From e59dd171743e46a9d9123c3b57139b38a516dabc Mon Sep 17 00:00:00 2001 From: David Michael Date: Sun, 11 Dec 2016 17:23:41 -0800 Subject: [PATCH] bump(metadata/glsa): sync with upstream --- .../metadata/glsa/glsa-201612-20.xml | 52 +++++++++++++ .../metadata/glsa/glsa-201612-21.xml | 55 ++++++++++++++ .../metadata/glsa/glsa-201612-22.xml | 51 +++++++++++++ .../metadata/glsa/glsa-201612-23.xml | 56 ++++++++++++++ .../metadata/glsa/glsa-201612-24.xml | 60 +++++++++++++++ .../metadata/glsa/glsa-201612-25.xml | 54 +++++++++++++ .../metadata/glsa/glsa-201612-26.xml | 61 +++++++++++++++ .../metadata/glsa/glsa-201612-27.xml | 75 +++++++++++++++++++ .../metadata/glsa/glsa-201612-28.xml | 46 ++++++++++++ .../metadata/glsa/glsa-201612-29.xml | 51 +++++++++++++ .../metadata/glsa/glsa-201612-30.xml | 54 +++++++++++++ .../metadata/glsa/glsa-201612-31.xml | 53 +++++++++++++ .../metadata/glsa/timestamp.chk | 2 +- 13 files changed, 669 insertions(+), 1 deletion(-) create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-20.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-21.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-22.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-23.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-24.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-25.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-26.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-27.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-28.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-29.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-30.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-31.xml diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-20.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-20.xml new file mode 100644 index 0000000000..cc31888da5 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-20.xml @@ -0,0 +1,52 @@ + + + + jq: Buffer overflow + A buffer overflow in jq might allow remote attackers to execute + arbitrary code. + + jq + December 08, 2016 + December 08, 2016: 1 + 580606 + remote + + + 1.5-r2 + 1.5-r2 + + + +

jq is a lightweight and flexible command-line JSON processor.

+ + +

An off-by-one error was discovered in the tokenadd function in + jv_parse.c which triggers a heap-based buffer overflow. +

+ + +

A remote attacker could trick a victim into processing a specially + crafted JSON file, possibly resulting in the execution of arbitrary code + with the privileges of the process. Additionally, a remote attacker + could cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All jq users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-misc/jq-1.5-r2" + + + + + CVE-2015-8863 + + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-21.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-21.xml new file mode 100644 index 0000000000..1e5603e1a4 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-21.xml @@ -0,0 +1,55 @@ + + + + SQLite: Multiple vulnerabilities + Multiple vulnerabilities were found in SQLite, the worst of which + may allow execution of arbitrary code. + + sqlite + December 08, 2016 + December 08, 2016: 1 + 549258 + 574420 + remote + + + 3.11.1 + 3.11.1 + + + +

SQLite is a C library that implements an SQL database engine.

+ + +

Multiple vulnerabilities have been discovered in SQLite. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All sqlite users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/sqlite-3.11.1" + + + + + + CVE-2015-7036 + + + Two invalid read errors / heap overflows in SQLite (TFPA 006/2015) + + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-22.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-22.xml new file mode 100644 index 0000000000..b0c9f471fa --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-22.xml @@ -0,0 +1,51 @@ + + + + Coreutils: Arbitrary code execution + A vulnerability in Coreutils could lead to the execution of + arbitrary code or a Denial of Service condition. + + coreutils + December 08, 2016 + December 08, 2016: 1 + 530514 + local, remote + + + 8.23 + 8.23 + + + +

The GNU Core Utilities are the basic file, shell and text manipulation + utilities of the GNU operating system. +

+ + +

A memory corruption flaw in GNU Coreutils’ parse_datetime function was + reported. Applications using parse_datetime(), such as touch or date, may + accepted untrusted input. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Coreutils users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/coreutils-8.23" + + + + CVE-2014-9471 + + b-man + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-23.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-23.xml new file mode 100644 index 0000000000..aba9f4d1e4 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-23.xml @@ -0,0 +1,56 @@ + + + + socat: Multiple vulnerabilities + Multiple vulnerabilities have been found in socat, the worst of + which may allow execution of arbitrary code. + + socat + December 08, 2016 + December 08, 2016: 1 + 573602 + remote + + + 1.7.3.1 + 1.7.3.1 + + + +

socat is a multipurpose bidirectional relay, similar to netcat.

+ + +

Multiple vulnerabilities have been discovered in socat. Please review + the references below for details. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, or obtain confidential information. +

+ + +

There is no known workaround at this time.

+ + +

All socat users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/socat-1.7.3.1" + + + + + CVE-2016-2217 + + + Socat security advisory 7 + + + Socat security advisory 8 + + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-24.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-24.xml new file mode 100644 index 0000000000..04ef17ed62 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-24.xml @@ -0,0 +1,60 @@ + + + + Binutils: Multiple vulnerabilities + Multiple vulnerabilities were found in Binutils, the worst of which + may allow execution of arbitrary code. + + binutils + December 08, 2016 + December 08, 2016: 1 + 526626 + local, remote + + + 2.25 + 2.25 + + + +

The GNU Binutils are a collection of tools to create, modify and analyse + binary files. Many of the files use BFD, the Binary File Descriptor + library, to do low-level manipulation. +

+ + +

Multiple vulnerabilities have been discovered in Binutils. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could entice a user to open a specially crafted file, + possibly resulting in execution of arbitrary code with the privileges of + the process, cause a Denial of Service condition, or overwrite arbitrary + files. +

+ + +

There is no known workaround at this time.

+ + +

All Binutils users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-devel/binutils-2.25" + + + + CVE-2014-8484 + CVE-2014-8485 + CVE-2014-8501 + CVE-2014-8502 + CVE-2014-8503 + CVE-2014-8504 + CVE-2014-8737 + CVE-2014-8738 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-25.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-25.xml new file mode 100644 index 0000000000..72a1e6bee7 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-25.xml @@ -0,0 +1,54 @@ + + + + CrackLib: Buffer overflow + A vulnerability in CrackLib could lead to the execution of + arbitrary code. + + cracklib + December 08, 2016 + December 08, 2016: 1 + 591456 + local + + + 2.9.6-r1 + 2.9.6-r1 + + + +

CrackLib is a library used to enforce strong passwords by comparing user + selected passwords to words in chosen word lists. +

+ + +

A stack-based buffer overflow was discovered in the FascistGecosUser + function of lib/fascist.c. +

+ + +

A local attacker could set a specially crafted GECOS field value in + “/etc/passwd”; possibly resulting in the execution of arbitrary code + with the privileges of the process, a Denial of Service condition, or the + escalation of privileges. +

+ + +

There is no known workaround at this time.

+ + +

All CrackLib users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-libs/cracklib-2.9.6-r1" + + + + CVE-2016-6318 + + + BlueKnight + + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-26.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-26.xml new file mode 100644 index 0000000000..29273b9b9f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-26.xml @@ -0,0 +1,61 @@ + + + + OpenJPEG: Multiple vulnerabilities + Multiple vulnerabilities have been found in OpenJPEG, the worst of + which may allow execution of arbitrary code. + + openjpeg + December 08, 2016 + December 08, 2016: 1 + 560632 + 572430 + 577608 + 594740 + remote + + + 2.1.1_p20160922 + 1.5.2 + 2.1.1_p20160922 + + + +

OpenJPEG is an open-source JPEG 2000 library.

+ + +

Multiple vulnerabilities have been discovered in OpenJPEG. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could entice a user to open a specially crafted JPEG + file, possibly resulting in execution of arbitrary code or a Denial of + Service condition. Furthermore, a remote attacker may be able to obtain + sensitive information. +

+ + +

There is no known workaround at this time.

+ + +

All OpenJPEG 2 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=media-libs/openjpeg-2.1.1_p20160922:2" + + + + CVE-2015-8871 + CVE-2016-1923 + CVE-2016-1924 + CVE-2016-3181 + CVE-2016-3182 + CVE-2016-3183 + CVE-2016-7445 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-27.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-27.xml new file mode 100644 index 0000000000..f4fd7f646d --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-27.xml @@ -0,0 +1,75 @@ + + + + VirtualBox: Multiple vulnerabilities + Multiple vulnerabilities have been found in VirtualBox, the worst + of which allows local users to escalate privileges. + + virtualbox + December 11, 2016 + December 11, 2016: 2 + 505274 + 537218 + 550964 + local + + + 4.3.28 + 4.3.28 + + + 4.3.28 + 4.3.28 + + + +

VirtualBox is a powerful virtualization product from Oracle.

+ + +

Multiple vulnerabilities have been discovered in VirtualBox. Please + review the CVE identifiers referenced below for details. +

+ + +

Local attackers could cause a Denial of Service condition, execute + arbitrary code, or escalate their privileges. +

+ + +

There is no known workaround at this time.

+ + +

All VirtualBox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/virtualbox-4.3.28" + + +

All VirtualBox-bin users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=app-emulation/virtualbox-bin-4.3.28" + + + + CVE-2014-0981 + CVE-2014-0983 + CVE-2014-6588 + CVE-2014-6589 + CVE-2014-6590 + CVE-2014-6595 + CVE-2015-0377 + CVE-2015-0418 + CVE-2015-0427 + CVE-2015-3456 + CVE-2016-5608 + CVE-2016-5610 + CVE-2016-5611 + CVE-2016-5613 + + whissi + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-28.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-28.xml new file mode 100644 index 0000000000..6b944e4c30 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-28.xml @@ -0,0 +1,46 @@ + + + + Docker: Privilege escalation + A vulnerability in Docker could lead to the escalation of + privileges. + + + December 11, 2016 + December 11, 2016: 1 + 581236 + remote + + + 1.11.0 + 1.11.0 + + + +

Docker is the world’s leading software containerization platform.

+ + +

Docker does not properly distinguish between numeric UIDs and string + usernames. +

+ + +

Local attackers could possibly escalate their privileges.

+ + +

There is no known workaround at this time.

+ + +

All Docker users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/docker-1.11.0" + + + + CVE-2016-3697 + + b-man + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-29.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-29.xml new file mode 100644 index 0000000000..a5f95961fb --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-29.xml @@ -0,0 +1,51 @@ + + + + libmms: Remote execution of arbitrary code + A heap-based buffer overflow vulnerability in libmms might allow + remote attackers to execute arbitrary code. + + libmms + December 11, 2016 + December 11, 2016: 1 + 507822 + remote + + + 0.6.4 + 0.6.4 + + + +

libmms is a library for downloading (streaming) media files using the + mmst and mmsh protocols. +

+ + +

A heap-based buffer overflow was discovered in the get_answer function + within mmsh.c of libmms. +

+ + +

A remote attacker might send a specially crafted MMS over HTTP (MMSH) + response, possibly resulting in the remote execution of arbitrary code + with the privileges of the process. +

+ + +

There is no known workaround at this time.

+ + +

All libmms users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/libmms-0.6.4" + + + + CVE-2014-2892 + + b-man + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-30.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-30.xml new file mode 100644 index 0000000000..f64bf35d55 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-30.xml @@ -0,0 +1,54 @@ + + + + SoX: User-assisted execution of arbitrary code + Multiple heap overflows in SoX may allow remote attackers to + execute arbitrary code. + + sox + December 11, 2016 + December 11, 2016: 1 + 533296 + remote + + + 14.4.2 + 14.4.2 + + + +

SoX is a command line utility that can convert various formats of + computer audio files in to other formats. +

+ + +

A heap-based buffer overflow can be triggered when processing a + malicious NIST Sphere or WAV audio file. +

+ + +

A remote attacker could coerce the victim to run SoX against their + malicious file. This may be leveraged by an attacker to gain control of + program execution with the privileges of the user. +

+ + +

There is no known workaround at this time.

+ + +

All SoX users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-sound/sox-14.4.2" + + + + + + CVE-2014-8145 + + + whissi + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-31.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-31.xml new file mode 100644 index 0000000000..3328cc0df4 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-31.xml @@ -0,0 +1,53 @@ + + + + exFAT: Multiple vulnerabilities + Two vulnerabilities have been found in exFAT allowing remote + attackers to execute arbitrary code or cause Denial of Service. + + + December 12, 2016 + December 12, 2016: 1 + 563936 + remote + + + 1.2.1 + 1.2.1 + + + +

A full-featured exFAT file system implementation for Unix-like systems.

+ + +

Two vulnerabilities were found in exFAT. A malformed input can cause a + write heap overflow or cause an endless loop. +

+ + +

Remote attackers could execute arbitrary code or cause Denial of + Service. +

+ + +

There is no known workaround at this time.

+ + +

All exFAT users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-fs/exfat-utils-1.2.1" + + + + CVE-2015-8026 + + Heap overflow and endless loop in exfatfsck / exfat-utils + + + + BlueKnight + + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk index 92f073798b..09cda85a2c 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Wed, 07 Dec 2016 18:13:28 +0000 +Mon, 12 Dec 2016 00:43:15 +0000