mirror of
https://github.com/flatcar/scripts.git
synced 2025-08-19 05:21:23 +02:00
bump(metadata/glsa): sync with upstream
This commit is contained in:
David Michael
parent
1907ae4335
commit
31a4e4c512
@ -1,23 +1,23 @@
|
|||||||
-----BEGIN PGP SIGNED MESSAGE-----
|
-----BEGIN PGP SIGNED MESSAGE-----
|
||||||
Hash: SHA512
|
Hash: SHA512
|
||||||
|
|
||||||
MANIFEST Manifest.files.gz 419802 BLAKE2B 77b61430b97be606d07e770dcefecad6df694cb9d174d02e411d0c9124496cc8f3c082d220e88b305fb15b10d7c63b688c68e4484d9efe6cf97b41aabe095755 SHA512 3f233f14b1531babe34f57d6f927c008a3406b144de3e74532b3bf23c806220ffc43906d40c476f43e773cfbdabd98ea035b95415e8a23d7ad3ed93384c13bf7
|
MANIFEST Manifest.files.gz 421065 BLAKE2B e5b50ffe2bff6e1107508e16429b0e9aa8dcd4044034c53166a7d066653c21e085a59cb4e867938b00f904f7abc63ae87d68724f2c506d2f3e384dfebadd3e8d SHA512 d6d92ec0eb389bb118fe14a90c5a7cfa51b633eae98383dd3516d94dae838bb21450c1f86c6da9dd7c536c539a0b941892ba8a40f25bbe44fe414a6659b84cfc
|
||||||
TIMESTAMP 2018-04-04T14:08:23Z
|
TIMESTAMP 2018-04-09T16:08:29Z
|
||||||
-----BEGIN PGP SIGNATURE-----
|
-----BEGIN PGP SIGNATURE-----
|
||||||
|
|
||||||
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlrE3FdfFIAAAAAALgAo
|
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlrLj/1fFIAAAAAALgAo
|
||||||
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
|
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
|
||||||
RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
|
RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
|
||||||
klCOqw//dq72XGk93uVY1A2zF8LLTGinHAwKLl7Jvv5ueZk+fi+y/J5rcWM34KAp
|
klCVng//ZCj2FD+CLhggl2gao3gG2dq439EDmwTErvUaX1G+deBU7GSn8C6/TDji
|
||||||
Sup8n8N4M/i5xMhBpag2ZnMIDyy7X9qGMmr/f0uxfI/jFplhLUJIwLj9tjUPs7Ml
|
m6PpfH2d/9OJNKOvHrzi/DuK6M8wN7gBVL+1R41zOC8YWyp/YGM8cI7w8AEjykSV
|
||||||
tv7Y5x01pQZYGM5w55EXk+basWkFNKS0qza8Gl6gYuHizB90fiWf91vIStgT9sQt
|
LMLl4+XhNKsC6i+QLZNLYXChqxL9oMOvuTtBaNzGncXTeIuXlGUykPB2/8gl3spZ
|
||||||
qgxlFuhM0cg7/4fCRZgKrLz+/CSfpIz0JKqwuNVx+md0OPkpq1LTbQrwUGeyRsi3
|
OHT//cmshfKvX+nMx/K4qKZKopVEN11zyd8HqhM1KlbDbpPxm70tLT4ZJfOhVdR/
|
||||||
U5+J1ugt2E6vgusR2sc4M0jlGPFqKN03maeQRBztepbuF0r6F7ROYQ4fFqT9hxQe
|
Iymfefq8fe1s7E5HFUbnRBtTNzMMPWuhq+JQluWUWn+26uUPn9eaTS+tOMBjz4L2
|
||||||
roprxcAiYqyRV3989+KwjcKu0Bw3eNXuXDZuaqA2FZdhVnfneMjfb8A9RILZz9z8
|
OpNPhyvhWIf72+cCn7g1k3aVn9L+k9jmJOsMjlIhJWu6gN5LlwRv6z89K+YqjBaa
|
||||||
RGCcyrEePJ2kpRoOB5644v0N7iZB1F6Jxm3G8U4GChL97ypxZUcqz/XwJTNYj7YC
|
g9sHCQRL4G6naqyl1v1IHLxDdnBBoDZhq3AYH+F96qWnh6iwXnvSE12yFPtTVIl3
|
||||||
bv0pAMfonPLWLWSH96r404aiAHCJzvnx7pfnKveXDV3ZEv83BeJQ82XtHHCIMlUU
|
oWXpL1Kp+j02v7MZrXmR+vfvomxeuIxvw92iqB1iP15K2BwHjHAd1481NIYUvnbg
|
||||||
lh4xaaB810rPMXN7hkS2TY6Jy7yBANRgnRiOgyMcsPupmpcUzXubFTkKt4il3Iea
|
BSoRbgllLd+jXyr8zMwilppTYBezR9XT+9+rnfczkpSeZpV3eUHgYCLdH01f7/vx
|
||||||
GK1c9W2y9LZlvn3n21KRcgKr7MdZd50UWqiACcAoI4LYQl0zoIwJXz7Ev7zCYnHo
|
n8XhwY/di84Jo6myrefjGa3r9LLS0lDp1q/AV5hBRIkO7HOV5s4C6euYMxI5L5cX
|
||||||
zJ1tIECigaXkxo1M6I9pHSBoKImka2nHe3JJXHuvBoCDgrMpYBM=
|
P1qoJv7630nM0q5BBkFS8e6zX7pRyMUuhvrQQ5cJD3dcpE2hH/c=
|
||||||
=KX1n
|
=lkul
|
||||||
-----END PGP SIGNATURE-----
|
-----END PGP SIGNATURE-----
|
||||||
|
|||||||
Binary file not shown.
55
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-03.xml
vendored
Normal file
55
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-03.xml
vendored
Normal file
@ -0,0 +1,55 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="201804-03">
|
||||||
|
<title>Poppler: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in Poppler, the worst of
|
||||||
|
which could allow a Denial of Service.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">poppler</product>
|
||||||
|
<announced>2018-04-08</announced>
|
||||||
|
<revised count="1">2018-04-08</revised>
|
||||||
|
<bug>644388</bug>
|
||||||
|
<bug>645868</bug>
|
||||||
|
<access>remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="app-text/poppler" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">0.61.1</unaffected>
|
||||||
|
<vulnerable range="lt">0.61.1</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>Poppler is a PDF rendering library based on the xpdf-3.0 code base.</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in Poppler. Please review
|
||||||
|
the CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>A remote attacker, by enticing a user to open a specially crafted PDF,
|
||||||
|
could cause a Denial of Service condition or have other unspecified
|
||||||
|
impacts.
|
||||||
|
</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All Poppler users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=app-text/poppler-0.61.1"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-1000456">
|
||||||
|
CVE-2017-1000456
|
||||||
|
</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-14975">CVE-2017-14975</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-14976">CVE-2017-14976</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-14977">CVE-2017-14977</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2018-04-08T12:41:02Z">b-man</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2018-04-08T14:25:23Z">b-man</metadata>
|
||||||
|
</glsa>
|
||||||
63
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-04.xml
vendored
Normal file
63
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-04.xml
vendored
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="201804-04">
|
||||||
|
<title>cURL: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in cURL, the worst of
|
||||||
|
which could result in a Denial of Service condition.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">curl</product>
|
||||||
|
<announced>2018-04-08</announced>
|
||||||
|
<revised count="1">2018-04-08</revised>
|
||||||
|
<bug>645698</bug>
|
||||||
|
<bug>650056</bug>
|
||||||
|
<access>remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="net-misc/curl" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">7.59.0</unaffected>
|
||||||
|
<vulnerable range="lt">7.59.0</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>A command line tool and library for transferring data with URLs.</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in cURL. Please review the
|
||||||
|
CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>Remote attackers could cause a Denial of Service condition, obtain
|
||||||
|
sensitive information, or have other unspecified impacts.
|
||||||
|
</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All cURL users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=net-misc/curl-7.59.0"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-1000005">
|
||||||
|
CVE-2018-1000005
|
||||||
|
</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-1000007">
|
||||||
|
CVE-2018-1000007
|
||||||
|
</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-1000120">
|
||||||
|
CVE-2018-1000120
|
||||||
|
</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-1000121">
|
||||||
|
CVE-2018-1000121
|
||||||
|
</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-1000122">
|
||||||
|
CVE-2018-1000122
|
||||||
|
</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2018-04-08T14:02:46Z">b-man</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2018-04-08T14:28:57Z">b-man</metadata>
|
||||||
|
</glsa>
|
||||||
59
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-05.xml
vendored
Normal file
59
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-05.xml
vendored
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="201804-05">
|
||||||
|
<title>ISC DHCP: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in ISC DHCP, the worst of
|
||||||
|
which could allow for the remote execution of arbitrary code.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">dhcp</product>
|
||||||
|
<announced>2018-04-08</announced>
|
||||||
|
<revised count="1">2018-04-08</revised>
|
||||||
|
<bug>644708</bug>
|
||||||
|
<bug>649010</bug>
|
||||||
|
<access>remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="net-misc/dhcp" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">4.3.6_p1</unaffected>
|
||||||
|
<vulnerable range="lt">4.3.6_p1</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>ISC DHCP is a Dynamic Host Configuration Protocol (DHCP) client/server.</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in ISC DHCP. Please review
|
||||||
|
the CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>Remote attackers could execute arbitrary code, cause a Denial of Service
|
||||||
|
condition, or have other unspecified impacts.
|
||||||
|
</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There are no known workarounds at this time for CVE-2018-5732 or
|
||||||
|
CVE-2018-5733.
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<p>In accordance with upstream documentation, the recommended workaround
|
||||||
|
for CVE-2017-3144 is, “to disallow access to the OMAPI control port
|
||||||
|
from unauthorized clients (in accordance with best practices for server
|
||||||
|
operation).”
|
||||||
|
</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All DHCP users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=net-misc/dhcp-4.3.6_p1"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-3144">CVE-2017-3144</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5732">CVE-2018-5732</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5733">CVE-2018-5733</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2018-03-13T18:06:24Z">chrisadr</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2018-04-08T16:46:04Z">b-man</metadata>
|
||||||
|
</glsa>
|
||||||
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-06.xml
vendored
Normal file
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-06.xml
vendored
Normal file
@ -0,0 +1,50 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="201804-06">
|
||||||
|
<title>mailx: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities were discovered in mailx, the worst of
|
||||||
|
which may allow a remote attacker to execute arbitrary commands.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">mailx</product>
|
||||||
|
<announced>2018-04-08</announced>
|
||||||
|
<revised count="1">2018-04-08</revised>
|
||||||
|
<bug>533208</bug>
|
||||||
|
<access>remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="mail-client/mailx" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">8.1.2.20160123</unaffected>
|
||||||
|
<vulnerable range="lt">8.1.2.20160123</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>A utility program for sending and receiving mail, also known as a Mail
|
||||||
|
User Agent program.
|
||||||
|
</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in mailx. Please review
|
||||||
|
the CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>A remote attacker could execute arbitrary commands.</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All mailx users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose
|
||||||
|
">=mail-client/mailx-8.1.2.20160123"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2004-2771">CVE-2004-2771</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2014-7844">CVE-2014-7844</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2018-04-08T17:41:56Z">chrisadr</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2018-04-08T23:25:59Z">b-man</metadata>
|
||||||
|
</glsa>
|
||||||
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-07.xml
vendored
Normal file
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-07.xml
vendored
Normal file
@ -0,0 +1,50 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="201804-07">
|
||||||
|
<title>libvirt: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been discovered in libvirt, the worst
|
||||||
|
of which may result in the execution of arbitrary commands.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">libvirt</product>
|
||||||
|
<announced>2018-04-08</announced>
|
||||||
|
<revised count="1">2018-04-08</revised>
|
||||||
|
<bug>647338</bug>
|
||||||
|
<bug>650018</bug>
|
||||||
|
<access>local</access>
|
||||||
|
<affected>
|
||||||
|
<package name="app-emulation/libvirt" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">4.1.0</unaffected>
|
||||||
|
<vulnerable range="lt">4.1.0</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>libvirt is a C toolkit for manipulating virtual machines.</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in libvirt. Please review
|
||||||
|
the CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>A local privileged attacker could execute arbitrary commands or cause a
|
||||||
|
Denial of Service condition.
|
||||||
|
</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All libvirt users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=app-emulation/libvirt-4.1.0"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5748">CVE-2018-5748</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6764">CVE-2018-6764</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2018-04-08T17:45:31Z">chrisadr</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2018-04-08T23:28:32Z">b-man</metadata>
|
||||||
|
</glsa>
|
||||||
61
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-08.xml
vendored
Normal file
61
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-08.xml
vendored
Normal file
@ -0,0 +1,61 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="201804-08">
|
||||||
|
<title>QEMU: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in QEMU, the worst of
|
||||||
|
which may allow an attacker to execute arbitrary code.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">qemu</product>
|
||||||
|
<announced>2018-04-08</announced>
|
||||||
|
<revised count="1">2018-04-08</revised>
|
||||||
|
<bug>629348</bug>
|
||||||
|
<bug>638506</bug>
|
||||||
|
<bug>643432</bug>
|
||||||
|
<bug>646814</bug>
|
||||||
|
<bug>649616</bug>
|
||||||
|
<access>local, remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="app-emulation/qemu" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">2.11.1-r1</unaffected>
|
||||||
|
<vulnerable range="lt">2.11.1-r1</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>QEMU is a generic and open source machine emulator and virtualizer.</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in QEMU. Please review the
|
||||||
|
CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>An attacker could execute arbitrary code, cause a Denial of Service
|
||||||
|
condition, or obtain sensitive information.
|
||||||
|
</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All QEMU users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=app-emulation/qemu-2.11.1-r1"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-13672">CVE-2017-13672</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-15124">CVE-2017-15124</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-16845">CVE-2017-16845</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-17381">CVE-2017-17381</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-18030">CVE-2017-18030</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-18043">CVE-2017-18043</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-5715">CVE-2017-5715</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5683">CVE-2018-5683</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5748">CVE-2018-5748</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-7550">CVE-2018-7550</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2018-04-08T17:31:53Z">chrisadr</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2018-04-08T23:30:08Z">b-man</metadata>
|
||||||
|
</glsa>
|
||||||
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-09.xml
vendored
Normal file
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-09.xml
vendored
Normal file
@ -0,0 +1,50 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="201804-09">
|
||||||
|
<title>SPICE VDAgent: Arbitrary command injection</title>
|
||||||
|
<synopsis>A vulnerability in SPICE VDAgent could allow local attackers to
|
||||||
|
execute arbitrary commands.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">spice,vdagent</product>
|
||||||
|
<announced>2018-04-08</announced>
|
||||||
|
<revised count="1">2018-04-08</revised>
|
||||||
|
<bug>650020</bug>
|
||||||
|
<access>local</access>
|
||||||
|
<affected>
|
||||||
|
<package name="app-emulation/spice-vdagent" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">0.17.0_p20180319</unaffected>
|
||||||
|
<vulnerable range="lt">0.17.0_p20180319</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>Provides a complete open source solution for remote access to virtual
|
||||||
|
machines in a seamless way so you can play videos, record audio, share
|
||||||
|
USB devices and share folders without complications.
|
||||||
|
</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>SPICE VDAgent does not properly escape save directory before passing to
|
||||||
|
shell.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>A local attacker could execute arbitrary commands.</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All SPICE VDAgent users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose
|
||||||
|
">=app-emulation/spice-vdagent-0.17.0_p20180319"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-15108">CVE-2017-15108</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2018-04-08T17:31:09Z">b-man</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2018-04-08T23:32:55Z">b-man</metadata>
|
||||||
|
</glsa>
|
||||||
56
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-10.xml
vendored
Normal file
56
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-10.xml
vendored
Normal file
@ -0,0 +1,56 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="201804-10">
|
||||||
|
<title>Zend Framework: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in Zend Framework, the
|
||||||
|
worst of which could allow attackers to remotely execute arbitrary
|
||||||
|
commands.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">zendframework</product>
|
||||||
|
<announced>2018-04-09</announced>
|
||||||
|
<revised count="1">2018-04-09</revised>
|
||||||
|
<bug>604182</bug>
|
||||||
|
<access>remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="dev-php/ZendFramework" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge"></unaffected>
|
||||||
|
<vulnerable range="le">1.12.9</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>Zend Framework is a high quality and open source framework for
|
||||||
|
developing Web Applications.
|
||||||
|
</p>
|
||||||
|
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in Zend Framework that
|
||||||
|
have remain unaddressed. Please review the referenced CVE identifiers for
|
||||||
|
details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>Remote attackers could execute arbitrary commands or conduct SQL
|
||||||
|
injection attacks.
|
||||||
|
</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>Gentoo has discontinued support for Zend Framework and recommends that
|
||||||
|
users unmerge the package:
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --unmerge "dev-php/ZendFramework"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2016-10034">CVE-2016-10034</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2016-4861">CVE-2016-4861</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2016-6233">CVE-2016-6233</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2018-04-09T00:33:10Z">b-man</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2018-04-09T15:59:52Z">b-man</metadata>
|
||||||
|
</glsa>
|
||||||
@ -1 +1 @@
|
|||||||
Wed, 04 Apr 2018 14:08:19 +0000
|
Mon, 09 Apr 2018 16:08:25 +0000
|
||||||
|
|||||||
@ -1 +1 @@
|
|||||||
e07af6df7a81524d31084c5565441abb9e572281 1522807580 2018-04-04T02:06:20+00:00
|
fe69ca3972e43ebf2d1f70b51f3af6c00d73c35b 1523289669 2018-04-09T16:01:09+00:00
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user