From 27e7839ace6ce8c083ddd256c9c939f05c611c3a Mon Sep 17 00:00:00 2001 From: David Michael Date: Mon, 8 Jan 2018 09:55:53 -0500 Subject: [PATCH] bump(metadata/glsa): sync with upstream --- .../portage-stable/metadata/glsa/Manifest | 30 ++-- .../metadata/glsa/Manifest.files.gz | Bin 412859 -> 414446 bytes .../metadata/glsa/glsa-201801-01.xml | 137 ++++++++++++++++++ .../metadata/glsa/glsa-201801-02.xml | 57 ++++++++ .../metadata/glsa/glsa-201801-03.xml | 134 +++++++++++++++++ .../metadata/glsa/glsa-201801-04.xml | 51 +++++++ .../metadata/glsa/glsa-201801-05.xml | 50 +++++++ .../metadata/glsa/glsa-201801-06.xml | 51 +++++++ .../metadata/glsa/glsa-201801-07.xml | 68 +++++++++ .../metadata/glsa/glsa-201801-08.xml | 53 +++++++ .../metadata/glsa/glsa-201801-09.xml | 63 ++++++++ .../metadata/glsa/glsa-201801-10.xml | 62 ++++++++ .../metadata/glsa/timestamp.chk | 2 +- .../metadata/glsa/timestamp.commit | 2 +- 14 files changed, 743 insertions(+), 17 deletions(-) create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-01.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-02.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-03.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-04.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-05.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-06.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-07.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-08.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-09.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-10.xml diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest index bcec7da2c7..296b96193c 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest @@ -1,23 +1,23 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 -MANIFEST Manifest.files.gz 412859 BLAKE2B 29f22611257846c43da3f994e05684673fa1caa957a4b148f39ff19bc84f3682e8490d97c111e7eccbdb376d70136a0d0906ef152ce3abf044f4fb391eb520c4 SHA512 49d32fc5be9c59d40fa5555276aaf748a6274c5421c12e450644629355174f7bb6f7e77103a5571ae8f5e28bcd53505531ac68ed8f7957c3debfc9196bd152cd -TIMESTAMP 2017-12-15T14:38:51Z +MANIFEST Manifest.files.gz 414446 BLAKE2B 5b433dfd85097ead79bccfcdc5ac71450a49f0cd04217ea95a0da4d9b3a14d6a0df186361cf5d3a4ff24547968a8bdb79ea1e31d21aa21b86708e0885a152525 SHA512 2410eac2ebdd40b883f4296ea6c8ebefb16545c125c9ecb039ba9a79dc2d32f43aaaa01673cb98557d5d7aa414d7d0c72e688610d9b127a0d56cb1584e16cf5c +TIMESTAMP 2018-01-08T14:09:18Z -----BEGIN PGP SIGNATURE----- -iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAloz3ntfFIAAAAAALgAo +iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlpTe45fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY -klChjw//YTiUDD4Fm0n7wQTnP+T2uP/k5D8u5GxF+dTXC8apVyGVlVq2LLUTTCPL -uLV+HWbXNvh11bjZpDrZU8TtI410H19iaK8+6vzpRhea2v5ClabU7J2MmaDZoOc7 -p+UyEntdtrw7DU/SNxHSdeAQ+ll0lers1pxMaoW+FFT1tvMUJBkO73QuZu6lApad -PORPMc2ibAju/EY1TiuKsSM9V2Vz9iKWNtjQzObCUCfZEKq39HhAEY+0ldqI/TDz -NgXr8MbYgIV/WxkOaDdNy2s4Q/AA1TdgJUHBH4d8qNl3m456p+maYiEwKJIpdbgx -R1h7ofef6I7Z/qmafUtfuNkpaZpl0o+Od2142Lfu5Ux0C67LRC2wMzztaPIkcuDs -4xkPDLQ+Hjzo9ix3Uk+J1iziHkdtf450Q4C2q0jdxWO0mkMf0DWc/uhd1GnWHJ4I -o1IflamHKQBAKC0+7zQw+hZ+pksEvuqboeC3Xh3Nxe9TQqRWje8+hs911N5QtYU9 -XqNIhuaEiSIi0b5Ld8lT6S4HP9KRnEM2L3WI7SRzIkEQl920MVybkyHq7ElhWGyg -Ma1U6ulPo8ExHZigdMF7kjM2A/8YRqyKLMiyfSea1e/waNqlmqXHIPAgz8RePuF6 -/cB49iydB/jcLzPmnkQ0up0ivOUwX/Wizk3aWRr83Zcc2+4ULi0= -=AvJa +klDADw//Y0MSMH/w88YmIdFIFhAFkVaiucRv0Y3ghNhw8ygK7XZZOgEjuY3drvfW +utdtH01gKMFQcv1aM+1N9m9qzvQM6sNwx/NPUi/eUil4XWlbqF1jJgvFavD5DEVW +3lLEx3ZvZG4IC39GtVOIlExMt5OOduP5xGCg6vKJXNRUKM3Y+h+4wFcEqi4ZCXOk +x2LNDnfFlndvaDAu/mYOVRxxBYffvJD5WYn6XCAMot3ZHaqAXKklVkwSSr2DGNwS +MG+tfo25tUstvkExRbnfOogZwQDbXXlHhe+a1swxuRSUCk3ZzRaWXHAAG1hGAlgP +MujuK2+Sflrbukf2bQcjIbUkL/6c/qIBA+t484cY8WLjCPD2f8Go0DlmEpCuB1s9 +kjMgpolbXFjE73F9PLOaM7svYQCKB6GbJGcmo6BL7vuwfhS2YZZpoKMbO6EdYimk +2NhHGpBSAOfZMKUgV/ll0meAZesOZXxf1f+e+QG19iiFHUMj//Nux04QUVyAuTy4 +R9DLOClKPOnMr1ODMRYznzSWDCAPaRTaBvrYK/yOk0AUerfCUt9F92ypbPTxD1qw +JaBUMmObEYMI5oj7wN1iigFCvnLmgcEjVXhXMB1Gzywi3N2T2KPk2ANcCjWxTyvn +D+b/1KH9cWusFhl87Axt3R4JRAD0SRT6X/08+eybXcS2Ow+jJaI= +=sXyp -----END PGP SIGNATURE----- diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz index 6fc5b55366c7dc1bf308aca0766392e4e1f87cb0..895c44865813fe3054a851180a6f71ab6677d335 100644 GIT binary patch delta 3197 zcmV-@41)8!nHlb-8GwWVgaU*Egam{Iv<9C>e_M_vw-H4DwFzmaIAFK6(TKxO^G5282F-N>Q=zj1lOAO2lywK%6B4Hk|Tq3 z(@EY_iPzR;pkiCTOaPRrCfQVbJ{Mn@fAaiz6SqF*x6(^L(F5c7o=m>m0gCL4_7MNs zDCjD&%UzD)CNNSt^e7jQqX)*jHlrt&>4R`rke^>qwZLdPa)`yzQ%7qpE)H$!)TBJv zl<)x9@8feKsW=+5?I@RH`?>CpZlBI_=H!!Ax*YX8I2B}5<#a6EZ4hOrsS_xYf4y=3 z)LADW5olUJQLu}OxhmFge!F@NdT59F0|1S%DCOUv(~tQrV%}GjKR{Z<>!FX)bZUp7 zrM2zaC7DB+^6mtV+)eJjrA*L4l*D|jteI9LH{4ey8;~j<)l;~rRk{wqtJYgZhkKc2 z3H{}e^<%r5>ikRMU=hN}YSRLbe-xM2_C%{h&Y~s6Wj|9p)g+J@N_pY^oakICbFqYQrUwigYna?Pa}rgZQv|IA7jQ`>E&&^+DFY z7(}0(Zv?m#`#^-ZdgJ;tR|P!N#r`(kJXEJGR+8p#JNMh{>@#j9&+2w6lRukm3P0L9sfI}XRSyz2q4KaxM(B4c{)#qA zo_nY5oXt(X=f~nW;g~jQfj2o_vO<72R8r)7mPz6~Crvw9P#51|%{Qy{F~9X9pTT0; zeIxMaGe%%D_+|Q}9g{A(f4aScdlbvf5;ktFbPAW=kuHi+tA8Mo&gBlUcuiNzeO_S? zfo5xK`&nAg)#9M!ysoII)oPdej-NSEhi1|lC&EWtvI@ZOA!Yf!9FkLlirtG877EKX zFsME{L2sqqPti$4O>)gXto>UnV?r8;Df?!sye>e90m#R8^yl)Ze zzHZ{tA9d0w5d+zusK@y|?J*6$yrkAGUPNeLhmQbM4%24Jwfby!VGk+5E;)hq0zEDT zPNSrMXL3P>(m+8+`n4#6PC3qQDu92C*uIR&xU<^Ka`7LEpVk$Gx>9RX$Xb>zp}tZ& z_n;n7%VJViNEu=Ne?Lc;hpO4usjQER4 zlB@ModiZ>mSp-aJ7~D<;hT@oto6GS?O^XM4Tc>k193HVZmyz&uI1IiO7^v1Lo4QVr zo5Tr#KlHH=T_>pXP9@RXemuX5Mu7Y@wf(jkpY3UIyUezp(`h?EpW|{y9aW9?%csIy zHmnySYxYI5f4aDMb#|3vqO{t4b2^B^!g-R(ZvNa`3YPf$8RdmBst0Io-S~VGoD&+! z?iPV8>J)k#QiXfIye3@={9B*CI_S&>!j|U12~1`XU<0tE82*j21er(ZuOM$8HbGVO zdK~*a-rdCX>-?4)z1??guJ&|XRnb%n8wX|N&`+(*f3q@uV9#t*HrdO5HUsx=O-a7) z6OBxsCDrcn35RkVyy5oUDkUpYYN~Ej9b1opYO<$Z%Zm|Ncgp?88&OlM?6Aa$Tq{b2 zqF1FnZf1JqI{j^}tFG4oc>8DduFz2FVno3ersrS@KnCs>^BE^qdg_XiT=d*W(VIS$3 zJJW-^%664;rXqm3s@@E_B`q#E4I1^R;l~Afo^w-pEH#NmPxy*k_wMoxw}zO=$0-nW zDbmzD?X1gY~d}3d-;~EeYPGr3NbxlD;=t_ zEdX}Le1wwTtk%zW`Qt_5z!Ob28rjDbF28~1A|~(yHb;9Yrdp`W97QIVQ6V=+wURWh zAxW?CogLpCN;#>h3n*dueY36J7XPr3ki!zTNpR>_X@+J&A{ zJ!@25pE~*0{YzGYosGmgq^C%D5WlB+e|II>o96L)Kx86ydfd?Q^ni(v%@3A!`g?0TNx>`k{vObQ*j}km0E4rmQmLp*@?*jR*Hn2l7O0z9kk+ z8xT$MXj9aTqL|99=QpdBe&y_606+~koaqeQd)459l-5y?igK1z{Cet$JX*m5f1xyH ztFxSZKXRKeP;)|VZ{qv;AxUjyt5)k1DR7AsH80R?@c)4upY#2`mx z2<|}=OcXk)vG0f&iPr{5R1sgoKX`}5d+Meq9!+-Hb_F7w+K;o@vyM^akNH-l?UBzA zN4E;y-A9mc-E(3jfj6u5lZ#Pbf9AJrgc3lKq|VYx97A93psaR@TYo3=rxX{bb|u`q z(`hW59gFZO%VI`*IhW4E6i9${z@np4UHP|7XBy{n9>te+E=-?tgnJmebY5R(Q9+)> zeubKWFBQqE4opW!`Uv`0=9>+*#r63EuE>r5qpTeD^aCiI2I+@_0 zL*!dv2$nGL=-L0*psbH`KnnMQd-tK=YU=r>Uq2C0$je%IHs`={`LTXC$QN9Oa)b>?XEZ|mwgDb2E zc^87{Vm-P!o3(S2?(#i&!(<=z1HTl7d#vr2j&rvzCaddhG7Aw>PWRe}5IzrFH^h0k5M@3-)H% zbM0;%)m)9`%NoBP_EXaXQt@q9O{jaT>r6hW)ON~2BO=Ic0o~sqR)v-B)DP{+SCDxu zEr?85G~Z@}m(%@U6G=c#iP}UIK2VpTea7vhOMc-PpQnMwQvt|J{gU%fp>>nArG{}o zhSL|*-f-~|f3QhH?|utD?siJSW;Uo+qEmN@&v)r(aLwzRv-N4g{PHdjhyu6}tj=e< zZE6iZ6kj#J_S)w5KT)RIDgD-R(PfcTPrV?kMM5}X-9{)i4kgGI^FC$DO5*h}^+DBm z*#To?z*19(4CP3jefwlZNoaR|9Wc*e@l)WHxNYkI)zVQRPk5j0Sv<%8}JQ^ z#Ud;i0~^rXAAXN=&orRkXd!4?)BI#cG9x1tHRW*Z7FjG6za#PFGD12^ZOw2?;!Hk` zNxh&@(Pb_8lBrK$R#`HQq}epvrqc59Vzt6!wVts2L1ryVZrRyCwVql`a)}x0goHTf zf4SGLN%d`1k45R%5jRK(M8RQGwWbLfp+`U z%&vaMExEU+uH_0LI6=o~q_#H|N^D?RlSJuuSuoa7r4D6%iwr})oC zK~ss{+2t4pfsx9gMP~sydSJY3P4vXleGqO6^7HGd78p%Ol31jkO0BiH*tDfnlX7EI z!VO>_+Xo}5NR3%`lvCP%K2}G!b-A25`DB$YseT)$f^4dsj)l7oqAZ&_fg;%(fBC0! zoq$B3Y5hdOE-L1#Sik1m)oaj0JM`}W=nRum{slUH@VAJ0pHY4TX%VkaeT=%S9fFqD zwsVzak}{pU6F71=x%-wfK?hM1^ER_)T9w=|u1q!{Rotqla8VD(bpT$+F;sLI(=1Eq zFPl?8wyUYmKP3((A)Kt%E$~Qje`zjHw1dc5w1l|qXKJUK1QMqbABTcnN{(b5Jb{12 z3`Glo8FgQTVZvlrgK`y{ss`V(4qRVtxE!P+U35}=nJ?ZT9##+g)7xp=6+NLo$l4c! z=#%_LfIG1dL^#wN*Pr=Nz%yO!Z`IvnztmqCdpJym;_Lk+$>@w66akfif6N!>ve-P< z@2<}l*;;NTX@1zbUuI_?aVvRNms6SZv&p9Lt*w)4h}2)lM#3gkZg$BC{j%b(XrtsF zD{bd&Zt^`p7U_g%w@C}U$?0+`1b9OwMZRa59GvH*X(tQn;v3BVVznOptta^m7R&A% zfj{pt0-M1v-6!psbjj82e;wSTSZ;P;V`!yQxb#xGC`PURfkZl&OJMPu&Xilf!XklY zYis*iTF)ItqGZ3WsHoMfm->z$IZ=mZ(itbhM_aNA!0#qy`Mo5`DM7{VMG6ar`&C={O# z^?+&?ld?j}2=jANf0s{Hv#nKoRZJPoul32WgVjzot_v3>t4^uKhGQZ^Az2ym2azOK z>woFt{aI!aFr{H|-4z&$XII?Z8IM%8cyMlOmsi8#5qonP2|t@;@TI^&wMN<0bb?$% zoB;SuAN$aBg4#EQ$ACV|Idm#5!HrHu)d#hp%I93Q5m|1%f8N){F@s>2?zZh+%iWi8 zv%A)bS_2rb| zCNjy3)p|$|KS`z!=eGHHeie-X`82itmKmSzX>hxfZ7rwWc7Q&|Wsf?l8ttb~g~MrB zFGSYti)3|ifANmqREmj?)#kzJAPNiTNhYiLGnN!A@%JOj3u9Cd(Av84|C8WkXe7H^ z1hS}8=rE)T_k4Lxx)k_F>%KbZ%m%`C%z+b_%pkx9U`a9j8)XSHx6off-hA2wRn_a3 z_PM>fiRnlFmKwdycWkb9m#(U4s)db28E5FbR_0lme?G8hwkezJW#4N8chssRU-OB^ zNuKGb-R%<&-(4g0O}aI*OK)M04VAqJOBUy diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-01.xml new file mode 100644 index 0000000000..edcda87e98 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-01.xml @@ -0,0 +1,137 @@ + + + + Binutils: Multiple vulnerabilities + Multiple vulnerabilities have been found in Binutils, the worst of + which may allow remote attackers to cause a Denial of Service condition. + + binutils + 2018-01-07 + 2018-01-07: 1 + 624700 + 627516 + 628538 + 629344 + 629922 + 631324 + 632100 + 632132 + 632384 + 632668 + 633988 + 635218 + 635692 + 635860 + 635968 + local, remote + + + 2.29.1-r1 + 2.29.1-r1 + + + +

The GNU Binutils are a collection of tools to create, modify and analyse + binary files. Many of the files use BFD, the Binary File Descriptor + library, to do low-level manipulation. +

+ + +

Multiple vulnerabilities have been discovered in Binutils. Please review + the referenced CVE identifiers for details. +

+ + +

A remote attacker, by enticing a user to compile/execute a specially + crafted ELF, tekhex, PE, or binary file, could possibly cause a Denial of + Service condition. +

+ + +

There are no known workarounds at this time.

+ + +

All Binutils users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-devel/binutils-2.29.1-r1" + + + + + CVE-2017-12456 + + + CVE-2017-12799 + + + CVE-2017-12967 + + + CVE-2017-14128 + + + CVE-2017-14129 + + + CVE-2017-14130 + + + CVE-2017-14333 + + + CVE-2017-15023 + + + CVE-2017-15938 + + + CVE-2017-15939 + + + CVE-2017-15996 + + + CVE-2017-7209 + + + CVE-2017-7210 + + + CVE-2017-7223 + + + CVE-2017-7224 + + + CVE-2017-7225 + + + CVE-2017-7227 + + + CVE-2017-9743 + + + CVE-2017-9746 + + + CVE-2017-9749 + + + CVE-2017-9750 + + + CVE-2017-9751 + + + CVE-2017-9755 + + + CVE-2017-9756 + + + jmbailey + jmbailey + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-02.xml new file mode 100644 index 0000000000..1e7fbff303 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-02.xml @@ -0,0 +1,57 @@ + + + + OptiPNG: Multiple vulnerabilities + Multiple vulnerabilities have been found in OptiPNG, the worst of + which may allow execution of arbitrary code. + + optipng + 2018-01-07 + 2018-01-07: 1 + 637936 + 639690 + remote + + + 0.7.6-r2 + 0.7.6-r2 + + + +

OptiPNG is a PNG optimizer that re-compresses image files to a smaller + size, without losing any information. +

+ + +

Multiple vulnerabilities have been discovered in OptiPNG. Please review + the referenced CVE identifiers for details. +

+ + +

A remote attacker could entice a user to process a specially crafted + image file, possibly resulting in execution of arbitrary code with the + privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All OptiPNG users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-gfx/optipng-0.7.6-r2" + + + + + CVE-2017-1000229 + + + CVE-2017-16938 + + + jmbailey + jmbailey + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-03.xml new file mode 100644 index 0000000000..67a86a6d18 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-03.xml @@ -0,0 +1,134 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in the execution of arbitrary code. + + chromium,google-chrome + 2018-01-07 + 2018-01-07: 1 + 640334 + 641376 + local, remote + + + 63.0.3239.108 + 63.0.3239.108 + + + 63.0.3239.108 + 63.0.3239.108 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices +

+ + +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the CVE identifiers referenced below for details. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, cause a Denial of Service condition, bypass + content security controls, or conduct URL spoofing. +

+ + +

There are no known workarounds at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-63.0.3239.108" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-63.0.3239.108" + + + + + CVE-2017-15407 + + + CVE-2017-15408 + + + CVE-2017-15409 + + + CVE-2017-15410 + + + CVE-2017-15411 + + + CVE-2017-15412 + + + CVE-2017-15413 + + + CVE-2017-15415 + + + CVE-2017-15416 + + + CVE-2017-15417 + + + CVE-2017-15418 + + + CVE-2017-15419 + + + CVE-2017-15420 + + + CVE-2017-15422 + + + CVE-2017-15423 + + + CVE-2017-15424 + + + CVE-2017-15425 + + + CVE-2017-15426 + + + CVE-2017-15427 + + + CVE-2017-15429 + + + Google Chrome Release 20171206 + + + Google Chrome Release 20171214 + + + jmbailey + jmbailey + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-04.xml new file mode 100644 index 0000000000..e49cf9f436 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-04.xml @@ -0,0 +1,51 @@ + + + + LibXcursor: User-assisted execution of arbitrary code + A vulnerability in LibXcursor might allow remote attackers to + execute arbitrary code. + + LibXcursor + 2018-01-07 + 2018-01-07: 1 + 639062 + local, remote + + + 1.1.15 + 1.1.15 + + + +

X.Org X11 libXcursor runtime library.

+ + +

It was discovered that libXcursor is prone to several heap overflows + when parsing malicious files. +

+ + +

A remote attacker, by enticing a user to process a specially crafted + cursor file, could possibly execute arbitrary code with the privileges of + the process or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All LibXcursor users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-libs/libXcursor-1.1.15" + + + + + CVE-2017-16612 + + + jmbailey + jmbailey + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-05.xml new file mode 100644 index 0000000000..0522284c6e --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-05.xml @@ -0,0 +1,50 @@ + + + + OpenSSH: Permission issue + A flaw has been discovered in OpenSSH which could allow a remote + attacker to create zero-length files. + + OpenSSH + 2018-01-07 + 2018-01-07: 1 + 633428 + remote + + + 7.5_p1-r3 + 7.5_p1-r3 + + + +

OpenSSH is a complete SSH protocol implementation that includes SFTP + client and server support. +

+ + +

The process_open function in sftp-server.c in OpenSSH did not properly + prevent write operations in readonly mode. +

+ + +

A remote attacker could cause the creation of zero-length files.

+ + +

There is no known workaround at this time.

+ + +

All OpenSSH users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/openssh-7.5_p1-r3" + + + + + CVE-2017-15906 + + + jmbailey + jmbailey + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-06.xml new file mode 100644 index 0000000000..a0725d7cc0 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-06.xml @@ -0,0 +1,51 @@ + + + + Back In Time: Command injection + A command injection vulnerability in 'Back in Time' may allow for + the execution of arbitrary shell commands. + + backintime + 2018-01-07 + 2018-01-07: 1 + 636974 + local, remote + + + 1.1.24 + 1.1.24 + + + +

A simple backup tool for Linux, inspired by “flyback project”.

+ + +

‘Back in Time’ did improper escaping/quoting of file paths used as + arguments to the ‘notify-send’ command leading to some parts of file + paths being executed as shell commands within an os.system call. +

+ + +

A context-dependent attacker could execute arbitrary shell commands via + a specially crafted file. +

+ + +

There is no known workaround at this time.

+ + +

All ‘Back In Time’ users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-backup/backintime-1.1.24" + + + + + CVE-2017-16667 + + + jmbailey + jmbailey + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-07.xml new file mode 100644 index 0000000000..48b58e98c0 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-07.xml @@ -0,0 +1,68 @@ + + + + GNU Emacs: Command injection + A vulnerability has been found in Emacs which may allow for + arbitrary command execution. + + Emacs + 2018-01-07 + 2018-01-08: 2 + 630680 + remote + + + 23.4-r16 + 24.5-r4 + 25.2-r1 + 23.4-r16 + 24.5-r4 + 25.2-r1 + + + +

GNU Emacs is a highly extensible and customizable text editor.

+ + +

A command injection flaw within the Emacs “enriched mode” handling + has been discovered. +

+ + +

A remote attacker, by enticing a user to open a specially crafted file, + could execute arbitrary commands with the privileges of process. +

+ + +

There is no known workaround at this time.

+ + +

All GNU Emacs 23.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-editors/emacs-23.4-r16:23" + + +

All GNU Emacs 24.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-editors/emacs-24.5-r4:24" + + +

All GNU Emacs 25.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-editors/emacs-25.2-r1:25" + + + + + CVE-2017-14482 + + + jmbailey + jmbailey + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-08.xml new file mode 100644 index 0000000000..71a3eac590 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-08.xml @@ -0,0 +1,53 @@ + + + + MiniUPnPc: Arbitrary code execution + A vulnerability in MiniUPnPc might allow remote attackers to + execute arbitrary code. + + MiniUPnP + 2018-01-07 + 2018-01-07: 1 + 562684 + remote + + + 2.0.20170509 + 2.0.20170509 + + + +

The client library, enabling applications to access the services + provided by an UPnP “Internet Gateway Device” present on the network. +

+ + +

An exploitable buffer overflow vulnerability exists in the XML parser + functionality of the MiniUPnP library. +

+ + +

A remote attacker, by enticing a user to connect to a malicious server, + could cause the execution of arbitrary code with the privileges of the + user running a MiniUPnPc linked application. +

+ + +

There is no known workaround at this time.

+ + +

All MiniUPnPc users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/miniupnpc-2.0.20170509" + + + + + CVE-2015-6031 + + + jmbailey + jmbailey + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-09.xml new file mode 100644 index 0000000000..e76b2d5028 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-09.xml @@ -0,0 +1,63 @@ + + + + WebkitGTK+: Multiple vulnerabilities + Multiple vulnerabilities have been found in WebkitGTK+, the worst + of which may lead to arbitrary code execution. + + WebkitGTK+ + 2018-01-07 + 2018-01-07: 1 + 641752 + remote + + + 2.18.4 + 2.18.4 + + + +

WebKitGTK+ is a full-featured port of the WebKit rendering engine.

+ + +

Multiple vulnerabilities have been discovered in WebkitGTK+. Please + review the referenced CVE Identifiers for details. +

+ + +

An attacker, by enticing a user to visit maliciously crafted web + content, may be able to execute arbitrary code or cause memory + corruption. +

+ + +

There are no known workarounds at this time.

+ + +

All WebkitGTK+ users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.18.4:4" + + + + + CVE-2017-13856 + + + CVE-2017-13866 + + + CVE-2017-13870 + + + CVE-2017-7156 + + + CVE-2017-7157 + + + jmbailey + jmbailey + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-10.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-10.xml new file mode 100644 index 0000000000..329c01883b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201801-10.xml @@ -0,0 +1,62 @@ + + + + LibXfont, LibXfont2: Arbitrary file access + A vulnerability has been found in LibXfont and LibXfont2 which may + allow for arbitrary file access. + + LibXfont, LibXfont2 + 2018-01-08 + 2018-01-08: 1 + 639064 + local + + + 1.5.4 + 1.5.4 + + + 2.0.3 + 2.0.3 + + + +

X.Org Xfont library.

+ + +

It was discovered that libXfont incorrectly followed symlinks when + opening font files. +

+ + +

A local unprivileged user could use this flaw to cause the X server to + access arbitrary files, including special device files. +

+ + +

There is no known workaround at this time.

+ + +

All LibXfont users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-libs/libXfont-1.5.4" + + +

All LibXfont2 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-libs/libXfont2-2.0.3" + + + + + + CVE-2017-16611 + + + jmbailey + jmbailey + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk index d9651b1869..51d96747a0 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Fri, 15 Dec 2017 14:38:47 +0000 +Mon, 08 Jan 2018 14:09:15 +0000 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit index 632542b5e1..aaca69940e 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit @@ -1 +1 @@ -30b0a682c74fee092dcec1e6356f4afc7fa14625 1513277071 2017-12-14T18:44:31+00:00 +83b03abfd2cbeb32bafb0df4d1a742e9717c33a3 1515417463 2018-01-08T13:17:43+00:00