Raspberry Pi Foundation,codename=${distro_codename},label=Raspberry Pi Foundation"; Here is the entire file (/etc/apt/apt.conf.d/50unattended-upgrades): // Unattended-Upgrade::Origins-Pattern controls which packages are // upgraded. // // Lines below have ...


10

The answer marked as correct is in fact outdated, and in a problematic way: rpi-update will update the firmware to the latest published version, which has to be considered "not stable". So following the recipe given you might end up with an unstable system (has happened to me ;) ).


10

It seems Python 3.4 is still in beta, and there is no package prepared for it yet. If youstill want python 3.4, you should download it and build it from source. You can find it here: https://www.python.org/downloads/release/python-340/ Download the source tar ball. The build instructions should be in there.


10

To have all the time the most recent Oracle java installed, you can do check current Java pi@raspberrypi:~ $ java -version java version "1.8.0_65" Java(TM) SE Runtime Environment (build 1.8.0_65-b17) Java HotSpot(TM) Client VM (build 25.65-b01, mixed mode) remove OpenJDK sudo apt-get purge openjdk* add digital key sudo apt-key adv --recv-key --...


10

I'd like to offer my different take on this. About Meltdown, it's a very specific vulnerability in some processors, so if ARM says the CPU in Raspberry Pi is not vulnerable, then it can probably be trusted. However, Spectre is a more general vulnerability. So far, only two variants have been demonstrated but I'm pretty sure there are more variants. The ...


9

Can I use it somehow? Maybe -- you can try. Edit /etc/apt/sources.list.d/sources.list and add a line: deb http://archive.raspbian.org/raspbian/ jessie main Then run apt-get update. This may take a few minutes. Searching for the package should now show it, and you can try apt-get install [whatever]. You may have to pull in further substantial updates ...


9

As far as I am aware collabora is still using wheezy based software, it has not been upgraded to jessie. If you want to use that repository change its entry back to wheezy from jessie.


8

You can install and configure cron-apt. Install it by doing the following: apt-get install cron-apt the main configuration file is /etc/cron-apt/config One thing I add to my configuration is: MAILON="always" this will send an email every time it runs, not only if it encounters an error. Note that the default setup will not automatically install the ...


7

Go to [ https://github.com/Hexxeh/rpi-firmware/commits/master ] and find the commit key for the version you want. Then use the following command will update to the last version. sudo rpi-update 81355451bcd9a214fdf221ca322b6ca681d8da55


7

Just an addition for users that could land here looking for the upgrade procedure, like me! On the official Raspberry Pi website the update from Wheezy to Jessie is discouraged. Instead they recommend to make a clean Jessie install. From https://www.raspberrypi.org/blog/raspbian-jessie-is-here/: Starting with a clean image is the recommended way to move ...


7

It's important to clarify something about Raspbian for people who aren't otherwise aware: Raspbian is Debian, a GNU/Linux distribution that's been around for ~20 years and is currently on its 8th major release, nicknamed "Jessie". This is why the first Raspbian release is numbered 7 and not 1. The software packages, excluding the firmware, tweaked kernel and ...


7

The package that provides the Wi-Fi firmware is called firmware-brcm80211. To downgrade this package to a version that works: sudo apt-get install firmware-brcm80211=0.43+rpi5 To prevent this package from being upgraded (either before an upgrade to stretch, or after downgrading the firmware): sudo apt-mark hold firmware-brcm80211


7

I assume you are using Raspbian. It could be that your installation lists are broken. I suggest to reinitialize them by editing sources.list and raspi.list. By default they look like this: rpi ~$ cat /etc/apt/sources.list deb http://raspbian.raspberrypi.org/raspbian/ stretch main contrib non-free rpi # Uncomment line below then 'apt-get update' to enable '...


Only top voted, non community-wiki answers of a minimum length are eligible