From 1aea7a18e8730dd8c2719c4c21b504527413cd0b Mon Sep 17 00:00:00 2001 From: David Michael Date: Mon, 9 Oct 2017 11:51:02 -0700 Subject: [PATCH] bump(metadata/glsa): sync with upstream --- .../metadata/glsa/glsa-201705-15.xml | 15 ++- .../metadata/glsa/glsa-201710-01.xml | 61 +++++++++++ .../metadata/glsa/glsa-201710-02.xml | 53 +++++++++ .../metadata/glsa/glsa-201710-03.xml | 59 ++++++++++ .../metadata/glsa/glsa-201710-04.xml | 52 +++++++++ .../metadata/glsa/glsa-201710-05.xml | 50 +++++++++ .../metadata/glsa/glsa-201710-06.xml | 101 ++++++++++++++++++ .../metadata/glsa/glsa-201710-07.xml | 54 ++++++++++ .../metadata/glsa/glsa-201710-08.xml | 56 ++++++++++ .../metadata/glsa/glsa-201710-09.xml | 66 ++++++++++++ .../metadata/glsa/timestamp.chk | 2 +- .../metadata/glsa/timestamp.commit | 2 +- 12 files changed, 564 insertions(+), 7 deletions(-) create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-01.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-02.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-03.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-04.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-05.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-06.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-07.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-08.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-09.xml diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201705-15.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201705-15.xml index a7507152a4..ee01ba3b83 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201705-15.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201705-15.xml @@ -5,13 +5,13 @@ A vulnerability in sudo allows local users to gain root privileges. sudo,privilege 2017-05-30 - 2017-05-30: 1 + 2017-10-07: 3 620182 local - 1.8.20_p1 - 1.8.20_p1 + 1.8.20_p2 + 1.8.20_p2 @@ -27,6 +27,8 @@ user-controlled, arbitrary tty device during its traversal of “/dev” by utilizing the world-writable /dev/shm.

+ +

For further information, please see the Qualys Security Advisory

A local attacker can pretend that his tty is any character device on the @@ -43,7 +45,7 @@ # emerge --sync - # emerge --ask --oneshot --verbose ">=app-admin/sudo-1.8.20_p1" + # emerge --ask --oneshot --verbose ">=app-admin/sudo-1.8.20_p2" @@ -51,7 +53,10 @@ CVE-2017-1000367 + + Qualys Security Advisory for CVE-2017-1000367 + K_F - K_F + K_F diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-01.xml new file mode 100644 index 0000000000..4d79ea91fd --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-01.xml @@ -0,0 +1,61 @@ + + + + RubyGems: Multiple vulnerabilities + Multiple vulnerabilities were found in RubyGems, the worst of which + allows execution of arbitrary code. + + rubygems + 2017-10-08 + 2017-10-08: 1 + 629230 + remote + + + 2.6.13 + 2.6.13 + + + +

RubyGems is a sophisticated package manager for Ruby.

+ + +

Multiple vulnerabilities have been discovered in RubyGems. Please review + the referenced CVE identifiers for details. +

+ + + +

A remote attacker, by enticing a user to install a specially crafted + gem, could possibly execute arbitrary code with the privileges of the + process or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All RubyGems users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-ruby/rubygems-2.6.13" + + + + + CVE-2017-0899 + + + CVE-2017-0900 + + + CVE-2017-0901 + + + CVE-2017-0902 + + + chrisadr + chrisadr + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-02.xml new file mode 100644 index 0000000000..f44b167e62 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-02.xml @@ -0,0 +1,53 @@ + + + + file: Stack-based buffer overflow + A stack-based buffer overflow was found in file, possibly resulting + in the execution of arbitrary code. + + file + 2017-10-08 + 2017-10-08: 1 + 629872 + remote + + + 5.32 + 5.32 + + + +

file is a utility that guesses a file format by scanning binary data for + patterns. +

+ + +

An issue discovered in file allows attackers to write 20 bytes to the + stack buffer via a specially crafted .notes section. +

+ + +

A remote attacker, by using a specially crafted .notes section in an ELF + binary, could execute arbitrary code or cause a Denial of Service + condition. +

+ + +

There is no known workaround at this time.

+ + +

All file users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/file-5.32" + + + + + CVE-2017-1000249 + + + chrisadr + chrisadr + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-03.xml new file mode 100644 index 0000000000..d55c1d1f47 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-03.xml @@ -0,0 +1,59 @@ + + + + ICU: Multiple vulnerabilities + Multiple vulnerabilities have been found in ICU, the worst of which + could allow remote code execution. + + icu + 2017-10-08 + 2017-10-08: 1 + 616468 + remote + + + 58.2-r1 + 58.2-r1 + + + +

ICU is a mature, widely used set of C/C++ and Java libraries providing + Unicode and Globalization support for software applications. +

+ + +

Multiple vulnerabilities have been discovered in ICU. Please review the + referenced CVE identifiers for details. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All ICU users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/icu-58.2-r1" + + +

Packages which depend on this library may need to be recompiled. Tools + such as revdep-rebuild may assist in identifying some of these packages. +

+ + + + CVE-2017-7867 + + + CVE-2017-7868 + + + chrisadr + chrisadr + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-04.xml new file mode 100644 index 0000000000..a6ad46e921 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-04.xml @@ -0,0 +1,52 @@ + + + + sudo: Privilege escalation + A vulnerability in sudo allows local users to gain root privileges. + sudo + 2017-10-08 + 2017-10-08: 1 + 620482 + local + + + 1.8.20_p2 + 1.8.20_p2 + + + +

sudo (su “do”) allows a system administrator to delegate authority + to give certain users (or groups of users) the ability to run some (or + all) commands as root or another user while providing an audit trail of + the commands and their arguments. +

+ + +

The fix present in app-admin/sudo-1.8.20_p1 (GLSA 201705-15) was + incomplete as it did not address the problem of a command with a newline + in the name. +

+ + +

A local attacker could execute arbitrary code with root privileges.

+ + +

There is no known workaround at this time.

+ + +

All sudo users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-admin/sudo-1.8.20_p2" + + + + + CVE-2017-1000368 + + GLSA 201705-15 + + chrisadr + chrisadr + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-05.xml new file mode 100644 index 0000000000..9fc4492741 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-05.xml @@ -0,0 +1,50 @@ + + + + Munin: Arbitrary file write + A vulnerability in Munin allows local attackers to overwrite any + file accessible to the www-data user. + + munin + 2017-10-08 + 2017-10-08: 1 + 610602 + local + + + 2.0.33 + 2.0.33 + + + +

Munin is an open source server monitoring tool.

+ + +

When Munin is compiled with CGI graphics enabled then the files + accessible to the www-data user can be overwritten. +

+ + +

A local attacker, by setting multiple upper_limit GET parameters, could + overwrite files accessible to the www-user. +

+ + +

There is no known workaround at this time.

+ + +

All Munin users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-analyzer/munin-2.0.33" + + + + + CVE-2017-6188 + + + chrisadr + chrisadr + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-06.xml new file mode 100644 index 0000000000..2ffbb73c66 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-06.xml @@ -0,0 +1,101 @@ + + + + PostgreSQL: Multiple vulnerabilities + Multiple vulnerabilities have been found in PostgreSQL, the worst + of which could result in privilege escalation. + + postgresql + 2017-10-08 + 2017-10-08: 1 + 618462 + 627462 + remote + + + 9.6.4 + 9.5.8 + 9.4.13 + 9.3.18 + 9.2.22 + 9.6.4 + + + +

PostgreSQL is an open source object-relational database management + system. +

+ + +

Multiple vulnerabilities have been discovered in PostgreSQL. Please + review the referenced CVE identifiers for details. +

+ + +

A remote attacker could escalate privileges, cause a Denial of Service + condition, obtain passwords, cause a loss in information, or obtain + sensitive information. +

+ + +

There is no known workaround at this time.

+ + +

All PostgreSQL 9.6.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.6.4" + + +

All PostgreSQL 9.5.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.5.8" + + +

All PostgreSQL 9.4.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.4.13" + + +

All PostgreSQL 9.3.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.3.18" + + +

All PostgreSQL 9.2.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.2.22" + + + + + CVE-2017-7484 + + + CVE-2017-7485 + + + CVE-2017-7486 + + + CVE-2017-7546 + + + CVE-2017-7547 + + + CVE-2017-7548 + + + BlueKnight + chrisadr + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-07.xml new file mode 100644 index 0000000000..8f01fb85b8 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-07.xml @@ -0,0 +1,54 @@ + + + + OCaml: Privilege escalation + A vulnerability in OCaml may allow local users to gain root + privileges. + + + ocaml + 2017-10-08 + 2017-10-08: 1 + 622544 + remote + + + 4.04.2 + 4.04.2 + + + +

OCaml is a high-level, strongly-typed, functional, and object-oriented + programming language from the ML family of languages. +

+ + +

A bad sanitization of environment variables: CAML_CPLUGINS, + CAML_NATIVE_CPLUGINS and CAML_BYTE_CPLUGINS in the OCaml compiler allows + the execution of raised privileges via external code. +

+ + +

A local attacker, by using specially crafted environment variables, + could possibly escalate privileges to the root group. +

+ + +

There is no known workaround at this time.

+ + +

All OCaml users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/ocaml-4.04.2" + + + + + CVE-2017-9772 + + + b-man + chrisadr + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-08.xml new file mode 100644 index 0000000000..ea0a9f6277 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-08.xml @@ -0,0 +1,56 @@ + + + + Pacemaker: Multiple vulnerabilities + Multiple vulnerabilities have been found in Pacemaker, the worst of + which could result in the execution of arbitrary code. + + pacemaker + 2017-10-08 + 2017-10-08: 1 + 546550 + 599194 + local, remote + + + 1.1.16 + 1.1.16 + + + +

Pacemaker is an Open Source, High Availability resource manager suitable + for both small and large clusters. +

+ + +

Multiple vulnerabilities have been discovered in Pacemaker. Please + review the referenced CVE identifiers for details. +

+ + +

A remote attacker could execute arbitrary code or a local attacker could + escalate privileges. +

+ + +

There is no known workaround at this time.

+ + +

All Pacemaker users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-cluster/pacemaker-1.1.16 " + + + + + CVE-2015-1867 + + + CVE-2016-7035 + + + BlueKnight + chrisadr + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-09.xml new file mode 100644 index 0000000000..09e2c7dce9 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-09.xml @@ -0,0 +1,66 @@ + + + + PCRE2: Multiple vulnerabilities + Multiple vulnerabilities have been found in PCRE2, the worst of + which may allow remote attackers to execute arbitrary code. + + libpcre2 + 2017-10-08 + 2017-10-08: 1 + 614050 + 617942 + 617944 + remote + + + 10.30 + 10.30 + + + +

PCRE2 is a project based on PCRE (Perl Compatible Regular Expressions) + which has a new and revised API. +

+ + +

Multiple vulnerabilities have been discovered in PCRE2. Please review + the referenced CVE identifiers for details. +

+ + + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, cause a Denial of Service condition, or have + other unspecified impacts. +

+ + +

There is no known workaround at this time.

+ + +

All PCRE2 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/libpcre2-10.30" + + +

Packages which depend on this library may need to be recompiled. Tools + such as revdep-rebuild may assist in identifying some of these packages. +

+ + + + CVE-2017-7186 + + + CVE-2017-8399 + + + CVE-2017-8786 + + + chrisadr + chrisadr + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk index 4a930ded7f..4996685384 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Fri, 29 Sep 2017 17:39:27 +0000 +Mon, 09 Oct 2017 18:08:59 +0000 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit index de145b11d5..9a85e68140 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit @@ -1 +1 @@ -612f47deca97e8d7ffc2100c1dbc82a602abdf39 1506632095 2017-09-28T20:54:55+00:00 +6563aef7bcf2b256b39e321f440df3efe76f81f4 1507473808 2017-10-08T14:43:28+00:00