diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest index 15707c00e3..b4beb56618 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest @@ -1,23 +1,23 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 -MANIFEST Manifest.files.gz 419802 BLAKE2B 77b61430b97be606d07e770dcefecad6df694cb9d174d02e411d0c9124496cc8f3c082d220e88b305fb15b10d7c63b688c68e4484d9efe6cf97b41aabe095755 SHA512 3f233f14b1531babe34f57d6f927c008a3406b144de3e74532b3bf23c806220ffc43906d40c476f43e773cfbdabd98ea035b95415e8a23d7ad3ed93384c13bf7 -TIMESTAMP 2018-04-04T14:08:23Z +MANIFEST Manifest.files.gz 421065 BLAKE2B e5b50ffe2bff6e1107508e16429b0e9aa8dcd4044034c53166a7d066653c21e085a59cb4e867938b00f904f7abc63ae87d68724f2c506d2f3e384dfebadd3e8d SHA512 d6d92ec0eb389bb118fe14a90c5a7cfa51b633eae98383dd3516d94dae838bb21450c1f86c6da9dd7c536c539a0b941892ba8a40f25bbe44fe414a6659b84cfc +TIMESTAMP 2018-04-09T16:08:29Z -----BEGIN PGP SIGNATURE----- -iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlrE3FdfFIAAAAAALgAo +iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlrLj/1fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY -klCOqw//dq72XGk93uVY1A2zF8LLTGinHAwKLl7Jvv5ueZk+fi+y/J5rcWM34KAp -Sup8n8N4M/i5xMhBpag2ZnMIDyy7X9qGMmr/f0uxfI/jFplhLUJIwLj9tjUPs7Ml -tv7Y5x01pQZYGM5w55EXk+basWkFNKS0qza8Gl6gYuHizB90fiWf91vIStgT9sQt -qgxlFuhM0cg7/4fCRZgKrLz+/CSfpIz0JKqwuNVx+md0OPkpq1LTbQrwUGeyRsi3 -U5+J1ugt2E6vgusR2sc4M0jlGPFqKN03maeQRBztepbuF0r6F7ROYQ4fFqT9hxQe -roprxcAiYqyRV3989+KwjcKu0Bw3eNXuXDZuaqA2FZdhVnfneMjfb8A9RILZz9z8 -RGCcyrEePJ2kpRoOB5644v0N7iZB1F6Jxm3G8U4GChL97ypxZUcqz/XwJTNYj7YC -bv0pAMfonPLWLWSH96r404aiAHCJzvnx7pfnKveXDV3ZEv83BeJQ82XtHHCIMlUU -lh4xaaB810rPMXN7hkS2TY6Jy7yBANRgnRiOgyMcsPupmpcUzXubFTkKt4il3Iea -GK1c9W2y9LZlvn3n21KRcgKr7MdZd50UWqiACcAoI4LYQl0zoIwJXz7Ev7zCYnHo -zJ1tIECigaXkxo1M6I9pHSBoKImka2nHe3JJXHuvBoCDgrMpYBM= -=KX1n +klCVng//ZCj2FD+CLhggl2gao3gG2dq439EDmwTErvUaX1G+deBU7GSn8C6/TDji +m6PpfH2d/9OJNKOvHrzi/DuK6M8wN7gBVL+1R41zOC8YWyp/YGM8cI7w8AEjykSV +LMLl4+XhNKsC6i+QLZNLYXChqxL9oMOvuTtBaNzGncXTeIuXlGUykPB2/8gl3spZ +OHT//cmshfKvX+nMx/K4qKZKopVEN11zyd8HqhM1KlbDbpPxm70tLT4ZJfOhVdR/ +Iymfefq8fe1s7E5HFUbnRBtTNzMMPWuhq+JQluWUWn+26uUPn9eaTS+tOMBjz4L2 +OpNPhyvhWIf72+cCn7g1k3aVn9L+k9jmJOsMjlIhJWu6gN5LlwRv6z89K+YqjBaa +g9sHCQRL4G6naqyl1v1IHLxDdnBBoDZhq3AYH+F96qWnh6iwXnvSE12yFPtTVIl3 +oWXpL1Kp+j02v7MZrXmR+vfvomxeuIxvw92iqB1iP15K2BwHjHAd1481NIYUvnbg +BSoRbgllLd+jXyr8zMwilppTYBezR9XT+9+rnfczkpSeZpV3eUHgYCLdH01f7/vx +n8XhwY/di84Jo6myrefjGa3r9LLS0lDp1q/AV5hBRIkO7HOV5s4C6euYMxI5L5cX +P1qoJv7630nM0q5BBkFS8e6zX7pRyMUuhvrQQ5cJD3dcpE2hH/c= +=lkul -----END PGP SIGNATURE----- diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz index b5be97045f..237780ae76 100644 Binary files a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz and b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz differ diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-03.xml new file mode 100644 index 0000000000..c59928cc59 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-03.xml @@ -0,0 +1,55 @@ + + + + Poppler: Multiple vulnerabilities + Multiple vulnerabilities have been found in Poppler, the worst of + which could allow a Denial of Service. + + poppler + 2018-04-08 + 2018-04-08 + 644388 + 645868 + remote + + + 0.61.1 + 0.61.1 + + + +

Poppler is a PDF rendering library based on the xpdf-3.0 code base.

+
+ +

Multiple vulnerabilities have been discovered in Poppler. Please review + the CVE identifiers referenced below for details. +

+
+ +

A remote attacker, by enticing a user to open a specially crafted PDF, + could cause a Denial of Service condition or have other unspecified + impacts. +

+
+ +

There is no known workaround at this time.

+
+ +

All Poppler users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-text/poppler-0.61.1" + +
+ + + CVE-2017-1000456 + + CVE-2017-14975 + CVE-2017-14976 + CVE-2017-14977 + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-04.xml new file mode 100644 index 0000000000..d12760a99d --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-04.xml @@ -0,0 +1,63 @@ + + + + cURL: Multiple vulnerabilities + Multiple vulnerabilities have been found in cURL, the worst of + which could result in a Denial of Service condition. + + curl + 2018-04-08 + 2018-04-08 + 645698 + 650056 + remote + + + 7.59.0 + 7.59.0 + + + +

A command line tool and library for transferring data with URLs.

+
+ +

Multiple vulnerabilities have been discovered in cURL. Please review the + CVE identifiers referenced below for details. +

+
+ +

Remote attackers could cause a Denial of Service condition, obtain + sensitive information, or have other unspecified impacts. +

+
+ +

There is no known workaround at this time.

+
+ +

All cURL users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/curl-7.59.0" + +
+ + + CVE-2018-1000005 + + + CVE-2018-1000007 + + + CVE-2018-1000120 + + + CVE-2018-1000121 + + + CVE-2018-1000122 + + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-05.xml new file mode 100644 index 0000000000..fac50a830a --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-05.xml @@ -0,0 +1,59 @@ + + + + ISC DHCP: Multiple vulnerabilities + Multiple vulnerabilities have been found in ISC DHCP, the worst of + which could allow for the remote execution of arbitrary code. + + dhcp + 2018-04-08 + 2018-04-08 + 644708 + 649010 + remote + + + 4.3.6_p1 + 4.3.6_p1 + + + +

ISC DHCP is a Dynamic Host Configuration Protocol (DHCP) client/server.

+
+ +

Multiple vulnerabilities have been discovered in ISC DHCP. Please review + the CVE identifiers referenced below for details. +

+
+ +

Remote attackers could execute arbitrary code, cause a Denial of Service + condition, or have other unspecified impacts. +

+
+ +

There are no known workarounds at this time for CVE-2018-5732 or + CVE-2018-5733. +

+ +

In accordance with upstream documentation, the recommended workaround + for CVE-2017-3144 is, “to disallow access to the OMAPI control port + from unauthorized clients (in accordance with best practices for server + operation).” +

+
+ +

All DHCP users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/dhcp-4.3.6_p1" + +
+ + CVE-2017-3144 + CVE-2018-5732 + CVE-2018-5733 + + chrisadr + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-06.xml new file mode 100644 index 0000000000..a038c24231 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-06.xml @@ -0,0 +1,50 @@ + + + + mailx: Multiple vulnerabilities + Multiple vulnerabilities were discovered in mailx, the worst of + which may allow a remote attacker to execute arbitrary commands. + + mailx + 2018-04-08 + 2018-04-08 + 533208 + remote + + + 8.1.2.20160123 + 8.1.2.20160123 + + + +

A utility program for sending and receiving mail, also known as a Mail + User Agent program. +

+
+ +

Multiple vulnerabilities have been discovered in mailx. Please review + the CVE identifiers referenced below for details. +

+
+ +

A remote attacker could execute arbitrary commands.

+
+ +

There is no known workaround at this time.

+
+ +

All mailx users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=mail-client/mailx-8.1.2.20160123" + +
+ + CVE-2004-2771 + CVE-2014-7844 + + chrisadr + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-07.xml new file mode 100644 index 0000000000..e47a94f67e --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-07.xml @@ -0,0 +1,50 @@ + + + + libvirt: Multiple vulnerabilities + Multiple vulnerabilities have been discovered in libvirt, the worst + of which may result in the execution of arbitrary commands. + + libvirt + 2018-04-08 + 2018-04-08 + 647338 + 650018 + local + + + 4.1.0 + 4.1.0 + + + +

libvirt is a C toolkit for manipulating virtual machines.

+
+ +

Multiple vulnerabilities have been discovered in libvirt. Please review + the CVE identifiers referenced below for details. +

+
+ +

A local privileged attacker could execute arbitrary commands or cause a + Denial of Service condition. +

+
+ +

There is no known workaround at this time.

+
+ +

All libvirt users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/libvirt-4.1.0" + +
+ + CVE-2018-5748 + CVE-2018-6764 + + chrisadr + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-08.xml new file mode 100644 index 0000000000..16b0315548 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-08.xml @@ -0,0 +1,61 @@ + + + + QEMU: Multiple vulnerabilities + Multiple vulnerabilities have been found in QEMU, the worst of + which may allow an attacker to execute arbitrary code. + + qemu + 2018-04-08 + 2018-04-08 + 629348 + 638506 + 643432 + 646814 + 649616 + local, remote + + + 2.11.1-r1 + 2.11.1-r1 + + + +

QEMU is a generic and open source machine emulator and virtualizer.

+
+ +

Multiple vulnerabilities have been discovered in QEMU. Please review the + CVE identifiers referenced below for details. +

+
+ +

An attacker could execute arbitrary code, cause a Denial of Service + condition, or obtain sensitive information. +

+
+ +

There is no known workaround at this time.

+
+ +

All QEMU users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/qemu-2.11.1-r1" + +
+ + CVE-2017-13672 + CVE-2017-15124 + CVE-2017-16845 + CVE-2017-17381 + CVE-2017-18030 + CVE-2017-18043 + CVE-2017-5715 + CVE-2018-5683 + CVE-2018-5748 + CVE-2018-7550 + + chrisadr + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-09.xml new file mode 100644 index 0000000000..ab4be11138 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-09.xml @@ -0,0 +1,50 @@ + + + + SPICE VDAgent: Arbitrary command injection + A vulnerability in SPICE VDAgent could allow local attackers to + execute arbitrary commands. + + spice,vdagent + 2018-04-08 + 2018-04-08 + 650020 + local + + + 0.17.0_p20180319 + 0.17.0_p20180319 + + + +

Provides a complete open source solution for remote access to virtual + machines in a seamless way so you can play videos, record audio, share + USB devices and share folders without complications. +

+
+ +

SPICE VDAgent does not properly escape save directory before passing to + shell. +

+
+ +

A local attacker could execute arbitrary commands.

+
+ +

There is no known workaround at this time.

+
+ +

All SPICE VDAgent users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=app-emulation/spice-vdagent-0.17.0_p20180319" + +
+ + CVE-2017-15108 + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-10.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-10.xml new file mode 100644 index 0000000000..03b18e71fa --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-10.xml @@ -0,0 +1,56 @@ + + + + Zend Framework: Multiple vulnerabilities + Multiple vulnerabilities have been found in Zend Framework, the + worst of which could allow attackers to remotely execute arbitrary + commands. + + zendframework + 2018-04-09 + 2018-04-09 + 604182 + remote + + + + 1.12.9 + + + +

Zend Framework is a high quality and open source framework for + developing Web Applications. +

+ +
+ +

Multiple vulnerabilities have been discovered in Zend Framework that + have remain unaddressed. Please review the referenced CVE identifiers for + details. +

+
+ +

Remote attackers could execute arbitrary commands or conduct SQL + injection attacks. +

+
+ +

There is no known workaround at this time.

+
+ +

Gentoo has discontinued support for Zend Framework and recommends that + users unmerge the package: +

+ + + # emerge --unmerge "dev-php/ZendFramework" + +
+ + CVE-2016-10034 + CVE-2016-4861 + CVE-2016-6233 + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk index f381d5b1a3..a94b43e076 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Wed, 04 Apr 2018 14:08:19 +0000 +Mon, 09 Apr 2018 16:08:25 +0000 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit index febf2abf42..bc06f32a40 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit @@ -1 +1 @@ -e07af6df7a81524d31084c5565441abb9e572281 1522807580 2018-04-04T02:06:20+00:00 +fe69ca3972e43ebf2d1f70b51f3af6c00d73c35b 1523289669 2018-04-09T16:01:09+00:00