Import Debian changes 1.6.9-2+deb8u8

Import Debian changes 1.6.9-2+deb8u8

openafs (1.6.9-2+deb8u8) jessie-security; urgency=high

  * Non-maintainer upload by the LTS team.
  * Fix CVE-2018-16947:
    The backup tape controller process accepts incoming RPCs but does not
    require (or allow for) authentication of those RPCs. Handling those RPCs
    results in operations being performed with administrator credentials,
    including dumping/restoring volume contents and manipulating the backup
    database.
  * Fix CVE-2018-16948:
    Several RPC server routines did not fully initialize their output variables
    before returning, leaking memory contents from both the stack and the heap.
    Because the OpenAFS cache manager functions as an Rx server for the AFSCB
    service, clients are also susceptible to information leakage.
  * Fix CVE-2018-16949:
    Several data types used as RPC input variables were implemented as
    unbounded array types, limited only by the inherent 32-bit length field to
    4GB. An unauthenticated attacker could send, or claim to send, large input
    values and consume server resources waiting for those inputs, denying
    service to other valid connections.