diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest index 3a2c80d1dd..f02dac4a2f 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest @@ -1,23 +1,23 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 -MANIFEST Manifest.files.gz 423767 BLAKE2B b4b02eedb610a1c6d9e2d0e9f57f61c0c0ddafb48679b275cd19d127faac6f1d44d72cf4d204e2e99bbdadfb9d1e296ea33c63e12cff5af0207e2e6247914ff9 SHA512 ba2fcf04666f32bf8235a27f099dd883ab13109b872e9d00eac03e3e02b976470b0d5a6f1b3ce76acd9005d909e8b6e04ffdfefb9cce629ec213bbe88eb4d8b4 -TIMESTAMP 2018-05-16T20:08:33Z +MANIFEST Manifest.files.gz 425353 BLAKE2B ec410f73e8160a04f1e8d9ba24f8a9a7403de8d80de422b45237ee3d29412684c7b01eb6c65076d2a0e39e2a5a031fa3a30e25eaf8291e44c92b9e9e62cb3412 SHA512 f41e2315afb547d2663e7d73d1c71ddccb41cbcb981f32843e47a742285e23731f0c982f66fc7df7697259b315666ee38e690923c6014e4574c7d7496b96947a +TIMESTAMP 2018-06-02T01:38:31Z -----BEGIN PGP SIGNATURE----- -iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlr8j8JfFIAAAAAALgAo +iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlsR9RdfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY -klBLhA//RVNgrZDx/5ZGvC+E2NFZhybIh6MHFsCzYZjlm4GH1owjNTBz9Pb4qBmx -I+Nmb9OW6GV+ZBIHG3xaVFeswQD+q4rFObbyF1Yxw/pDaAi3Bmlm6B4vMENcXYTK -9d1QtaE5ronANqnq1tcA/+cHxJSTTqNoTzWPiyfv/mtajuhdI0z+7zTin8+CEELH -SRXJDXjpStwVZbKNP6OrNk7zluuerY86mgAqVMrV2ZIQ0FnEYC3M69Y7U5lccFrc -KxLpqZWNLhBYzrvP+aNdfpPSVrMJhPBnPOYvOm3Q+kP4iiwMuYKWEfgjn0GfepMi -nHY5HUCZAxyB+kl5oHLAe8QL1yU8YfBjcfC9j3ZL25+M2/+WoZwaUNyOpwa5xx0t -8grQY7Sz3/pHE5XIttn7yvRUt2R2kMIukkhY99GNEI0TzDVjZfIoxR9vquV6i7vM -XGL9pGAEW91FSG9ZOeZ8Kb56DePEj7GY/d7lHPnAa10KBWN8YH4j0L+aBCbNiBLM -ugnK9r0C4X5n0/kbPY+5OLP5bdP3RWxjl5aO0BHpx1jFAd0LJgyyAPYMlBC21cva -3eaQjvLmdYab6zpIjJ3eg4Iwk96rgCddwRwWio5nZn50kKF2dnavndMzQIzNp+un -iK7AonyV5Z+E8dgVF1dZd/QX6WecMObMZ50fAa/3zXDuYK+Ce54= -=rOnb +klDiVQ/9Hynr5LjtFvhMkIAi1jYrkkehZsySmuf6AHTf9nzsQAzijTJMzYMpS+Mi +Cd7Vl91YaL6+pd42/X7G+0QPoJpWsNlo+uzRnbfBHpGURF4BIVQq3v6fDV6tm3ue +osQh9goeu40hQUj0XT3YI4filYi1WCm0jrUFcXl+Y2Pk97v6/qo4jtS/jzu+au9m +QKAWpIU43CUYEoiYb4Ll31UN2qwrCmSGGM66iHXenVr6u8uf4Ztco3kO/7iUTJT6 +waB+dJQc4tqgDLPpW/GUgrPyArxTXk7jv4ecMhbARByDc/mHwjq8VaGdsWns4fRt +42w8DzGjoKxUO2dFKH7s0VVfI4FGSKF9g6hEDjpbmiYA1kD0zKz0sTmsikl20UuT +DAalneB6x5c+mH/LEfTw8gM1XfEjj1LbKzMVK9OJuyf1Tv0ONmSbhhHPiLvBJ1oa +qpGgPQ7wC6zX4A939k/mCOFmbJiuQAMMduHNOwDBh9KKfPTE+3myhlRRVTpCrKMh +Ipq+FH7TB9RnQv+xS8d/fP8LBU7wiPfpZWbvP/31HZa+nKBesqWo0wEXcQmctF9B +CsJTVCgyNN8prp5B2u7kix7/hOM/ToCSsaXYakEoMGeXFrJhtGE6mz0CE6m66xgq +v5LGX3XyY7vZhto6aKzbnzPrlswgDViv+5cH+7n341f62FKe8mw= +=lhbu -----END PGP SIGNATURE----- diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz index 595bc6ad9a..863cd62f2c 100644 Binary files a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz and b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz differ diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-06.xml new file mode 100644 index 0000000000..41200abbfd --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-06.xml @@ -0,0 +1,74 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in privilege escalation. + + chromium, chrome + 2018-05-20 + 2018-05-20 + 655720 + local, remote + + + 66.0.3359.170 + 66.0.3359.170 + + + 66.0.3359.170 + 66.0.3359.170 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+
+ +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the referenced CVE identifiers and Google Chrome + Releases for details. +

+
+ +

A remote attacker, by enticing a user to install malicious extensions, + could possibly escalate privileges, cause a Denial of Service condition, + or have other unspecified impacts. +

+
+ +

There is no known workaround at this time.

+
+ +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-66.0.3359.170" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-66.0.3359.170" + +
+ + CVE-2018-6120 + CVE-2018-6121 + CVE-2018-6122 + + Google Chrome Release 20180510 + + + chrisadr + chrisadr +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-07.xml new file mode 100644 index 0000000000..f57a6fb9d6 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-07.xml @@ -0,0 +1,57 @@ + + + + Samba: Multiple vulnerabilities + Multiple vulnerabilities have been found in Samba, the worst of + which may allow remote execution of arbitrary code. + + samba + 2018-05-22 + 2018-05-22 + 588262 + 619516 + 639024 + 650382 + remote + + + 4.5.16 + 4.5.16 + + + +

Samba is a suite of SMB and CIFS client/server programs.

+
+ +

Multiple vulnerabilities have been discovered in Samba. Please review + the CVE identifiers referenced below for details. +

+
+ +

A remote attacker could possibly execute arbitrary code, cause a Denial + of Service condition, conduct a man-in-the-middle attack, or obtain + sensitive information. +

+
+ +

There is no known workaround at this time.

+
+ +

All Samba users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-fs/samba-4.5.16" + +
+ + CVE-2016-2119 + CVE-2017-14746 + CVE-2017-15275 + CVE-2017-7494 + CVE-2018-1050 + CVE-2018-1057 + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-08.xml new file mode 100644 index 0000000000..5b8b529355 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-08.xml @@ -0,0 +1,70 @@ + + + + VirtualBox: Multiple vulnerabilities + Multiple vulnerabilities have been found in VirtualBox, the worst + of which could allow an attacker to take control of VirtualBox. + + virtualbox + 2018-05-22 + 2018-05-22 + 655186 + remote + + + 5.1.36 + 5.1.36 + + + 5.1.36.122089 + 5.1.36.122089 + + + +

VirtualBox is a powerful virtualization product from Oracle.

+
+ +

Multiple vulnerabilities have been discovered in VirtualBox. Please + review the CVE identifiers referenced below for details. +

+
+ +

An attacker could take control of VirtualBox resulting in the execution + of arbitrary code with the privileges of the process, a Denial of Service + condition, or other unspecified impacts. +

+
+ +

There is no known workaround at this time.

+
+ +

All VirtualBox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/virtualbox-5.1.36" + + +

All VirtualBox binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=app-emulation/virtualbox-bin-5.1.36.122089" + +
+ + CVE-2018-2830 + CVE-2018-2831 + CVE-2018-2835 + CVE-2018-2836 + CVE-2018-2837 + CVE-2018-2842 + CVE-2018-2843 + CVE-2018-2844 + CVE-2018-2845 + CVE-2018-2860 + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-09.xml new file mode 100644 index 0000000000..f4af27e4d2 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-09.xml @@ -0,0 +1,48 @@ + + + + Shadow: security bypass + A vulnerability found in Shadow may allow local attackers to bypass + security restrictions. + + shadow + 2018-05-22 + 2018-05-22 + 647790 + remote + + + 4.6 + 4.6 + + + +

Shadow is a set of tools to deal with user accounts.

+
+ +

A local attacker could possibly bypass security restrictions if an + administrator used “group blacklisting” to restrict access to file + system paths. +

+
+ +

A local attacker could possibly bypass security restrictions.

+
+ +

There is no known workaround at this time.

+
+ +

All shadow users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/shadow-4.6" + + +
+ + CVE-2018-7169 + + Zlogene + Zlogene +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-10.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-10.xml new file mode 100644 index 0000000000..75dcf4ebe6 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-10.xml @@ -0,0 +1,58 @@ + + + + Zsh: Multiple vulnerabilities + Multiple vulnerabilities have been found in Zsh, the worst of which + could allow local attackers to execute arbitrary code. + + zsh + 2018-05-26 + 2018-05-26 + 649614 + 651860 + 655708 + local + + + 5.5 + 5.5 + + + +

A shell designed for interactive use, although it is also a powerful + scripting language. +

+
+ +

Multiple vulnerabilities have been discovered in Zsh. Please review the + CVE identifiers referenced below for details. +

+
+ +

A local attacker could execute arbitrary code, escalate privileges, or + cause a Denial of Service condition. +

+
+ +

There is no known workaround at this time.

+
+ +

All Zsh users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-shells/zsh-5.5" + +
+ + CVE-2017-18205 + CVE-2017-18206 + CVE-2018-1071 + CVE-2018-1083 + CVE-2018-1100 + CVE-2018-7548 + CVE-2018-7549 + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-11.xml new file mode 100644 index 0000000000..6e793ac2cc --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-11.xml @@ -0,0 +1,52 @@ + + + + Rootkit Hunter: User-assisted execution of arbitrary code + A vulnerability has been found in Rootkit Hunter that allows a + remote attacker to execute arbitrary code. + + rkhunter + 2018-05-26 + 2018-05-26 + 623150 + remote + + + 1.4.6 + 1.4.6 + + + +

Scans for known and unknown rootkits, backdoors, and sniffers.

+
+ +

A vulnerability was discovered in Rootkit Hunter that allows the + downloading of mirror updates over insecure channels (HTTP). + Furthermore, the mirror update is then executed in Bash. +

+
+ +

A remote attacker, by performing a man-in-the-middle attack, could + execute arbitrary code, conduct a Denial of Service, or have other + unspecified impacts. +

+
+ +

Users are advised to not trust insecure protocols such as HTTP and to + turn off any mirror updates utilizing such channels. +

+
+ +

All Rootkit Hunter users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-forensics/rkhunter-1.4.6" + +
+ + CVE-2017-7480 + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-12.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-12.xml new file mode 100644 index 0000000000..a3a9dfc3d6 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-12.xml @@ -0,0 +1,52 @@ + + + + NTP: Multiple vulnerabilities + Multiple vulnerabilities have been found in NTP, the worst of which + could lead to remote code execution. + + ntp + 2018-05-26 + 2018-05-26 + 649612 + remote + + + 4.2.8_p11 + 4.2.8_p11 + + + +

NTP contains software for the Network Time Protocol.

+
+ +

Multiple vulnerabilities have been discovered in NTP. Please review the + CVE identifiers referenced below for details. +

+
+ +

A remote attacker could possibly execute arbitrary code or cause a + Denial of Service condition. +

+
+ +

There is no known workaround at this time.

+
+ +

All NTP users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/ntp-4.2.8_p11" + +
+ + CVE-2018-7170 + CVE-2018-7182 + CVE-2018-7183 + CVE-2018-7184 + CVE-2018-7185 + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-13.xml new file mode 100644 index 0000000000..701ee3093b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-13.xml @@ -0,0 +1,51 @@ + + + + Git: Multiple vulnerabilities + Git contains multiple vulnerabilities that allow for the remote + execution of arbitrary code. + + git + 2018-05-30 + 2018-05-30 + 656868 + remote + + + 2.16.4 + 2.16.4 + + + +

Git is a free and open source distributed version control system + designed to handle everything from small to very large projects with + speed and efficiency. +

+
+ +

Multiple vulnerabilities have been discovered in Git. Please review the + CVE identifiers referenced below for details. +

+
+ +

Remote attackers could execute arbitrary code on both client and server.

+
+ +

There is no known workaround at this time.

+
+ +

All Git users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.16.4" + + +
+ + CVE-2018-11233 + CVE-2018-11235 + + whissi + whissi +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-14.xml new file mode 100644 index 0000000000..3199c6204d --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-14.xml @@ -0,0 +1,54 @@ + + + + procps: Multiple vulnerabilities + Multiple vulnerabilities have been found in procps, the worst of + which could result in the execution of arbitrary code. + + procps + 2018-05-30 + 2018-05-30 + 656022 + local + + + 3.3.15-r1 + 3.3.15-r1 + + + +

A bunch of small useful utilities that give information about processes + using the /proc filesystem. +

+
+ +

Multiple vulnerabilities have been discovered in procps. Please review + the CVE identifiers referenced below for details. +

+
+ +

A local attacker could execute arbitrary code, escalate privileges, or + cause a Denial of Service condition. +

+
+ +

There is no known workaround at this time.

+
+ +

All procps users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-process/procps-3.3.15-r1" + +
+ + CVE-2018-1120 + CVE-2018-1121 + CVE-2018-1122 + CVE-2018-1123 + CVE-2018-1124 + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-15.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-15.xml new file mode 100644 index 0000000000..f6d2e91d83 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-15.xml @@ -0,0 +1,44 @@ + + + + beep: Local privilege escalation + A vulnerability in beep could allow local attackers to escalate + privileges. + + beep + 2018-05-30 + 2018-05-30 + 652330 + remote + + + 1.3-r3 + 1.3-r3 + + + +

The advanced PC speaker beeper.

+
+ +

A race condition, if setuid, was discovered in beep.

+
+ +

A local attacker could escalate privileges.

+
+ +

There is no known workaround at this time.

+
+ +

All beep users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-misc/beep-1.3-r3" + +
+ + CVE-2018-0492 + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk index b9507068ed..75af5c3c7f 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Wed, 16 May 2018 20:08:29 +0000 +Sat, 02 Jun 2018 01:38:28 +0000 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit index 2680641b2a..4ed1ab056d 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit @@ -1 +1 @@ -40f254b177f3628d865f1e77c8fd7c94584de14e 1526340152 2018-05-14T23:22:32+00:00 +e1eed7ae3b27f8139b508d9d14861c4437216138 1527689205 2018-05-30T14:06:45+00:00