Security fixes

• Upgrade to Linux 4.7. (Closes: #11885, #11818)
• Upgrade to Tor 0.2.8.9. (Closes: #11832, #11891)
• Upgrade Tor Browser to 6.0.6 based on Firefox 45.5. (Closes: #11910)
• Upgrade Icedove to 1:45.4.0-1~deb8u1+zerotracepen1. (Closes: #11854,

  11860)

• Upgrade imagemagick to 8:6.8.9.9-5+deb8u5.
• Upgrade openssl to 1.0.1t-1+deb8u5.
• Upgrade libarchive to 3.1.2-11+deb8u3.
• Upgrade bind9 to 1:9.9.5.dfsg-9+deb8u8.
• Upgrade libav to 6:11.8-1~deb8u1.
• Upgrade ghostscript to 9.06~dfsg-2+deb8u3.
• Upgrade c-ares to 1.10.0-2+deb8u1.
• Upgrade nspr to 2:4.12-1+debu8u1.
• Upgrade nss to 2:3.26-1+debu8u1.
• Upgrade tar to 1.27.1-2+deb8u1.
• Upgrade curl to 7.38.0-4+deb8u5.
• Upgrade libgd3 to 2.1.0-5+deb8u7.
• Upgrade opendjk-7 to 7u111-2.6.7-2~deb8u1.
• Upgrade mat to 0.5.2-3+deb8u1.
• Upgrade libxslt to 1.1.28-2+deb8u2.
• Upgrade pillow to 2.6.1-2+deb8u3.

• Minor improvements

  • Ship Let's encrypt intermediate certificate to prepare the
    the next certificate renewal of our website. Also unify the
    way our upgrades and security checkers verify this SSL
    certificate using our dedicated perl lib code. (Closes: #11810)

• Bugfixes

  • Fix multiarch support in Synaptic. (Closes: #11820)
  • Set default spelling language to en_US in Icedove. (Closes: #11037)

• Build system

  • Disable debootstrap merged-usr option. (Closes: #11903)

• Test suite

  • Add test for incremental upgrades. (Closes: #6309)
  • Add tests for Icedove. (Closes: #6304)
  • Decrease timeout to Zero Trace Pen Greeter to speed up testing of branches
    where it is broken. (Closes: #11449)
  • Add a ID field to the remote shell responses to filter out
    unrelated ones. (Closes: #11846)
  • Reliabily wait for the Greeter PostLogin script. (Closes: #5666)
  • Reliabily type the kernel command line in the prompt at the boot
    menu to ensure the remote shell is started. (Closes: #10777)
  • Remove DVDROM device when not used, to workaround QEMU/Libvirt
    compatibility issue. (Closes: #11874)