diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest index 96a62a9cda..92a8f84969 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest @@ -1,23 +1,23 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 -MANIFEST Manifest.files.gz 465570 BLAKE2B a62e99817e32fd8ff7f82db3f63ecd455d8d078254d12926bca9349cd7d4cb7525d19b5ca213653d7ca3a28e5f51b7e4f978944f6a7c39fec3994650ada13ff2 SHA512 ee24891578ae08c29634185ea42adbf62dff9fd502bd411c413a0b0088f0d305dd4dba72180ac6793f6d434a7cc1a30d883831d3d40443eae468994ac283a7ef -TIMESTAMP 2020-05-15T14:08:26Z +MANIFEST Manifest.files.gz 517807 BLAKE2B 2ecdb63e9cfe1a1b71d23ab4fe58b057928be5a410ab9012b87ec1e7c917af227099229248e5b2c7dc5b25edb96e4adad920259d956349d0ecbb204178f8da2c SHA512 4ca9cc06a8ae7d4eefdd8a435b92f1f4e675295b618afdb11cf1d7f45b49f0fd5137f7f0c81b60933a8b942fe25de9928a9f4ffe0d5968bae8eae39c95a7da50 +TIMESTAMP 2021-09-03T09:39:09Z -----BEGIN PGP SIGNATURE----- -iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAl6+olpfFIAAAAAALgAo +iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmEx7T1fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY -klBInA//UsEYg3X87qjYposFYkbACD9iS4i63RKctLCgMXD3wNQLH2hP6A3CmAQT -rEuWnPDuWyWJ7NX7RlWWO0IsNn6lcy628Aw/h4fpM8t0NvtmnZflyt1tXznmez/i -0Ws4eyP86Kygz+wBfLWeqc+rKY2GHcB+BtY99SxZ9dr9XoK8/DaLbpN7Af1ljkmK -pdLRKW04PMMUVAoLTolqK5C2SoveY/AkjH6MA4+oKuaQtTQVCjnfgB3O8RumrdBK -WdWPyDR2W45Bp0a25pFcBcIb8KQdbKk8Rr3c/7rpae7UUG62aKzHo6Ej1d5Ih81B -FWtN2cKeUKSrI5FY8oZnZGVfhzJjKGkTwYm6SsNJ9Oa01/Lt/Vb5RBRgozhdVUdj -3zihSZ+2h3JJlo/FGLUnqFK8oihZ21wPdztkWre5moVaQ3gg9DIOSl6w5+MT7gqc -X6qkpkAOxxsKz/EiVJHPqtdzEAwLAGK15qoaiKxoHFHqGDrPjTyWA+qcrZmUo9l8 -MfJ1KPMT+O9uWaOaA4Pnp2enS13q2XpzcoRcsYBKomFezDBOjuZ/Yrq3Cr21ABp+ -rxdlMO1tV0C992S7W9KxEZGHYNaP0kUkIR/jtLWsaTabVqiSJe6IZGsypr8SbEiU -wISVxlE6KbWGSJmaP/F7e7MnBckTOrLB0vx41r/9+kZbR1whfRQ= -=VfoR +klDDdg/9E3xzbHQflhxbmbSuYxUQw+5moNxqX0RH7/BlcY/jtIzF4trigK8Sq+eQ +zawPG+Z46e42+9llPtTeJ/S9fThrYfbJ2F8bw3QlQT6bdwOsi+Gm0x2taeLJM42L +5TQUDlSsB9V0Q41nNpqBn4KKrz7KeSd0B6EFOtgyjIivAR6IiDpn6t8XHHQUAcDt +MqeWOU1AuDvR3spVwNIXiC3nX8hn9LnPk2F/N3tmxAT1IctmW0mZtNxhlbEa48Le +h/ESWkPqsPno/OGGby+qsXyS1+29LFq4dYin+zl9qOdFoqJ/FcbpYYajz7Kg4fT+ +Rt71hIBC9e6N4Vruyj4TGp1UyuQ95W8ff0fuuUGV02dsGZCgN1qdW8RD6x+LtAGn +ee5tLam28eFy6n2M3ACaKdgGfUCQs5UozjR9/KjGjf5ZzMt1O0DYOkGK3lOx90jJ +9R04NMl4lN6NqyzqEn0Gr6ljMyjhXP2VYaqQqtu0ybAezVenIV+xXw99WuA0IUYJ +KEzFaKCB/D4tj6IidGvz3/Zk+Asa1+VxlZ3GoT9jkG4E93doQQk7mcWpulADxYwI +1VYd/u/8ud8LLe6Yq61DZRnoAIyQJYhX8Ij2d54uD+G1vz/Oa+o0nk3yCcJl/Pjj +A1vjJG4Be5NsoFJUVQaxiNcfN0KxGx6Z5RPgGMYlGhkSIjsw56U= +=plvA -----END PGP SIGNATURE----- diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz index 192d458f15..fb3d67f101 100644 Binary files a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz and b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz differ diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200503-22.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200503-22.xml index dcd5c2142e..5bedbe96fb 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200503-22.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200503-22.xml @@ -1,7 +1,7 @@ - KDE: Local Denial of Service + KDE: Local Denial of service KDE is vulnerable to a local Denial of Service attack. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200503-33.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200503-33.xml index c2229fc7fb..1ef5171273 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200503-33.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200503-33.xml @@ -1,7 +1,7 @@ - IPsec-Tools: racoon Denial of Service + IPsec-Tools: racoon Denial of service IPsec-Tools' racoon is affected by a remote Denial of Service vulnerability. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200601-16.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200601-16.xml index ac2bc802e3..0c4f496882 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200601-16.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200601-16.xml @@ -1,7 +1,7 @@ - MyDNS: Denial of Service + MyDNS: Denial of service MyDNS contains a vulnerability that may lead to a Denial of Service attack. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200603-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200603-11.xml index 90b33f414f..0585a3400a 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200603-11.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200603-11.xml @@ -1,7 +1,7 @@ - Freeciv: Denial of Service + Freeciv: Denial of service A memory allocation bug in Freeciv allows a remote attacker to perform a Denial of Service attack. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200604-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200604-09.xml index e680ddc0e8..fb77749e58 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200604-09.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200604-09.xml @@ -1,7 +1,7 @@ - Cyrus-SASL: DIGEST-MD5 Pre-Authentication Denial of Service + Cyrus-SASL: DIGEST-MD5 Pre-Authentication Denial of service Cyrus-SASL contains a vulnerability in the DIGEST-MD5 process that could lead to a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200605-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200605-11.xml index 62de66a80b..3cee0b37ef 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200605-11.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200605-11.xml @@ -1,7 +1,7 @@ - Ruby: Denial of Service + Ruby: Denial of service Ruby WEBrick and XMLRPC servers are vulnerable to Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200606-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200606-11.xml index a58e8de973..c4ad483ce0 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200606-11.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200606-11.xml @@ -1,7 +1,7 @@ - JPEG library: Denial of Service + JPEG library: Denial of service The JPEG library is vulnerable to a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200606-19.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200606-19.xml index c0fec98a63..1c54e139b6 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200606-19.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200606-19.xml @@ -1,7 +1,7 @@ - Sendmail: Denial of Service + Sendmail: Denial of service Faulty multipart MIME messages can cause forked Sendmail processes to crash. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200606-26.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200606-26.xml index 22e4caf92e..ce147a2f36 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200606-26.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200606-26.xml @@ -1,7 +1,7 @@ - EnergyMech: Denial of Service + EnergyMech: Denial of service A Denial of Service vulnerability was discovered in EnergyMech that is easily exploitable via IRC. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200608-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200608-09.xml index ba8779a96c..85072294a7 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200608-09.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200608-09.xml @@ -1,7 +1,7 @@ - MySQL: Denial of Service + MySQL: Denial of service An authenticated user can crash MySQL through invalid parameters to the date_format function. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200608-23.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200608-23.xml index a93902eb2e..2fc97981e5 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200608-23.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200608-23.xml @@ -1,7 +1,7 @@ - Heartbeat: Denial of Service + Heartbeat: Denial of service Heartbeat is vulnerable to a Denial of Service which can be triggered by a remote attacker without authentication. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200609-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200609-03.xml index bfc9021743..92a3af875a 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200609-03.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200609-03.xml @@ -1,7 +1,7 @@ - OpenTTD: Remote Denial of Service + OpenTTD: Remote Denial of service The OpenTTD server is vulnerable to a remote Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200609-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200609-11.xml index 2ac89d018f..bc717d5570 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200609-11.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200609-11.xml @@ -1,7 +1,7 @@ - BIND: Denial of Service + BIND: Denial of service ISC BIND contains two vulnerabilities allowing a Denial of Service under certain conditions. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200609-17.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200609-17.xml index 7533659d3e..3a4a79d4b4 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200609-17.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200609-17.xml @@ -1,7 +1,7 @@ - OpenSSH: Denial of Service + OpenSSH: Denial of service A flaw in the OpenSSH daemon allows remote unauthenticated attackers to cause a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200609-20.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200609-20.xml index 2764e38d94..d1b853bc63 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200609-20.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200609-20.xml @@ -1,7 +1,7 @@ - DokuWiki: Shell command injection and Denial of Service + DokuWiki: Shell command injection and Denial of service DokuWiki is vulnerable to shell command injection and Denial of Service attacks when using ImageMagick. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200611-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200611-09.xml index e920101985..1dec8d5fbb 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200611-09.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200611-09.xml @@ -1,7 +1,7 @@ - libpng: Denial of Service + libpng: Denial of service A vulnerability in libpng may allow a remote attacker to crash applications that handle untrusted images. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200612-18.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200612-18.xml index 1a43445064..5ed634ad43 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200612-18.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200612-18.xml @@ -1,7 +1,7 @@ - ClamAV: Denial of Service + ClamAV: Denial of service ClamAV is vulnerable to Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200701-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200701-01.xml index 7f9efc3a29..2671dcd809 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200701-01.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200701-01.xml @@ -1,7 +1,7 @@ - DenyHosts: Denial of Service + DenyHosts: Denial of service DenyHosts does not correctly parse log entries, potentially causing a remote Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200701-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200701-05.xml index 48768ef296..37c4f19e04 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200701-05.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200701-05.xml @@ -1,7 +1,7 @@ - KDE kfile JPEG info plugin: Denial of Service + KDE kfile JPEG info plugin: Denial of service The KDE kfile JPEG info plugin of kdegraphics could enter an endless loop leading to a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200701-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200701-09.xml index 35197acf50..c2c0ae1fe2 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200701-09.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200701-09.xml @@ -1,7 +1,7 @@ - oftpd: Denial of Service + oftpd: Denial of service An assertion in oftpd could lead to a denial of service vulnerability. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200701-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200701-14.xml index f3dff2ebb7..8fc60c481f 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200701-14.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200701-14.xml @@ -1,7 +1,7 @@ - Mod_auth_kerb: Denial of Service + Mod_auth_kerb: Denial of service Mod_auth_kerb is vulnerable to a buffer overflow possibly allowing a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200702-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200702-03.xml index 22952e8493..11a93ad716 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200702-03.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200702-03.xml @@ -1,7 +1,7 @@ - Snort: Denial of Service + Snort: Denial of service Snort contains a vulnerability in the rule matching algorithm that could result in a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200702-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200702-05.xml index 0f8a14baba..98d513b6fd 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200702-05.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200702-05.xml @@ -1,7 +1,7 @@ - Fail2ban: Denial of Service + Fail2ban: Denial of service A flaw in Fail2ban may allow remote attackers to deny access to arbitrary hosts. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200702-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200702-06.xml index 3e3f503e4e..1f3c0b9369 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200702-06.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200702-06.xml @@ -1,7 +1,7 @@ - BIND: Denial of Service + BIND: Denial of service ISC BIND contains two vulnerabilities allowing a Denial of Service under certain conditions. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-02.xml index 9785ebf3dc..7c75cc5b2b 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-02.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-02.xml @@ -1,7 +1,7 @@ - SpamAssassin: Long URI Denial of Service + SpamAssassin: Long URI Denial of service SpamAssassin is vulnerable to a Denial of Service attack. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-03.xml index 8a543ec90f..408b8fb5cf 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-03.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-03.xml @@ -1,7 +1,7 @@ - ClamAV: Denial of Service + ClamAV: Denial of service ClamAV contains two vulnerabilities allowing a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-12.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-12.xml index be1d5010c7..c6ed3db7e6 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-12.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-12.xml @@ -1,7 +1,7 @@ - SILC Server: Denial of Service + SILC Server: Denial of service SILC Server is affected by a Denial of Service vulnerability. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-14.xml index b2fcc2b2d9..49cc182ad3 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-14.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-14.xml @@ -1,7 +1,7 @@ - Asterisk: SIP Denial of Service + Asterisk: SIP Denial of service Asterisk is vulnerable to Denial of Service in the SIP channel. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-27.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-27.xml index 4f7898a76e..5d1bddf411 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-27.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-27.xml @@ -1,7 +1,7 @@ - Squid: Denial of Service + Squid: Denial of service Squid is affected by a Denial of Service vulnerability. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-28.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-28.xml index 1004180daa..5e2265c331 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-28.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200703-28.xml @@ -1,7 +1,7 @@ - CUPS: Denial of Service + CUPS: Denial of service CUPS incorrectly handles partially-negotiated SSL connections allowing for a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200704-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200704-11.xml index 3f9ab070a1..c8ff587f0f 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200704-11.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200704-11.xml @@ -1,7 +1,7 @@ - Vixie Cron: Denial of Service + Vixie Cron: Denial of service The Gentoo implementation of Vixie Cron is vulnerable to a local Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200704-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200704-13.xml index e41f921b22..28ebd44ba7 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200704-13.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200704-13.xml @@ -1,7 +1,7 @@ - File: Denial of Service + File: Denial of service A vulnerability has been discovered in file allowing for a denial of service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200704-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200704-14.xml index e4e6fe5c70..5c7ec666f4 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200704-14.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200704-14.xml @@ -1,7 +1,7 @@ - FreeRADIUS: Denial of Service + FreeRADIUS: Denial of service A memory leak has been discovered in FreeRADIUS, possibly allowing for a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200704-22.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200704-22.xml index d8e3e96f32..3a176a3c6f 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200704-22.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200704-22.xml @@ -1,7 +1,7 @@ - BEAST: Denial of Service + BEAST: Denial of service A vulnerability has been discovered in BEAST allowing for a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200705-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200705-04.xml index 5978092a4c..30a4532283 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200705-04.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200705-04.xml @@ -1,7 +1,7 @@ - Apache mod_perl: Denial of Service + Apache mod_perl: Denial of service The mod_perl Apache module is vulnerable to a Denial of Service when processing regular expressions. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200705-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200705-05.xml index 6d950b3cfe..18bccf17f9 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200705-05.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200705-05.xml @@ -1,7 +1,7 @@ - Quagga: Denial of Service + Quagga: Denial of service A vulnerability has been discovered in Quagga allowing for a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200705-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200705-09.xml index 577098b4b9..65861b5fe6 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200705-09.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200705-09.xml @@ -1,7 +1,7 @@ - IPsec-Tools: Denial of Service + IPsec-Tools: Denial of service IPsec-Tools contains a vulnerability that allows a remote attacker to crash the IPsec tunnel. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200705-24.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200705-24.xml index 6479d816ed..de581b3b95 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200705-24.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200705-24.xml @@ -1,7 +1,7 @@ - libpng: Denial of Service + libpng: Denial of service A vulnerability in libpng may allow a remote attacker to crash applications that handle untrusted images. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200707-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200707-13.xml index ce5738fe43..b453866225 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200707-13.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200707-13.xml @@ -1,7 +1,7 @@ - Fail2ban: Denial of Service + Fail2ban: Denial of service Fail2ban is vulnerable to a Denial of Service attack. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200708-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200708-04.xml index 6a40c42514..6dfe88cabe 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200708-04.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200708-04.xml @@ -1,7 +1,7 @@ - ClamAV: Denial of Service + ClamAV: Denial of service A vulnerability has been discovered in ClamAV, allowing for a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200708-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200708-14.xml index c508dda3b7..99f8ebbbac 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200708-14.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200708-14.xml @@ -1,7 +1,7 @@ - NVIDIA drivers: Denial of Service + NVIDIA drivers: Denial of service A vulnerability has been discovered in the NVIDIA graphic drivers, allowing for a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200709-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200709-11.xml index 08bd14227d..9eafab06f7 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200709-11.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200709-11.xml @@ -1,7 +1,7 @@ - GDM: Local Denial of Service + GDM: Local Denial of service GDM can be crashed by a local user, preventing it from managing future displays. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200710-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200710-14.xml index 43b9e66728..62556ffae5 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200710-14.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200710-14.xml @@ -1,7 +1,7 @@ - DenyHosts: Denial of Service + DenyHosts: Denial of service DenyHosts does not correctly parse log entries, potentially causing a remote Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200711-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200711-09.xml index 74f22b4a61..d1157db456 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200711-09.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200711-09.xml @@ -1,7 +1,7 @@ - MadWifi: Denial of Service + MadWifi: Denial of service MadWifi does not correctly process beacon frames which can lead to a remotely triggered Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200711-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200711-13.xml index 173e6eee72..b5fae92bd6 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200711-13.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200711-13.xml @@ -1,7 +1,7 @@ - 3proxy: Denial of Service + 3proxy: Denial of service A vulnerability has been discovered in 3proxy, possibly resulting in a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200711-25.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200711-25.xml index 76d1de6e64..2f8d6ecd06 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200711-25.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200711-25.xml @@ -1,7 +1,7 @@ - MySQL: Denial of Service + MySQL: Denial of service A Denial of Service vulnerability was found in MySQL. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200711-31.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200711-31.xml index 648863f135..c2ad71fe74 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200711-31.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200711-31.xml @@ -1,7 +1,7 @@ - Net-SNMP: Denial of Service + Net-SNMP: Denial of service A Denial of Service vulnerability has been discovered in Net-SNMP when processing GETBULK requests. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200712-12.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200712-12.xml index 7c3efd5ec3..80c56b1811 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200712-12.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200712-12.xml @@ -1,7 +1,7 @@ - IRC Services: Denial of Service + IRC Services: Denial of service A Denial of Service vulnerability has been reported in IRC Services. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200712-19.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200712-19.xml index 0f6a2b97d9..0068fec39b 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200712-19.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200712-19.xml @@ -1,7 +1,7 @@ - Syslog-ng: Denial of Service + Syslog-ng: Denial of service A Denial of Service vulnerability has been discovered in Syslog-ng. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-04.xml index d3e4a272fc..8cfc9c9fd3 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-04.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-04.xml @@ -1,7 +1,7 @@ - OpenAFS: Denial of Service + OpenAFS: Denial of service A Denial of Service vulnerability has been discovered in OpenAFS. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-05.xml index b859a1c011..f24ca70c44 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-05.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-05.xml @@ -1,7 +1,7 @@ - Squid: Denial of Service + Squid: Denial of service A Denial of Service vulnerability has been reported in Squid. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-13.xml index 3ebdb971b5..387976aae9 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-13.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-13.xml @@ -1,7 +1,7 @@ - ngIRCd: Denial of Service + ngIRCd: Denial of service ngIRCd does not properly sanitize commands sent by users, allowing for a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-16.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-16.xml index 875199ea73..1613eb4540 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-16.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-16.xml @@ -1,7 +1,7 @@ - MaraDNS: CNAME Denial of Service + MaraDNS: CNAME Denial of service MaraDNS is prone to a Denial of Service vulnerability impacting CNAME resolution. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-17.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-17.xml index 9e4f8f009d..641d7c5e38 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-17.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-17.xml @@ -1,7 +1,7 @@ - Netkit FTP Server: Denial of Service + Netkit FTP Server: Denial of service Netkit FTP Server contains a Denial of Service vulnerability. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-20.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-20.xml index d46c67897e..a691335980 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-20.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200801-20.xml @@ -1,7 +1,7 @@ - libxml2: Denial of Service + libxml2: Denial of service A Denial of Service vulnerability has been reported in libxml2. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200802-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200802-08.xml index 60f2a9054f..34f5fae290 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200802-08.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200802-08.xml @@ -1,7 +1,7 @@ - Boost: Denial of Service + Boost: Denial of service Two vulnerabilities have been reported in Boost, each one possibly resulting in a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200803-22.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200803-22.xml index 00c1b30f8e..9e0f0c9515 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200803-22.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200803-22.xml @@ -1,7 +1,7 @@ - LIVE555 Media Server: Denial of Service + LIVE555 Media Server: Denial of service A Denial of Service vulnerability has been reported in LIVE555 Media Server. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200803-32.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200803-32.xml index cc5d432c44..daa30e7488 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200803-32.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200803-32.xml @@ -1,7 +1,7 @@ - Wireshark: Denial of Service + Wireshark: Denial of service Multiple Denial of Service vulnerabilities have been discovered in Wireshark. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200804-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200804-02.xml index 29c4052825..c6f4d547ca 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200804-02.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200804-02.xml @@ -1,7 +1,7 @@ - bzip2: Denial of Service + bzip2: Denial of service A buffer overread vulnerability has been discovered in Bzip2. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200804-19.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200804-19.xml index ec5409c1e7..44b2e47761 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200804-19.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200804-19.xml @@ -1,7 +1,7 @@ - PHP Toolkit: Data disclosure and Denial of Service + PHP Toolkit: Data disclosure and Denial of service PHP Toolkit does not quote parameters, allowing for PHP source code disclosure on Apache, and a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200804-26.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200804-26.xml index 152bb1ead8..9ef4614933 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200804-26.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200804-26.xml @@ -1,7 +1,7 @@ - Openfire: Denial of Service + Openfire: Denial of service A design error in Openfire might lead to a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200805-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200805-05.xml index e10026a9b8..ee55e151f1 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200805-05.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200805-05.xml @@ -1,7 +1,7 @@ - Wireshark: Denial of Service + Wireshark: Denial of service Multiple Denial of Service vulnerabilities have been discovered in Wireshark. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200805-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200805-08.xml index b966afc4e5..02e9b52498 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200805-08.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200805-08.xml @@ -1,7 +1,7 @@ - InspIRCd: Denial of Service + InspIRCd: Denial of service A buffer overflow in InspIRCd allows remote attackers to cause a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200805-15.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200805-15.xml index 8b7c2bfc9f..96643bbef6 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200805-15.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200805-15.xml @@ -1,7 +1,7 @@ - libid3tag: Denial of Service + libid3tag: Denial of service A Denial of Service vulnerability was found in libid3tag. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200806-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200806-08.xml index 07c01edbac..d0c5a77a54 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200806-08.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200806-08.xml @@ -1,7 +1,7 @@ - OpenSSL: Denial of Service + OpenSSL: Denial of service Two vulnerabilities might allow for a Denial of Service of daemons using OpenSSL. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200807-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200807-06.xml index 6febbf8e29..4c8f81534f 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200807-06.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200807-06.xml @@ -1,7 +1,7 @@ - Apache: Denial of Service + Apache: Denial of service Multiple vulnerabilities in Apache might lead to a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200808-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200808-04.xml index 65dc75fa10..56e32abcfd 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200808-04.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200808-04.xml @@ -1,7 +1,7 @@ - Wireshark: Denial of Service + Wireshark: Denial of service Multiple Denial of Service vulnerabilities have been discovered in Wireshark. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200808-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200808-05.xml index 7ca04ba842..eb4a3291ba 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200808-05.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200808-05.xml @@ -1,7 +1,7 @@ - ISC DHCP: Denial of Service + ISC DHCP: Denial of service A Denial of Service vulnerability was discovered in ISC DHCP. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200809-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200809-09.xml index 86b8b82925..dbcb6a4033 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200809-09.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200809-09.xml @@ -1,7 +1,7 @@ - Postfix: Denial of Service + Postfix: Denial of service A memory leak in Postfix might allow local users to cause a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200809-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200809-11.xml index d2b3e8b6ed..d52daa78b5 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200809-11.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200809-11.xml @@ -1,7 +1,7 @@ - HAVP: Denial of Service + HAVP: Denial of service A Denial of Service vulnerability has been reported in HAVP. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200812-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200812-03.xml index 64a9b2625c..18468b710e 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200812-03.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200812-03.xml @@ -1,7 +1,7 @@ - IPsec-Tools: racoon Denial of Service + IPsec-Tools: racoon Denial of service IPsec-Tools' racoon is affected by a remote Denial of Service vulnerability. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200901-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200901-04.xml index db1df4fc44..216cca9b51 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200901-04.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200901-04.xml @@ -1,7 +1,7 @@ - D-Bus: Denial of Service + D-Bus: Denial of service An error condition can cause D-Bus to crash. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200901-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200901-11.xml index 3321fd6e7e..4a5984b720 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200901-11.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200901-11.xml @@ -1,7 +1,7 @@ - Avahi: Denial of Service + Avahi: Denial of service A Denial of Service vulnerability has been discovered in Avahi. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200901-15.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200901-15.xml index 41fba986c0..f76b93c35a 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200901-15.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200901-15.xml @@ -1,7 +1,7 @@ - Net-SNMP: Denial of Service + Net-SNMP: Denial of service A vulnerability in Net-SNMP could lead to a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200903-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200903-13.xml index d806329896..fc0f88cdaa 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200903-13.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200903-13.xml @@ -1,7 +1,7 @@ - MPFR: Denial of Service + MPFR: Denial of service Multiple buffer overflows in MPFR might lead to a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200903-19.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200903-19.xml index ad6e89cfac..695675b087 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200903-19.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200903-19.xml @@ -1,7 +1,7 @@ - Xerces-C++: Denial of Service + Xerces-C++: Denial of service An error in Xerces-C++ allows for a Denial of Service via malicious XML schema files. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200903-40.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200903-40.xml index 5f8c75c50b..2cebd0751e 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200903-40.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200903-40.xml @@ -1,7 +1,7 @@ - Analog: Denial of Service + Analog: Denial of service A Denial of Service vulnerability was discovered in Analog. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200904-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200904-04.xml index 6c52deb11a..872ca9feab 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200904-04.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200904-04.xml @@ -1,7 +1,7 @@ - WeeChat: Denial of Service + WeeChat: Denial of service A processing error in WeeChat might lead to a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200904-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200904-08.xml index f3139bf89b..fc55291362 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200904-08.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200904-08.xml @@ -1,7 +1,7 @@ - OpenSSL: Denial of Service + OpenSSL: Denial of service An error in OpenSSL might allow for a Denial of Service when printing certificate details. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200904-10.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200904-10.xml index 193c67427b..fcb96cd0ec 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200904-10.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200904-10.xml @@ -1,7 +1,7 @@ - Avahi: Denial of Service + Avahi: Denial of service An error in Avahi might lead to a Denial of Service via network and CPU consumption. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200904-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200904-13.xml index 9764bf9415..ae0a94d91e 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200904-13.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200904-13.xml @@ -1,7 +1,7 @@ - Ventrilo: Denial of Service + Ventrilo: Denial of service A vulnerability has been discovered in Ventrilo, allowing for a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200905-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200905-03.xml index 75e027433c..df09584c41 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200905-03.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200905-03.xml @@ -1,7 +1,7 @@ - IPSec Tools: Denial of Service + IPSec Tools: Denial of service Multiple errors in the IPSec Tools racoon daemon might allow remote attackers to cause a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200905-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200905-06.xml index f0daa27a27..714676172c 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200905-06.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200905-06.xml @@ -1,7 +1,7 @@ - acpid: Denial of Service + acpid: Denial of service An error in acpid might allow remote attackers to cause a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200906-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200906-02.xml index 9a9e750e1a..257a1415bd 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200906-02.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200906-02.xml @@ -1,7 +1,7 @@ - Ruby: Denial of Service + Ruby: Denial of service A flaw in the Ruby standard library might allow remote attackers to cause a Denial of Service attack. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200907-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200907-02.xml index d9211d2c82..beec6bcaba 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200907-02.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200907-02.xml @@ -1,7 +1,7 @@ - ModSecurity: Denial of Service + ModSecurity: Denial of service Two vulnerabilities in ModSecurity might lead to a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200907-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200907-05.xml index 265b7af3e6..d506ec04c3 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200907-05.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200907-05.xml @@ -1,7 +1,7 @@ - git: git-daemon Denial of Service + git: git-daemon Denial of service An error in git-daemon might lead to a Denial of Service via resource consumption. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200908-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200908-02.xml index 71c2cc9cba..77eac4fc16 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200908-02.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200908-02.xml @@ -1,7 +1,7 @@ - BIND: Denial of Service + BIND: Denial of service Dynamic Update packets can cause a Denial of Service in the BIND daemon. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200908-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200908-07.xml index d6fea11da9..5a3d87de1b 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200908-07.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200908-07.xml @@ -1,7 +1,7 @@ - Perl Compress::Raw modules: Denial of Service + Perl Compress::Raw modules: Denial of service An off-by-one error in Compress::Raw::Zlib and Compress::Raw::Bzip2 might lead to a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200908-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200908-08.xml index 0ccedf026c..4b5a418e28 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200908-08.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200908-08.xml @@ -1,7 +1,7 @@ - ISC DHCP: dhcpd Denial of Service + ISC DHCP: dhcpd Denial of service dhcpd as included in the ISC DHCP implementation does not properly handle special conditions, leading to a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200909-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200909-05.xml index 40704e5ada..a398bc011e 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200909-05.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200909-05.xml @@ -1,7 +1,7 @@ - Openswan: Denial of Service + Openswan: Denial of service Multiple vulnerabilities in the pluto IKE daemon of Openswan might allow remote attackers to cause a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200909-16.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200909-16.xml index 851049fae1..64761d810e 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200909-16.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-200909-16.xml @@ -1,7 +1,7 @@ - Wireshark: Denial of Service + Wireshark: Denial of service Multiple vulnerabilities have been discovered in Wireshark which allow for Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201001-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201001-01.xml index fb7fd3c0c5..a463491468 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201001-01.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201001-01.xml @@ -1,7 +1,7 @@ - NTP: Denial of Service + NTP: Denial of service A Denial of Service condition in ntpd can cause excessive CPU or bandwidth consumption. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201006-17.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201006-17.xml index ab4d122e45..32888ad18a 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201006-17.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201006-17.xml @@ -1,7 +1,7 @@ - lighttpd: Denial of Service + lighttpd: Denial of service A processing error in lighttpd might result in a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201009-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201009-07.xml index 46008757c7..1500716099 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201009-07.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201009-07.xml @@ -1,7 +1,7 @@ - libxml2: Denial of Service + libxml2: Denial of service Multiple Denial of Services vulnerabilities were found in libxml2. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201110-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201110-07.xml index 9a25d95636..8d7182803f 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201110-07.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201110-07.xml @@ -1,7 +1,7 @@ - vsftpd: Denial of Service + vsftpd: Denial of service A Denial of Service vulnerability was found in vsftpd. vsftpd 2011-10-10 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201110-12.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201110-12.xml index 7062b51845..90c7062201 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201110-12.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201110-12.xml @@ -1,7 +1,7 @@ - Unbound: Denial of Service + Unbound: Denial of service Multiple Denial of Service vulnerabilities were found in Unbound. unbound 2011-10-15 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201110-17.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201110-17.xml index ea0e65c2c6..47fefb9d03 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201110-17.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201110-17.xml @@ -1,7 +1,7 @@ - Avahi: Denial of Service + Avahi: Denial of service Multiple vulnerabilities were found in Avahi, allowing for Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201202-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201202-03.xml index 3baeb6dd9e..0da4cebd6c 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201202-03.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201202-03.xml @@ -1,7 +1,7 @@ - MaraDNS: Denial of Service + MaraDNS: Denial of service A hash collision vulnerability in MaraDNS allows remote attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201202-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201202-04.xml index 280556e84d..96096d8090 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201202-04.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201202-04.xml @@ -1,7 +1,7 @@ - PowerDNS: Denial of Service + PowerDNS: Denial of service A vulnerability in PowerDNS could allow a remote attacker to create a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201202-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201202-06.xml index 18e40c3c20..f840c259f8 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201202-06.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201202-06.xml @@ -1,7 +1,7 @@ - Asterisk: Denial of Service + Asterisk: Denial of service A vulnerability in Asterisk could allow a remote attacker to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201203-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201203-04.xml index 0c57f93286..a7d5a7b852 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201203-04.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201203-04.xml @@ -1,7 +1,7 @@ - libxml2: Denial of Service + libxml2: Denial of service A hash collision vulnerability in libxml2 allows remote attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201203-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201203-05.xml index 95ac56dff1..17d12d9339 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201203-05.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201203-05.xml @@ -1,7 +1,7 @@ - Rack: Denial of Service + Rack: Denial of service A hash collision vulnerability in Rack allows remote attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201203-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201203-08.xml index 0911c04697..bba0509f08 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201203-08.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201203-08.xml @@ -1,7 +1,7 @@ - libxslt: Denial of Service + libxslt: Denial of service A vulnerability in libxslt could result in Denial of Service. libxslt 2012-03-06 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201203-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201203-13.xml index b276e27990..98d1f6edf9 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201203-13.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201203-13.xml @@ -1,7 +1,7 @@ - Openswan: Denial of Service + Openswan: Denial of service Multiple vulnerabilities in Openswan may create a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201206-20.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201206-20.xml index aeda09bcb1..ac53364d11 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201206-20.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201206-20.xml @@ -1,7 +1,7 @@ - gdk-pixbuf: Denial of Service + gdk-pixbuf: Denial of service Multiple vulnerabilities in gdk-pixbuf may create a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201207-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201207-06.xml index fc5aef2fca..3e4ce1c21d 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201207-06.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201207-06.xml @@ -1,7 +1,7 @@ - JRuby: Denial of Service + JRuby: Denial of service A hash collision vulnerability in JRuby allows remote attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201207-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201207-07.xml index b7b19be392..1dbaabc348 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201207-07.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201207-07.xml @@ -1,7 +1,7 @@ - Keepalived: Denial of Service + Keepalived: Denial of service Keepalived uses world-writable PID files, allowing a local attacker to kill arbitrary processes. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-08.xml index 320c8db037..e051dc3d8b 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-08.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-08.xml @@ -1,7 +1,7 @@ - SquidClamav: Denial of Service + SquidClamav: Denial of service A vulnerability in SquidClamav may result in Denial of Service. squidclamav 2012-09-24 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-09.xml index 516acf6ab6..33a7516c26 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-09.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-09.xml @@ -1,7 +1,7 @@ - Atheme IRC Services: Denial of Service + Atheme IRC Services: Denial of service A vulnerability has been found in Atheme which may lead to Denial of Service or a bypass of security restrictions. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-12.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-12.xml index 6d3624bc43..8fefa88559 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-12.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-12.xml @@ -1,7 +1,7 @@ - Libtasn1: Denial of Service + Libtasn1: Denial of service A vulnerability in Libtasn1 might cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-14.xml index 2e41c9e63e..16c0ffb00f 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-14.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-14.xml @@ -1,7 +1,7 @@ - file: Denial of Service + file: Denial of service A vulnerability in file could result in Denial of Service. file 2012-09-26 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-20.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-20.xml index 19cf6109fe..69c91c77d8 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-20.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201209-20.xml @@ -1,7 +1,7 @@ - mod_rpaf: Denial of Service + mod_rpaf: Denial of service A vulnerability in mod_rpaf may result in Denial of Service. mod_rpaf 2012-09-27 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201301-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201301-06.xml index c51e55f944..612b1dbab7 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201301-06.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201301-06.xml @@ -1,7 +1,7 @@ - ISC DHCP: Denial of Service + ISC DHCP: Denial of service Multiple vulnerabilities have been found in ISC DHCP, the worst of which may allow remote Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201308-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201308-02.xml index bab7fa6e14..f5a0b5daeb 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201308-02.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201308-02.xml @@ -1,7 +1,7 @@ - D-Bus: Denial of Service + D-Bus: Denial of service A vulnerability has been found in D-Bus which allows a local user to cause a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201309-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201309-01.xml index 1bf4114b17..658ec5e207 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201309-01.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201309-01.xml @@ -1,7 +1,7 @@ - Cyrus-SASL: Denial of Service + Cyrus-SASL: Denial of service A NULL pointer dereference in Cyrus-SASL may allow remote attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201309-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201309-03.xml index 983ce843dd..8625528ca7 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201309-03.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201309-03.xml @@ -1,7 +1,7 @@ - Xlockmore: Denial of Service + Xlockmore: Denial of service A buffer overflow in Xlockmore might allow remote attackers to cause a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201311-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201311-04.xml index e1730eca26..f32c058f87 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201311-04.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201311-04.xml @@ -1,7 +1,7 @@ - Vixie cron: Denial of Service + Vixie cron: Denial of service A vulnerability has been found in Vixie cron, allowing local attackers to conduct symlink attacks. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201311-18.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201311-18.xml index 799c3ecf56..7d4c35954a 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201311-18.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201311-18.xml @@ -1,7 +1,7 @@ - Unbound: Denial of Service + Unbound: Denial of service Multiple Denial of Service vulnerabilities have been found in Unbound. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201312-15.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201312-15.xml index 88f6a6288a..027a038d19 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201312-15.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201312-15.xml @@ -1,7 +1,7 @@ - Tinyproxy: Denial of Service + Tinyproxy: Denial of service A vulnerability has been found in Tinyproxy, allows remote attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201401-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201401-05.xml index 2e856e71a1..e0504d2e70 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201401-05.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201401-05.xml @@ -1,7 +1,7 @@ - ISC DHCP: Denial of Service + ISC DHCP: Denial of service A memory exhaustion vulnerability in ISC DHCP could lead to Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201401-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201401-07.xml index c0e733e083..d7b49ab80c 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201401-07.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201401-07.xml @@ -1,7 +1,7 @@ - libxslt: Denial of Service + libxslt: Denial of service Multiple Denial of Service vulnerabilities have been found in libxslt. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201401-34.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201401-34.xml index bba64bbbcf..9c7660a1ef 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201401-34.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201401-34.xml @@ -1,7 +1,7 @@ - BIND: Denial of Service + BIND: Denial of service Multiple vulnerabilities have been found in BIND, possibly resulting in Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201402-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201402-11.xml index 3b42a11ed9..32b8a63295 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201402-11.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201402-11.xml @@ -1,7 +1,7 @@ - Links: Denial of Service + Links: Denial of service An integer overflow in Links might allow remote attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201402-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201402-14.xml index f1c8a0032b..ffb27ce0e4 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201402-14.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201402-14.xml @@ -1,7 +1,7 @@ - International Components for Unicode: Denial of Service + International Components for Unicode: Denial of service Two vulnerabilities in International Components for Unicode might allow remote attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201402-25.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201402-25.xml index e4bd8e090e..927714d1a9 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201402-25.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201402-25.xml @@ -1,7 +1,7 @@ - OpenSSL: Denial of Service + OpenSSL: Denial of service A vulnerability in OpenSSL's handling of TLS handshakes could result in a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201403-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201403-03.xml index 4d1dd97ce5..b951172bdd 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201403-03.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201403-03.xml @@ -1,7 +1,7 @@ - file: Denial of Service + file: Denial of service A vulnerability in file could result in Denial of Service. file 2014-03-13 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201403-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201403-04.xml index 9c88b36634..fddfad7996 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201403-04.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201403-04.xml @@ -1,7 +1,7 @@ - QtCore: Denial of Service + QtCore: Denial of service A vulnerability in QXmlSimpleReader class can be used to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-02.xml index feb538b9f1..ca980569f6 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-02.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-02.xml @@ -1,7 +1,7 @@ - libSRTP: Denial of Service + libSRTP: Denial of service A vulnerability in libSRTP can result in a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-05.xml index 4d4d968a9a..314dac6647 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-05.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-05.xml @@ -1,7 +1,7 @@ - Asterisk: Denial of Service + Asterisk: Denial of service Multiple buffer overflows in Asterisk might allow remote attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-14.xml index 5983113bd5..cd8bcad2f5 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-14.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-14.xml @@ -1,7 +1,7 @@ - Ruby OpenID: Denial of Service + Ruby OpenID: Denial of service A vulnerability in Ruby OpenID may lead to Denial of Service. ruby-openid 2014-05-17 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-16.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-16.xml index 229014a3a9..744a1d2bc4 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-16.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-16.xml @@ -1,7 +1,7 @@ - Mono: Denial of Service + Mono: Denial of service A hash collision vulnerability in Mono allows remote attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-20.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-20.xml index 8ed494ebb4..c889f9dfe1 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-20.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-20.xml @@ -1,7 +1,7 @@ - JBIG-KIT: Denial of Service + JBIG-KIT: Denial of service A stack-based buffer overflow in JBIG-KIT might allow remote attackers to cause a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-21.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-21.xml index 342671e410..f95cfa4e17 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-21.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-21.xml @@ -1,7 +1,7 @@ - Charybdis, ShadowIRCd: Denial of Service + Charybdis, ShadowIRCd: Denial of service A vulnerability has been found in Charybdis and ShadowIRCd, possibly resulting in remote Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-24.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-24.xml index 069f8d1f85..412fdc38ca 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-24.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201405-24.xml @@ -1,7 +1,7 @@ - Apache Portable Runtime, APR Utility Library: Denial of Service + Apache Portable Runtime, APR Utility Library: Denial of service Memory consumption errors in Apache Portable Runtime and APR Utility Library could result in Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201406-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201406-04.xml index 958e65c665..a99c235d5a 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201406-04.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201406-04.xml @@ -1,7 +1,7 @@ - SystemTap: Denial of Service + SystemTap: Denial of service A vulnerability in SystemTap could allow a local attacker to create a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201406-23.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201406-23.xml index 8e64dae79b..e80c53dc8e 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201406-23.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201406-23.xml @@ -1,7 +1,7 @@ - DenyHosts: Denial of Service + DenyHosts: Denial of service A vulnerability in DenyHosts could allow a remote attacker to create a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201407-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201407-01.xml index 10697913e8..4a84a78e22 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201407-01.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201407-01.xml @@ -1,7 +1,7 @@ - OpenTTD: Denial of Service + OpenTTD: Denial of service A vulnerability in OpenTTD could allow a remote attacker to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201407-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201407-04.xml index 4b478172bf..92f3af8d01 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201407-04.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201407-04.xml @@ -1,7 +1,7 @@ - GnuPG: Denial of Service + GnuPG: Denial of service A vulnerability in GnuPG can lead to a Denial of Service condition. GnuPG. 2014-07-16 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201408-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201408-08.xml index 1a9f4a94ad..a5e640f0f8 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201408-08.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201408-08.xml @@ -1,7 +1,7 @@ - file: Denial of Service + file: Denial of service A vulnerability in file could result in Denial of Service. file 2014-08-26 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201409-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201409-02.xml index 54ad07f110..8fd46bf3ba 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201409-02.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201409-02.xml @@ -1,7 +1,7 @@ - Net-SNMP: Denial of Service + Net-SNMP: Denial of service Multiple vulnerabilities have been found in Net-SNMP which could allow remote attackers to cause Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201409-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201409-07.xml index 6265fadea6..d67dc7b810 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201409-07.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201409-07.xml @@ -1,7 +1,7 @@ - c-icap: Denial of Service + c-icap: Denial of service A vulnerability in c-icap could result in Denial of Service. c-icap,DoS 2014-09-19 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201409-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201409-08.xml index 6c07d082ac..8fa255a5fb 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201409-08.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201409-08.xml @@ -1,7 +1,7 @@ - libxml2: Denial of Service + libxml2: Denial of service A vulnerability in libxml2 allows a remote attacker to cause Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201411-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201411-07.xml index 90a31b3b88..626953bd8c 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201411-07.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201411-07.xml @@ -1,7 +1,7 @@ - Openswan: Denial of Service + Openswan: Denial of service A NULL pointer dereference in Openswan may allow remote attackers to cause Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-03.xml index 26a12152e1..d433305172 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-03.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-03.xml @@ -1,7 +1,7 @@ - Dovecot: Denial of Service + Dovecot: Denial of service A vulnerability in Dovecot could allow a remote attacker to create a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-06.xml index a01b6e448b..c993e4d348 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-06.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-06.xml @@ -1,7 +1,7 @@ - libxml2: Denial of Service + libxml2: Denial of service A vulnerability in libxml2 could result in Denial of Service. libxml2 2014-12-10 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-16.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-16.xml index 9952692321..cb189790d7 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-16.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-16.xml @@ -1,7 +1,7 @@ - CouchDB: Denial of Service + CouchDB: Denial of service A vulnerability in CouchDB could result in Denial of Service. couchdb 2014-12-13 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-20.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-20.xml index 88ee9b5c98..80222f8575 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-20.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-20.xml @@ -1,7 +1,7 @@ - GNUstep Base library: Denial of Service + GNUstep Base library: Denial of service A vulnerability in GNUstep Base library could lead to Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-25.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-25.xml index 58d21454ae..59936b32dc 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-25.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-25.xml @@ -1,7 +1,7 @@ - QtGui: Denial of Service + QtGui: Denial of service A NULL pointer dereference in QtGui could lead to Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-27.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-27.xml index 227cffd106..5fa51c8a81 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-27.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-27.xml @@ -1,7 +1,7 @@ - Ruby: Denial of Service + Ruby: Denial of service Multiple vulnerabilities have been found in Ruby, allowing context-dependent attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-31.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-31.xml index afba269755..9cd7dee012 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-31.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-31.xml @@ -1,7 +1,7 @@ - ZNC: Denial of Service + ZNC: Denial of service Multiple vulnerabilities in ZNC could lead to Denial of Service. znc 2014-12-19 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-35.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-35.xml index e260519fd0..18211d95da 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-35.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-35.xml @@ -1,7 +1,7 @@ - RSYSLOG: Denial of Service + RSYSLOG: Denial of service Multiple vulnerabilities have been found in RSYSLOG, allowing attackers to cause Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-36.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-36.xml index 54314591da..b654cff79b 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-36.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-36.xml @@ -1,7 +1,7 @@ - libvirt: Denial of Service + libvirt: Denial of service Multiple vulnerabilities have been found in libvirt, worst of which allows context-dependent attackers to cause Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-41.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-41.xml index 0e4423b9b5..d7c4486aeb 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-41.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-41.xml @@ -1,7 +1,7 @@ - OpenVPN: Denial of Service + OpenVPN: Denial of service A vulnerability in OpenVPN could lead to Denial of Service. openvpn 2014-12-26 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-42.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-42.xml index b9ef0229df..d0c8d9c3f8 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-42.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-42.xml @@ -1,7 +1,7 @@ - Xen: Denial of Service + Xen: Denial of service Multiple vulnerabilities have been found in Xen, possibly resulting in Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-46.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-46.xml index 973ec5a5ac..6dda6c616e 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-46.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-46.xml @@ -1,7 +1,7 @@ - LittleCMS: Denial of Service + LittleCMS: Denial of service Multiple buffer overflow flaws and a parser error in LittleCMS could cause Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-48.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-48.xml index 62aec4732b..be51de898f 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-48.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201412-48.xml @@ -1,7 +1,7 @@ - file: Denial of Service + file: Denial of service A vulnerability in file could allow a context-dependent attack to create a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201502-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201502-14.xml index 8abef79d55..6f94fb6973 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201502-14.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201502-14.xml @@ -1,7 +1,7 @@ - grep: Denial of Service + grep: Denial of service A vulnerability in grep could result in Denial of Service. grep,dos 2015-02-25 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201503-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201503-02.xml index 8665dc717d..28f58b933d 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201503-02.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201503-02.xml @@ -1,7 +1,7 @@ - D-Bus: Denial of Service + D-Bus: Denial of service A vulnerability has been found in D-Bus, possibly resulting in local Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201503-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201503-08.xml index 48633c2dac..d38e5342a1 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201503-08.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201503-08.xml @@ -1,7 +1,7 @@ - file: Denial of Service + file: Denial of service Vulnerabilities in file could allow a context-dependent attack to create a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-02.xml index 5ebfd72e89..6f71d87dd7 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-02.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-02.xml @@ -1,7 +1,7 @@ - Tor: Denial of Service + Tor: Denial of service Two vulnerabilities have been found in Tor, the worst of which can allow remote attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-03.xml index 14eb3aa499..aa82322b4b 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-03.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-03.xml @@ -1,7 +1,7 @@ - Exiv2: Denial of Service + Exiv2: Denial of service A vulnerability in Exiv2 could lead to Denial of Service condition. exiv2 2015-07-07 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-08.xml index 678c5f652b..9f3a3e7b3d 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-08.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-08.xml @@ -1,7 +1,7 @@ - libxml2: Denial of Service + libxml2: Denial of service A vulnerability in libxml2 allows a remote attacker to cause Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-11.xml index d6b1451186..805038e6bd 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-11.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-11.xml @@ -1,7 +1,7 @@ - Perl: Denial of Service + Perl: Denial of service A vulnerability in Perl allows a remote attacker to cause Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-12.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-12.xml index 9f9381c92d..fbf1efc92d 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-12.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-12.xml @@ -1,7 +1,7 @@ - libCapsiNetwork: Denial of Service + libCapsiNetwork: Denial of service A buffer overflow in libcapsinetwork might allow remote attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-17.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-17.xml index 917f618700..40006ead84 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-17.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201507-17.xml @@ -1,7 +1,7 @@ - SNMP: Denial of Service + SNMP: Denial of service A vulnerability in SNMP could lead to a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201508-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201508-03.xml index 918d648861..f6d9915d49 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201508-03.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201508-03.xml @@ -1,7 +1,7 @@ - Icecast: Denial of Service + Icecast: Denial of service A bug in the Icecast code handling source client URL authentication causes a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201509-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201509-05.xml index 10f9698480..df4c340837 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201509-05.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201509-05.xml @@ -1,7 +1,7 @@ - NetworkManager: Denial of Service + NetworkManager: Denial of service Improper handling of Router Advertisements in NetworkManager could cause a Denial of Service condition in IPv6 network stacks. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201510-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201510-01.xml index 52af9d49c6..902f3e3579 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201510-01.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201510-01.xml @@ -1,7 +1,7 @@ - BIND: Denial of Service + BIND: Denial of service A vulnerability in BIND could lead to a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201512-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201512-01.xml index b38f18f341..43c0c782d7 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201512-01.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201512-01.xml @@ -1,7 +1,7 @@ - Dnsmasq: Denial of Service + Dnsmasq: Denial of service A vulnerability in Dnsmasq can lead to a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-03.xml index addc04e39f..74310dab60 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-03.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-03.xml @@ -1,7 +1,7 @@ - libfpx: Denial of Service + libfpx: Denial of service A double free vulnerability has been discovered in libfpx that allows remote attackers to cause a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201611-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201611-13.xml index c4b6a2dd41..340f93f10c 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201611-13.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201611-13.xml @@ -1,7 +1,7 @@ - MongoDB: Denial of Service + MongoDB: Denial of service A vulnerability in MongoDB can lead to a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201611-17.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201611-17.xml index 0b744a3719..06918e18c1 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201611-17.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201611-17.xml @@ -1,7 +1,7 @@ - RPCBind: Denial of Service + RPCBind: Denial of service A buffer overflow in RPCBind might allow remote attackers to cause a Denial of Service. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-12.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-12.xml index 7c87051e4a..bed3765284 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-12.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-12.xml @@ -1,7 +1,7 @@ - Patch: Denial of Service + Patch: Denial of service Patch is vulnerable to a locally generated Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-13.xml index 2a94b8945d..bbd016eb7e 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-13.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-13.xml @@ -1,7 +1,7 @@ - nghttp2: Denial of Service + nghttp2: Denial of service Nghttp2 is vulnerable to a Denial of Service attack. nghttp2 2016-12-05 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201701-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201701-05.xml index 86c9150d5b..7dc6c70320 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201701-05.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201701-05.xml @@ -1,7 +1,7 @@ - BusyBox: Denial of Service + BusyBox: Denial of service A vulnerability in BusyBox might allow remote attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201701-26.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201701-26.xml index 8004eafa66..7a8fc557c1 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201701-26.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201701-26.xml @@ -1,7 +1,7 @@ - BIND: Denial of Service + BIND: Denial of service A vulnerability in BIND might allow remote attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201703-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201703-05.xml index e1637abc9d..6b0df1ab9a 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201703-05.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201703-05.xml @@ -1,7 +1,7 @@ - GNU Libtasn1: Denial of Service + GNU Libtasn1: Denial of service A vulnerability in Libtasn1 allows remote attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201706-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201706-11.xml index 48a4c273b8..e520317c30 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201706-11.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201706-11.xml @@ -1,7 +1,7 @@ - PCRE library: Denial of Service + PCRE library: Denial of service A vulnerability in PCRE library allows remote attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201708-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201708-08.xml index 1ca006521c..9e374ef565 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201708-08.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201708-08.xml @@ -1,7 +1,7 @@ - bzip2: Denial of Service + bzip2: Denial of service An use-after-free vulnerability has been found in bzip2 that could allow remote attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-15.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-15.xml index 3955bb67f1..34aff01db1 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-15.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-15.xml @@ -1,7 +1,7 @@ - GnuTLS: Denial of Service + GnuTLS: Denial of service A null pointer dereference in GnuTLS might allow attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201811-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201811-03.xml index cbf256a1d5..9da1809294 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201811-03.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201811-03.xml @@ -1,7 +1,7 @@ - OpenSSL: Denial of Service + OpenSSL: Denial of service A vulnerability in OpenSSL might allow remote attackers to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201811-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201811-07.xml index a8cd2f6305..4980d7d7f9 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201811-07.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201811-07.xml @@ -1,7 +1,7 @@ - Pango: Denial of Service + Pango: Denial of service A vulnerability in Pango could result in a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-05.xml index 106046f3f7..6c9b929148 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-05.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-05.xml @@ -1,7 +1,7 @@ - Tar: Denial of Service + Tar: Denial of service A vulnerability in Tar could led to a Denial of Service condition. tar 2019-03-10 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-01.xml index 413cf96f36..9ad5f7e37d 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-01.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-01.xml @@ -1,7 +1,7 @@ - Cairo: Denial of Service + Cairo: Denial of service Multiple vulnerabilities were found in Cairo, the worst of which could cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-08.xml index 9a634deb75..8f0c6a0299 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-08.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-08.xml @@ -1,7 +1,7 @@ - Subversion: Denial of Service + Subversion: Denial of service A vulnerability in Subversion could lead to a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-15.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-15.xml index 5c645f5aec..d0357f915f 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-15.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-15.xml @@ -1,7 +1,7 @@ - libTIFF: Denial of Service + libTIFF: Denial of service A vulnerability in libTIFF could lead to a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201908-25.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201908-25.xml index 7f2c146a92..700154a260 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201908-25.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201908-25.xml @@ -1,7 +1,7 @@ - hostapd and wpa_supplicant: Denial of Service + hostapd and wpa_supplicant: Denial of service A vulnerability in hostapd and wpa_supplicant could lead to a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202003-43.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202003-43.xml index 12f723cb96..d07350f365 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202003-43.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202003-43.xml @@ -7,16 +7,17 @@ tomcat 2020-03-19 - 2020-03-20 + 2020-06-26 692402 706208 710656 remote - 8.5.51 - 7.0.100 - 8.5.51 + 8.5.51 + 7.0.100 + 8.5.51 + 7.0.100 @@ -58,5 +59,5 @@ CVE-2020-1938 whissi - whissi + whissi diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-08.xml index 2bccb96214..fcb9f3e073 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-08.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-08.xml @@ -1,7 +1,7 @@ - libssh: Denial of Service + libssh: Denial of service A vulnerability in libssh could allow a remote attacker to cause a Denial of Service condition. diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-09.xml index 332036b907..7b7322c0b6 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-09.xml +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-09.xml @@ -1,22 +1,23 @@ - Python: Denial of Service + Python: Denial of service A vulnerability in Python could lead to a Denial of Service condition. python 2020-05-14 - 2020-05-14 + 2020-10-18 707822 + 741502 remote - 2.7.18 + 2.7.18-r2 3.6.10-r2 3.7.7-r2 3.8.2-r2 - 2.7.18 + 2.7.18-r2 3.6.10-r2 3.7.7-r2 3.8.2-r2 @@ -44,7 +45,7 @@ # emerge --sync - # emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.18:2.7" + # emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.18-r2:2.7"

All Python 3.6 users should upgrade to the latest version:

@@ -73,5 +74,5 @@ CVE-2020-8492 sam_c - sam_c + sam_c diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-01.xml new file mode 100644 index 0000000000..e8768cba05 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-01.xml @@ -0,0 +1,49 @@ + + + + GnuTLS: Information disclosure + An information disclosure vulnerability in GnuTLS allow remote + attackers to obtain sensitive information. + + gnutls + 2020-06-09 + 2020-06-09 + 727108 + remote + + + 3.6.14 + 3.6.14 + + + +

GnuTLS is an Open Source implementation of the TLS and SSL protocols.

+ + +

A flaw was reported in the TLS session ticket key construction in + GnuTLS. +

+ + +

A remote attacker could recover previous conversations in TLS 1.2 and + obtain sensitive information or conduct a man-in-the-middle attack to + bypass authentication in TLS 1.3. +

+ + +

There is no known workaround at this time.

+ + +

All GnuTLS user should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/gnutls-3.6.14" + + + + CVE-2020-13777 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-02.xml new file mode 100644 index 0000000000..663d9d9029 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-02.xml @@ -0,0 +1,96 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in the arbitrary execution of code. + + chromium,google-chrome + 2020-06-10 + 2020-06-13 + 724008 + remote + + + 83.0.4103.97 + 83.0.4103.97 + + + 83.0.4103.97 + 83.0.4103.97 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-83.0.4103.97" + + +

All google-chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-83.0.4103.97" + + + + + CVE-2020-6465 + CVE-2020-6466 + CVE-2020-6467 + CVE-2020-6468 + CVE-2020-6469 + CVE-2020-6470 + CVE-2020-6471 + CVE-2020-6472 + CVE-2020-6473 + CVE-2020-6474 + CVE-2020-6475 + CVE-2020-6476 + CVE-2020-6477 + CVE-2020-6478 + CVE-2020-6479 + CVE-2020-6480 + CVE-2020-6481 + CVE-2020-6482 + CVE-2020-6483 + CVE-2020-6484 + CVE-2020-6485 + CVE-2020-6486 + CVE-2020-6487 + CVE-2020-6488 + CVE-2020-6489 + CVE-2020-6490 + CVE-2020-6491 + CVE-2020-6493 + CVE-2020-6494 + CVE-2020-6495 + CVE-2020-6496 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-03.xml new file mode 100644 index 0000000000..06c72762cc --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-03.xml @@ -0,0 +1,49 @@ + + + + Perl: Multiple vulnerabilities + Multiple vulnerabilities have been found in Perl, the worst of + which could result in a Denial of Service condition. + + perl + 2020-06-12 + 2020-06-12 + 723792 + local, remote + + + 5.30.3 + 5.30.3 + + + +

Perl is a highly capable, feature-rich programming language.

+ + +

Multiple vulnerabilities have been discovered in Perl. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Perl users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/perl-5.30.3" + + + + + CVE-2020-10543 + CVE-2020-10878 + CVE-2020-12723 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-04.xml new file mode 100644 index 0000000000..39cb805aee --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-04.xml @@ -0,0 +1,54 @@ + + + + glibc: Multiple vulnerabilities + Multiple vulnerabilities have been found in glibc, the worst of + which could result in a Denial of Service condition. + + glibc + 2020-06-13 + 2020-06-13 + 677272 + 679044 + 711558 + 717938 + 719472 + local, remote + + + 2.30-r8 + 2.30-r8 + + + +

glibc is a package that contains the GNU C library.

+ + +

Multiple vulnerabilities have been discovered in glibc. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All glibc users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.30-r8" + + + + CVE-2019-6488 + CVE-2019-7309 + CVE-2019-9169 + CVE-2020-10029 + CVE-2020-1751 + + BlueKnight + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-05.xml new file mode 100644 index 0000000000..8e2d321a30 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-05.xml @@ -0,0 +1,55 @@ + + + + Nokogiri: Command injection + Nokogiri has a vulnerability allowing arbitrary execution of code + if a certain function is used. + + Nokogiri + 2020-06-13 + 2020-06-13 + 691974 + remote + + + 1.10.4 + 1.10.4 + + + +

Nokogiri is an HTML, XML, SAX, and Reader parser.

+ + +

A command injection vulnerability in Nokogiri allows commands to be + executed in a subprocess by Ruby’s Kernel.open method. Processes are + vulnerable only if the undocumented method + Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process. +

+ + +

Avoid calling the undocumented method Nokogiri::CSS::Tokenizer#load_file + with untrusted user input. +

+ + +

All Nokogiri users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-ruby/nokogiri-1.10.4" + + + + CVE-2019-5477 + Upstream + bug + + + BlueKnight + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-06.xml new file mode 100644 index 0000000000..132e827b53 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-06.xml @@ -0,0 +1,56 @@ + + + + ssvnc: Multiple vulnerabilities + Multiple vulnerabilities have been found in ssvnc, the worst of + which could result in the arbitrary execution of code. + + ssvnc + 2020-06-13 + 2020-06-13 + 701820 + remote + + + 1.0.29-r2 + + + +

The Enhanced TightVNC Viewer, SSVNC, adds encryption security to VNC + connections. +

+ + +

Multiple vulnerabilities have been discovered in ssvnc. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

Gentoo has discontinued support for ssvnc. We recommend that users + unmerge ssvnc: +

+ + + # emerge --unmerge "net-misc/ssvnc" + + +

NOTE: The Gentoo developer(s) maintaining ssvnc have discontinued + support at this time. It may be possible that a new Gentoo developer will + update ssvnc at a later date. An alternative may be a manual SSH tunnel. +

+ + + CVE-2018-20020 + CVE-2018-20021 + CVE-2018-20022 + CVE-2018-20024 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-07.xml new file mode 100644 index 0000000000..9d5ea5d256 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-07.xml @@ -0,0 +1,66 @@ + + + + Mozilla Firefox: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mozilla Firefox, the + worst of which could result in the arbitrary execution of code. + + firefox + 2020-06-13 + 2020-06-13 + 726844 + remote + + + 68.9.0 + 68.9.0 + + + 68.9.0 + 68.9.0 + + + +

Mozilla Firefox is a popular open-source web browser from the Mozilla + Project. +

+ + +

Multiple vulnerabilities have been discovered in Mozilla Firefox. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Firefox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-68.9.0" + + +

All Mozilla Firefox binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-68.9.0" + + + + + CVE-2020-12405 + CVE-2020-12406 + CVE-2020-12407 + CVE-2020-12408 + CVE-2020-12409 + CVE-2020-12410 + CVE-2020-12411 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-08.xml new file mode 100644 index 0000000000..e6a391fc9c --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-08.xml @@ -0,0 +1,61 @@ + + + + WebKitGTK+: Multiple vulnerabilities + Multiple vulnerabilities have been found in WebKitGTK+, the worst + of which could result in the arbitrary execution of code. + + webkitgtk+ + 2020-06-13 + 2020-06-13 + 712260 + remote + + + 2.28.2 + 2.28.2 + + + +

WebKitGTK+ is a full-featured port of the WebKit rendering engine, + suitable for projects requiring any kind of web integration, from hybrid + HTML/CSS applications to full-fledged web browsers. +

+ + +

Multiple vulnerabilities have been discovered in WebKitGTK+. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All WebKitGTK+ users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.28.2" + + + + + CVE-2020-10018 + CVE-2020-10018 + CVE-2020-11793 + CVE-2020-11793 + CVE-2020-3885 + CVE-2020-3894 + CVE-2020-3895 + CVE-2020-3897 + CVE-2020-3899 + CVE-2020-3900 + CVE-2020-3901 + CVE-2020-3902 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-09.xml new file mode 100644 index 0000000000..8943a42220 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-09.xml @@ -0,0 +1,51 @@ + + + + Adobe Flash Player: Arbitrary code execution + A flaw in Adobe Flash Player may allow local or remote attacker(s) + to execute arbitrary code. + + adobe-flash + 2020-06-13 + 2020-06-13 + 727812 + remote + + + 32.0.0.387 + 32.0.0.387 + + + +

The Adobe Flash Player is a renderer for the SWF file format, which is + commonly used to provide interactive websites. +

+ + +

An unspecified flaw has been discovered in Adobe Flash Player.

+ + +

This flaw can be exploited by attackers for remote code execution.

+ + +

There is no known workaround at this time.

+ + +

All Adobe Flash Player users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-plugins/adobe-flash-32.0.0.387" + + + + + CVE-2020-9633 + + Upstream advisory (APSB20-30) + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-10.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-10.xml new file mode 100644 index 0000000000..0291e53cf3 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-10.xml @@ -0,0 +1,48 @@ + + + + GNU Readline: Multiple vulnerabilities + Multiple vulnerabilities have been found in GNU Readline, the worst + of which could result in a Denial of Service condition. + + readline + 2020-06-13 + 2020-06-13 + 717924 + local + + + 8.0 + 8.0 + + + +

The GNU Readline library provides a set of functions for use by + applications that allow users to edit command lines as they are typed in. +

+ + +

Multiple vulnerabilities have been discovered in GNU Readline. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All GNU Readline users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-libs/readline-8.0" + + + + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-11.xml new file mode 100644 index 0000000000..39a9974e3f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-11.xml @@ -0,0 +1,55 @@ + + + + Ansible: Multiple vulnerabilities + Multiple vulnerabilities have been found in Ansible, the worst of + which could result in the arbitrary execution of code. + + ansible + 2020-06-13 + 2020-06-13 + 711974 + remote + + + 2.9.7 + 2.9.7 + + + +

Ansible is a radically simple IT automation platform.

+ + +

Multiple vulnerabilities have been discovered in Ansible. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Ansible users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-admin/ansible-2.9.7" + + + + + CVE-2020-10684 + CVE-2020-10685 + CVE-2020-1733 + CVE-2020-1735 + CVE-2020-1736 + CVE-2020-1737 + CVE-2020-1738 + CVE-2020-1740 + CVE-2020-1753 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-12.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-12.xml new file mode 100644 index 0000000000..d55a1902c2 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-12.xml @@ -0,0 +1,46 @@ + + + + GNU Mailutils: Privilege escalation + A vulnerability has been found in GNU Mailutils allowing privilege + escalation. + + mailutils + 2020-06-13 + 2020-06-13 + 700806 + local + + + 3.8 + 3.8 + + + +

The GNU Mailutils are a collection of mail-related utilities, including + an IMAP4 server (imap4d). +

+ + +

GNU Mailutils runs maidag by default with setuid root permissions.

+ + +

An attacker can use this to write to arbitrary files as root.

+ + +

There is no known workaround at this time.

+ + +

All GNU Mailutils users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-mail/mailutils-3.8" + + + + CVE-2019-18862 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-13.xml new file mode 100644 index 0000000000..42eeba52e2 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-13.xml @@ -0,0 +1,48 @@ + + + + json-c: Multiple vulnerabilities + Multiple vulnerabilities have been found in json-c, the worst of + which could result in a Denial of Service condition. + + json-c + 2020-06-15 + 2020-06-15 + 722150 + remote + + + 0.14-r3 + 0.14-r3 + + + +

json-c is a JSON implementation in C.

+ + +

Multiple vulnerabilities have been discovered in json-c. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote/local attacker could send a specially crafted file possibly + resulting in a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All json-c users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/json-c-0.14-r3" + + + + CVE-2020-12762 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-14.xml new file mode 100644 index 0000000000..46fb4e1145 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-14.xml @@ -0,0 +1,52 @@ + + + + PEAR Archive_Tar: Remote code execution vulnerability + A buffer overflow in the PEAR module Archive_Tar might allow local + or remote attacker(s) to execute arbitrary code. + + archive_tar + 2020-06-15 + 2020-06-15 + 675576 + local, remote + + + 1.4.5 + 1.4.5 + + + +

This class provides handling of tar files in PHP.

+ + +

An issue was discovered in the PEAR module Archive_Tar’s handling of + file paths within Tar achives. +

+ + +

A local or remote attacker could possibly execute arbitrary code with + the privileges of the process. +

+ + +

Avoid handling untrusted Tar files with this package until you have + upgraded to a non-vulnerable version. +

+ + +

All PEAR-Archive_Tar users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-php/PEAR-Archive_Tar-1.4.5" + + + + + CVE-2018-1000888 + + + BlueKnight + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-15.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-15.xml new file mode 100644 index 0000000000..9fbb52de8e --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-15.xml @@ -0,0 +1,48 @@ + + + + OpenConnect: Multiple vulnerabilities + Multiple vulnerabilities have been found in OpenConnect, the worst + of which could result in the arbitrary execution of code. + + openconnect + 2020-06-15 + 2020-06-15 + 719108 + 722740 + remote + + + 8.09-r1 + 8.09-r1 + + + +

OpenConnect is a free client for Cisco AnyConnect SSL VPN software.

+ + +

Multiple vulnerabilities have been discovered in OpenConnect. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All OpenConnect users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-vpn/openconnect-8.09-r1" + + + + CVE-2020-12105 + CVE-2020-12823 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-16.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-16.xml new file mode 100644 index 0000000000..a652c18c28 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-16.xml @@ -0,0 +1,46 @@ + + + + PCRE2: Denial of service + A vulnerability in PCRE2 could lead to a Denial of Service + condition. + + pcre2 + 2020-06-15 + 2020-06-15 + 717800 + local, remote + + + 10.34 + 10.34 + + + +

PCRE2 is a project based on PCRE (Perl Compatible Regular Expressions) + which has a new and revised API. +

+ + +

PCRE2 has a flaw when handling JIT-compiled regex using the \X pattern.

+ + +

An attacker could cause a possible Denial of Service condition.

+ + +

There is no known workaround at this time.

+ + +

All PCRE2 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/pcre2-10.34" + + + + CVE-2019-20454 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-17.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-17.xml new file mode 100644 index 0000000000..95c9c6dd1a --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-17.xml @@ -0,0 +1,62 @@ + + + + FAAD2: Multiple vulnerabilities + Multiple vulnerabilities have been found in FAAD2, the worst of + which could result in the arbitrary execution of code. + + faad2 + 2020-06-15 + 2020-06-15 + 695540 + local, remote + + + 2.9.0 + 2.9.0 + + + +

FAAD2 is an open source MPEG-4 and MPEG-2 AAC decoder.

+ + +

Multiple vulnerabilities have been discovered in FAAD2. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All FAAD2 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/faad2-2.9.0" + + + + CVE-2018-19502 + CVE-2018-19503 + CVE-2018-19504 + CVE-2018-20194 + CVE-2018-20195 + CVE-2018-20196 + CVE-2018-20197 + CVE-2018-20198 + CVE-2018-20199 + CVE-2018-20357 + CVE-2018-20358 + CVE-2018-20359 + CVE-2018-20360 + CVE-2018-20361 + CVE-2018-20362 + CVE-2019-15296 + CVE-2019-6956 + + BlueKnight + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-18.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-18.xml new file mode 100644 index 0000000000..ad77d145a2 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-18.xml @@ -0,0 +1,48 @@ + + + + Bubblewrap: Arbitrary code execution + Bubblewrap misuses temporary directories allowing local code + execution. + + bubblerwrap + 2020-06-15 + 2020-06-15 + 686114 + local + + + 0.4.1 + 0.4.1 + + + +

Bubblewrap is an unprivileged sandboxing tool namespaces-powered + chroot-like solution. +

+ + +

Bubblewrap misuses temporary directories in /tmp as a mount point.

+ + +

This flaw may allow possible execution of code or prevention of running + Bubblewrap. +

+ + +

There is no known workaround at this time.

+ + +

All Bubblewrap users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/bubblewrap-0.4.1" + + + + CVE-2019-12439 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-19.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-19.xml new file mode 100644 index 0000000000..4f2140b8c1 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-19.xml @@ -0,0 +1,68 @@ + + + + Mozilla Thunderbird: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mozilla Thunderbird, + the worst of which could result in the arbitrary execution of code. + + thunderbird + 2020-06-15 + 2020-06-15 + 727118 + remote + + + 68.9.0 + 68.9.0 + + + 68.9.0 + 68.9.0 + + + +

Mozilla Thunderbird is a popular open-source email client from the + Mozilla project. +

+ + +

Multiple vulnerabilities have been discovered in Mozilla Thunderbird. + Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Thunderbird users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-68.9.0" + + +

All Mozilla Thunderbird binary users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=mail-client/thunderbird-bin-68.9.0" + + + + CVE-2020-12398 + CVE-2020-12405 + CVE-2020-12406 + CVE-2020-12410 + + MFSA-2020-22 + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-20.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-20.xml new file mode 100644 index 0000000000..690bfee258 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-20.xml @@ -0,0 +1,49 @@ + + + + Asterisk: Root privilege escalation + A vulnerability was discovered in Asterisk which may allow local + attackers to gain root privileges. + + asterisk + 2020-06-15 + 2020-06-15 + 602722 + local + + + 13.32.0-r1 + 13.32.0-r1 + + + +

A Modular Open Source PBX System.

+ + +

It was discovered that Gentoo’s Asterisk ebuild does not properly set + permissions on its data directories. This only affects OpenRC systems, as + the flaw was exploitable via the init script. +

+ + +

A local attacker could escalate privileges.

+ + +

Users should ensure the proper permissions are set as discussed in the + referenced bugs. Do not run /etc/init.d/asterisk checkperms. +

+ + +

All Asterisk users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/asterisk-13.32.0-r1" + + + + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-21.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-21.xml new file mode 100644 index 0000000000..ac2c137808 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-21.xml @@ -0,0 +1,63 @@ + + + + Apache Tomcat: Remote code execution + A vulnerability has been discovered in Apache Tomcat which could + result in the arbitrary execution of code. + + tomcat + 2020-06-15 + 2020-06-15 + 724344 + remote + + + 7.0.104 + 8.5.55 + 7.0.104 + 8.5.55 + + + +

Apache Tomcat is a Servlet-3.0/JSP-2.2 Container.

+ + +

Apache Tomcat improperly handles deserialization of files under specific + circumstances. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Apache Tomcat 7.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-servers/tomcat-7.0.104" + + +

All Apache Tomcat 8.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-servers/tomcat-8.5.55" + + + + CVE-2020-9484 + + Upstream advisory (7) + + + Upstream advisory (8.5) + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-22.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-22.xml new file mode 100644 index 0000000000..82046e4ece --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-22.xml @@ -0,0 +1,96 @@ + + + + OpenJDK, IcedTea: Multiple vulnerabilities + Multiple vulnerabilities have been found in OpenJDK and IcedTea, + the worst of which could result in the arbitrary execution of code. + + icedtea + 2020-06-15 + 2020-06-15 + 718720 + 720690 + remote + + + 8.252_p09 + 8.252_p09 + + + 8.252_p09 + 8.252_p09 + + + 3.16.0 + 3.16.0 + + + +

OpenJDK is a free and open-source implementation of the Java Platform, + Standard Edition. +

+ +

IcedTea’s aim is to provide OpenJDK in a form suitable for easy + configuration, compilation and distribution with the primary goal of + allowing inclusion in GNU/Linux distributions. +

+ + +

Multiple vulnerabilities have been discovered in OpenJDK and IcedTea. + Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All OpenJDK binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-java/openjdk-bin-8.252_p09" + + +

All OpenJDK JRE binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=dev-java/openjdk-jre-bin-8.252_p09" + + +

All IcedTea binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-java/icedtea-bin-3.16.0" + + + + CVE-2020-2585 + CVE-2020-2585 + CVE-2020-2755 + CVE-2020-2755 + CVE-2020-2756 + CVE-2020-2756 + CVE-2020-2757 + CVE-2020-2757 + CVE-2020-2773 + CVE-2020-2773 + CVE-2020-2781 + CVE-2020-2781 + CVE-2020-2800 + CVE-2020-2800 + CVE-2020-2803 + CVE-2020-2803 + CVE-2020-2805 + CVE-2020-2805 + CVE-2020-2830 + CVE-2020-2830 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-23.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-23.xml new file mode 100644 index 0000000000..7fb7e375cb --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202006-23.xml @@ -0,0 +1,50 @@ + + + + Cyrus IMAP Server: Access restriction bypass + An error in Cyrus IMAP Server allows mailboxes to be created with + administrative privileges. + + cyrusimap + 2020-06-15 + 2020-06-15 + 703630 + remote + + + 3.0.13 + 3.0.13 + + + +

The Cyrus IMAP Server is an efficient, highly-scalable IMAP e-mail + server. +

+ + +

An issue was discovered in Cyrus IMAP Server where sieve script + uploading is excessively trusted. +

+ + +

A user can use a sieve script to create any mailbox with administrator + privileges. +

+ + +

Disable sieve script uploading until the upgrade is complete.

+ + +

All Cyrus IMAP Server users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-mail/cyrus-imapd-3.0.13" + + + + CVE-2019-19783 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-01.xml new file mode 100644 index 0000000000..56c6b1c301 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-01.xml @@ -0,0 +1,50 @@ + + + + netqmail: Multiple vulnerabilities + Multiple vulnerabilities have been found in netqmail, the worst of + which could result in the arbitrary execution of code. + + netqmail + 2020-07-26 + 2020-07-26 + 721566 + local, remote + + + 1.06-r13 + 1.06-r13 + + + +

qmail is a secure, reliable, efficient, simple message transfer agent.

+ + +

Multiple vulnerabilities have been discovered in netqmail. Please review + the CVE identifiers referenced below for details. +

+ + +

In the default configuration, these vulnerabilities are only local. + Please review the referenced CVE identifiers for details. +

+ + +

There is no known workaround at this time.

+ + +

All netqmail users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-mta/netqmail-1.06-r13" + + + + CVE-2005-1513 + CVE-2005-1514 + CVE-2005-1515 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-02.xml new file mode 100644 index 0000000000..7cc7db21c7 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-02.xml @@ -0,0 +1,62 @@ + + + + Xen: Multiple vulnerabilities + Multiple vulnerabilities have been found in Xen, the worst of which + could result in the arbitrary execution of code. + + xen + 2020-07-26 + 2020-07-26 + 731658 + remote + + + 4.12.3-r2 + 4.12.3-r2 + + + 4.12.3-r2 + 4.12.3-r2 + + + +

Xen is a bare-metal hypervisor.

+ + +

Multiple vulnerabilities have been discovered in Xen. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Xen users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/xen-4.12.3-r2" + + +

All Xen Tools users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=app-emulation/xen-tools-4.12.3-r2" + + + + CVE-2020-15563 + CVE-2020-15564 + CVE-2020-15565 + CVE-2020-15566 + CVE-2020-15567 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-03.xml new file mode 100644 index 0000000000..93079b9e24 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-03.xml @@ -0,0 +1,61 @@ + + + + Cacti: Multiple vulnerabilities + Multiple vulnerabilities have been found in Cacti, the worst of + which could result in the arbitrary execution of code. + + cacti + 2020-07-26 + 2020-07-26 + 728678 + 732522 + remote + + + 1.2.13 + 1.2.13 + + + 1.2.13 + 1.2.13 + + + +

Cacti is a complete frontend to rrdtool.

+ + +

Multiple vulnerabilities have been discovered in Cacti. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Cacti users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-1.2.13" + + +

All Cacti Spine users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-spine-1.2.13" + + + + + CVE-2020-11022 + CVE-2020-11023 + CVE-2020-14295 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-04.xml new file mode 100644 index 0000000000..b04ea7893e --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-04.xml @@ -0,0 +1,61 @@ + + + + fwupd, libjcat: Multiple vulnerabilities + Multiple vulnerabilities have been found in fwupd and libjcat, the + worst of which could result in the arbitrary execution of code. + + fwupd,libjfcat + 2020-07-26 + 2020-07-26 + 727656 + remote + + + 1.3.10 + 1.3.10 + + + 0.1.3 + 0.1.3 + + + +

fwupd aims to make updating firmware on Linux automatic, safe and + reliable. libjcat is a library and tool for reading and writing Jcat + files. +

+ + +

Multiple vulnerabilities have been discovered in fwupd and libjcat. + Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All fwupd users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/fwupd-1.3.10" + + +

All libjcat users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/libjcat-0.1.3" + + + + + CVE-2020-10759 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-05.xml new file mode 100644 index 0000000000..75ae7ba35b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-05.xml @@ -0,0 +1,55 @@ + + + + libexif: Multiple vulnerabilities + Multiple vulnerabilities have been found in libexif, the worst of + which could result in the arbitrary execution of code. + + libexif + 2020-07-26 + 2020-07-26 + 708728 + remote + + + 0.6.22 + 0.6.22 + + + +

libexif is a library for parsing, editing and saving Exif metadata from + images. +

+ + +

Multiple vulnerabilities have been discovered in libexif. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All libexif users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/libexif-0.6.22" + + + + + CVE-2016-6328 + CVE-2019-9278 + CVE-2020-0093 + CVE-2020-12767 + CVE-2020-13112 + CVE-2020-13113 + CVE-2020-13114 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-06.xml new file mode 100644 index 0000000000..e8f7cd438d --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-06.xml @@ -0,0 +1,50 @@ + + + + HylaFAX: Multiple vulnerabilities + Multiple vulnerabilities have been found in HylaFAX, the worst of + which could result in privilege escalation. + + hylafax + 2020-07-26 + 2020-07-26 + 730290 + local + + + 7.0.2 + 7.0.2 + + + +

HylaFAX is an enterprise-class system for sending and receiving + facsimile messages and for sending alpha-numeric pages. +

+ + +

Multiple vulnerabilities have been discovered in HylaFAX. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All HylaFAX users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/hylafaxplus-7.0.2" + + + + + CVE-2020-15396 + CVE-2020-15397 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-07.xml new file mode 100644 index 0000000000..3093043f62 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-07.xml @@ -0,0 +1,51 @@ + + + + Transmission: Remote code execution + A use-after-free possibly allowing remote execution of code was + discovered in Transmission. + + transmission + 2020-07-26 + 2020-07-26 + 723258 + remote + + + 3.00 + 3.00 + + + +

Transmission is a cross-platform BitTorrent client.

+ + +

Transmission mishandles some memory management which may allow + manipulation of the heap. +

+ + +

A remote attacker could entice a user to open a specially crafted + torrent file using Transmission, possibly resulting in execution of + arbitrary code with the privileges of the process or a Denial of Service + condition. +

+ + +

There is no known workaround at this time.

+ + +

All Transmission users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-p2p/transmission-3.00" + + + + + CVE-2018-10756 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-08.xml new file mode 100644 index 0000000000..a4f230e66b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-08.xml @@ -0,0 +1,96 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in the arbitrary execution of code. + + chromium,google-chrome + 2020-07-26 + 2020-07-26 + 728418 + 729310 + 732588 + remote + + + 84.0.4147.89 + 84.0.4147.89 + + + 84.0.4147.89 + 84.0.4147.89 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-84.0.4147.89" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-84.0.4147.89" + + + + CVE-2020-6505 + CVE-2020-6506 + CVE-2020-6507 + CVE-2020-6509 + CVE-2020-6510 + CVE-2020-6511 + CVE-2020-6512 + CVE-2020-6513 + CVE-2020-6514 + CVE-2020-6515 + CVE-2020-6516 + CVE-2020-6517 + CVE-2020-6518 + CVE-2020-6519 + CVE-2020-6520 + CVE-2020-6521 + CVE-2020-6522 + CVE-2020-6523 + CVE-2020-6524 + CVE-2020-6525 + CVE-2020-6526 + CVE-2020-6527 + CVE-2020-6528 + CVE-2020-6529 + CVE-2020-6530 + CVE-2020-6531 + CVE-2020-6533 + CVE-2020-6534 + CVE-2020-6535 + CVE-2020-6536 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-09.xml new file mode 100644 index 0000000000..eafd82da13 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-09.xml @@ -0,0 +1,67 @@ + + + + Mozilla Thunderbird: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mozilla Thunderbird, + the worst of which could result in the arbitrary execution of code. + + thunderbird + 2020-07-26 + 2020-07-26 + 730628 + remote + + + 68.10.0 + 68.10.0 + + + 68.10.0 + 68.10.0 + + + +

Mozilla Thunderbird is a popular open-source email client from the + Mozilla project. +

+ + +

Multiple vulnerabilities have been discovered in Mozilla Thunderbird. + Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Thunderbird users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-68.10.0" + + +

All Mozilla Thunderbird binary users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=mail-client/thunderbird-bin-68.10.0" + + + + + CVE-2020-12417 + CVE-2020-12418 + CVE-2020-12419 + CVE-2020-12420 + CVE-2020-12421 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-10.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-10.xml new file mode 100644 index 0000000000..ba5545fd96 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-10.xml @@ -0,0 +1,71 @@ + + + + Mozilla Firefox: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mozilla Firefox, the + worst of which could result in the arbitrary execution of code. + + firefox + 2020-07-26 + 2020-07-26 + 730418 + remote + + + 68.10.0 + 68.10.0 + + + 68.10.0 + 68.10.0 + + + +

Mozilla Firefox is a popular open-source web browser from the Mozilla + Project. +

+ + +

Multiple vulnerabilities have been discovered in Mozilla Firefox. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Firefox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-68.10.0" + + +

All Mozilla Firefox binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-68.10.0" + + + + + CVE-2020-12402 + CVE-2020-12415 + CVE-2020-12416 + CVE-2020-12417 + CVE-2020-12418 + CVE-2020-12419 + CVE-2020-12420 + CVE-2020-12421 + CVE-2020-12422 + CVE-2020-12424 + CVE-2020-12425 + CVE-2020-12426 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-11.xml new file mode 100644 index 0000000000..914221d859 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-11.xml @@ -0,0 +1,56 @@ + + + + WebKitGTK+: Multiple vulnerabilities + Multiple vulnerabilities have been found in WebKitGTK+, the worst + of which could result in the arbitrary execution of code. + + webkitgtk+ + 2020-07-26 + 2020-07-26 + 732104 + remote + + + 2.28.3 + 2.28.3 + + + +

WebKitGTK+ is a full-featured port of the WebKit rendering engine, + suitable for projects requiring any kind of web integration, from hybrid + HTML/CSS applications to full-fledged web browsers. +

+ + +

Multiple vulnerabilities have been discovered in WebKitGTK+. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All WebKitGTK+ users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.28.3" + + + + CVE-2020-13753 + CVE-2020-9802 + CVE-2020-9803 + CVE-2020-9805 + CVE-2020-9806 + CVE-2020-9807 + CVE-2020-9843 + CVE-2020-9850 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-12.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-12.xml new file mode 100644 index 0000000000..15f5cd20ec --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-12.xml @@ -0,0 +1,50 @@ + + + + NTP: Multiple vulnerabilities + Multiple vulnerabilities have been found in NTP, the worst of which + could result in a Denial of Service condition. + + ntp + 2020-07-26 + 2020-07-26 + 717798 + 729458 + remote + + + 4.2.8_p15 + 4.2.8_p15 + + + +

NTP contains software for the Network Time Protocol.

+ + +

Multiple vulnerabilities have been discovered in NTP. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All NTP users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/ntp-4.2.8_p15" + + + + + CVE-2020-11868 + CVE-2020-13817 + CVE-2020-15025 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-13.xml new file mode 100644 index 0000000000..5c0c85cff0 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-13.xml @@ -0,0 +1,55 @@ + + + + Wireshark: Multiple vulnerabilities + Multiple vulnerabilities have been found in Wireshark, the worst of + which could result in a Denial of Service condition. + + wireshark + 2020-07-26 + 2020-07-26 + 711012 + 716756 + 724132 + 730414 + remote + + + 3.2.5 + 3.2.5 + + + +

Wireshark is a network protocol analyzer formerly known as ethereal.

+ + +

Multiple vulnerabilities have been discovered in Wireshark. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Wireshark users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-analyzer/wireshark-3.2.5" + + + + CVE-2020-11647 + CVE-2020-13164 + CVE-2020-15466 + CVE-2020-9428 + CVE-2020-9429 + CVE-2020-9430 + CVE-2020-9431 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-14.xml new file mode 100644 index 0000000000..6fe7f34940 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-14.xml @@ -0,0 +1,44 @@ + + + + yaml-cpp: Denial of service + A vulnerability in yaml-cpp could lead to a Denial of Service + condition. + + yaml-cpp + 2020-07-26 + 2020-07-26 + 626662 + remote + + + 0.6.3-r2 + 0.6.3-r2 + + + +

yaml-cpp is a YAML parser and emitter in C++.

+ + +

The function Scanner::peek in scanner.cpp may have an assertion failure.

+ + +

An attacker could cause a possible Denial of Service condition.

+ + +

There is no known workaround at this time.

+ + +

All yaml-cpp users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-cpp/yaml-cpp-0.6.3-r2" + + + + CVE-2017-11692 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-15.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-15.xml new file mode 100644 index 0000000000..f45efd3367 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-15.xml @@ -0,0 +1,52 @@ + + + + Samba: Multiple vulnerabilities + Multiple vulnerabilities have been found in Samba, the worst of + which could result in a Denial of Service condition. + + samba + 2020-07-26 + 2020-07-26 + 719120 + 730472 + remote + + + 4.11.11 + 4.11.11 + + + +

Samba is a suite of SMB and CIFS client/server programs.

+ + +

Multiple vulnerabilities have been discovered in Samba. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Samba users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-fs/samba-4.11.11" + + + + CVE-2020-10700 + CVE-2020-10704 + CVE-2020-10730 + CVE-2020-10745 + CVE-2020-10760 + CVE-2020-14303 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-16.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-16.xml new file mode 100644 index 0000000000..393e5994cc --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-16.xml @@ -0,0 +1,47 @@ + + + + cURL: Multiple vulnerabilities + Multiple vulnerabilities have been found in cURL, the worst of + which could result in information disclosure or data loss. + + curl + 2020-07-26 + 2020-07-26 + 729374 + remote + + + 7.71.0 + 7.71.0 + + + +

A command line tool and library for transferring data with URLs.

+ + +

Multiple vulnerabilities have been discovered in cURL. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All cURL users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/curl-7.71.0" + + + + CVE-2020-8169 + CVE-2020-8177 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-17.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-17.xml new file mode 100644 index 0000000000..1234ccc4b9 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-17.xml @@ -0,0 +1,55 @@ + + + + JHead: Multiple vulnerabilities + Multiple vulnerabilities have been found in JHead, the worst of + which could result in a Denial of Service condition. + + jhead + 2020-07-26 + 2020-07-27 + 701826 + 711220 + remote + + + 3.04 + 3.04 + + + +

JHead is an exif jpeg header manipulation tool.

+ + +

Multiple vulnerabilities have been discovered in JHead. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All JHead users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-gfx/jhead-3.04" + + + + + CVE-2019-1010301 + + + CVE-2019-1010302 + + CVE-2019-19035 + CVE-2020-6624 + CVE-2020-6625 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-18.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-18.xml new file mode 100644 index 0000000000..01b58a0aad --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-18.xml @@ -0,0 +1,48 @@ + + + + QtNetwork: Denial of service + A vulnerability in QtNetwork could lead to a Denial of Service + condition. + + qtnetwork + 2020-07-26 + 2020-07-26 + 727604 + remote + + + 5.14.2-r1 + 5.14.2-r1 + + + +

QtNetwork provides a set of APIs for programming applications that use + TCP/IP. It is part of the Qt framework. +

+ + +

A flaw was discovered in QtNetwork’s handling of OpenSSL protocol + errors. +

+ + +

An attacker could cause a possible Denial of Service condition.

+ + +

There is no known workaround at this time.

+ + +

All QtNetwork users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-qt/qtnetwork-5.14.2-r1" + + + + CVE-2020-13962 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-19.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-19.xml new file mode 100644 index 0000000000..2155cd0080 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-19.xml @@ -0,0 +1,51 @@ + + + + WavPack: Multiple vulnerabilities + Multiple vulnerabilities have been found in WavPack, the worst of + which could result in a Denial of Service condition. + + wavpack + 2020-07-27 + 2020-07-27 + 672638 + remote + + + 5.3.2 + 5.3.2 + + + +

WavPack is a set of hybrid lossless audio compression tools.

+ + +

Multiple vulnerabilities have been discovered in WavPack. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could send a specially crafted audio file possibly + resulting in a Denial of Service condition. Please review the referenced + CVE identifiers for details. +

+ + +

There is no known workaround at this time.

+ + +

All WavPack users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-sound/wavpack-5.3.2" + + + + CVE-2018-19840 + CVE-2018-19841 + CVE-2019-11498 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-20.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-20.xml new file mode 100644 index 0000000000..b05df4b815 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-20.xml @@ -0,0 +1,51 @@ + + + + fuseiso: Multiple vulnerabilities + Multiple vulnerabilities have been found in fuseiso, the worst of + which could result in the arbitrary execution of code. + + fuseiso + 2020-07-27 + 2020-07-27 + 713328 + remote + + + 20070708-r3 + 20070708-r3 + + + +

FuseISO is a FUSE module to mount ISO filesystem images (.iso, .nrg, + .bin, .mdf and .img files). +

+ + +

Multiple vulnerabilities have been discovered in fuseiso. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could entice a user to open a specially crafted ISO + file using fuseiso, possibly resulting in execution of arbitrary code + with the privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All fuseiso users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-fs/fuseiso-20070708-r3" + + + + CVE-2015-8837 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-21.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-21.xml new file mode 100644 index 0000000000..41a83f01f9 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-21.xml @@ -0,0 +1,51 @@ + + + + Libreswan: Denial of service + A vulnerability in Libreswan could lead to a Denial of Service + condition. + + libreswan + 2020-07-27 + 2020-07-27 + 722696 + remote + + + 3.32 + 3.32 + + + +

Libreswan is a free software implementation of the most widely supported + and standarized VPN protocol based on (“IPsec”) and the Internet Key + Exchange (“IKE”). +

+ + +

As a result of a bug in handling certain bogus encrypted IKEv1, while + building a log message that the packet has been dropped, a NULL pointer + dereference causes Libreswan to crash and restart when it attempts to log + the state name involved. +

+ + +

An attacker could cause a possible Denial of Service condition.

+ + +

There is no known workaround at this time.

+ + +

All Libreswan users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-vpn/libreswan-3.32" + + + + CVE-2020-1763 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-22.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-22.xml new file mode 100644 index 0000000000..fce9e1a3bb --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-22.xml @@ -0,0 +1,50 @@ + + + + sysstat: Arbitrary code execution + A use-after-free in sysstat was discovered which may allow + arbitrary code execution. + + sysstat + 2020-07-27 + 2020-07-27 + 706206 + local + + + 12.2.1 + 12.2.1 + + + +

sysstat is a package containing a number of performance monitoring + utilities for Linux, including sar, mpstat, iostat and sa tools. +

+ + +

A double-free in sysstat’s check_file_actlst() function was + discovered. +

+ + +

A local attacker could possibly execute arbitrary code with the + privileges of the process or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All sysstat users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-admin/sysstat-12.2.1" + + + + CVE-2019-19725 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-23.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-23.xml new file mode 100644 index 0000000000..49b3737c30 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-23.xml @@ -0,0 +1,48 @@ + + + + ClamAV: Multiple vulnerabilities + Multiple vulnerabilities have been found in ClamAV, the worst of + which could result in a Denial of Service condition. + + clamav + 2020-07-27 + 2020-07-27 + 732944 + remote + + + 0.102.4 + 0.102.4 + + + +

ClamAV is a GPL virus scanner.

+ + +

Multiple vulnerabilities have been discovered in ClamAV. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All ClamAV users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.102.4" + + + + CVE-2020-3327 + CVE-2020-3350 + CVE-2020-3481 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-24.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-24.xml new file mode 100644 index 0000000000..1ee579b1f6 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-24.xml @@ -0,0 +1,47 @@ + + + + Twisted: Access restriction bypasses + Multiple vulnerabilities have been found in Twisted, the worst of + which could result in a Denial of Service condition. + + twisted + 2020-07-27 + 2020-07-27 + 712240 + remote + + + 20.3.0 + 20.3.0 + + + +

Twisted is an asynchronous networking framework written in Python.

+ + +

Multiple vulnerabilities have been discovered in Twisted. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Twisted users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-python/twisted-20.3.0" + + + + CVE-2020-10108 + CVE-2020-10109 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-25.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-25.xml new file mode 100644 index 0000000000..95c3536dcf --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-25.xml @@ -0,0 +1,50 @@ + + + + arpwatch: Root privilege escalation + A vulnerability was discovered in arpwatch which may allow local + attackers to gain root privileges. + + arpwatch + 2020-07-27 + 2020-07-27 + 602552 + local + + + 2.1.15-r11 + 2.1.15-r11 + + + +

The ethernet monitor program; for keeping track of ethernet/ip address + pairings. +

+ + +

It was discovered that Gentoo’s arpwatch ebuild made excessive + permission operations on its data directories, possibly changing + ownership of unintended files. This only affects OpenRC systems, as the + flaw was exploitable via the init script. +

+ + +

A local attacker could escalate privileges.

+ + +

There is no known workaround at this time.

+ + +

All arpwatch users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=net-analyzer/arpwatch-2.1.15-r11" + + + + + b-man + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-26.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-26.xml new file mode 100644 index 0000000000..9d1a1dbc8f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-26.xml @@ -0,0 +1,55 @@ + + + + SQLite: Multiple vulnerabilities + Multiple vulnerabilities have been found in SQLite, the worst of + which could result in the arbitrary execution of code. + + sqlite + 2020-07-27 + 2020-07-27 + 716748 + remote + + + 3.32.3 + 3.32.3 + + + +

SQLite is a C library that implements an SQL database engine.

+ + +

Multiple vulnerabilities have been discovered in SQLite. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All SQLite users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/sqlite-3.32.3" + + + + CVE-2019-20218 + CVE-2020-11655 + CVE-2020-11656 + CVE-2020-13434 + CVE-2020-13435 + CVE-2020-13630 + CVE-2020-13631 + CVE-2020-13632 + CVE-2020-13871 + CVE-2020-15358 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-27.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-27.xml new file mode 100644 index 0000000000..cc568e2427 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-27.xml @@ -0,0 +1,50 @@ + + + + Haml: Arbitrary code execution + A flaw in Haml allows arbitrary code execution as a result of + improper filtering. + + haml + 2020-07-27 + 2020-07-27 + 699840 + remote + + + 5.1.2 + 5.1.2 + + + +

Haml is a templating engine for HTML.

+ + +

It was discovered that Haml was not correctly filtering out special + characters which may be used for attributes. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Haml users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-ruby/haml-5.1.2" + + + + + CVE-2017-1002201 + + + BlueKnight + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-28.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-28.xml new file mode 100644 index 0000000000..9f2b781ea0 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-28.xml @@ -0,0 +1,46 @@ + + + + re2c: Buffer overflow + A vulnerability in re2c could lead to a Denial of Service + condition. + + re2c + 2020-07-27 + 2020-07-27 + 718350 + remote + + + 1.3-r1 + 1.3-r1 + + + +

re2c is a tool for generating C-based recognizers from regular + expressions. +

+ + +

A heap buffer overflow vulnerability was discovered in re2c.

+ + +

An attacker could possibly cause a Denial of Service condition.

+ + +

There is no known workaround at this time.

+ + +

All re2c users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-util/re2c-1.3-r1" + + + + CVE-2020-11958 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-29.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-29.xml new file mode 100644 index 0000000000..07c32a1b7c --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-29.xml @@ -0,0 +1,59 @@ + + + + rssh: Multiple vulnerabilities + Multiple vulnerabilities have been found in rssh, the worst of + which could result in the arbitrary execution of code. + + rssh + 2020-07-27 + 2020-07-27 + 699842 + remote + + + 2.3.4_p3 + + + +

rssh is a restricted shell, allowing only a few commands like scp or + sftp. It is often used as a complement to OpenSSH to provide limited + access to users. +

+ + +

Multiple vulnerabilities have been discovered in rssh. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

Gentoo has discontinued support for rssh. We recommend that users + unmerge rssh: +

+ + + # emerge --unmerge "app-shells/rssh" + + +

NOTE: The Gentoo developer(s) maintaining rssh have discontinued support + at this time. It may be possible that a new Gentoo developer will update + rssh at a later date. OpenSSH (net-misc/openssh) may be able to provide + similar functionality using its extensive configuration. +

+ + + + CVE-2019-1000018 + + CVE-2019-3463 + CVE-2019-3464 + + b-man + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-30.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-30.xml new file mode 100644 index 0000000000..7a093aa57c --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-30.xml @@ -0,0 +1,51 @@ + + + + spice: Arbitrary code execution + A buffer overread has been discovered in spice possibly allowing + remote execution of code. + + spice + 2020-07-27 + 2020-07-27 + 717776 + remote + + + 0.14.2 + 0.14.2 + + + +

Provides a complete open source solution for remote access to virtual + machines in a seamless way so you can play videos, record audio, share + USB devices, and share folders without complications. +

+ + +

A flaw in spice’s memory handling code has been discovered, allowing + an out of bounds read. +

+ + +

A remote attacker may be able to send malicious packets causing remote + code execution. +

+ + +

There is no known workaround at this time.

+ + +

All spice users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/spice-0.14.2" + + + + CVE-2019-3813 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-31.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-31.xml new file mode 100644 index 0000000000..add1030a68 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-31.xml @@ -0,0 +1,55 @@ + + + + Icinga: Root privilege escalation + Icinga installs files with insecure permissions allowing root + privilege escalation. + + icinga + 2020-07-27 + 2020-07-27 + 638186 + local + + + 1.14.2 + + + +

Icinga is an open source computer system and network monitoring + application. It was originally created as a fork of the Nagios system + monitoring application in 2009. +

+ + +

It was discovered that Icinga’s installed files have insecure + permissions, possibly allowing root privilege escalation. +

+ + +

A local attacker could escalate privileges to root.

+ + +

There is no known workaround at this time.

+ + +

Gentoo has discontinued support for Icinga. We recommend that users + unmerge Icinga: +

+ + + # emerge --unmerge "net-analyzer/icinga" + + +

NOTE: The Gentoo developer(s) maintaining Icinga have discontinued + support at this time. It may be possible that a new Gentoo developer will + update Icinga at a later date. The natural replacement is Icinga 2 + (net-analyzer/icinga2). +

+ + + CVE-2017-16882 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-32.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-32.xml new file mode 100644 index 0000000000..4d7d455e0b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-32.xml @@ -0,0 +1,45 @@ + + + + Sarg: Local privilege escalation + A flaw in Sarg may allow local privilege escalation. + sarg + 2020-07-27 + 2020-07-27 + 706748 + local + + + 2.4.0 + 2.4.0 + + + +

Sarg (Squid Analysis Report Generator) is a tool that provides many + informations about the Squid web proxy server users activities: time, + sites, traffic, etc. +

+ + +

A flaw in Sarg’s handling of temporary directories was discovered.

+ + +

A local attacker may be able to escalate privileges.

+ + +

There is no known workaround at this time.

+ + +

All Sarg users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-analyzer/sarg-2.4.0" + + + + CVE-2019-18932 + + b-man + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-33.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-33.xml new file mode 100644 index 0000000000..4a0344ccad --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-33.xml @@ -0,0 +1,52 @@ + + + + OSSEC: Multiple vulnerabilities + Multiple vulnerabilities have been found in OSSEC, the worst of + which could result in the arbitrary execution of code. + + ossec-hids + 2020-07-27 + 2020-07-27 + 707826 + local, remote + + + 3.6.0 + 3.6.0 + + + +

OSSEC is a full platform to monitor and control your system(s).

+ + +

Multiple vulnerabilities have been discovered in OSSEC. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All OSSEC users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-analyzer/ossec-hids-3.6.0" + + + + CVE-2020-8442 + CVE-2020-8443 + CVE-2020-8444 + CVE-2020-8445 + CVE-2020-8446 + CVE-2020-8447 + CVE-2020-8448 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-34.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-34.xml new file mode 100644 index 0000000000..dc1ab39bcc --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-34.xml @@ -0,0 +1,51 @@ + + + + Apache Ant: Multiple vulnerabilities + Apache Ant uses various insecure temporary files possibly allowing + local code execution. + + ant + 2020-07-27 + 2020-07-27 + 723086 + local + + + 1.10.8 + 1.10.8 + + + +

Ant is a Java-based build tool similar to ‘make’ that uses XML + configuration files. +

+ + +

Apache Ant was found to be using multiple insecure temporary files which + may disclose sensitive information or execute code from an unsafe local + location. +

+ + +

A local attacker could possibly execute arbitrary code with the + privileges of the process, or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Apache Ant users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-java/ant-1.10.8" + + + + CVE-2020-1945 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-35.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-35.xml new file mode 100644 index 0000000000..0e50ed083b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-35.xml @@ -0,0 +1,50 @@ + + + + ReportLab: Arbitrary code execution + A vulnerability allowing arbitrary code execution was found in + ReportLab. + + reportlab + 2020-07-27 + 2020-07-27 + 710738 + remote + + + 3.5.42 + 3.5.42 + + + +

ReportLab is an Open Source Python library for generating PDFs and + graphics. +

+ + +

ReportLab was found to be mishandling XML documents and may evaluate the + contents without checking for their safety. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All ReportLab users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-python/reportlab-3.5.42" + + + + CVE-2019-17626 + + b-man + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-36.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-36.xml new file mode 100644 index 0000000000..d02db4bdd6 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-36.xml @@ -0,0 +1,52 @@ + + + + DjVu: Multiple vulnerabilities + Multiple vulnerabilities have been found in DjVu, the worst of + which could result in a Denial of Service condition. + + djvu + 2020-07-27 + 2020-07-27 + 536720 + 718552 + local, remote + + + 3.5.27-r2 + 3.5.27-r2 + + + +

DjVu is a web-centric format and software platform for distributing + documents and images. +

+ + +

Multiple vulnerabilities have been discovered in DjVu. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All DjVu users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-text/djvu-3.5.27-r2" + + + + CVE-2019-15142 + CVE-2019-15143 + CVE-2019-15144 + CVE-2019-15145 + + b-man + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-37.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-37.xml new file mode 100644 index 0000000000..939c728346 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-37.xml @@ -0,0 +1,48 @@ + + + + AWStats: Multiple vulnerabilities + Multiple vulnerabilities have been found in AWStats, the worst of + which could result in the arbitrary execution of code. + + awstats + 2020-07-27 + 2020-07-27 + 646786 + remote + + + 7.8 + 7.8 + + + +

AWStats is an advanced log file analyzer and statistics generator.

+ + +

Multiple vulnerabilities have been discovered in AWStats. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All AWStats users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-misc/awstats-7.8" + + + + + CVE-2017-1000501 + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-38.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-38.xml new file mode 100644 index 0000000000..7af45ddf4b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-38.xml @@ -0,0 +1,52 @@ + + + + QtGui: Arbitrary code execution + A use-after-free was discovered in QtGui's Markdown handling code + possibly allowing a remote attacker to execute arbitrary code. + + qtgui + 2020-07-27 + 2020-07-27 + 719732 + remote + + + 5.14.2 + 5.14.2 + + + +

QtGui is a module for the Qt toolkit.

+ + +

QtGui’s setMarkdown has a use-after-free related to + QTextMarkdownImporter::insertBlock. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All QtGui users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-qt/qtgui-5.14.2" + + +

Note that the Qt suite is best kept in sync, so a world upgrade may be + advisable to keep your system in a good state. +

+ + + CVE-2020-12267 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-39.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-39.xml new file mode 100644 index 0000000000..58f929084a --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-39.xml @@ -0,0 +1,60 @@ + + + + Binutils: Multiple vulnerabilities + Multiple vulnerabilities have been found in Binutils, the worst of + which could result in a Denial of Service condition. + + binutils + 2020-07-27 + 2020-07-27 + 688836 + 690590 + 711324 + remote + + + 2.33.1 + 2.33.1 + + + +

The GNU Binutils are a collection of tools to create, modify and analyse + binary files. Many of the files use BFD, the Binary File Descriptor + library, to do low-level manipulation. +

+ + +

Multiple vulnerabilities have been discovered in Binutils. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Binutils users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-devel/binutils-2.33.1" + + + + CVE-2019-12972 + CVE-2019-14250 + CVE-2019-14444 + CVE-2019-17450 + CVE-2019-17451 + CVE-2019-12972 + CVE-2019-14250 + CVE-2019-14444 + CVE-2019-17450 + CVE-2019-17451 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-40.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-40.xml new file mode 100644 index 0000000000..e9df7724c5 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-40.xml @@ -0,0 +1,54 @@ + + + + Thin: Privilege escalation + A vulnerability was discovered in Thin which may allow local + attackers to kill arbitrary processes (denial of service). + + thin + 2020-07-27 + 2020-07-27 + 642200 + local + + + 1.7.2 + + + +

Thin is a small and fast Ruby web server.

+ + +

It was discovered that Gentoo’s Thin ebuild does not properly handle + its temporary runtime directories. This only affects OpenRC systems, as + the flaw was exploitable via the init script. +

+ + +

A local attacker could cause denial of service by killing arbitrary + processes. +

+ + +

There is no known workaround at this time.

+ + +

Gentoo has discontinued support for Thin. We recommend that users + unmerge Thin: +

+ + + # emerge --unmerge "www-servers/thin" + + +

NOTE: The Gentoo developer(s) maintaining Thin have discontinued support + at this time. It may be possible that a new Gentoo developer will update + Thin at a later date. There are many other web servers available in the + tree in the www-servers category. +

+ + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-41.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-41.xml new file mode 100644 index 0000000000..bf2f0ca236 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-41.xml @@ -0,0 +1,58 @@ + + + + Roundcube: Multiple vulnerabilities + A flaw in Roundcube's handling of configuration files may allow + arbitrary code execution, amongst other vulnerabilities. + + Roundcube + 2020-07-27 + 2020-07-27 + 720876 + remote + + + 1.4.4 + 1.3.11 + 1.4.4 + 1.3.11 + + + +

Free and open source webmail software for the masses, written in PHP.

+ + +

Multiple vulnerabilities have been discovered in Roundcube. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Roundcube 1.4.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/roundcube-1.4.4" + + +

All Roundcube 1.3.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/roundcube-1.3.11" + + + + CVE-2020-12625 + CVE-2020-12626 + CVE-2020-12640 + CVE-2020-12641 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-42.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-42.xml new file mode 100644 index 0000000000..ec32f06457 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-42.xml @@ -0,0 +1,48 @@ + + + + LHa: Buffer overflow + LHa has a buffer overflow in its compression utility with + unspecified impact. + + lha + 2020-07-27 + 2020-07-27 + 572418 + remote + + + 114i_p20201004 + 114i_p20201004 + + + +

LHa is a console-based program for packing and unpacking LHarc archives.

+ + +

A buffer overflow in LHa’s compression code was discovered which can + be triggered by a crafted input file. +

+ + +

A remote attacker could send a specially crafted file possibly resulting + in a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All LHa users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-arch/lha-114i_p20201004" + + + + CVE-2016-1925 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-43.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-43.xml new file mode 100644 index 0000000000..ea037b2c02 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-43.xml @@ -0,0 +1,46 @@ + + + + TRE: Multiple vulnerabilities + Multiple vulnerabilities have been found in TRE, the worst of which + could result in the arbitrary execution of code. + + tre + 2020-07-27 + 2020-07-27 + 597616 + remote + + + 0.8.0-r2 + 0.8.0-r2 + + + +

TRE is the free and portable approximate regex matching library.

+ + +

Multiple vulnerabilities have been discovered in TRE. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All TRE users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/tre-0.8.0-r2" + + + + CVE-2016-8859 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-44.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-44.xml new file mode 100644 index 0000000000..faf4a14f3b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-44.xml @@ -0,0 +1,52 @@ + + + + FreeXL: Multiple vulnerabilities + Multiple vulnerabilities have been found in FreeXL, the worst of + which could result in a Denial of Service condition. + + freexl + 2020-07-27 + 2020-07-27 + 648700 + remote + + + 1.0.5 + 1.0.5 + + + +

FreeXL is an open source library to extract valid data from within an + Excel (.xls) spreadsheet. +

+ + +

Multiple vulnerabilities have been discovered in FreeXL. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All FreeXL users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/freexl-1.0.5" + + + + CVE-2018-7435 + CVE-2018-7436 + CVE-2018-7437 + CVE-2018-7438 + CVE-2018-7439 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-45.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-45.xml new file mode 100644 index 0000000000..0e64d8ef9f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-45.xml @@ -0,0 +1,50 @@ + + + + NTFS-3G: Remote code execution, possible privilege escalation + A buffer overflow in NTFS-3g might allow local or remote + attacker(s) to execute arbitrary code, or escalate privileges. + + ntfs-3g + 2020-07-27 + 2020-07-27 + 717640 + remote + + + 2017.3.23-r3 + 2017.3.23-r3 + + + +

NTFS-3G is a stable, full-featured, read-write NTFS driver for various + operating systems. +

+ + +

An integer underflow issue exists in NTFS-3G which may cause a heap + buffer overflow with crafted input. +

+ + +

A remote attacker may be able to execute arbitrary code while a local + attacker may be able to escalate privileges. +

+ + +

There is no known workaround at this time.

+ + +

All NTFS-3G users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-fs/ntfs3g-2017.3.23-r3" + + + + CVE-2019-9755 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-46.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-46.xml new file mode 100644 index 0000000000..f4248489fd --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-46.xml @@ -0,0 +1,46 @@ + + + + D-Bus: Denial of service + A local Denial of Service vulnerability was discovered in D-Bus. + d-bus + 2020-07-27 + 2020-07-27 + 727104 + local + + + 1.12.18 + 1.12.18 + + + +

D-Bus is a message bus system which processes can use to talk to each + other. +

+ + +

D-Bus does not correctly dispose of old connections meaning that it is + possible for D-Bus to hit a connection limit. +

+ + +

An attacker could cause a possible Denial of Service condition.

+ + +

There is no known workaround at this time.

+ + +

All D-Bus users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/dbus-1.12.18" + + + + CVE-2020-12049 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-47.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-47.xml new file mode 100644 index 0000000000..17e4f22573 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-47.xml @@ -0,0 +1,49 @@ + + + + Okular: Local restricted command execution + A logic error in Okular might allow an attacker to execute + arbitrary code. + + okular + 2020-07-27 + 2020-07-27 + 712490 + local, remote + + + 19.12.3-r1 + 19.12.3-r1 + + + +

Okular is a universal document viewer based on KPDF.

+ + +

A logic error was discovered in Okular, which results in trusting action + links within a PDF, possibly allowing execution of a binary. +

+ + +

A remote attacker could entice a user to open a specially crafted PDF + using Okular, possibly resulting in execution of arbitrary code with the + privileges of the process or a Denial of Service condition. +

+ + +

Avoid opening PDFs from an untrusted source.

+ + +

All Okular users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=kde-apps/okular-19.12.3-r1" + + + + CVE-2020-9359 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-48.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-48.xml new file mode 100644 index 0000000000..d89382e831 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-48.xml @@ -0,0 +1,50 @@ + + + + OCaml: Arbitrary code execution + An integer overflow was discovered in OCaml's standard library, + possibly allowing arbitrary execution of code. + + ocaml + 2020-07-27 + 2020-07-27 + 719134 + remote + + + 4.09.0 + 4.09.0 + + + +

OCaml is a high-level, strongly-typed, functional, and object-oriented + programming language from the ML family of languages +

+ + +

The caml_ba_deserialize function in byterun/bigarray.c in the standard + library of OCaml has an integer overflow. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All OCaml users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/ocaml-4.09.0" + + + + CVE-2018-9838 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-49.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-49.xml new file mode 100644 index 0000000000..b49d290f49 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-49.xml @@ -0,0 +1,49 @@ + + + + Mozilla Network Security Service (NSS): Information disclosure + NSS has an information disclosure vulnerability when handling DSA + keys. + + nss + 2020-07-27 + 2020-07-27 + 726842 + local, remote + + + 3.52.1 + 3.52.1 + + + +

The Mozilla Network Security Service (NSS) is a library implementing + security features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS + #12, S/MIME and X.509 certificates. +

+ + +

NSS was found to not always perform constant-time operations when + working with DSA key material. +

+ + +

An attacker may be able to obtain information about a DSA private key.

+ + +

There is no known workaround at this time.

+ + +

All NSS users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.52.1" + + + + CVE-2020-12399 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-50.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-50.xml new file mode 100644 index 0000000000..850b4d3f93 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-50.xml @@ -0,0 +1,49 @@ + + + + GLib Networking: Improper certificate validation + GLib Networking was not properly verifying TLS certificates in all + circumstances, possibly allowing an integrity/confidentiality compromise. + + glib-networking + 2020-07-27 + 2020-07-27 + 725880 + remote + + + 2.62.4 + 2.62.4 + + + +

Network-related giomodules for glib

+ + +

GTlsClientConnection skips hostname verification of the server’s TLS + certificate if the application fails to specify the expected server + identity. +

+ + +

There may be a breach of integrity or confidentiality in connections + made using GLib Networking. +

+ + +

There is no known workaround at this time.

+ + +

All GLib Networking users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/glib-networking-2.62.4" + + + + CVE-2020-13645 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-51.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-51.xml new file mode 100644 index 0000000000..c31beb1558 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-51.xml @@ -0,0 +1,44 @@ + + + + FileZilla: Untrusted search path + A vulnerability was found in FileZilla which might allow privilege + escalation. + + filezilla + 2020-07-27 + 2020-07-27 + 717726 + remote + + + 3.47.2.1 + 3.47.2.1 + + + +

FileZilla is an open source FTP client.

+ + +

It was discovered that FileZilla uses an untrusted search path.

+ + +

An attacker could use a malicious binary to escalate privileges.

+ + +

There is no known workaround at this time.

+ + +

All FileZilla users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-ftp/filezilla-3.47.2.1" + + + + CVE-2019-5429 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-52.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-52.xml new file mode 100644 index 0000000000..ca15b4d4aa --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-52.xml @@ -0,0 +1,49 @@ + + + + mujs: Multiple vulnerabilities + + Multiple vulnerabilities have been found in mujs, the worst of + which could result in a Denial of Service condition. + + mujs + 2020-07-28 + 2020-07-28 + 719248 + remote + + + 1.0.6 + 1.0.6 + + + +

mujs is an embeddable Javascript interpreter in C.

+ + +

Multiple vulnerabilities have been discovered in mujs. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All mujs users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/mujs-" + + + + CVE-2019-11411 + CVE-2019-11412 + CVE-2019-11413 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-53.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-53.xml new file mode 100644 index 0000000000..4a0f3ad7e3 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-53.xml @@ -0,0 +1,50 @@ + + + + Dropbear: Multiple vulnerabilities + Multiple vulnerabilities have been found in Dropbear, the worst of + which could result in a Denial of Service condition. + + dropbear + 2020-07-28 + 2020-07-28 + 723848 + remote + + + 2020.80 + 2020.80 + + + +

Dropbear is an SSH server and client designed with a small memory + footprint. +

+ + +

Multiple vulnerabilities have been discovered in Dropbear. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Dropbear users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/dropbear-2020.80" + + + + CVE-2018-0739 + CVE-2018-12437 + CVE-2018-20685 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-54.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-54.xml new file mode 100644 index 0000000000..72209c2221 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-54.xml @@ -0,0 +1,49 @@ + + + + rsync: Multiple vulnerabilities + Multiple vulnerabilities have been found in rsync, the worst of + which could result in a Denial of Service condition. + + rsync + 2020-07-28 + 2020-07-28 + 728852 + remote + + + 3.2.0 + 3.2.0 + + + +

File transfer program to keep remote files into sync.

+ + +

Multiple vulnerabilities have been discovered in rsync (within bundled + zlib). Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All rsync users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/rsync-3.2.0" + + + + CVE-2016-9840 + CVE-2016-9841 + CVE-2016-9842 + CVE-2016-9843 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-55.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-55.xml new file mode 100644 index 0000000000..cb2f337bff --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-55.xml @@ -0,0 +1,50 @@ + + + + libetpan: Improper STARTTLS handling + A vulnerability was discovered in libetpan's STARTTLS handling, + possibly allowing an integrity/confidentiality compromise. + + libetpan + 2020-07-28 + 2020-07-28 + 734130 + remote + + + 1.9.4-r1 + 1.9.4-r1 + + + +

libetpan is a portable, efficient middleware for different kinds of mail + access. +

+ + +

It was discovered that libetpan was not properly handling state within + the STARTTLS protocol handshake. +

+ + +

There may be a breach of integrity or confidentiality in connections + made using libetpan with STARTTLS. +

+ + +

There is no known workaround at this time.

+ + +

All libetpan users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/libetpan-1.9.4-r1" + + + + CVE-2020-15953 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-56.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-56.xml new file mode 100644 index 0000000000..f71973e186 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-56.xml @@ -0,0 +1,48 @@ + + + + Claws Mail: Improper STARTTLS handling + A vulnerability was discovered in Claws Mail's STARTTLS handling, + possibly allowing an integrity/confidentiality compromise. + + claws-mail + 2020-07-28 + 2020-07-28 + 733684 + remote + + + 3.17.6 + 3.17.6 + + + +

Claws Mail is a GTK based e-mail client.

+ + +

It was discovered that Claws Mail was not properly handling state within + the STARTTLS protocol handshake. +

+ + +

There may be a breach of integrity or confidentiality in connections + made using Claws Mail with STARTTLS. +

+ + +

There is no known workaround at this time.

+ + +

All Claws Mail users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/claws-mail-3.17.6" + + + + CVE-2020-15917 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-57.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-57.xml new file mode 100644 index 0000000000..3c2e72d851 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-57.xml @@ -0,0 +1,65 @@ + + + + Mutt, Neomutt: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mutt and Neomutt, the + worst of which could result in an access restriction bypass. + + mutt,neomutt + 2020-07-28 + 2020-07-28 + 728294 + 728302 + 728708 + remote + + + 1.14.4 + 1.14.4 + + + 20200619 + 20200619 + + + +

Mutt is a small but very powerful text-based mail client.

+ +

NeoMutt is a command line mail reader (or MUA). It’s a fork of Mutt + with added features. +

+ + +

Multiple vulnerabilities have been discovered in Mutt and Neomutt. + Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mutt users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/mutt-1.14.4" + + +

All Neomutt users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/neomutt-20200619" + + + + CVE-2020-14093 + CVE-2020-14154 + CVE-2020-14954 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-58.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-58.xml new file mode 100644 index 0000000000..5e62fba956 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-58.xml @@ -0,0 +1,54 @@ + + + + FFmpeg: Multiple vulnerabilities + Multiple vulnerabilities have been found in FFmpeg, the worst of + which could result in the arbitrary execution of code. + + ffmpeg + 2020-07-28 + 2020-07-28 + 718012 + 719940 + 727450 + remote + + + 4.2.4 + 4.2.4 + + + +

FFmpeg is a complete, cross-platform solution to record, convert and + stream audio and video. +

+ + +

Multiple vulnerabilities have been discovered in FFmpeg. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All FFmpeg users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-video/ffmpeg-4.2.4" + + + + CVE-2019-13312 + CVE-2019-15942 + CVE-2020-12284 + CVE-2020-13904 + CVE-2020-14212 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-59.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-59.xml new file mode 100644 index 0000000000..affe1e4294 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-59.xml @@ -0,0 +1,70 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in the arbitrary execution of code. + + chromium,google-chrome + 2020-07-29 + 2020-07-29 + 734150 + remote + + + 84.0.4147.105 + 84.0.4147.105 + + + 84.0.4147.105 + 84.0.4147.105 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-84.0.4147.105" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-84.0.4147.105" + + + + CVE-2020-6532 + CVE-2020-6537 + CVE-2020-6538 + CVE-2020-6539 + CVE-2020-6540 + CVE-2020-6541 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-60.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-60.xml new file mode 100644 index 0000000000..5edcdfccdf --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-60.xml @@ -0,0 +1,62 @@ + + + + Mozilla Firefox: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mozilla Firefox, the + worst of which could result in the arbitrary execution of code. + + firefox + 2020-07-30 + 2020-07-30 + 734324 + remote + + + 68.11.0 + 68.11.0 + + + 68.11.0 + 68.11.0 + + + +

Mozilla Firefox is a popular open-source web browser from the Mozilla + Project. +

+ + +

Multiple vulnerabilities have been discovered in Mozilla Firefox. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Firefox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-68.11.0" + + +

All Mozilla Firefox binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-68.11.0" + + + + + CVE-2020-15652 + CVE-2020-15659 + CVE-2020-6463 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-61.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-61.xml new file mode 100644 index 0000000000..1b54bb27df --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-61.xml @@ -0,0 +1,55 @@ + + + + WebKitGTK+: Multiple vulnerabilities + Multiple vulnerabilities have been found in WebKitGTK+, the worst + of which could result in the arbitrary execution of code. + + webkitgtk+ + 2020-07-31 + 2020-07-31 + 734584 + remote + + + 2.28.4 + 2.28.4 + + + +

WebKitGTK+ is a full-featured port of the WebKit rendering engine, + suitable for projects requiring any kind of web integration, from hybrid + HTML/CSS applications to full-fledged web browsers. +

+ + +

Multiple vulnerabilities have been discovered in WebKitGTK+. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All WebKitGTK+ users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.28.4" + + + + + CVE-2020-9862 + CVE-2020-9893 + CVE-2020-9894 + CVE-2020-9895 + CVE-2020-9915 + CVE-2020-9925 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-62.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-62.xml new file mode 100644 index 0000000000..6186762c7c --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-62.xml @@ -0,0 +1,51 @@ + + + + PyCrypto: Weak key generation + A flaw in PyCrypto allow remote attackers to obtain sensitive + information. + + pycrypto + 2020-07-31 + 2020-07-31 + 703682 + remote + + + 2.6.1-r2 + + + +

PyCrypto is the Python Cryptography Toolkit.

+ + +

It was discovered that PyCrypto incorrectly generated ElGamal key + parameters. +

+ + +

Attackers may be able to obtain sensitive information by reading + ciphertext data. +

+ + +

There is no known workaround at this time.

+ + +

Gentoo has discontinued support for PyCrypto. We recommend that users + unmerge PyCrypto: +

+ +

# emerge --unmerge “dev-python/pycrypto”

+ +

NOTE: The Gentoo developer(s) maintaining PyCrypto have discontinued + support at this time. PyCryptodome is the canonical successor to + PyCrypto. +

+ + + CVE-2018-6594 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-63.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-63.xml new file mode 100644 index 0000000000..b9966a5a0b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-63.xml @@ -0,0 +1,53 @@ + + + + SNMP Trap Translator: Multiple vulnerabilities + Multiple vulnerabilities have been found in SNMP Trap Translator, + the worst of which could allow attackers to execute arbitrary shell code. + + snmptt + 2020-07-31 + 2020-08-16 + 733478 + remote + + + 1.4.1 + 1.4.1 + + + +

SNMP Trap Translator (SNMPTT) is an SNMP trap handler written in Perl.

+ + +

It was found that SNMP Trap Translator does not drop privileges as + configured and does not properly escape shell commands in certain + functions. +

+ + +

A remote attacker, by sending a malicious crafted SNMP trap, could + possibly execute arbitrary shell code with the privileges of the process + or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All SNMP Trap Translator users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-analyzer/snmptt-1.4.1" + + + + + SNMPTT 1.4.1 ChangeLog + + CVE-2020-24361 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-64.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-64.xml new file mode 100644 index 0000000000..1267eab96b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-64.xml @@ -0,0 +1,68 @@ + + + + Mozilla Thunderbird: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mozilla Thunderbird, + the worst of which could result in the arbitrary execution of code. + + thunderbird + 2020-07-31 + 2020-07-31 + 734978 + remote + + + 68.11.0 + 68.11.0 + + + 68.11.0 + 68.11.0 + + + +

Mozilla Thunderbird is a popular open-source email client from the + Mozilla project. +

+ + +

Multiple vulnerabilities have been discovered in Mozilla Thunderbird. + Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Thunderbird users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-68.11.0" + + +

All Mozilla Thunderbird binary users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=mail-client/thunderbird-bin-68.11.0" + + + + CVE-2020-15652 + CVE-2020-15659 + CVE-2020-6463 + CVE-2020-6514 + + MFSA-2020-35 + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-65.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-65.xml new file mode 100644 index 0000000000..afb2aede7b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202007-65.xml @@ -0,0 +1,52 @@ + + + + libsndfile: Multiple vulnerabilities + Multiple vulnerabilities have been found in libsndfile, the worst + of which could result in a Denial of Service condition. + + libsndfile + 2020-07-31 + 2020-07-31 + 631674 + 671834 + remote + + + 1.0.29_pre2_p20191024 + 1.0.29_pre2_p20191024 + + + +

libsndfile is a C library for reading and writing files containing + sampled sound. +

+ + +

Multiple vulnerabilities have been discovered in libsndfile. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All libsndfile users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=media-libs/libsndfile-1.0.29_pre2_p20191024" + + + + CVE-2017-14245 + CVE-2017-14246 + CVE-2019-3832 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-01.xml new file mode 100644 index 0000000000..3027067a0e --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-01.xml @@ -0,0 +1,77 @@ + + + + Python: Multiple vulnerabilities + Multiple vulnerabilities have been found in Python, the worst of + which could result in a Denial of Service condition. + + python + 2020-08-02 + 2020-08-02 + 728668 + 732498 + remote + + + 2.7.18-r1 + 3.6.11-r2 + 3.7.8-r2 + 3.8.4-r1 + 2.7.18-r1 + 3.6.11-r2 + 3.7.8-r2 + 3.8.4-r1 + + + +

Python is an interpreted, interactive, object-oriented programming + language. +

+ + +

Multiple vulnerabilities have been discovered in Python. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Python 2.7 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.18-r1" + + +

All Python 3.6 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.6.11-r2" + + +

All Python 3.7 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.7.8-r2" + + +

All Python 3.8 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.8.4-r1" + + + + CVE-2019-20907 + CVE-2020-14422 + + sam_c + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-02.xml new file mode 100644 index 0000000000..fb25e05173 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-02.xml @@ -0,0 +1,50 @@ + + + + GNU GLOBAL: Arbitrary code execution + A vulnerability in GNU GLOBAL was discovered, possibly allowing + remote attackers to execute arbitrary code. + + global + 2020-08-08 + 2020-08-08 + 646348 + remote + + + 6.6.4 + 6.6.4 + + + +

GNU GLOBAL is a source code tagging system that works the same way + across diverse environments, such as Emacs editor, Vi editor, Less + viewer, Bash shell, various web browsers, etc. +

+ + +

A vulnerability was found in an undocumented function of gozilla.

+ + +

A remote attacker could entice a user to open a specially crafted URL + using GNU GLOBAL, possibly resulting in execution of arbitrary code with + the privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All GNU GLOBAL users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-util/global-6.6.4" + + + + CVE-2017-17531 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-03.xml new file mode 100644 index 0000000000..3aac543e24 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-03.xml @@ -0,0 +1,51 @@ + + + + Ark: Arbitrary code execution + Ark was found to allow arbitrary file overwrite, possibly allowing + arbitrary code execution. + + ark + 2020-08-08 + 2020-08-08 + 734622 + remote + + + 20.04.3-r1 + 20.04.3-r1 + + + +

Ark is a graphical file compression/decompression utility with support + for multiple formats. +

+ + +

A maliciously crafted archive with “../” in the file path(s) could + install files anywhere in the user’s home directory upon extraction. +

+ + +

A remote attacker could entice a user to open a specially crafted + archive using Ark, possibly resulting in execution of arbitrary code with + the privileges of the process or a Denial of Service condition. +

+ + +

Avoid opening untrusted archives.

+ + +

All Ark users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=kde-apps/ark-20.04.3-r1" + + + + CVE-2020-16116 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-04.xml new file mode 100644 index 0000000000..cfae51c02f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-04.xml @@ -0,0 +1,51 @@ + + + + Apache: Multiple vulnerabilities + Multiple vulnerabilities have been found in Apache, the worst of + which could result in the arbitrary execution of code. + + apache + 2020-08-08 + 2020-08-08 + 736282 + remote + + + 2.4.46 + 2.4.46 + + + +

The Apache HTTP server is one of the most popular web servers on the + Internet. +

+ + +

Multiple vulnerabilities have been discovered in Apache. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Apache users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-servers/apache-2.4.46" + + + + CVE-2020-11984 + CVE-2020-11985 + CVE-2020-11993 + CVE-2020-9490 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-05.xml new file mode 100644 index 0000000000..bf2114ea11 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-05.xml @@ -0,0 +1,50 @@ + + + + gThumb: Arbitrary code execution + A buffer overflow in gThumb might allow remote attacker(s) to + execute arbitrary code. + + gthumb + 2020-08-08 + 2020-08-08 + 712932 + remote + + + 3.10.0 + 3.10.0 + + + +

gThumb is an image viewer and browser for GNOME.

+ + +

A heap-based buffer overflow in gThumb’s + _cairo_image_surface_create_from_jpeg() function, located in + extensions/cairo_io/cairo-image-surface-jpeg.c was discovered. +

+ + +

A remote attacker could entice a user to open a specially crafted image + file using gThumb, possibly resulting in execution of arbitrary code with + the privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All gThumb users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-gfx/gthumb-3.10.0" + + + + CVE-2019-20326 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-06.xml new file mode 100644 index 0000000000..56806d91c7 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-06.xml @@ -0,0 +1,50 @@ + + + + iproute2: Denial of service + A use-after-free was found in iproute2, possibly allowing a Denial + of Service condition. + + iproute2 + 2020-08-08 + 2020-08-08 + 722144 + remote + + + 5.1.0 + 5.1.0 + + + +

iproute2 is a set of tools for managing Linux network routing and + advanced features. +

+ + +

iproute2 was found to contain a use-after-free in get_netnsid_from_name + in ip/ipnetns.c. +

+ + +

A remote attacker, able to feed iproute2 crafted data, may be able to + cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All iproute2 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/iproute2-5.1.0" + + + + CVE-2019-20795 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-07.xml new file mode 100644 index 0000000000..9105017da9 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-07.xml @@ -0,0 +1,80 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in the arbitrary execution of code. + + chromium,google-chrome + 2020-08-12 + 2020-08-12 + 736659 + remote + + + 84.0.4147.125 + 84.0.4147.125 + + + 84.0.4147.125 + 84.0.4147.125 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-84.0.4147.125" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-84.0.4147.125" + + + + CVE-2020-6542 + CVE-2020-6543 + CVE-2020-6544 + CVE-2020-6545 + CVE-2020-6547 + CVE-2020-6548 + CVE-2020-6549 + CVE-2020-6550 + CVE-2020-6551 + CVE-2020-6552 + CVE-2020-6553 + CVE-2020-6554 + CVE-2020-6555 + + Upstream advisory + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-08.xml new file mode 100644 index 0000000000..52d74e6941 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-08.xml @@ -0,0 +1,51 @@ + + + + Mozilla Network Security Service (NSS): Multiple vulnerabilities + NSS has multiple information disclosure vulnerabilities when + handling secret key material. + + nss + 2020-08-19 + 2020-08-19 + 734986 + local, remote + + + 3.55 + 3.55 + + + +

The Mozilla Network Security Service (NSS) is a library implementing + security features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS + #12, S/MIME and X.509 certificates. +

+ + +

Multiple vulnerabilities have been discovered in NSS. Please review the + CVE identifiers referenced below for details. +

+ + +

An attacker may be able to obtain information about secret key material.

+ + +

There is no known workaround at this time.

+ + +

All NSS users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.55" + + + + CVE-2020-12400 + CVE-2020-12401 + CVE-2020-12403 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-09.xml new file mode 100644 index 0000000000..b70ae35ee7 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-09.xml @@ -0,0 +1,49 @@ + + + + Shadow: Privilege escalation + Multiple Shadow utilities were installed with setuid permissions, + allowing possible root privilege escalation. + + shadow + 2020-08-25 + 2020-08-25 + 702252 + local + + + 4.8-r3 + 4.8-r3 + + + +

Shadow is a set of tools to deal with user accounts.

+ + +

When Shadow was installed with the PAM use flag, setuid binaries + provided by Shadow were not properly restricted. +

+ + +

A local attacker could escalate privileges to root.

+ + +

There is no known workaround at this time.

+ + +

All Shadow users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/shadow-4.8-r3" + + + + CVE-2019-19882 + Upstream + mitigation + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-10.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-10.xml new file mode 100644 index 0000000000..4dd751b4bc --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-10.xml @@ -0,0 +1,72 @@ + + + + Chromium, Google Chrome: Heap buffer overflow + + A vulnerablity has been found in Chromium and Google Chrome that could + allow a remote attacker to execute arbitrary code. + + chromium,google-chrome + 2020-08-25 + 2020-08-25 + 737942 + remote + + + 84.0.4147.135 + 84.0.4147.135 + + + 84.0.4147.135 + 84.0.4147.135 + + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

A buffer overflow has been discovered in Chromium and Google Chrome’s + SwiftShader component. +

+ + +

A remote attacker, by enticing a user to visit a specially crafted + website, could execute arbitrary code with the privileges of the process. +

+ + +

There is no known workaround at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-84.0.4147.135" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-84.0.4147.135" + + + + CVE-2020-6556 + + Upstream advisory + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-11.xml new file mode 100644 index 0000000000..41360a2fea --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-11.xml @@ -0,0 +1,80 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in the arbitrary execution of code. + + chromium,google-chrome + 2020-08-26 + 2020-08-26 + 738998 + local, remote + + + 85.0.4183.83 + 85.0.4183.83 + + + 85.0.4183.83 + 85.0.4183.83 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-85.0.4183.83" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-85.0.4183.83" + + + + CVE-2020-6559 + CVE-2020-6560 + CVE-2020-6561 + CVE-2020-6562 + CVE-2020-6563 + CVE-2020-6564 + CVE-2020-6565 + CVE-2020-6566 + CVE-2020-6567 + CVE-2020-6568 + CVE-2020-6569 + CVE-2020-6570 + CVE-2020-6571 + + Upstream advisory + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-12.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-12.xml new file mode 100644 index 0000000000..cdcf07b143 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-12.xml @@ -0,0 +1,50 @@ + + + + Net-SNMP: Multiple vulnerabilities + Multiple vulnerabilities have been found in Net-SNMP, the worst of + which could result in privilege escalation. + + Net-SNMP + 2020-08-26 + 2020-08-26 + 729610 + 734994 + local, remote + + + 5.8.1_pre1 + 5.8.1_pre1 + + + +

Net-SNMP bundles software for generating and retrieving SNMP data.

+ + +

Multiple vulnerabilities have been discovered in Net-SNMP. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Net-SNMP users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=net-analyzer/net-snmp-5.8.1_pre1" + + + + CVE-2019-20892 + CVE-2020-15861 + CVE-2020-15862 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-13.xml new file mode 100644 index 0000000000..a55d622083 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-13.xml @@ -0,0 +1,85 @@ + + + + PostgreSQL: Multiple vulnerabilities + Multiple vulnerabilities have been found in PostgreSQL, the worst + of which could result in privilege escalation. + + postgresql + 2020-08-26 + 2020-08-26 + 737032 + remote + + + 9.5.23 + 9.6.19 + 10.14 + 11.9 + 12.4 + 9.5.23 + 9.6.19 + 10.14 + 11.9 + 12.4 + + + +

PostgreSQL is an open source object-relational database management + system. +

+ + +

Multiple vulnerabilities have been discovered in PostgreSQL. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All PostgreSQL 9.5 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.5.23:9.5" + + +

All PostgreSQL 9.6 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.6.19:9.6" + + +

All PostgreSQL 10 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-10.14:10" + + +

All PostgreSQL 11 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-11.9:11" + + +

All PostgreSQL 12 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-12.4:12" + + + + CVE-2020-14349 + CVE-2020-14350 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-14.xml new file mode 100644 index 0000000000..e7a8b15cd1 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-14.xml @@ -0,0 +1,47 @@ + + + + Wireshark: Denial of service + A vulnerability in Wireshark could lead to a Denial of Service + condition. + + wireshark + 2020-08-26 + 2020-08-26 + 736914 + local, remote + + + 3.2.6 + 3.2.6 + + + +

Wireshark is a network protocol analyzer formerly known as ethereal.

+ + +

A double free error was discovered in Wireshark’s Kafka dissector.

+ + +

A remote attacker could exploit these vulnerabilities by sending a + malformed packet or enticing a user to read a malformed packet trace + file, causing a Denial of Service. +

+ + +

There is no known workaround at this time.

+ + +

All Wireshark users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-analyzer/wireshark-3.2.6" + + + + CVE-2020-17498 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-15.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-15.xml new file mode 100644 index 0000000000..20e4c75b7c --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-15.xml @@ -0,0 +1,47 @@ + + + + Docker: Information disclosure + A flaw in Docker allowed possible information leakage. + docker + 2020-08-26 + 2020-08-26 + 729208 + local + + + 19.03.12 + 19.03.12 + + + +

Docker is the world’s leading software containerization platform.

+ + +

It was found that Docker created network bridges which by default accept + IPv6 router advertisements. +

+ + +

An attacker who gained access to a container with CAP_NET_RAW capability + may be able to to spoof router advertisements, resulting in information + disclosure or denial of service. +

+ + +

There is no known workaround at this time.

+ + +

All Docker users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/docker-19.03.12" + + + + CVE-2020-13401 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-16.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-16.xml new file mode 100644 index 0000000000..7ffbf3730c --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-16.xml @@ -0,0 +1,96 @@ + + + + Mozilla Firefox, Mozilla Thunderbird: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mozilla Firefox and + Mozilla Thunderbird, the worst of which could result in the arbitrary + execution of code. + + firefox,thunderbird + 2020-08-27 + 2020-08-27 + 739006 + 739164 + local, remote + + + 68.12.0 + 68.12.0 + + + 68.12.0 + 68.12.0 + + + 68.12.0 + 68.12.0 + + + 68.12.0 + 68.12.0 + + + +

Mozilla Firefox is a popular open-source web browser from the Mozilla + Project. +

+ +

Mozilla Thunderbird is a popular open-source email client from the + Mozilla project. +

+ + +

Multiple vulnerabilities have been discovered in Mozilla Firefox and + Mozilla Thunderbird. Please review the CVE identifiers referenced below + for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Firefox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-68.12.0" + + +

All Firefox binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-68.12.0" + + +

All Thunderbird users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-68.12.0" + + +

All Thunderbird binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=mail-client/thunderbird-bin-68.12.0" + + + + CVE-2020-15664 + CVE-2020-15669 + + Upstream advisory (MFSA-2020-37) + + + Upstream advisory (MFSA-2020-38) + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-17.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-17.xml new file mode 100644 index 0000000000..dc913a9dec --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-17.xml @@ -0,0 +1,50 @@ + + + + Redis: Multiple vulnerabilities + Multiple vulnerabilities have been found in Redis, the worst of + which could result in the arbitrary execution of code. + + redis + 2020-08-27 + 2020-08-27 + 633824 + 724776 + remote + + + 5.0.9 + 5.0.9 + + + +

Redis is an open source (BSD licensed), in-memory data structure store, + used as a database, cache and message broker. +

+ + +

Multiple vulnerabilities have been discovered in Redis. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Redis users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/redis-5.0.9" + + + + CVE-2017-15047 + CVE-2020-14147 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-18.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-18.xml new file mode 100644 index 0000000000..5989b06e8b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-18.xml @@ -0,0 +1,50 @@ + + + + X.Org X11 library: Multiple vulnerabilities + Multiple vulnerabilities have been found in X.org X11 library, the + worst of which could result in the arbitrary execution of code. + + xorg x11 library + 2020-08-27 + 2020-08-27 + 734974 + 738984 + local, remote + + + 1.6.12 + 1.6.12 + + + +

X.Org is an implementation of the X Window System. The X.Org X11 library + provides the X11 protocol library files. +

+ + +

Multiple vulnerabilities have been discovered in X.org X11 library. + Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All X.org X11 library users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-libs/libX11-1.6.12" + + + + CVE-2020-14344 + CVE-2020-14363 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-19.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-19.xml new file mode 100644 index 0000000000..c19d5d126c --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-19.xml @@ -0,0 +1,50 @@ + + + + BIND: Multiple vulnerabilities + Multiple vulnerabilities have been found in BIND, the worst of + which could result in a Denial of Service condition. + + bind + 2020-08-29 + 2020-08-29 + 738250 + remote + + + 9.16.6 + 9.16.6 + + + +

BIND (Berkeley Internet Name Domain) is a Name Server.

+ + +

Multiple vulnerabilities have been discovered in BIND. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All BIND users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-dns/bind-9.16.6" + + + + CVE-2020-8620 + CVE-2020-8621 + CVE-2020-8622 + CVE-2020-8623 + CVE-2020-8624 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-20.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-20.xml new file mode 100644 index 0000000000..58f28b0be4 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-20.xml @@ -0,0 +1,71 @@ + + + + GPL Ghostscript: Multiple vulnerabilities + Multiple vulnerabilities have been found in GPL Ghostscript, the + worst of which could result in the arbitrary execution of code. + + ghostscript + 2020-08-29 + 2020-08-29 + 734322 + remote + + + 9.52 + 9.52 + + + +

Ghostscript is an interpreter for the PostScript language and for PDF.

+ + +

Multiple vulnerabilities have been discovered in GPL Ghostscript. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All GPL Ghostscript users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-text/ghostscript-gpl-9.52" + + + + CVE-2020-15900 + CVE-2020-16287 + CVE-2020-16288 + CVE-2020-16289 + CVE-2020-16290 + CVE-2020-16291 + CVE-2020-16292 + CVE-2020-16293 + CVE-2020-16294 + CVE-2020-16295 + CVE-2020-16296 + CVE-2020-16297 + CVE-2020-16298 + CVE-2020-16299 + CVE-2020-16300 + CVE-2020-16301 + CVE-2020-16302 + CVE-2020-16303 + CVE-2020-16304 + CVE-2020-16305 + CVE-2020-16306 + CVE-2020-16307 + CVE-2020-16308 + CVE-2020-16309 + CVE-2020-16310 + CVE-2020-17538 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-21.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-21.xml new file mode 100644 index 0000000000..95b86052c0 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-21.xml @@ -0,0 +1,51 @@ + + + + Kleopatra: Remote code execution + A vulnerability in Kleopatra allows arbitrary execution of code. + kleopatra + 2020-08-30 + 2020-08-30 + 739556 + local, remote + + + 20.04.3-r1 + 20.04.3-r1 + + + +

Kleopatra is a certificate manager and a universal crypto GUI. It + supports managing X.509 and OpenPGP certificates in the GpgSM keybox and + retrieving certificates from LDAP servers. +

+ + +

Kleopatra did not safely escape command line parameters provided by + URLs, which it configures itself to handle. +

+ + +

A remote attacker could entice a user to process a specially crafted URL + via openpgp4fpr handler, possibly resulting in execution of arbitrary + code with the privileges of the process, or cause a Denial of Service + condition. +

+ + +

There is no known workaround at this time.

+ + +

All Kleopatra users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=kde-apps/kleopatra-20.04.3-r1" + + + + CVE-2020-24972 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-22.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-22.xml new file mode 100644 index 0000000000..acef962fdf --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-22.xml @@ -0,0 +1,47 @@ + + + + targetcli-fb: Multiple vulnerabilities + Multiple vulnerabilities have been found in targetcli-fb, the worst + of which could result in privilege escalation. + + targetcli-fb + 2020-08-30 + 2020-08-30 + 736086 + local + + + 2.1.53 + 2.1.53 + + + +

Tool for managing the Linux LIO kernel target.

+ + +

Multiple vulnerabilities have been discovered in targetcli-fb. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All targetcli-fb users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-block/targetcli-fb-2.1.53" + + + + CVE-2020-10699 + CVE-2020-13867 + + sam_c + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-23.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-23.xml new file mode 100644 index 0000000000..c4ea9bb571 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-23.xml @@ -0,0 +1,51 @@ + + + + chrony: Symlink vulnerability + A vulnerability in chrony may allow a privileged attacker to cause + data loss via a symlink. + + chrony + 2020-08-30 + 2020-08-30 + 738154 + local + + + 3.5.1 + 3.5.1 + + + +

chrony is a versatile implementation of the Network Time Protocol (NTP).

+ + +

It was found that chrony did not check whether its PID file was a + symlink. +

+ + +

A local attacker could perform symlink attack(s) to overwrite arbitrary + files with root privileges. +

+ + +

There is no known workaround at this time.

+ + +

All chrony users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/chrony-3.5.1" + + + + CVE-2020-14367 + + chrony-3.5.1 release announcement + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-24.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-24.xml new file mode 100644 index 0000000000..a8c11cd49f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202008-24.xml @@ -0,0 +1,66 @@ + + + + OpenJDK: Multiple vulnerabilities + Multiple vulnerabilities have been found in OpenJDK, the worst of + which could result in the arbitrary execution of code. + + openjdk + 2020-08-30 + 2020-08-30 + 732624 + remote + + + 8.262_p01 + 8.262_p01 + + + 8.262_p01 + 8.262_p01 + + + +

OpenJDK is a free and open-source implementation of the Java Platform, + Standard Edition. +

+ + +

Multiple vulnerabilities have been discovered in OpenJDK. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All OpenJDK users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-java/openjdk-8.262_p01" + + +

All OpenJDK binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-java/openjdk-bin-8.262_p01" + + + + CVE-2020-14556 + CVE-2020-14562 + CVE-2020-14573 + CVE-2020-14578 + CVE-2020-14579 + CVE-2020-14583 + CVE-2020-14593 + CVE-2020-14621 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-01.xml new file mode 100644 index 0000000000..0bb5e7ea2a --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-01.xml @@ -0,0 +1,49 @@ + + + + GnuTLS: Denial of service + A flaw was found in GnuTLS, possibly allowing a Denial of Service + condition. + + gnutls + 2020-09-06 + 2020-09-06 + 740390 + local, remote + + + 3.6.15 + 3.6.15 + + + +

GnuTLS is an Open Source implementation of the TLS and SSL protocols.

+ + +

It was found that GnuTLS didn’t handle “no_renegotiation” alert + properly. +

+ + +

A remote attacker could entice a user to connect to a malicious TLS + endpoint using an application linked against GnuTLS, possibly resulting + in a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All GnuTLS users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/gnutls-3.6.15" + + + + CVE-2020-24659 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-02.xml new file mode 100644 index 0000000000..72f3601248 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-02.xml @@ -0,0 +1,52 @@ + + + + Dovecot: Multiple vulnerabilities + Multiple vulnerabilities have been found in Dovecot, the worst of + which could allow remote attackers to cause a Denial of Service condition. + + dovecot + 2020-09-06 + 2020-09-06 + 736617 + remote + + + 2.3.11.3 + 2.3.11.3 + + + +

Dovecot is an open source IMAP and POP3 email server.

+ + +

It was discovered that Dovecot incorrectly handled deeply nested MIME + parts, incorrectly handled memory when using NTLM, and incorrectly + handled zero-length messages. +

+ + +

A remote attacker could send a specially crafted mail or send specially + crafted authentication requests possibly resulting in a Denial of Service + condition. +

+ + +

There is no known workaround at this time.

+ + +

All Dovecot users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-mail/dovecot-2.3.11.3" + + + + CVE-2020-12100 + CVE-2020-12673 + CVE-2020-12674 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-03.xml new file mode 100644 index 0000000000..fe967a8a1e --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-03.xml @@ -0,0 +1,68 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in the arbitrary execution of code. + + chromium,google-chrome + 2020-09-10 + 2020-09-10 + 741312 + local, remote + + + 85.0.4183.102 + 85.0.4183.102 + + + 85.0.4183.102 + 85.0.4183.102 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-85.0.4183.102" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-85.0.4183.102" + + + + CVE-2020-15959 + CVE-2020-6573 + CVE-2020-6575 + CVE-2020-6576 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-04.xml new file mode 100644 index 0000000000..c3a3e40d2d --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-04.xml @@ -0,0 +1,44 @@ + + + + Qt GUI: Buffer overflow + Qt GUI has a buffer overflow with unspecified impact. + qtgui + 2020-09-13 + 2020-09-13 + 736924 + local, remote + + + 5.14.2-r1 + 5.14.2-r1 + + + +

The GUI module and platform plugins for the Qt5 framework.

+ + +

It was discovered that Qt GUI’s XBM parser did not properly handle X + BitMap files. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Qt GUI users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-qt/qtgui-5.14.2-r1" + + + + CVE-2020-17507 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-05.xml new file mode 100644 index 0000000000..6ae334f3e7 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-05.xml @@ -0,0 +1,50 @@ + + + + GStreamer RTSP Server: Denial of service + A vulnerability in GStreamer RTSP Server could lead to a Denial of + Service condition. + + gst-rtsp-server + 2020-09-13 + 2020-09-13 + 715100 + local, remote + + + 1.16.2 + 1.16.2 + + + +

RTSP server library based on GStreamer.

+ + +

It was discovered that GStreamer RTSP Server did not properly handle + authentication. +

+ + +

A remote attacker, by sending specially crafted authentication requests, + could possibly cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All GStreamer RTSP Server users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=media-libs/gst-rtsp-server-1.16.2" + + + + + CVE-2020-6095 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-06.xml new file mode 100644 index 0000000000..4b5a2bdb63 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-06.xml @@ -0,0 +1,44 @@ + + + + GNOME File Roller: Directory traversal + A vulnerability in GNOME File Roller could lead to a directory + traversal attack. + + file-roller + 2020-09-13 + 2020-09-13 + 717362 + local, remote + + + 3.36.3 + 3.36.3 + + + +

File Roller is an archive manager for the GNOME desktop environment.

+ + +

It was discovered that GNOME File Roller incorrectly handled symlinks.

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All GNOME File Roller users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-arch/file-roller-3.36.3" + + + + CVE-2020-11736 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-07.xml new file mode 100644 index 0000000000..7722f78909 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-07.xml @@ -0,0 +1,47 @@ + + + + Perl DBI: Multiple vulnerabilities + Multiple vulnerabilities have been found in the Perl module DBI, + the worst of which could result in a Denial of Service condition. + + dbi + 2020-09-13 + 2020-09-13 + 732636 + local + + + 1.643.0 + 1.643.0 + + + +

A database access module for the Perl programming language.

+ + +

Multiple vulnerabilities have been discovered in the Perl module DBI. + Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Perl DBI module users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-perl/DBI-1.643.0" + + + + CVE-2020-14392 + CVE-2020-14393 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-08.xml new file mode 100644 index 0000000000..f955577511 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-08.xml @@ -0,0 +1,49 @@ + + + + GNOME Shell: Information disclosure + An information disclosure vulnerability in GNOME Shell might allow + local attackers to obtain sensitive information. + + gnome-shell + 2020-09-13 + 2020-09-13 + 736802 + local + + + 3.34.5-r1 + 3.34.5-r1 + + + +

GNOME Shell provides core user interface functions for the GNOME 3 + desktop, like switching to windows and launching applications. +

+ + +

It was discovered that GNOME Shell incorrectly handled the login screen + password dialog. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All GNOME Shell users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=gnome-base/gnome-shell-3.34.5-r1" + + + + CVE-2020-17489 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-09.xml new file mode 100644 index 0000000000..4716f54af8 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-09.xml @@ -0,0 +1,53 @@ + + + + Nextcloud Desktop Sync client: Multiple vulnerabilities + Multiple vulnerabilities have been found in Nextcloud Desktop Sync + client, the worst of which may allow execution of arbitrary code. + + nextcloud-client + 2020-09-13 + 2020-09-13 + 736649 + remote + + + 2.6.5 + 2.6.5 + + + +

Nextcloud Desktop Sync client can synchronize one or more directories to + Nextcloud server. +

+ + +

Multiple vulnerabilities have been discovered in Nextcloud Desktop Sync + client. Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Nextcloud Desktop Sync client users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/nextcloud-client-2.6.5" + + + + + CVE-2020-8189 + CVE-2020-8224 + CVE-2020-8227 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-10.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-10.xml new file mode 100644 index 0000000000..3ff0e04b33 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-10.xml @@ -0,0 +1,67 @@ + + + + PHP: Denial of service + A vulnerabilities in PHP could lead to a Denial of Service + condition. + + PHP + 2020-09-13 + 2020-09-13 + 736158 + local, remote + + + 7.2.33 + 7.3.21 + 7.4.9 + 7.2.33 + 7.3.21 + 7.4.9 + + + +

PHP is an open source general-purpose scripting language that is + especially suited for web development. +

+ + +

It was discovered that PHP did not properly handle PHAR files.

+ + +

A remote attacker could entice a user to open a specially crafted PHAR + file using PHP, possibly allowing attacker to obtain sensitive + information or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All PHP 7.2 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/php-7.2.33" + + +

All PHP 7.3 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/php-7.3.21" + + +

All PHP 7.4 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/php-7.4.9" + + + + CVE-2020-7068 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-11.xml new file mode 100644 index 0000000000..0db2968196 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-11.xml @@ -0,0 +1,48 @@ + + + + ProFTPD: Denial of service + A vulnerability in ProFTPD could lead to a Denial of Service + condition. + + proftpd + 2020-09-13 + 2020-09-13 + 733376 + local, remote + + + 1.3.7a + 1.3.7a + + + +

ProFTPD is an advanced and very configurable FTP server.

+ + +

It was found that ProFTPD did not properly handle invalid SCP commands.

+ + +

An authenticated remote attacker could issue invalid SCP commands, + possibly resulting in a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All ProFTPD users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-ftp/proftpd-1.3.7a" + + + + Invalid SCP + command leads to null pointer dereference + + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-12.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-12.xml new file mode 100644 index 0000000000..a298602604 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-12.xml @@ -0,0 +1,51 @@ + + + + ZeroMQ: Denial of service + A vulnerability in ZeroMQ could lead to a Denial of Service + condition. + + zeromq + 2020-09-13 + 2020-09-13 + 740574 + local, remote + + + 4.3.3 + 4.3.3 + + + +

Looks like an embeddable networking library but acts like a concurrency + framework. +

+ + +

It was discovered that ZeroMQ does not properly handle connecting peers + before a handshake is completed. +

+ + +

An unauthenticated remote attacker able to connect to a ZeroMQ endpoint, + even with CURVE encryption/authentication enabled, can cause a Denial of + Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All ZeroMQ users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/zeromq-4.3.3" + + + + CVE-2020-15166 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-13.xml new file mode 100644 index 0000000000..163c6c7718 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-13.xml @@ -0,0 +1,74 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromiun and Google + Chrome, the worst of which could result in the arbitrary execution of code. + + chromium,google-chrome + 2020-09-29 + 2020-09-29 + 744007 + remote + + + 85.0.4183.121 + 85.0.4183.121 + + + 85.0.4183.121 + 85.0.4183.121 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-85.0.4183.121" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-85.0.4183.121" + + + + CVE-2020-15960 + CVE-2020-15961 + CVE-2020-15962 + CVE-2020-15963 + CVE-2020-15964 + CVE-2020-15965 + CVE-2020-15966 + + Upstream advisory + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-14.xml new file mode 100644 index 0000000000..e7f29aeae1 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-14.xml @@ -0,0 +1,61 @@ + + + + Xen: Buffer overflow + A buffer overflow in Xen might allow remote attacker(s) to execute + arbitrary code. + + xen + 2020-09-29 + 2020-09-29 + 738040 + local, remote + + + 4.13.1-r3 + 4.13.1-r3 + + + 4.13.1-r3 + 4.13.1-r3 + + + +

Xen is a bare-metal hypervisor.

+ + +

An out-of-bounds read/write access issue was found in the USB emulator + when using QEMU. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Xen users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/xen-4.13.1-r3" + + +

All Xen tools users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=app-emulation/xen-tools-4.13.1-r3" + + + + CVE-2020-14364 + XSA-335 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-15.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-15.xml new file mode 100644 index 0000000000..8fb1616dfe --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-15.xml @@ -0,0 +1,50 @@ + + + + libuv: Buffer overflow + A buffer overflow in libuv might allow remote attacker(s) to + execute arbitrary code. + + libuv + 2020-09-29 + 2020-09-29 + 742890 + remote + + + 1.39.0 + 1.39.0 + + + +

libuv is a multi-platform support library with a focus on asynchronous + I/O. +

+ + +

libuv used an incorrect buffer size for paths, causing a buffer + overflow. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All libuv users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/libuv-1.39.0" + + + + CVE-2020-8252 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-16.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-16.xml new file mode 100644 index 0000000000..f58afe91c7 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-16.xml @@ -0,0 +1,52 @@ + + + + LinuxCIFS: Shell injection + A vulnerability in LinuxCIFS may allow a remote code execution via + a command line option. + + LinuxCIFS + 2020-09-29 + 2020-09-29 + 743211 + remote + + + 6.11 + 6.11 + + + +

The LinuxCIFS utils are a collection of tools for managing Linux CIFS + Client Filesystems. +

+ + +

The mount.cifs utility had a shell injection issue where one can embed + shell commands via the username mount option. Those commands will be run + via popen() in the context of the user calling mount. +

+ + +

A remote attacker could entice a user to use a specially crafted + argument using mount.cifs, possibly resulting in execution of arbitrary + code with the privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All LinuxCIFS users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-fs/cifs-utils-6.11" + + + + CVE-2020-14342 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-17.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-17.xml new file mode 100644 index 0000000000..408f401fbb --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-17.xml @@ -0,0 +1,48 @@ + + + + gpsd: Arbitrary code execution + A vulnerability in gpsd could allow remote code execution. + gpsd + 2020-09-29 + 2020-09-29 + 743766 + remote + + + 3.18 + 3.18 + + + +

gpsd is a GPS daemon and library for USB/serial GPS devices and + GPS/mapping clients. +

+ + +

A stack-based buffer overflow was discovered in gpsd on port 2947/TCP or + crafted JSON inputs. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All gpsd users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sci-geosciences/gpsd-3.18" + + + + CVE-2018-17937 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-18.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-18.xml new file mode 100644 index 0000000000..024a1e62ea --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202009-18.xml @@ -0,0 +1,71 @@ + + + + Bitcoin: Multiple vulnerabilities + Multiple vulnerabilities have been found in Bitcoin, the worst of + which could result in a Denial of Service condition. + + bitcoin + 2020-09-30 + 2020-09-30 + 711198 + remote + + + 0.20.1 + 0.20.1 + + + 0.20.1 + 0.20.1 + + + 0.20.1 + 0.20.1 + + + +

Bitcoin Core consists of both “full-node” software for fully + validating the blockchain as well as a bitcoin wallet. +

+ + +

Multiple vulnerabilities have been discovered in Bitcoin. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All bitcoind users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-p2p/bitcoind-0.20.1" + + +

All bitcoin-qt users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-p2p/bitcoin-qt-0.20.1" + + +

All bitcoin-cli users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-p2p/bitcoin-cli-0.20.1" + + + + CVE-2019-15947 + CVE-2020-14198 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-01.xml new file mode 100644 index 0000000000..855bac0279 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-01.xml @@ -0,0 +1,92 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in the arbitrary execution of code. + + chromium, google-chrome + 2020-10-17 + 2020-10-17 + 747013 + local, remote + + + 86.0.4240.75 + 86.0.4240.75 + + + 86.0.4240.75 + 86.0.4240.75 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-86.0.4240.75" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-86.0.4240.75" + + + + + CVE-2020-15967 + CVE-2020-15968 + CVE-2020-15969 + CVE-2020-15970 + CVE-2020-15971 + CVE-2020-15972 + CVE-2020-15973 + CVE-2020-15974 + CVE-2020-15975 + CVE-2020-15976 + CVE-2020-15977 + CVE-2020-15978 + CVE-2020-15979 + CVE-2020-15980 + CVE-2020-15981 + CVE-2020-15982 + CVE-2020-15983 + CVE-2020-15984 + CVE-2020-15985 + CVE-2020-15986 + CVE-2020-15987 + CVE-2020-15988 + CVE-2020-15989 + CVE-2020-15990 + CVE-2020-15991 + CVE-2020-15992 + CVE-2020-6557 + + sam_c + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-02.xml new file mode 100644 index 0000000000..e67ad5cb89 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-02.xml @@ -0,0 +1,121 @@ + + + + Mozilla Firefox, Mozilla Thunderbird: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mozilla Firefox and + Mozilla Thunderbird, the worst of which could result in the arbitrary + execution of code. + + firefox,thunderbird + 2020-10-17 + 2020-10-17 + 744208 + 745432 + local, remote + + + 81.0 + 78.3.0 + 81.0 + + + 81.0 + 78.3.0 + 81.0 + + + 78.3.1 + 78.3.1 + + + 78.3.1 + 78.3.1 + + + +

Mozilla Firefox is a popular open-source web browser from the Mozilla + project. +

+ +

Mozilla Thunderbird is a popular open-source email client from the + Mozilla project. +

+ + +

Multiple vulnerabilities have been discovered in Mozilla Firefox and + Mozilla Thunderbird. Please review the CVE identifiers referenced below + for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Firefox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-81.0" + + +

All Mozilla Firefox (bin) users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-81.0" + + +

All Mozilla Firefox ESR (bin) users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-78.3.0" + + +

All Mozilla Firefox ESR (bin) users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-78.3.0" + + +

All Mozilla Thunderbird users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-78.3.1" + + +

All Mozilla Thunderbird (bin) users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=mail-client/thunderbird-bin-78.3.1" + + + + + CVE-2020-15673 + CVE-2020-15676 + CVE-2020-15677 + CVE-2020-15678 + + Mozilla Foundation Security Advisory 2020-43 + + + Mozilla Foundation Security Advisory 2020-44 + + + sam_c + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-03.xml new file mode 100644 index 0000000000..192d449c53 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-03.xml @@ -0,0 +1,60 @@ + + + + libjpeg-turbo: Information disclosure + An information disclosure vulnerability in libjpeg-turbo allow + remote attackers to obtain sensitive information. + + libjpeg-turbo + 2020-10-20 + 2020-10-20 + 727010 + local, remote + + + 1.5.3-r3 + 2.0.4-r1 + 2.0.4-r1 + + + +

libjpeg-turbo is a MMX, SSE, and SSE2 SIMD accelerated JPEG library.

+ + +

It was discovered that libjpeg-turbo incorrectly handled certain PPM + files. +

+ + +

A remote attacker could entice a user to open a specially crafted PPM + file using an application linked against libjpeg-turbo, possibly allowing + attacker to obtain sensitive information. +

+ + +

There is no known workaround at this time.

+ + +

All libjpeg-turbo 1.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=media-libs/libjpeg-turbo-1.5.3-r3:0/0.1" + + +

All libjpeg-turbo 2.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=media-libs/libjpeg-turbo-2.0.4-r1:0/0.2" + + + + + CVE-2020-13790 + + sam_c + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-04.xml new file mode 100644 index 0000000000..78c3523463 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-04.xml @@ -0,0 +1,50 @@ + + + + libxml2: Multiple vulnerabilities + Multiple vulnerabilities have been found in libxml2, the worst of + which could result in a Denial of Service condition. + + libxml2 + 2020-10-20 + 2020-10-20 + 710748 + local, remote + + + 2.9.10 + 2.9.10 + + + +

libxml2 is the XML (eXtended Markup Language) C parser and toolkit + initially developed for the Gnome project. +

+ + +

Multiple vulnerabilities have been discovered in libxml2. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All libxml2 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.9.10" + + + + + CVE-2019-20388 + CVE-2020-7595 + + sam_c + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-05.xml new file mode 100644 index 0000000000..06ea01608c --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-05.xml @@ -0,0 +1,54 @@ + + + + LibRaw: Multiple vulnerabilities + Multiple vulnerabilities have been found in LibRaw, the worst of + which may allow attackers to execute arbitrary code. + + libraw + 2020-10-20 + 2020-10-20 + 744190 + local, remote + + + 0.20.0 + 0.20.0 + + + +

LibRaw is a library for reading RAW files obtained from digital photo + cameras. +

+ + +

Multiple vulnerabilities have been discovered in LibRaw. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could entice a user to open a specially crafted image + file using an application linked against LibRaw, possibly resulting in + execution of arbitrary code with the privileges of the process or a + Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All LibRaw users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/libraw-0.20.0" + + + + + CVE-2020-24889 + CVE-2020-24890 + + sam_c + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-06.xml new file mode 100644 index 0000000000..6996a19ab1 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-06.xml @@ -0,0 +1,52 @@ + + + + Ark: Arbitrary code execution + Ark was found to allow arbitrary file overwrite, possibly allowing + arbitrary code execution. + + ark + 2020-10-20 + 2020-10-20 + 743959 + local, remote + + + 20.04.3-r2 + 20.04.3-r2 + + + +

Ark is a graphical file compression/decompression utility with support + for multiple formats. +

+ + +

It was discovered that Ark incorrectly handled symbolic links in tar + archive files. +

+ + +

A remote attacker could entice a user to open a specially crafted + archive using Ark, possibly resulting in execution of arbitrary code with + the privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All KDE Ark users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=kde-apps/ark-20.04.3-r2" + + + + + CVE-2020-24654 + + sam_c + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-07.xml new file mode 100644 index 0000000000..8e52bf4fa5 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-07.xml @@ -0,0 +1,50 @@ + + + + FreeType: Arbitrary code execution + A buffer overflow in FreeType might allow remote attacker(s) to + execute arbitrary code. + + freetype + 2020-10-23 + 2020-10-23 + 750275 + remote + + + 2.10.3-r1 + 2.10.3-r1 + + + +

FreeType is a high-quality and portable font engine.

+ + +

A flaw in FreeType’s handling of embedded PNG bitmaps was discovered + where the image height and width was not checked to be within bounds. +

+ + +

A remote attacker could entice a user to open a specially crafted font + file using FreeType possibly resulting in the execution of arbitrary code + with the privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All FreeType users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/freetype-2.10.3-r1" + + + + CVE-2020-15999 + Upstream bug + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-08.xml new file mode 100644 index 0000000000..f206b1a074 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202010-08.xml @@ -0,0 +1,120 @@ + + + + Mozilla Firefox, Mozilla Thunderbird: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mozilla Firefox and + Mozilla Thunderbird, the worst of which could result in the arbitrary + execution of code. + + firefox,thunderbird + 2020-10-28 + 2020-10-28 + 750446 + local, remote + + + 82.0 + 78.4.0 + 82.0 + + + 82.0 + 78.4.0 + 82.0 + + + 78.4.0 + 78.4.0 + + + 78.4.0 + 78.4.0 + + + +

Mozilla Firefox is a popular open-source web browser from the Mozilla + project. +

+ +

Mozilla Thunderbird is a popular open-source email client from the + Mozilla project. +

+ + +

Multiple vulnerabilities have been discovered in Mozilla Firefox and + Mozilla Thunderbird. Please review the CVE identifiers referenced below + for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Firefox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-82.0" + + +

All Mozilla Firefox (bin) users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-82.0" + + +

All Mozilla Firefox ESR users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/firefox-78.4.0:0/esr78" + + +

All Mozilla Firefox ESR (bin) users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/firefox-bin-78.4.0:0/esr78" + + +

All Mozilla Thunderbird users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-78.4.0" + + +

All Mozilla Thunderbird (bin) users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=mail-client/thunderbird-bin-78.4.0" + + + + CVE-2020-15683 + CVE-2020-15969 + + MFSA-2020-45 + + + MFSA-2020-46 + + + MFSA-2020-47 + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-01.xml new file mode 100644 index 0000000000..8050a84cb5 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-01.xml @@ -0,0 +1,51 @@ + + + + BlueZ: Arbitrary code execution + A vulnerability in BlueZ might allow remote attackers to execute + arbitrary code. + + bluez + 2020-11-03 + 2020-11-03 + 749285 + remote + + + 5.55 + 5.55 + + + +

Set of tools to manage Bluetooth devices for Linux.

+ + +

It was discovered that there was a double-free vulnerability in Bluez + after the service discovery which occurs after a Bluetoth Low Energy + (BLE) connection has been established to a device. +

+ + +

A remote attacker, by enticing a user to connect to a malicious GATT + server or device, could cause the execution of arbitrary code with the + privileges of the user running gatttool client or cause a Denial of + Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All BlueZ users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-wireless/bluez-5.55" + + + + CVE-2020-27153 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-02.xml new file mode 100644 index 0000000000..b718c8d628 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-02.xml @@ -0,0 +1,50 @@ + + + + OpenDMARC: Heap-based buffer overflow + A heap-based buffer overflow in OpenDMARC might allow remote + attackers to execute arbitrary code. + + opendmarc + 2020-11-03 + 2020-11-03 + 734158 + local, remote + + + 1.3.3 + 1.3.3 + + + +

OpenDMARC is an open source DMARC implementation.

+ + +

It was found that OpenDMARC did not properly handle DMARC aggregate + reports. +

+ + +

A remote attacker, by sending a specially crafted DMARC aggregate + report, could possibly cause a Denial of Service condition and depending + on how OpenDMARC library is used in linked application execute arbitrary + code with the privileges of the process. +

+ + +

There is no known workaround at this time.

+ + +

All OpenDMARC users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-filter/opendmarc-1.3.3" + + + + CVE-2020-12460 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-03.xml new file mode 100644 index 0000000000..e1b7742733 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-03.xml @@ -0,0 +1,53 @@ + + + + KPMCore: Root privilege escalation + A vulnerability in kpmcore could result in privilege escalation. + kpmcore + 2020-11-03 + 2020-11-03 + 749822 + local + + + 4.2.0 + 4.2.0 + + + +

KPMcore, the KDE Partition Manager core, is a library for examining and + modifying partitions, disk devices, and filesystems on a Linux system. It + provides a unified programming interface over top of (external) + system-manipulation tools. +

+ + +

Improper checks on the D-Bus request received resulted in improper + protection for /etc/fstab. +

+ + +

An attacker could esclate privileges to root by exploiting this + vulnerability. +

+ + +

There is no known workaround at this time.

+ + +

All KPMCore users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-libs/kpmcore-4.2.0" + + + + CVE-2020-27187 + + Upstream advisory + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-04.xml new file mode 100644 index 0000000000..6cef70d8b7 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-04.xml @@ -0,0 +1,51 @@ + + + + Fossil: Multiple vulnerabilities + Multiple vulnerabilities have been found in Fossil, the worst of + which could result in the arbitrary execution of code. + + fossil + 2020-11-03 + 2020-11-03 + 738220 + remote + + + 2.12.1 + 2.12.1 + + + +

Fossil is a simple, high-reliability, distributed software configuration + management system. +

+ + +

Multiple vulnerabilities have been discovered in Fossil. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could entice a user to open a specially crafted + repository using Fossil, possibly resulting in execution of arbitrary + code with the privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Fossil users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-vcs/fossil-2.12.1" + + + + CVE-2020-24614 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-05.xml new file mode 100644 index 0000000000..e33d8909d0 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-05.xml @@ -0,0 +1,48 @@ + + + + libssh: Denial of service + A vulnerability in libssh could lead to a Denial of Service + condition. + + libssh + 2020-11-03 + 2020-11-03 + 734624 + remote + + + 0.9.5 + 0.9.5 + + + +

libssh is a multiplatform C library implementing the SSHv2 protocol on + client and server side. +

+ + +

libssh was found to have a NULL pointer dereference in tftpserver.c if + the function ssh_buffer_new returns NULL. +

+ + +

An attacker could cause a possible Denial of Service condition.

+ + +

There is no known workaround at this time.

+ + +

All libssh users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/libssh-0.9.5" + + + + CVE-2020-16135 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-06.xml new file mode 100644 index 0000000000..f3f187929c --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-06.xml @@ -0,0 +1,78 @@ + + + + Xen: Multiple vulnerabilities + Multiple vulnerabilities have been found in Xen, the worst of which + could result in privilege escalation. + + xen + 2020-11-11 + 2020-11-11 + 744202 + 750779 + 753692 + remote + + + 4.13.2 + 4.13.2 + + + 4.13.2 + 4.13.2 + + + +

Xen is a bare-metal hypervisor.

+ + +

Multiple vulnerabilities have been discovered in Xen. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Xen users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/xen-4.13.1-r5" + + +

All Xen Tools users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=app-emulation/xen-tools-4.13.1-r5" + + + + CVE-2020-25595 + CVE-2020-25596 + CVE-2020-25597 + CVE-2020-25598 + CVE-2020-25599 + CVE-2020-25600 + CVE-2020-25601 + CVE-2020-25602 + CVE-2020-25603 + CVE-2020-25604 + CVE-2020-27670 + CVE-2020-27671 + CVE-2020-27672 + CVE-2020-27673 + CVE-2020-27674 + CVE-2020-27675 + XSA-345 + XSA-346 + XSA-347 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-07.xml new file mode 100644 index 0000000000..19e8efe6d6 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-07.xml @@ -0,0 +1,84 @@ + + + + Mozilla Firefox: Remote code execution + A use-after-free in Mozilla Firefox might allow remote attacker(s) + to execute arbitrary code. + + firefox + 2020-11-11 + 2020-11-11 + 753773 + remote + + + 82.0.3 + 78.4.1 + 82.0.3 + + + 82.0.3 + 78.4.1 + 78.4.1 + + + +

Mozilla Firefox is a popular open-source web browser from the Mozilla + project. +

+ + +

Invalid assumptions when emitting the the MCallGetProperty opcode in the + JavaScript JIT may result in a use-after-free condition. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Firefox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-82.0.3" + + +

All Mozilla Firefox (bin) users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/firefox-bin-78.4.1:0/esr78" + + +

All Mozilla Firefox (ESR) users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-82.0.3" + + +

All Mozilla Firefox (ESR) bin users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/firefox-bin-78.4.1:0/esr78" + + + + CVE-2020-26950 + + MFSA-2020-49 + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-08.xml new file mode 100644 index 0000000000..c91c014dc5 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-08.xml @@ -0,0 +1,52 @@ + + + + Wireshark: Multiple vulnerabilities + Multiple vulnerabilities have been found in Wireshark, the worst of + which could result in a Denial of Service condition. + + wireshark + 2020-11-11 + 2020-11-11 + 750692 + remote + + + 3.4.0 + 3.4.0 + + + +

Wireshark is a network protocol analyzer formerly known as ethereal.

+ + +

Multiple vulnerabilities have been discovered in Wireshark. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Wireshark users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-analyzer/wireshark-3.4.0" + + + + CVE-2020-26575 + + wnpa-sec-2020-14 + + + wnpa-sec-2020-15 + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-09.xml new file mode 100644 index 0000000000..fba58488bd --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-09.xml @@ -0,0 +1,57 @@ + + + + QEMU: Multiple vulnerabilities + Multiple vulnerabilities have been found in QEMU, the worst of + which could result in the arbitrary execution of code. + + qemu + 2020-11-11 + 2020-11-11 + 720896 + 725634 + 743649 + local, remote + + + 5.1.0-r1 + 5.1.0-r1 + + + +

QEMU is a generic and open source machine emulator and virtualizer.

+ + +

Multiple vulnerabilities have been discovered in QEMU. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All QEMU users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/qemu-5.1.0-r1" + + + + CVE-2020-10717 + CVE-2020-10761 + CVE-2020-13253 + CVE-2020-13361 + CVE-2020-13362 + CVE-2020-13659 + CVE-2020-13754 + CVE-2020-13791 + CVE-2020-13800 + CVE-2020-14364 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-10.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-10.xml new file mode 100644 index 0000000000..3126f1b174 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-10.xml @@ -0,0 +1,48 @@ + + + + tmux: Buffer overflow + A buffer overflow in tmux might allow remote attacker(s) to execute + arbitrary code. + + tmux + 2020-11-11 + 2020-11-11 + 753206 + remote + + + 3.1c + 3.1c + + + +

tmux is a terminal multiplexer.

+ + +

A flaw in tmux’s handling of escape characters was discovered which + may allow a buffer overflow. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All tmux users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-misc/tmux-3.1c" + + + + CVE-2020-27347 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-11.xml new file mode 100644 index 0000000000..ee062a5069 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-11.xml @@ -0,0 +1,46 @@ + + + + Blueman: Local privilege escalation + A privilege escalation vulnerability has been discovered in + Blueman. + + blueman + 2020-11-11 + 2020-11-11 + 751556 + local + + + 2.1.4 + 2.1.4 + + + +

Blueman is a simple and intuitive GTK+ Bluetooth Manager.

+ + +

Where Polkit is not used and the default permissions have been changed + on a specific rule file, control of a local DHCP daemon may be possible. +

+ + +

A local attacker may be able to achieve root privilege escalation.

+ + +

There is no known workaround at this time.

+ + +

All Blueman users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-wireless/blueman-2.1.4" + + + + CVE-2020-15238 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-12.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-12.xml new file mode 100644 index 0000000000..03f1f501df --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-12.xml @@ -0,0 +1,73 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in the arbitrary execution of code. + + chromium,google-chrome + 2020-11-11 + 2020-11-11 + 750854 + 752375 + 753848 + remote + + + 86.0.4240.193 + 86.0.4240.193 + + + 86.0.4240.193 + 86.0.4240.193 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-86.0.4240.193" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-86.0.4240.193" + + + + CVE-2020-15999 + CVE-2020-16004 + CVE-2020-16005 + CVE-2020-16006 + CVE-2020-16008 + CVE-2020-16009 + CVE-2020-16016 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-13.xml new file mode 100644 index 0000000000..b5f2816077 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-13.xml @@ -0,0 +1,51 @@ + + + + Salt: Multiple vulnerabilities + Multiple vulnerabilities have been found in Salt, the worst of + which could result in the arbitrary execution of code. + + salt + 2020-11-11 + 2020-11-11 + 753266 + remote + + + 3000.5 + 3000.5 + + + +

Salt is a remote execution and configuration manager.

+ + +

Multiple vulnerabilities have been discovered in Salt. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Salt users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-admin/salt-3000.5" + + + + CVE-2020-16846 + CVE-2020-17490 + CVE-2020-25592 + + Upstream advisory + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-14.xml new file mode 100644 index 0000000000..2ae7a8c2ec --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-14.xml @@ -0,0 +1,74 @@ + + + + MariaDB: Remote code execution + A vulnerability has been discovered in MariaDB which could result + in the arbitrary execution of code. + + mariadb + 2020-11-11 + 2020-11-11 + 747166 + local, remote + + + 10.5.6 + 10.4.13-r3 + 10.3.23-r3 + 10.2.22-r3 + 10.5.6 + + + +

MariaDB is an enhanced, drop-in replacement for MySQL.

+ + +

It was discovered that MariaDB did not properly validate the content of + a packet received from a server. +

+ + +

A remote attacker could send a specially crafted packet to WSREP + service, possibly resulting in execution of arbitrary code with the + privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All MariaDB 10.5.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/mariadb-10.5.6:10.5" + + +

All MariaDB 10.4.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/mariadb-10.4.13-r3:10.4" + + +

All MariaDB 10.3.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/mariadb-10.3.23-r3:10.3" + + +

All MariaDB 10.2.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/mariadb-10.2.22-r3:10.2" + + + + + CVE-2020-15180 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-15.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-15.xml new file mode 100644 index 0000000000..91f3acadcd --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-15.xml @@ -0,0 +1,52 @@ + + + + libmaxminddb: Denial of service + A vulnerability in libmaxminddb could lead to a Denial of Service + condition. + + libmaxminddb + 2020-11-14 + 2020-11-14 + 753275 + remote + + + 1.4.3 + 1.4.3 + + + +

The libmaxminddb library provides a C library for reading MaxMind DB + files, including the GeoIP2 databases from MaxMind. +

+ + +

libmaxminddb used uninitialised memory when reading from a corrupt + database file. +

+ + +

A remote attacker could entice a user to use a specially crafted + database with libmaxminddb, possibly resulting in a Denial of Service + condition. +

+ + +

There is no known workaround at this time.

+ + +

All libmaxminddb users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/libmaxminddb-1.4.3" + + + + + CVE-2020-28241 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-16.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-16.xml new file mode 100644 index 0000000000..1ffe1738d6 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-16.xml @@ -0,0 +1,69 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in the arbitrary execution of code. + + chromium,google-chrome + 2020-11-16 + 2020-11-16 + 754093 + local, remote + + + 86.0.4240.198 + 86.0.4240.198 + + + 86.0.4240.198 + 86.0.4240.198 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-86.0.4240.198" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-86.0.4240.198" + + + + CVE-2020-16013 + CVE-2020-16017 + + Google Chrome 86.0.4240.198 release announcement + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-17.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-17.xml new file mode 100644 index 0000000000..8de429e1f0 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-17.xml @@ -0,0 +1,50 @@ + + + + MIT Kerberos 5: Denial of service + A vulnerability in MIT Kerberos 5 could lead to a Denial of Service + condition. + + mit-krb5 + 2020-11-16 + 2020-11-16 + 753281 + remote + + + 1.18.2-r2 + 1.18.2-r2 + + + +

The MIT Kerberos 5 implementation provides a command line telnet client + which is used for remote login via the telnet protocol. +

+ + +

It was discovered that MIT Kerberos network authentication system, krb5, + did not properly handle ASN.1-encoded Kerberos messages. +

+ + +

A remote attacker could send a specially crafted Kerberos message, + possibly resulting in a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All MIT Kerberos 5 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.18.2-r2" + + + + CVE-2020-28196 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-18.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-18.xml new file mode 100644 index 0000000000..5e570091d3 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-18.xml @@ -0,0 +1,51 @@ + + + + Apache Ant: Insecure temporary file + Apache Ant uses various insecure temporary files possibly allowing + local code execution. + + ant + 2020-11-16 + 2020-11-16 + 745768 + local + + + 1.10.9 + 1.10.9 + + + +

Ant is a Java-based build tool similar to ‘make’ that uses XML + configuration files. +

+ + +

A previous fix for a security vulnerability involving insecure temporary + files has been found to be incomplete. +

+ + +

A local attacker could perform symlink attacks to overwrite arbitrary + files with the privileges of the user running the application. +

+ + +

There is no known workaround at this time.

+ + +

All Apache Ant users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-java/ant-1.10.9" + + + + CVE-2020-11979 + GLSA-202007-34 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-19.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-19.xml new file mode 100644 index 0000000000..3f0a5cc981 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202011-19.xml @@ -0,0 +1,51 @@ + + + + libexif: Multiple vulnerabilities + Multiple vulnerabilities have been found in libexif, the worst of + which could result in the arbitrary execution of code. + + libexif + 2020-11-16 + 2020-11-16 + 754681 + remote + + + 0.6.22_p20201105 + 0.6.22_p20201105 + + + +

libexif is a library for parsing, editing and saving Exif metadata from + images. +

+ + +

Multiple vulnerabilities have been discovered in libexif. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All libexif users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=media-libs/libexif-0.6.22_p20201105" + + + + CVE-2020-0181 + CVE-2020-0198 + CVE-2020-0452 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-01.xml new file mode 100644 index 0000000000..eade9bb0a6 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-01.xml @@ -0,0 +1,65 @@ + + + + X.Org X Server: Multiple vulnerabilities + Multiple vulnerabilities have been found in X.org X Server, the + worst of which could lead to privilege escalation. + + xorg x server + 2020-12-07 + 2020-12-07 + 734976 + 757882 + local + + + 1.20.10 + 1.20.10 + + + +

The X Window System is a graphical windowing system based on a + client/server model. +

+ + +

Multiple vulnerabilities have been discovered in X.org X Server. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

A local attacker could escalate privileges.

+ + +

All X.org X Server users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=11-base/xorg-server-1.20.10" + + + + + CVE-2020-14345 + CVE-2020-14346 + CVE-2020-14347 + CVE-2020-14360 + CVE-2020-14361 + CVE-2020-14362 + CVE-2020-25712 + + Upstream advisory (2020-07-31) + + + Upstream advisory (2020-08-25) + + + Upstream advisory (2020-12-01) + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-02.xml new file mode 100644 index 0000000000..7ad33f8171 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-02.xml @@ -0,0 +1,79 @@ + + + + SeaMonkey: Multiple vulnerabilities + Multiple vulnerabilities have been found in SeaMonkey, the worst of + which could result in the arbitrary execution of code. + + seamonkey + 2020-12-07 + 2020-12-07 + 718738 + 718746 + local, remote + + + 2.53.5 + 2.53.5.1 + + + 2.49.1_rc2 + + + +

The SeaMonkey project is a community effort to deliver + production-quality releases of code derived from the application formerly + known as “Mozilla Application Suite”. +

+ + +

Multiple vulnerabilities have been discovered in SeaMonkey. Please + review referenced release notes for more details. +

+ + +

Please review the referenced release notes for details.

+ + +

There is no known workaround at this time.

+ + +

All SeaMonkey users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/seamonkey-2.53.5.1" + + +

Gentoo has discontinued support for the SeaMonkey binary package. We + recommend that users unmerge the SeaMonkey binary package: +

+ +

# emerge --unmerge “www-client/seamonkey-bin”

+ +

NOTE: The Gentoo developer(s) maintaining the SeaMonkey binary package + have discontinued support at this time. It may be possible that a new + Gentoo developer will update it at a later date. The alternative is using + the standard SeaMonkey package. +

+ + + + SeaMonkey 2.53.2 Release Notes + + + SeaMonkey 2.53.3 Release Notes + + + SeaMonkey 2.53.4 Release Notes + + + SeaMonkey 2.53.5 Release Notes + + + SeaMonkey 2.53.5.1 Release Notes + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-03.xml new file mode 100644 index 0000000000..b44b423513 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-03.xml @@ -0,0 +1,95 @@ + + + + Mozilla Firefox: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mozilla Firefox, the + worst of which could result in the arbitrary execution of code. + + firefox + 2020-12-07 + 2020-12-07 + 755170 + local, remote + + + 83 + 78.5.0 + 83 + + + 83 + 78.5.0 + 83 + + + +

Mozilla Firefox is a popular open-source web browser from the Mozilla + project. +

+ + +

Multiple vulnerabilities have been discovered in Mozilla Firefox. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Firefox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-83" + + +

All Mozilla Firefox binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-83" + + +

All Mozilla Firefox (ESR) users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/firefox-78.5.0:0/esr78" + + +

All Mozilla Firefox (ESR) binary users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/firefox-bin-78.5.0:0/esr78" + + + + + + Mozilla Foundation Security Advisory 2020-51 + + CVE-2020-16012 + CVE-2020-26951 + CVE-2020-26953 + CVE-2020-26956 + CVE-2020-26958 + CVE-2020-26959 + CVE-2020-26960 + CVE-2020-26961 + CVE-2020-26965 + CVE-2020-26968 + + Mozilla Foundation Security Advisory 2020-50 + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-04.xml new file mode 100644 index 0000000000..e0bf6a7a5f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-04.xml @@ -0,0 +1,81 @@ + + + + Mozilla Thunderbird: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mozilla Thunderbird, + the worst of which could lead to the execution of arbitrary code. + + thunderbird + 2020-12-07 + 2020-12-07 + 758857 + local, remote + + + 78.5.1 + 78.5.1 + + + 78.5.1 + 78.5.1 + + + +

Mozilla Thunderbird is a popular open-source email client from the + Mozilla project. +

+ + +

Multiple vulnerabilities have been discovered in Mozilla Thunderbird. + Please review the referenced Mozilla Foundation Security Advisories and + CVE identifiers below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Thunderbird users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-78.5.1" + + +

All Mozilla Thunderbird binary users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=mail-client/thunderbird-bin-78.5.1" + + + + + + Mozilla Foundation Security Advisory 2020-52 + + + Mozilla Foundation Security Advisory 2020-53 + + CVE-2020-15999 + CVE-2020-16012 + CVE-2020-26951 + CVE-2020-26953 + CVE-2020-26956 + CVE-2020-26958 + CVE-2020-26959 + CVE-2020-26960 + CVE-2020-26961 + CVE-2020-26965 + CVE-2020-26968 + CVE-2020-26970 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-05.xml new file mode 100644 index 0000000000..4d9179db4f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-05.xml @@ -0,0 +1,92 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in the arbitrary execution of code. + + chromium,google-chrome + 2020-12-07 + 2020-12-07 + 755227 + 758368 + local, remote + + + 87.0.4280.88 + 87.0.4280.88 + + + 87.0.4280.88 + 87.0.4280.88 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-87.0.4280.88" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-87.0.4280.88" + + + + + CVE-2020-16014 + CVE-2020-16015 + CVE-2020-16018 + CVE-2020-16019 + CVE-2020-16020 + CVE-2020-16021 + CVE-2020-16022 + CVE-2020-16023 + CVE-2020-16024 + CVE-2020-16025 + CVE-2020-16026 + CVE-2020-16027 + CVE-2020-16028 + CVE-2020-16029 + CVE-2020-16030 + CVE-2020-16031 + CVE-2020-16032 + CVE-2020-16033 + CVE-2020-16034 + CVE-2020-16036 + CVE-2020-16037 + CVE-2020-16038 + CVE-2020-16039 + CVE-2020-16040 + CVE-2020-16041 + CVE-2020-16042 + + sam_c + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-06.xml new file mode 100644 index 0000000000..daa51d1411 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-06.xml @@ -0,0 +1,52 @@ + + + + Linux-PAM: Authentication bypass + A vulnerability has been found in Linux-PAM, allowing attackers to + bypass the authentication process. + + pam + 2020-12-07 + 2020-12-07 + 756361 + local, remote + + + 1.5.1 + 1.5.1 + + + +

Linux-PAM (Pluggable Authentication Modules) is an architecture allowing + the separation of the development of privilege granting software from the + development of secure and appropriate authentication schemes. +

+ + +

A flaw was found in Linux-Pam in the way it handle empty passwords for + non-existing users. +

+ + +

A remote attacker, who only needs to know a non-existing username, could + bypass security restrictions and authenticate as root user. +

+ + +

Ensure that root account is protected by a non-empty password.

+ + +

All Linux-PAM users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-libs/pam-1.5.1" + + + + + CVE-2020-27780 + + sam_c + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-07.xml new file mode 100644 index 0000000000..3ce91200d1 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-07.xml @@ -0,0 +1,94 @@ + + + + PostgreSQL: Multiple vulnerabilities + Multiple vulnerabilities have been found in PostgreSQL, the worst + of which could result in arbitrary code execution. + + postgresql + 2020-12-07 + 2020-12-07 + 754363 + local, remote + + + 9.5.24 + 9.6.20 + 10.15 + 11.10 + 12.5 + 13.1 + 13.1 + + + +

PostgreSQL is an open source object-relational database management + system. +

+ + +

Multiple vulnerabilities have been discovered in PostgreSQL. Please + review the CVE identifiers referenced below for details. +

+ + +

A remote attacker could possibly obtain sensitive information, alter SQL + commands, escape PostgreSQL sandbox or execute arbitrary code with the + privileges of the process. +

+ + +

There is no known workaround at this time.

+ + +

All PostgreSQL 9.5.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.5.24:9.5" + + +

All PostgreSQL 9.6.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.6.20:9.6" + + +

All PostgreSQL 10.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-10.15:10" + + +

All PostgreSQL 11.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-11.10:11" + + +

All PostgreSQL 12.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-12.5:12" + + +

All PostgreSQL 13.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-13.1:13" + + + + + CVE-2020-25694 + CVE-2020-25695 + CVE-2020-25696 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-08.xml new file mode 100644 index 0000000000..468beb7d8a --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-08.xml @@ -0,0 +1,74 @@ + + + + MariaDB: Multiple vulnerabilities + Multiple vulnerabilities have been found in MariaDB, the worst of + which could result in privilege escalation. + + mariadb + 2020-12-07 + 2020-12-07 + 722782 + remote + + + 10.2.36 + 10.3.27 + 10.4.17 + 10.5.8 + 10.5.8 + + + +

MariaDB is an enhanced, drop-in replacement for MySQL.

+ + +

Multiple vulnerabilities have been discovered in MariaDB. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All MariaDB 10.2.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/mariadb-10.2.36:10.2" + + +

All MariaDB 10.3.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/mariadb-10.3.27:10.3" + + +

All MariaDB 10.4.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/mariadb-10.4.17:10.4" + + +

All MariaDB 10.5.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/mariadb-10.5.8:10.5" + + + + + CVE-2020-2752 + CVE-2020-2760 + CVE-2020-2812 + CVE-2020-2814 + + sam_c + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-09.xml new file mode 100644 index 0000000000..98367ceec4 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-09.xml @@ -0,0 +1,50 @@ + + + + Cherokee: Multiple vulnerabilities + Multiple vulnerabilities have been found in Cherokee, the worst of + which could result in a Denial of Service condition. + + cherokee + 2020-12-23 + 2020-12-23 + 715204 + remote + + + 1.2.104-r2 + + + +

Cherokee is an extra-light web server.

+ + +

Multiple vulnerabilities have been discovered in Cherokee. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

Gentoo has discontinued support for Cherokee. We recommend that users + unmerge package: +

+ + + # emerge --unmerge "www-servers/cherokee" + + + + CVE-2006-1681 + CVE-2019-20798 + CVE-2019-20799 + CVE-2019-20800 + CVE-2020-12845 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-10.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-10.xml new file mode 100644 index 0000000000..d3fcad05f7 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-10.xml @@ -0,0 +1,60 @@ + + + + WebkitGTK+: Multiple vulnerabilities + Multiple vulnerabilities have been found in WebKitGTK+, the worst + of which could result in the arbitrary execution of code. + + webkit-gtk + 2020-12-23 + 2020-12-23 + 755947 + remote + + + 2.30.3 + 2.30.3 + + + +

WebKitGTK+ is a full-featured port of the WebKit rendering engine, + suitable for projects requiring any kind of web integration, from hybrid + HTML/CSS applications to full-fledged web browsers. +

+ + +

Multiple vulnerabilities have been discovered in WebKitGTK+. Please + review the CVE identifiers referenced below for details. +

+ + +

An attacker, by enticing a user to visit maliciously crafted web + content, may be able to execute arbitrary code or cause memory + corruption. +

+ + +

There is no known workaround at this time.

+ + +

All WebkitGTK+ users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.30.3" + + + + + CVE-2020-13543 + CVE-2020-13584 + CVE-2020-9948 + CVE-2020-9951 + CVE-2020-9952 + CVE-2020-9983 + WSA-2020-0008 + WSA-2020-0009 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-11.xml new file mode 100644 index 0000000000..f3d69f2db4 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-11.xml @@ -0,0 +1,46 @@ + + + + c-ares: Denial of service + A Denial of Service vulnerability was discovered in c-ares. + c-ares + 2020-12-23 + 2020-12-23 + 754939 + local, remote + + + 1.17.1 + 1.17.1 + + + +

c-ares is an asynchronous resolver library.

+ + +

It was discovered that c-ares incorrectly handled certain DNS requests.

+ + +

A remote attacker, able to trigger a DNS request for a host of their + choice by an application linked against c-ares, could possibly cause a + Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All c-ares users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-dns/c-ares-1.17.1" + + + + + CVE-2020-8277 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-12.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-12.xml new file mode 100644 index 0000000000..ea229f22c9 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-12.xml @@ -0,0 +1,53 @@ + + + + libass: User-assisted execution of arbitrary code + A vulnerability has been found in libass that could allow a remote + attacker to execute arbitrary code. + + libass + 2020-12-23 + 2020-12-23 + 746413 + local, remote + + + 0.15.0 + 0.15.0 + + + +

libass is a portable subtitle renderer for the ASS/SSA (Advanced + Substation Alpha/Substation Alpha) subtitle format. +

+ + +

It was discovered that libass did not properly handle Advanced + Substation Alpha/Substation Alpha subtitle format files. +

+ + +

A remote attacker could entice a user to process an a specially crafted + subtitle format file using an application linked against libass, possibly + resulting in execution of arbitrary code with the privileges of the + process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All libass users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/libass-0.15.0" + + + + + CVE-2020-26682 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-13.xml new file mode 100644 index 0000000000..5bd290db05 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-13.xml @@ -0,0 +1,51 @@ + + + + OpenSSL: Denial of service + A vulnerability in OpenSSL might allow remote attackers to cause a + Denial of Service condition. + + openssl + 2020-12-23 + 2020-12-23 + 759079 + local, remote + + + 1.1.1i + 1.1.1i + + + +

OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer + (SSL v2/v3) and Transport Layer Security (TLS v1/v1.1/v1.2/v1.3) as well + as a general purpose cryptography library. +

+ + +

A null pointer dereference flaw was found in OpenSSL.

+ + +

A remote attacker, able to control the arguments of the GENERAL_NAME_cmp + function in an application linked against OpenSSL, could possibly cause a + Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All OpenSSL users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.1.1i" + + + + + CVE-2020-1971 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-14.xml new file mode 100644 index 0000000000..6d7c215154 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-14.xml @@ -0,0 +1,51 @@ + + + + cURL: Multiple vulnerabilities + Multiple vulnerabilities have been found in cURL, the worst of + which could result in information disclosure or data loss. + + curl + 2020-12-23 + 2020-12-23 + 737990 + 759259 + remote + + + 7.74.0 + 7.74.0 + + + +

A command line tool and library for transferring data with URLs.

+ + +

Multiple vulnerabilities have been discovered in cURL. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All cURL users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/curl-7.74.0" + + + + + CVE-2020-8231 + CVE-2020-8284 + CVE-2020-8285 + CVE-2020-8286 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-15.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-15.xml new file mode 100644 index 0000000000..771f8956fd --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-15.xml @@ -0,0 +1,50 @@ + + + + GDK-PixBuf: Denial of service + A vulnerability in GDK-PixBuf library could lead to a Denial of + Service condition. + + gdk-pixbuf + 2020-12-23 + 2020-12-23 + 759094 + local, remote + + + 2.42.2 + 2.42.2 + + + +

GDK-PixBuf is an image loading library for GTK+.

+ + +

It was discovered that the GDK-PixBuf library did not properly handle + certain GIF images. +

+ + +

A remote attacker could entice a user to open a specially crafted GIF + image in an application linked against GDK-PixBuf library, possibly + resulting in a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All GDK-PixBuf library users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-libs/gdk-pixbuf-2.42.2" + + + + + CVE-2020-29385 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-16.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-16.xml new file mode 100644 index 0000000000..30556bb56e --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-16.xml @@ -0,0 +1,73 @@ + + + + PHP: Multiple vulnerabilities + Multiple vulnerabilities have been found in PHP, the worst of which + could result in a Denial of Service condition. + + php + 2020-12-23 + 2020-12-23 + 711140 + 745993 + 756775 + local, remote + + + 7.2.34-r1 + 7.3.25 + 7.4.13 + 8.0.0 + + + +

PHP is an open source general-purpose scripting language that is + especially suited for web development. +

+ + +

Multiple vulnerabilities have been discovered in PHP. Please review the + CVE identifiers and change log referenced below for details. +

+ + +

An attacker could cause a Denial of Service condition or obtain + sensitive information. +

+ + +

There is no known workaround at this time.

+ + +

All PHP 7.2.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/php-7.2.34-r1:7.2" + + +

All PHP 7.3.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/php-7.3.25:7.3" + + +

All PHP 7.4.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/php-7.4.13:7.4" + + + + + CVE-2020-7069 + CVE-2020-7070 + PHP 7.4.13 Change + Log + + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-17.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-17.xml new file mode 100644 index 0000000000..80b1db8fc4 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-17.xml @@ -0,0 +1,52 @@ + + + + D-Bus: Denial of service + A local Denial of Service vulnerability was discovered in D-Bus. + dbus + 2020-12-23 + 2020-12-23 + 755392 + local + + + 1.12.20 + 1.12.20 + + + +

D-Bus is a message bus system which processes can use to talk to each + other. +

+ + +

It was discovered that D-Bus did not properly handle the situation when + two usernames have the same numeric UID. +

+ + +

An attacker could possibly cause a Denial of Service condition or + trigger other undefined behavior, possibly including incorrect + authorization decisions. +

+ + +

There is no known workaround at this time.

+ + +

All D-Bus users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/dbus-1.12.20" + + + + + + dbus 1.12.20 security update announcement + + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-18.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-18.xml new file mode 100644 index 0000000000..f7fbf13a6d --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-18.xml @@ -0,0 +1,55 @@ + + + + PowerDNS: information disclosure + An information disclosure vulnerability in PowerDNS allow remote + attackers to obtain sensitive information. + + pdns + 2020-12-23 + 2020-12-23 + 744160 + remote + + + 4.3.1 + 4.3.1 + + + +

The PowerDNS nameserver is an authoritative-only nameserver which uses a + flexible backend architecture. +

+ + +

It was discovered that PowerDNS did not properly handle certain unknown + records. +

+ + +

An authorized attacker with the ability to insert crafted records into a + zone might be able to leak the content of uninitialized memory. Crafted + records cannot be inserted via AXFR. +

+ + +

Do not take zone data from untrusted users.

+ + +

All PowerDNS users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-dns/pdns-4.3.1" + + + + + CVE-2020-17482 + + PowerDNS Security Advisory 2020-05 + + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-19.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-19.xml new file mode 100644 index 0000000000..939cc25c34 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-19.xml @@ -0,0 +1,52 @@ + + + + PowerDNS Recursor: Denial of service + A vulnerability in PowerDNS Recursor could lead to a Denial of + Service condition. + + pdns-recursor + 2020-12-23 + 2020-12-23 + 746923 + remote + + + 4.3.5 + 4.3.5 + + + +

PowerDNS Recursor is a high-end, high-performance resolving name server.

+ + +

It was discovered that it was possible to update the DNSSEC validation + state to a bogus state for a cached record via DNS ANY query. +

+ + +

A remote attacker could send specially crafted DNS queries to deny + DNSSEC validation. +

+ + +

There is no known workaround at this time.

+ + +

All PowerDNS Recursor users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-dns/pdns-recursor-4.3.5" + + + + + CVE-2020-25829 + + PowerDNS Security Advisory 2020-07 + + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-20.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-20.xml new file mode 100644 index 0000000000..883bfb8411 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-20.xml @@ -0,0 +1,122 @@ + + + + Mozilla Firefox, Mozilla Thunderbird: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mozilla Firefox and + Mozilla Thunderbird, the worst of which could result in the arbitrary + execution of code. + + firefox,thunderbird + 2020-12-23 + 2020-12-23 + 759097 + local, remote + + + 78.6.0 + 84.0 + 84.0 + + + 78.6.0 + 84.0 + 84.0 + + + 78.6.0 + 78.6.0 + + + 78.6.0 + 78.6.0 + + + +

Mozilla Firefox is a popular open-source web browser from the Mozilla + project. +

+ +

Mozilla Thunderbird is a popular open-source email client from the + Mozilla project. +

+ + +

Multiple vulnerabilities have been discovered in Mozilla Firefox and + Mozilla Thunderbird. Please review the CVE identifiers referenced below + for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Firefox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-84.0" + + +

All Mozilla Firefox (bin) users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-84.0" + + +

All Mozilla Firefox ESR users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/firefox-78.6.0:0/esr78" + + +

All Mozilla Firefox ESR (bin) users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/firefox-bin-78.6.0:0/esr78" + + +

All Mozilla Thunderbird users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-78.6.0" + + +

All Mozilla Thunderbird (bin) users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=mail-client/thunderbird-bin-78.6.0" + + + + CVE-2020-16042 + CVE-2020-26971 + CVE-2020-26973 + CVE-2020-26974 + CVE-2020-26978 + CVE-2020-35111 + CVE-2020-35113 + + MFSA-2020-55 + + + MFSA-2020-56 + + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-21.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-21.xml new file mode 100644 index 0000000000..3baa8cb1d4 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-21.xml @@ -0,0 +1,53 @@ + + + + Mozilla Network Security Service (NSS): Denial of service + A vulnerability in NSS might allow remote attackers to cause a + Denial of Service condition. + + nss + 2020-12-23 + 2020-12-23 + 750254 + remote + + + 3.58 + 3.58 + + + +

The Mozilla Network Security Service (NSS) is a library implementing + security features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS + #12, S/MIME and X.509 certificates. +

+ + +

A flaw was found in the way Mozilla Network Security Service (NSS) + handled CCS (ChangeCipherSpec) messages in TLS 1.3. +

+ + +

A remote attacker could send multiple crafted CSS messages in row after + ClientHello message to a server application linked against NSS library, + possibly resulting in a Denial of Service condition. +

+ + +

Disable TLS 1.3 protocol.

+ + +

All NSS users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.58" + + + + + CVE-2020-25648 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-22.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-22.xml new file mode 100644 index 0000000000..083b6e2777 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-22.xml @@ -0,0 +1,58 @@ + + + + HAProxy: Arbitrary code execution + A buffer overflow in HAProxy might allow an attacker to execute + arbitrary code. + + haproxy + 2020-12-24 + 2020-12-24 + 715944 + remote + + + 2.0.13 + 2.1.4 + 2.1.4 + + + +

HAProxy is a TCP/HTTP reverse proxy for high availability environments.

+ + +

It was discovered that HAProxy incorrectly handled certain HTTP/2 + headers. +

+ + +

A remote attacker, by sending a specially crafted HTTP/2 request, could + possibly execute arbitrary code with the privileges of the process, or + cause a Denial of Service condition. +

+ + +

Disable HTTP/2 support.

+ + +

All HAProxy 2.0.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-proxy/haproxy-2.0.13:0/2.0" + + +

All other HAProxy users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-proxy/haproxy-2.1.4" + + + + + CVE-2020-11100 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-23.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-23.xml new file mode 100644 index 0000000000..15ee7d6925 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-23.xml @@ -0,0 +1,59 @@ + + + + Apache Tomcat: Information disclosure + A vulnerability has been discovered in Apache Tomcat that allows + for the disclosure of sensitive information. + + tomcat + 2020-12-24 + 2020-12-24 + 758338 + remote + + + 8.5.60 + 9.0.40 + 8.5.60 + 9.0.40 + + + +

Apache Tomcat is a Servlet-3.0/JSP-2.2 Container.

+ + +

It was discovered that Apache Tomcat could re-use an HTTP request header + value from the previous stream received on an HTTP/2 connection for the + request associated with the subsequent stream. +

+ + +

A remote attacker, by sending well-timed HTTP/2 requests, could possibly + obtain sensitive information. +

+ + +

Disable HTTP/2 support.

+ + +

All Apache Tomcat 8.5.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-servers/tomcat-8.5.60:8.5" + + +

All Apache Tomcat 9.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-servers/tomcat-9.0.40:9" + + + + + CVE-2020-17527 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-24.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-24.xml new file mode 100644 index 0000000000..b0f388729a --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202012-24.xml @@ -0,0 +1,51 @@ + + + + Samba: Multiple vulnerabilities + Multiple vulnerabilities have been found in Samba, the worst of + which could result in a Denial of Service condition. + + samba + 2020-12-24 + 2020-12-24 + 743433 + 751724 + remote + + + 4.12.9 + 4.12.9 + + + +

Samba is a suite of SMB and CIFS client/server programs.

+ + +

Multiple vulnerabilities have been discovered in Samba. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Samba users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-fs/samba-4.12.9" + + + + + CVE-2020-14318 + CVE-2020-14323 + CVE-2020-14383 + CVE-2020-1472 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-01.xml new file mode 100644 index 0000000000..c5890e4772 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-01.xml @@ -0,0 +1,54 @@ + + + + Dovecot: Multiple vulnerabilities + Multiple vulnerabilities have been found in Dovecot, the worst of + which could allow remote attackers to cause a Denial of Service condition. + + dovecot + 2021-01-10 + 2021-01-10 + 763525 + local, remote + + + 2.3.13 + 2.3.13 + + + +

Dovecot is an open source IMAP and POP3 email server.

+ + +

Multiple vulnerabilities have been discovered in Dovecot. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could send a specially crafted mail or send a + specially crafted IMAP command possibly resulting in a Denial of Service + condition or an authenticated remote attacker might be able to discover + the file system directory structure and access other users’ emails. +

+ + +

The information disclosure vulnerability can be mitigated by disabling + IMAP hibernation feature which isn’t enabled by default. +

+ + +

All Dovecot users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-mail/dovecot-2.3.13" + + + + + CVE-2020-24386 + CVE-2020-25275 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-02.xml new file mode 100644 index 0000000000..3f021e488b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-02.xml @@ -0,0 +1,50 @@ + + + + Firejail: Multiple vulnerabilities + Multiple vulnerabilities have been found in Firejail, the worst of + which could result in the arbitrary execution of code. + + firejail + 2021-01-10 + 2021-01-10 + 736816 + remote + + + 0.9.64 + 0.9.64 + + + +

A SUID program that reduces the risk of security breaches by restricting + the running environment of untrusted applications using Linux namespaces + and seccomp-bpf. +

+ + +

Multiple vulnerabilities have been discovered in Firejail. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Firejail users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/firejail-0.9.64" + + + + CVE-2020-17367 + CVE-2020-17368 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-03.xml new file mode 100644 index 0000000000..1202c1ba25 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-03.xml @@ -0,0 +1,49 @@ + + + + ipmitool: Multiple vulnerabilities + A buffer overflow in ipmitool might allow remote attacker(s) to + execute arbitrary code. + + ipmitool + 2021-01-10 + 2021-01-10 + 708436 + remote + + + 1.8.18_p20201004-r1 + 1.8.18_p20201004-r1 + + + +

Utility for controlling IPMI enabled devices.

+ + +

Multiple vulnerabilities have been discovered in ipmiool. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All ipmitool users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=sys-apps/ipmitool-1.8.18_p20201004-r1" + + + + CVE-2020-5208 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-04.xml new file mode 100644 index 0000000000..c2d23f52d1 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-04.xml @@ -0,0 +1,83 @@ + + + + Mozilla Firefox: Remote code execution + A use-after-free in Mozilla Firefox's SCTP handling may allow + remote code execution. + + firefox,thunderbird + 2021-01-10 + 2021-01-10 + 764161 + remote + + + 78.6.1 + 84.0.2 + 84.0.2 + + + 78.6.1 + 84.0.2 + 84.0.2 + + + +

Mozilla Firefox is a popular open-source web browser from the Mozilla + project. +

+ + +

A use-after-free bug was discovered in Mozilla Firefox’s handling of + SCTP. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Firefox ESR users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/firefox-78.6.1:0/esr78" + + +

All Firefox ESR binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/firefox-bin-78.6.1:0/esr78" + + +

All Firefox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-84.0.2" + + +

All Firefox binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-84.0.2" + + + + + CVE-2020-16044 + + MFSA-2021-01 + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-05.xml new file mode 100644 index 0000000000..ced5846cab --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-05.xml @@ -0,0 +1,77 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in the arbitrary execution of code. + + google-chrome,chromium + 2021-01-10 + 2021-01-10 + 764251 + remote + + + 87.0.4280.141 + 87.0.4280.141 + + + 87.0.4280.141 + 87.0.4280.141 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-87.0.4280.141" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-87.0.4280.141" + + + + CVE-2020-15995 + CVE-2020-16043 + CVE-2021-21106 + CVE-2021-21107 + CVE-2021-21108 + CVE-2021-21109 + CVE-2021-21110 + CVE-2021-21111 + CVE-2021-21112 + CVE-2021-21113 + CVE-2021-21114 + CVE-2021-21115 + CVE-2021-21116 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-06.xml new file mode 100644 index 0000000000..efa0c4ddc2 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-06.xml @@ -0,0 +1,49 @@ + + + + Ark: Symlink vulnerability + Ark was found to allow arbitrary file overwrite, possibly allowing + arbitrary code execution. + + ark + 2021-01-11 + 2021-01-11 + 743959 + remote + + + 20.04.3-r2 + 20.04.3-r2 + + + +

Ark is a graphical file compression/decompression utility with support + for multiple formats. +

+ + +

KDE Ark did not fully verify symlinks contained within tar archives.

+ + +

A remote attacker could entice a user to open a specially crafted tar + archive using KDE Ark, possibly resulting in execution of arbitrary code + with the privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All KDE Ark users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=kde-apps/ark-20.04.3-r2" + + + + CVE-2020-24654 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-07.xml new file mode 100644 index 0000000000..14b6b1ae8c --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-07.xml @@ -0,0 +1,69 @@ + + + + NodeJS: Multiple vulnerabilities + Multiple vulnerabilities have been found in NodeJS, the worst of + which could result in the arbitrary execution of code. + + nodejs + 2021-01-11 + 2021-01-11 + 726836 + 731654 + 742893 + 754942 + 763588 + remote + + + 15.5.1 + 14.15.1 + 12.20.1 + 15.5.1 + + + +

Node.js is a JavaScript runtime built on Chrome’s V8 JavaScript + engine. +

+ + +

Multiple vulnerabilities have been discovered in NodeJS. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All NodeJS 15 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/nodejs-15.5.1" + + +

All NodeJS 14 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/nodejs-14.15.1" + + + + + CVE-2020-15095 + CVE-2020-8172 + CVE-2020-8174 + CVE-2020-8201 + CVE-2020-8251 + CVE-2020-8265 + CVE-2020-8277 + CVE-2020-8287 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-08.xml new file mode 100644 index 0000000000..64adcec9d2 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-08.xml @@ -0,0 +1,48 @@ + + + + Pillow: Multiple vulnerabilities + Multiple vulnerabilities have been found in Pillow, the worst of + which could result in a Denial of Service condition. + + pillow + 2021-01-11 + 2021-01-11 + 763210 + remote + + + 8.1.0 + 8.1.0 + + + +

Python Imaging Library (fork)

+ + +

Multiple vulnerabilities have been discovered in Pillow. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Pillow users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-python/pillow-8.1.0" + + + + CVE-2020-35653 + CVE-2020-35654 + CVE-2020-35655 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-09.xml new file mode 100644 index 0000000000..a5a9f5605e --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-09.xml @@ -0,0 +1,147 @@ + + + + VirtualBox: Multiple vulnerabilities + Multiple vulnerabilities have been found in VirtualBox, the worst + of which could allow an attacker to take control of VirtualBox. + + virtualbox + 2021-01-12 + 2021-01-12 + 714064 + 717626 + 717782 + 733924 + remote + + + 6.1.12 + 6.0.24 + 6.1.12 + + + +

VirtualBox is a powerful virtualization product from Oracle.

+ + +

Multiple vulnerabilities have been discovered in VirtualBox. Please + review the CVE identifiers referenced below for details. +

+ + +

An attacker could take control of VirtualBox resulting in the execution + of arbitrary code with the privileges of the process, a Denial of Service + condition, or other unspecified impacts. +

+ + +

There is no known workaround at this time.

+ + +

All Virtualbox 6.0.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=app-emulation/virtualbox-6.0.24:0/6.0" + + +

All Virtualbox 6.1.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=app-emulation/virtualbox-6.1.12:0/6.1" + + + + CVE-2019-2848 + CVE-2019-2850 + CVE-2019-2859 + CVE-2019-2863 + CVE-2019-2864 + CVE-2019-2865 + CVE-2019-2866 + CVE-2019-2867 + CVE-2019-2873 + CVE-2019-2874 + CVE-2019-2875 + CVE-2019-2876 + CVE-2019-2877 + CVE-2019-2926 + CVE-2019-2944 + CVE-2019-2984 + CVE-2019-3002 + CVE-2019-3005 + CVE-2019-3017 + CVE-2019-3021 + CVE-2019-3026 + CVE-2019-3028 + CVE-2019-3031 + CVE-2020-14628 + CVE-2020-14629 + CVE-2020-14646 + CVE-2020-14647 + CVE-2020-14648 + CVE-2020-14649 + CVE-2020-14650 + CVE-2020-14673 + CVE-2020-14674 + CVE-2020-14675 + CVE-2020-14676 + CVE-2020-14677 + CVE-2020-14694 + CVE-2020-14695 + CVE-2020-14698 + CVE-2020-14699 + CVE-2020-14700 + CVE-2020-14703 + CVE-2020-14704 + CVE-2020-14707 + CVE-2020-14711 + CVE-2020-14712 + CVE-2020-14713 + CVE-2020-14714 + CVE-2020-14715 + CVE-2020-2575 + CVE-2020-2674 + CVE-2020-2678 + CVE-2020-2681 + CVE-2020-2682 + CVE-2020-2689 + CVE-2020-2690 + CVE-2020-2691 + CVE-2020-2692 + CVE-2020-2693 + CVE-2020-2698 + CVE-2020-2701 + CVE-2020-2702 + CVE-2020-2703 + CVE-2020-2704 + CVE-2020-2705 + CVE-2020-2725 + CVE-2020-2726 + CVE-2020-2727 + CVE-2020-2741 + CVE-2020-2742 + CVE-2020-2743 + CVE-2020-2748 + CVE-2020-2758 + CVE-2020-2894 + CVE-2020-2902 + CVE-2020-2905 + CVE-2020-2907 + CVE-2020-2908 + CVE-2020-2909 + CVE-2020-2910 + CVE-2020-2911 + CVE-2020-2913 + CVE-2020-2914 + CVE-2020-2929 + CVE-2020-2951 + CVE-2020-2958 + CVE-2020-2959 + + BlueKnight + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-10.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-10.xml new file mode 100644 index 0000000000..8abb71de98 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-10.xml @@ -0,0 +1,58 @@ + + + + Asterisk: Multiple vulnerabilities + Multiple vulnerabilities have been found in Asterisk, the worst of + which could result in a Denial of Service condition. + + asterisk + 2021-01-12 + 2021-01-12 + 753269 + 761313 + remote + + + 13.38.1 + 13.38.1 + + + +

A Modular Open Source PBX System.

+ + +

Multiple vulnerabilities have been discovered in Asterisk. Please review + the security advisories referenced below for details. +

+ + +

An attacker could cause a possible Denial of Service condition.

+ + +

There is no known workaround at this time.

+ + +

All Asterisk users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/asterisk-13.38.1" + + + + + AST-2020-001 + + + AST-2020-002 + + + AST-2020-003 + + + AST-2020-004 + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-11.xml new file mode 100644 index 0000000000..317df24d34 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-11.xml @@ -0,0 +1,63 @@ + + + + Zabbix: Root privilege escalation + Multiple vulnerabilities were discovered in Gentoo's ebuild for + Zabbix which could lead to root privilege escalation. + + zabbix + 2021-01-21 + 2021-01-21 + 629882 + 629884 + local + + + 3.0.30 + 4.0.18 + 4.4.6 + + + +

Zabbix is software for monitoring applications, networks, and servers.

+ + +

It was discovered that Gentoo’s Zabbix ebuild did not properly set + permissions or placed the pid file in an unsafe directory. +

+ + +

A local attacker could escalate privileges.

+ + +

There is no known workaround at this time.

+ + +

All Zabbix 3.0.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=net-analyzer/zabbix-3.0.30:0/3.0" + + +

All Zabbix 4.0.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=net-analyzer/zabbix-4.0.18:0/4.0" + + +

All other Zabbix users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-analyzer/zabbix-4.4.6" + + + + + BlueKnight + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-12.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-12.xml new file mode 100644 index 0000000000..10de65bdd4 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-12.xml @@ -0,0 +1,51 @@ + + + + Wireshark: Multiple vulnerabilities + Multiple vulnerabilities have been found in Wireshark, the worst of + which could result in a Denial of Service condition. + + wireshark + 2021-01-22 + 2021-01-22 + 759541 + 760800 + remote + + + 3.4.2 + 3.4.2 + + + +

Wireshark is a network protocol analyzer formerly known as ethereal.

+ + +

Multiple vulnerabilities have been discovered in Wireshark. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Wireshark users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-analyzer/wireshark-3.4.2" + + + + CVE-2020-26418 + CVE-2020-26419 + CVE-2020-26420 + CVE-2020-26421 + CVE-2020-26422 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-13.xml new file mode 100644 index 0000000000..e5c9507b0d --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-13.xml @@ -0,0 +1,91 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in the arbitrary execution of code. + + google-chrome,chromium + 2021-01-22 + 2021-01-22 + 766207 + remote + + + 88.0.4324.96 + 88.0.4324.96 + + + 88.0.4324.96 + 88.0.4324.96 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-88.0.4324.96" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-88.0.4324.96" + + + + + CVE-2020-16044 + CVE-2021-21117 + CVE-2021-21118 + CVE-2021-21119 + CVE-2021-21120 + CVE-2021-21121 + CVE-2021-21122 + CVE-2021-21123 + CVE-2021-21124 + CVE-2021-21125 + CVE-2021-21126 + CVE-2021-21127 + CVE-2021-21128 + CVE-2021-21129 + CVE-2021-21130 + CVE-2021-21131 + CVE-2021-21132 + CVE-2021-21133 + CVE-2021-21134 + CVE-2021-21135 + CVE-2021-21136 + CVE-2021-21137 + CVE-2021-21138 + CVE-2021-21139 + CVE-2021-21140 + CVE-2021-21141 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-14.xml new file mode 100644 index 0000000000..f8ce93e509 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-14.xml @@ -0,0 +1,67 @@ + + + + Mozilla Thunderbird: Remote code execution + Multiple vulnerabilities have been found in Mozilla Thunderbird, + the worst of which could result in the arbitrary execution of code. + + thunderbird + 2021-01-22 + 2021-01-22 + 765088 + remote + + + 78.6.1 + 78.6.1 + + + 78.6.1 + 78.6.1 + + + +

Mozilla Thunderbird is a popular open-source email client from the + Mozilla project. +

+ + +

A use-after-free bug was discovered in Mozilla Thunderbird handling of + SCTP. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Thunderbird users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-78.6.1" + + +

All Mozilla Thunderbird binary users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=mail-client/thunderbird-bin-78.6.1" + + + + CVE-2020-16044 + + MFSA-2021-02 + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-15.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-15.xml new file mode 100644 index 0000000000..3762d3444f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-15.xml @@ -0,0 +1,70 @@ + + + + VirtualBox: Multiple vulnerabilities + Multiple vulnerabilities have been found in VirtualBox, the worst + of which could result in privilege escalation. + + virtualbox + 2021-01-22 + 2021-01-22 + 750782 + 766348 + remote + + + 6.1.18 + 6.1.18 + + + +

VirtualBox is a powerful virtualization product from Oracle.

+ + +

Multiple vulnerabilities have been discovered in VirtualBox. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All VirtualBox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/virtualbox-6.1.18" + + + + CVE-2020-14872 + CVE-2020-14881 + CVE-2020-14884 + CVE-2020-14885 + CVE-2020-14886 + CVE-2020-14889 + CVE-2020-14892 + CVE-2021-2073 + CVE-2021-2074 + CVE-2021-2086 + CVE-2021-2111 + CVE-2021-2112 + CVE-2021-2119 + CVE-2021-2120 + CVE-2021-2121 + CVE-2021-2123 + CVE-2021-2124 + CVE-2021-2125 + CVE-2021-2126 + CVE-2021-2127 + CVE-2021-2128 + CVE-2021-2129 + CVE-2021-2130 + CVE-2021-2131 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-16.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-16.xml new file mode 100644 index 0000000000..2f7ed9ee67 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-16.xml @@ -0,0 +1,48 @@ + + + + KDE Connect: Denial of service + A vulnerability in KDE Connect could lead to a Denial of Service + condition. + + kde-connect + 2021-01-22 + 2021-01-22 + 746401 + remote + + + 20.04.3-r1 + 20.04.3-r1 + + + +

KDE Connect is a project that enables all your devices to communicate + with each other. +

+ + +

Multiple issues causing excessive resource consumption were found in KDE + Connect. +

+ + +

An attacker could cause a possible Denial of Service condition.

+ + +

There is no known workaround at this time.

+ + +

All KDE Connect users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=kde-misc/kdeconnect-20.04.3-r1" + + + + CVE-2020-26164 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-17.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-17.xml new file mode 100644 index 0000000000..9fd515383c --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-17.xml @@ -0,0 +1,58 @@ + + + + Dnsmasq: Multiple vulnerabilities + Multiple vulnerabilities have been found in Dnsmasq, the worst of + which may allow remote attackers to execute arbitrary code. + + dnsmasq + 2021-01-22 + 2021-01-22 + 766126 + local, remote + + + 2.83 + 2.83 + + + +

Dnsmasq is a lightweight and easily-configurable DNS forwarder and DHCP + server. +

+ + +

Multiple vulnerabilities have been discovered in Dnsmasq. Please review + the references below for details. +

+ + +

An attacker, by sending specially crafted DNS replies, could possibly + execute arbitrary code with the privileges of the process, perform a + cache poisoning attack or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Dnsmasq users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-dns/dnsmasq-2.83" + + + + + CVE-2020-25681 + CVE-2020-25682 + CVE-2020-25683 + CVE-2020-25684 + CVE-2020-25685 + CVE-2020-25686 + CVE-2020-25687 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-18.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-18.xml new file mode 100644 index 0000000000..03d6e27b19 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-18.xml @@ -0,0 +1,90 @@ + + + + Python: Multiple vulnerabilities + Multiple vulnerabilities have been found in Python, the worst of + which could result in the arbitrary execution of code. + + python + 2021-01-24 + 2021-01-24 + 749339 + 759928 + 766189 + remote + + + 2.7.18-r6 + 3.6.12-r2 + 3.7.9-r2 + 3.8.7-r1 + 3.9.1-r1 + 2.7.18-r6 + 3.6.12-r2 + 3.7.9-r2 + 3.8.7-r1 + 3.9.1-r1 + + + +

Python is an interpreted, interactive, object-oriented programming + language. +

+ + +

Multiple vulnerabilities have been discovered in Python. Please review + the bugs referenced below for details. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Python 2.7 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.18-r5" + + +

All Python 3.6 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.6.12-r1" + + +

All Python 3.7 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.7.9-r1" + + +

All Python 3.8 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.8.6-r1" + + +

All Python 3.9 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.9.0-r1" + + + + + CVE-2020-26116 + CVE-2021-3177 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-19.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-19.xml new file mode 100644 index 0000000000..866c37dcdf --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-19.xml @@ -0,0 +1,86 @@ + + + + OpenJDK: Multiple vulnerabilities + Multiple vulnerabilities have been found in OpenJDK, the worst of + which could result in the arbitrary execution of code. + + openjdk + 2021-01-25 + 2021-01-25 + 705992 + 750833 + remote + + + 8.272_p10 + 8.272_p10 + + + 8.272_p10 + 8.272_p10 + + + 8.272_p10 + 8.272_p10 + + + +

OpenJDK is a free and open-source implementation of the Java Platform, + Standard Edition. +

+ + +

Multiple vulnerabilities have been discovered in OpenJDK. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All OpenJDK users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-java/openjdk-8.272_p10" + + +

All OpenJDK (binary) users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-java/openjdk-bin-8.272_p10" + + +

All OpenJDK JRE (binary) users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=dev-java/openjdk-jre-bin-8.272_p10" + + + + CVE-2020-14779 + CVE-2020-14781 + CVE-2020-14782 + CVE-2020-14792 + CVE-2020-14796 + CVE-2020-14797 + CVE-2020-14798 + CVE-2020-14803 + CVE-2020-2583 + CVE-2020-2590 + CVE-2020-2593 + CVE-2020-2601 + CVE-2020-2604 + CVE-2020-2654 + CVE-2020-2659 + + sam_c + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-20.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-20.xml new file mode 100644 index 0000000000..c4fc0f6dd3 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-20.xml @@ -0,0 +1,53 @@ + + + + glibc: Multiple vulnerabilities + Multiple vulnerabilities have been found in glibc, the worst of + which could result in the arbitrary execution of code. + + glibc + 2021-01-25 + 2021-01-25 + 611344 + 717058 + 720730 + 758359 + local, remote + + + 2.32-r5 + 2.32-r5 + + + +

glibc is a package that contains the GNU C library.

+ + +

Multiple vulnerabilities have been discovered in glibc. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All glibc users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.32-r5" + + + + CVE-2016-10228 + CVE-2020-1752 + CVE-2020-29562 + CVE-2020-29573 + CVE-2020-6096 + + sam_c + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-21.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-21.xml new file mode 100644 index 0000000000..38c63fc9f4 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-21.xml @@ -0,0 +1,54 @@ + + + + Flatpak: Sandbox escape + A vulnerability was discovered in Flatpak which could allow a + remote attacker to execute arbitrary code. + + flatpak + 2021-01-25 + 2021-01-25 + 765457 + remote + + + 1.10.0 + 1.10.0 + + + +

Flatpak is a Linux application sandboxing and distribution framework.

+ + +

A bug was discovered in the flatpak-portal service that can allow + sandboxed applications to execute arbitrary code on the host system (a + sandbox escape). +

+ + +

A remote attacker could entice a user to open a specially crafted + Flatpak app possibly resulting in execution of arbitrary code with the + privileges of the process or a Denial of Service condition. +

+ + +

As a workaround, this vulnerability can be mitigated by preventing the + flatpak-portal service from starting, but that mitigation will prevent + many Flatpak apps from working correctly. It is highly recommended to + upgrade. +

+ + +

All Flatpak users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/flatpak-1.10.0" + + + + CVE-2021-21261 + + sam_c + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-22.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-22.xml new file mode 100644 index 0000000000..36a94ff168 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-22.xml @@ -0,0 +1,42 @@ + + + + libvirt: Unintended access to /dev/mapper/control + A vulnerability in libvirt may allow root privilege escalation. + libvirt + 2021-01-26 + 2021-01-26 + 739948 + local + + + 6.7.0 + 6.7.0 + + + +

libvirt is a C toolkit for manipulating virtual machines.

+ + +

A file descriptor for /dev/mapper/control was insufficiently protected.

+ + +

A local attacker may be able to escalate to root privileges.

+ + +

There is no known workaround at this time.

+ + +

All libvirt users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/libvirt-6.7.0" + + + + CVE-2020-14339 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-23.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-23.xml new file mode 100644 index 0000000000..d3ba7f3054 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-23.xml @@ -0,0 +1,49 @@ + + + + PEAR Archive_Tar: Directory traversal + Multiple vulnerabilities have been found in PEAR Archive_Tar, the + worst of which could result in the arbitrary execution of code. + + PEAR-Archive_Tar + 2021-01-26 + 2021-01-26 + 755653 + 766036 + remote + + + 1.4.12 + 1.4.12 + + + +

This class provides handling of tar files in PHP.

+ + +

Multiple vulnerabilities have been discovered in PEAR Archive_Tar. + Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All PEAR-Archive_Tar users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-php/PEAR-Archive_Tar-1.4.12" + + + + CVE-2020-28948 + CVE-2020-28949 + CVE-2020-36193 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-24.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-24.xml new file mode 100644 index 0000000000..3e9fb3f777 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-24.xml @@ -0,0 +1,49 @@ + + + + cfitsio: Multiple vulnerabilities + Multiple vulnerabilities have been found in cfitsio, the worst of + which could result in the arbitrary execution of code. + + cfitsio + 2021-01-26 + 2021-01-26 + 673944 + remote + + + 3.490 + 3.490 + + + +

A C and Fortran library for manipulating FITS files.

+ + +

Multiple vulnerabilities have been discovered in cfitsio. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All cfitsio users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sci-libs/cfitsio-3.490" + + + + CVE-2018-3846 + CVE-2018-3847 + CVE-2018-3848 + CVE-2018-3849 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-25.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-25.xml new file mode 100644 index 0000000000..6914662437 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-25.xml @@ -0,0 +1,44 @@ + + + + Mutt: Denial of service + A vulnerability in Mutt could lead to a Denial of Service + condition. + + mutt + 2021-01-26 + 2021-01-26 + 765790 + remote + + + 2.0.4-r1 + 2.0.4-r1 + + + +

Mutt is a small but very powerful text-based mail client.

+ + +

A memory leak could occur when a crafted email message is received.

+ + +

An attacker could cause a possible Denial of Service condition.

+ + +

There is no known workaround at this time.

+ + +

All Mutt users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/mutt-2.0.4-r1" + + + + CVE-2021-3181 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-26.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-26.xml new file mode 100644 index 0000000000..64fbf2c1b6 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-26.xml @@ -0,0 +1,50 @@ + + + + f2fs-tools: Multiple vulnerabilities + Multiple vulnerabilities have been found in f2fs-tools, the worst + of which could result in the arbitrary execution of code. + + f2fs-tools + 2021-01-26 + 2021-01-26 + 749318 + remote + + + 1.14.0 + 1.14.0 + + + +

Tools for Flash-Friendly File System (F2FS).

+ + +

Multiple vulnerabilities have been discovered in f2fs-tools. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All f2fs-tools users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-fs/f2fs-tools-1.14.0" + + + + CVE-2020-6104 + CVE-2020-6105 + CVE-2020-6106 + CVE-2020-6107 + CVE-2020-6108 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-27.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-27.xml new file mode 100644 index 0000000000..776a918224 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-27.xml @@ -0,0 +1,45 @@ + + + + FreeRADIUS: Root privilege escalation + Multiple vulnerabilities were discovered in Gentoo's systemd unit + for FreeRADIUS which could lead to root privilege escalation. + + freeradius + 2021-01-26 + 2021-01-26 + 630910 + local + + + 3.0.20-r1 + 3.0.20-r1 + + + +

FreeRADIUS is a modular, high performance free RADIUS suite.

+ + +

It was discovered that Gentoo’s FreeRADIUS systemd unit set + permissions on an unsafe directory on start. +

+ + +

A local attacker could escalate privileges.

+ + +

There is no known workaround at this time.

+ + +

All FreeRADIUS users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-dialup/freeradius-3.0.20-r1" + + + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-28.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-28.xml new file mode 100644 index 0000000000..8ba014862b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-28.xml @@ -0,0 +1,47 @@ + + + + ncurses: Multiple vulnerabilities + Multiple vulnerabilities have been found in ncurses, the worst of + which could result in a Denial of Service condition. + + ncurses + 2021-01-26 + 2021-01-26 + 698210 + remote + + + 6.2 + 6.2 + + + +

A console display library.

+ + +

Multiple vulnerabilities have been discovered in ncurses. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All ncurses users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/ncurses-6.2" + + + + CVE-2019-17594 + CVE-2019-17595 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-29.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-29.xml new file mode 100644 index 0000000000..5f2c0b02b1 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-29.xml @@ -0,0 +1,65 @@ + + + + OpenJPEG: Multiple vulnerabilities + Multiple vulnerabilities have been found in OpenJPEG, the worst of + which could result in the arbitrary execution of code. + + openjpeg + 2021-01-26 + 2021-01-26 + 711260 + 718918 + remote + + + 2.4.0 + 2.4.0 + 1.5.2-r1 + + + +

OpenJPEG is an open-source JPEG 2000 library.

+ + +

Multiple vulnerabilities have been discovered in OpenJPEG. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All OpenJPEG 2 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/openjpeg-2.4.0:2" + + +

Gentoo has discontinued support OpenJPEG 1.x and any dependent packages + should now be using OpenJPEG 2 or have dropped support for the library. + We recommend that users unmerge OpenJPEG 1.x: +

+ + + # emerge --unmerge "media-libs/openjpeg:1" + + + + CVE-2018-21010 + CVE-2019-12973 + CVE-2020-15389 + CVE-2020-27814 + CVE-2020-27841 + CVE-2020-27842 + CVE-2020-27843 + CVE-2020-27844 + CVE-2020-27845 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-30.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-30.xml new file mode 100644 index 0000000000..0c4e07eeaa --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-30.xml @@ -0,0 +1,151 @@ + + + + Qt WebEngine: Multiple vulnerabilities + Multiple vulnerabilities have been found in Qt WebEngine, the worst + of which could result in the arbitrary execution of code. + + qtwebengine + 2021-01-26 + 2021-01-26 + 734600 + 754852 + remote + + + 5.15.2 + 5.15.2 + + + +

Library for rendering dynamic web content in Qt5 C++ and QML + applications. +

+ + +

Multiple vulnerabilities have been discovered in Qt WebEngine. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Qt WebEngine users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-qt/qtwebengine-5.15.2" + + + + CVE-2020-15959 + CVE-2020-15959 + CVE-2020-15960 + CVE-2020-15960 + CVE-2020-15961 + CVE-2020-15961 + CVE-2020-15962 + CVE-2020-15962 + CVE-2020-15963 + CVE-2020-15963 + CVE-2020-15964 + CVE-2020-15964 + CVE-2020-15965 + CVE-2020-15965 + CVE-2020-15966 + CVE-2020-15966 + CVE-2020-15968 + CVE-2020-15968 + CVE-2020-15969 + CVE-2020-15969 + CVE-2020-15972 + CVE-2020-15972 + CVE-2020-15974 + CVE-2020-15974 + CVE-2020-15976 + CVE-2020-15976 + CVE-2020-15977 + CVE-2020-15977 + CVE-2020-15978 + CVE-2020-15978 + CVE-2020-15979 + CVE-2020-15979 + CVE-2020-15985 + CVE-2020-15985 + CVE-2020-15987 + CVE-2020-15987 + CVE-2020-15989 + CVE-2020-15989 + CVE-2020-15992 + CVE-2020-15992 + CVE-2020-16001 + CVE-2020-16001 + CVE-2020-16002 + CVE-2020-16002 + CVE-2020-16003 + CVE-2020-16003 + CVE-2020-6467 + CVE-2020-6467 + CVE-2020-6470 + CVE-2020-6470 + CVE-2020-6471 + CVE-2020-6471 + CVE-2020-6472 + CVE-2020-6473 + CVE-2020-6474 + CVE-2020-6475 + CVE-2020-6476 + CVE-2020-6480 + CVE-2020-6481 + CVE-2020-6482 + CVE-2020-6483 + CVE-2020-6486 + CVE-2020-6487 + CVE-2020-6489 + CVE-2020-6490 + CVE-2020-6506 + CVE-2020-6510 + CVE-2020-6511 + CVE-2020-6512 + CVE-2020-6513 + CVE-2020-6514 + CVE-2020-6518 + CVE-2020-6523 + CVE-2020-6524 + CVE-2020-6526 + CVE-2020-6529 + CVE-2020-6530 + CVE-2020-6531 + CVE-2020-6532 + CVE-2020-6533 + CVE-2020-6534 + CVE-2020-6535 + CVE-2020-6540 + CVE-2020-6541 + CVE-2020-6542 + CVE-2020-6543 + CVE-2020-6544 + CVE-2020-6545 + CVE-2020-6548 + CVE-2020-6549 + CVE-2020-6550 + CVE-2020-6551 + CVE-2020-6555 + CVE-2020-6557 + CVE-2020-6559 + CVE-2020-6561 + CVE-2020-6562 + CVE-2020-6569 + CVE-2020-6570 + CVE-2020-6571 + CVE-2020-6573 + CVE-2020-6575 + CVE-2020-6576 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-31.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-31.xml new file mode 100644 index 0000000000..3d7dcd82f9 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-31.xml @@ -0,0 +1,46 @@ + + + + Cacti: Remote code execution + A vulnerability in Cacti could lead to remote code execution. + cacti + 2021-01-26 + 2021-01-26 + 765019 + remote + + + 1.2.16-r1 + 1.2.16-r1 + + + +

Cacti is a complete frontend to rrdtool.

+ + +

The side_id parameter in data_debug.php does not properly verify input + allowing SQL injection. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Cacti users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-1.2.16-r1" + + + + CVE-2020-35701 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-32.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-32.xml new file mode 100644 index 0000000000..2c1a6dd3ef --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-32.xml @@ -0,0 +1,62 @@ + + + + Mutt, NeoMutt: Information disclosure + A weakness was discovered in Mutt and NeoMutt's TLS handshake + handling + + NeoMutt + 2021-01-26 + 2021-01-26 + 755833 + 755866 + remote + + + 2.0.2 + 2.0.2 + + + 20201120 + 20201120 + + + +

Mutt is a small but very powerful text-based mail client.

+ +

NeoMutt is a command line mail reader (or MUA). It’s a fork of Mutt + with added features. +

+ + +

A weakness in TLS handshake handling was found which may allow + information disclosure. +

+ + +

A remote attacker may be able to cause information disclosure.

+ + +

There is no known workaround at this time.

+ + +

All Mutt users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/mutt-2.0.2" + + +

All NeoMutt users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/neomutt-20201120" + + + + CVE-2020-28896 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-33.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-33.xml new file mode 100644 index 0000000000..a53bfabd5c --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-33.xml @@ -0,0 +1,61 @@ + + + + sudo: Multiple vulnerabilities + Multiple vulnerabilities have been found in sudo, the worst of + which could result in privilege escalation. + + sudo + 2021-01-26 + 2021-01-26 + 764986 + 767364 + local + + + 1.9.5_p2 + 1.9.5_p2 + + + +

sudo (su “do”) allows a system administrator to delegate authority + to give certain users (or groups of users) the ability to run some (or + all) commands as root or another user while providing an audit trail of + the commands and their arguments. +

+ + +

Multiple vulnerabilities have been discovered in sudo. Please review the + CVE identifiers referenced below for details. +

+ + +

Local users are able to gain unauthorized privileges on the system or + determine the existence of files. +

+ + +

There is no known workaround at this time.

+ + +

All sudo users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-admin/sudo-1.9.5_p2" + + + + CVE-2021-23239 + CVE-2021-23240 + CVE-2021-3156 + Upstream + advisory (CVE-2020-23240) + + Upstream + advisory (CVE-2021-3156) + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-34.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-34.xml new file mode 100644 index 0000000000..bedeea759a --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-34.xml @@ -0,0 +1,48 @@ + + + + Telegram Desktop: Multiple vulnerabilities + Multiple vulnerabilities have been found in Telegram, the worst of + which could result in information disclosure. + + telegram + 2021-01-27 + 2021-01-27 + 736774 + 749288 + remote + + + 2.4.4 + 2.4.4 + + + +

Telegram is a messaging app with a focus on speed and security.

+ + +

Multiple vulnerabilities have been discovered in Telegram Desktop. + Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Telegram Desktop users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-im/telegram-desktop-2.4.4" + + + + CVE-2020-17448 + CVE-2020-25824 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-35.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-35.xml new file mode 100644 index 0000000000..974a6a240e --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-35.xml @@ -0,0 +1,47 @@ + + + + phpMyAdmin: Multiple vulnerabilities + Multiple vulnerabilities have been found in phpMyAdmin, allowing + remote attackers to conduct XSS. + + phpmyadmin + 2021-01-27 + 2021-01-27 + 747805 + remote + + + 4.9.6 + 4.9.6 + + + +

phpMyAdmin is a web-based management tool for MySQL databases.

+ + +

Multiple vulnerabilities have been discovered in phpMyAdmin. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All phpMyAdmin users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/phpmyadmin-4.9.6" + + + + CVE-2020-26934 + CVE-2020-26935 + + whissi + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-36.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-36.xml new file mode 100644 index 0000000000..7b5b52d6a1 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-36.xml @@ -0,0 +1,60 @@ + + + + ImageMagick: Command injection + A vulnerability in ImageMagick's handling of PDF was discovered + possibly allowing code execution. + + imagemagick + 2021-01-29 + 2021-01-29 + 756829 + remote + + + 7.0.10.41-r1 + 6.9.11.41-r1 + 7.0.10.41-r1 + 6.9.11.41-r1 + + + +

A collection of tools and libraries for many image formats.

+ + +

A flaw in ImageMagick’s handling of password protected PDFs was + discovered. +

+ + +

A remote attacker could entice a user to open a specially crafted PDF + using ImageMagick possibly resulting in execution of arbitrary code with + the privileges of the process or a Denial of Service condition. +

+ + +

Do not open untrusted PDFs.

+ + +

All ImageMagick 7 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=media-gfx/imagemagick-7.0.10.41-r1" + + +

All ImageMagick 6 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=media-gfx/imagemagick-6.9.11.41-r1" + + + + CVE-2020-29599 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-37.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-37.xml new file mode 100644 index 0000000000..52b09f41e0 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-37.xml @@ -0,0 +1,47 @@ + + + + VLC: Buffer overflow + A buffer overflow in VLC might allow remote attacker(s) to execute + arbitrary code. + + vlc + 2021-01-29 + 2021-01-29 + 765040 + remote + + + 3.0.12.1 + 3.0.12.1 + + + +

VLC is a cross-platform media player and streaming server.

+ + +

VLC was found to have a buffer overflow when handling crafted MKV files.

+ + +

A remote attacker could entice a user to open a specially crafted MKV + file using VLC possibly resulting in execution of arbitrary code with the + privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All VLC users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-video/vlc-3.0.12.1" + + + + CVE-2020-26664 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-38.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-38.xml new file mode 100644 index 0000000000..11ca507fa1 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202101-38.xml @@ -0,0 +1,49 @@ + + + + NSD: Symbolic link traversal + A vulnerability was discovered in NSD which could allow a local + attacker to cause a Denial of Service condition. + + nsd + 2021-01-29 + 2021-01-29 + 758977 + local + + + 4.3.4 + 4.3.4 + + + +

An authoritative only, high performance, open source name server

+ + +

A local vulnerability was discovered that would allow for a local + symlink attack due to how NSD handles PID files. +

+ + +

A local attacker could cause a Denial of Service condition.

+ + +

There is no known workaround at this time.

+ + +

All NSD users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-dns/nsd-4.3.4" + + + + CVE-2020-28935 + + Upstream advisory + + + whissi + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202102-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202102-01.xml new file mode 100644 index 0000000000..c448adf3cd --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202102-01.xml @@ -0,0 +1,95 @@ + + + + Mozilla Firefox: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mozilla Firefox, the + worst of which could result in the arbitrary execution of code. + + firefox + 2021-02-01 + 2021-02-01 + 767334 + remote + + + 78.7.0 + 85.0 + 85.0 + + + 78.7.0 + 85.0 + 85.0 + + + +

Mozilla Firefox is a popular open-source web browser from the Mozilla + project. +

+ + +

Multiple vulnerabilities have been discovered in Mozilla Firefox. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Firefox ESR users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-78.7.0" + + +

All Mozilla Firefox ESR binary users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-78.7.0" + + +

All Mozilla Firefox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-85.0" + + +

All Mozilla Firefox binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-85.0" + + + + + CVE-2021-23953 + CVE-2021-23954 + CVE-2021-23955 + CVE-2021-23956 + CVE-2021-23958 + CVE-2021-23960 + CVE-2021-23961 + CVE-2021-23962 + CVE-2021-23963 + CVE-2021-23964 + CVE-2021-23965 + CVE-2021-26976 + + Upstream advisory (MFSA-2021-03) + + + Upstream advisory (MFSA-2021-04) + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202102-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202102-02.xml new file mode 100644 index 0000000000..69f0cc482a --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202102-02.xml @@ -0,0 +1,71 @@ + + + + Mozilla Thunderbird: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mozilla Thunderbird, + the worst of which could result in the arbitrary execution of code. + + thunderbird + 2021-02-01 + 2021-02-01 + 767394 + remote + + + 78.7.0 + 78.7.0 + + + 78.7.0 + 78.7.0 + + + +

Mozilla Thunderbird is a popular open-source email client from the + Mozilla project. +

+ + +

Multiple vulnerabilities have been discovered in Mozilla Thunderbird. + Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Thunderbird users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-78.7.0" + + +

All Mozilla Thunderbird binary users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=mail-client/thunderbird-bin-78.7.0" + + + + + CVE-2020-15685 + CVE-2020-26976 + CVE-2021-23953 + CVE-2021-23954 + CVE-2021-23960 + CVE-2021-23964 + + Upstream advisory (MFSA-2021-05) + + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202103-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202103-01.xml new file mode 100644 index 0000000000..ff3d8ebd9e --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202103-01.xml @@ -0,0 +1,59 @@ + + + + Salt: Multiple vulnerabilities + Multiple vulnerabilities have been found in Salt, the worst of + which could allow remote attacker to execute arbitrary commands. + + salt + 2021-03-31 + 2021-03-31 + 767919 + local, remote + + + 3000.8 + 3000.8 + + + +

Salt is a fast, intelligent and scalable automation engine.

+ + +

Multiple vulnerabilities have been discovered in Salt. Please review the + CVE identifiers referenced below for details. +

+ + +

A remote attacker could possibly execute arbitrary commands via + salt-api, cause a Denial of Service condition, bypass access restrictions + or disclose sensitive information. +

+ + +

There is no known workaround at this time.

+ + +

All Salt users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-admin/salt-3000.8" + + + + + CVE-2020-28243 + CVE-2020-28972 + CVE-2020-35662 + CVE-2021-25281 + CVE-2021-25282 + CVE-2021-25283 + CVE-2021-25284 + CVE-2021-3144 + CVE-2021-3148 + CVE-2021-3197 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202103-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202103-02.xml new file mode 100644 index 0000000000..0dc5e402d9 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202103-02.xml @@ -0,0 +1,59 @@ + + + + Redis: Remote code execution + A vulnerability in Redis could lead to remote code execution. + redis + 2021-03-31 + 2021-03-31 + 773328 + local, remote + + + 5.0.12 + 6.0.12 + 6.0.12 + + + +

Redis is an open source (BSD licensed), in-memory data structure store, + used as a database, cache and message broker. +

+ + +

It was discovered that there were a number of integer overflow issues in + Redis. +

+ + +

A remote attacker, able to connect to a Redis instance, could send a + malicious crafted large request possibly resulting in the execution of + arbitrary code with the privileges of the process or a Denial of Service + condition. +

+ + +

There is no known workaround at this time.

+ + +

All Redis 5.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/redis-5.0.12" + + +

All Redis 6.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/redis-6.0.12" + + + + + CVE-2021-21309 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202103-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202103-03.xml new file mode 100644 index 0000000000..2fc78d7a7b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202103-03.xml @@ -0,0 +1,54 @@ + + + + OpenSSL: Multiple vulnerabilities + Multiple vulnerabilities have been found in OpenSSL, the worst of + which could allow remote attackers to cause a Denial of Service condition. + + openssl + 2021-03-31 + 2021-03-31 + 769785 + 777681 + local, remote + + + 1.1.1k + 1.1.1k + + + +

OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer + (SSL v2/v3) and Transport Layer Security (TLS v1/v1.1/v1.2/v1.3) as well + as a general purpose cryptography library. +

+ + +

Multiple vulnerabilities have been discovered in OpenSSL. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All OpenSSL users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.1.1k" + + + + + CVE-2021-23840 + CVE-2021-23841 + CVE-2021-3449 + CVE-2021-3450 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202103-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202103-04.xml new file mode 100644 index 0000000000..35516875df --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202103-04.xml @@ -0,0 +1,45 @@ + + + + SQLite: Remote code execution + A vulnerability in SQLite could lead to remote code execution. + sqlite + 2021-03-31 + 2021-03-31 + 777990 + local, remote + + + 3.34.1 + 3.34.1 + + + +

SQLite is a C library that implements an SQL database engine.

+ + +

It was discovered that SQLite incorrectly handled certain sub-queries.

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All SQLite users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/sqlite-3.34.1" + + + + + CVE-2021-20227 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-01.xml new file mode 100644 index 0000000000..74237596f2 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-01.xml @@ -0,0 +1,52 @@ + + + + Git: User-assisted execution of arbitrary code + A vulnerability has been found in Git that could allow a remote + attacker to execute arbitrary code. + + git + 2021-04-30 + 2021-04-30 + 774678 + local + + + 2.26.3 + 2.26.3 + + + +

Git is a distributed version control system designed.

+ + +

It was discovered that Git could be fooled into running remote code + during a clone on case-insensitive file systems with support for symbolic + links, if Git is configured globally to apply delay-capable clean/smudge + filters (such as Git LFS). +

+ + +

A remote attacker could entice a user to clone a specially crafted + repository, possibly resulting in the remote execution of arbitrary code + with the privileges of the user running the application. +

+ + +

There is no known workaround at this time.

+ + +

All Git users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.26.3" + + + + + CVE-2021-21300 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-02.xml new file mode 100644 index 0000000000..fc7805e8fe --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-02.xml @@ -0,0 +1,51 @@ + + + + X.Org X Server: Privilege escalation + A vulnerability in X.Org X Server may allow users to escalate + privileges. + + xorg-server + 2021-04-30 + 2021-04-30 + 782679 + local, remote + + + 1.20.11 + 1.20.11 + + + +

The X Window System is a graphical windowing system based on a + client/server model. +

+ + +

It was discovered that X.Org X Server did not sufficiently check the + length of the XInput extension’s ChangeFeedbackControl request. +

+ + +

An authorized attacker could possibly escalate privileges, or cause a + Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All X.Org X Server users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.20.11" + + + + + CVE-2021-3472 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-03.xml new file mode 100644 index 0000000000..1486ced0fb --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-03.xml @@ -0,0 +1,65 @@ + + + + WebkitGTK+: Multiple vulnerabilities + Multiple vulnerabilities have been found in WebkitGTK+, the worst + of which could result in the arbitrary execution of code. + + webkit-gtk + 2021-04-30 + 2021-04-30 + 770793 + 773193 + local, remote + + + 2.30.6 + 2.30.6 + + + +

WebKitGTK+ is a full-featured port of the WebKit rendering engine, + suitable for projects requiring any kind of web integration, from hybrid + HTML/CSS applications to full-fledged web browsers. +

+ + +

Multiple vulnerabilities have been discovered in WebkitGTK+. Please + review the CVE identifiers referenced below for details. +

+ + +

An attacker, by enticing a user to visit maliciously crafted web + content, may be able to execute arbitrary code, violate iframe sandboxing + policy, access restricted ports on arbitrary servers, cause memory + corruption, or could cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All WebkitGTK+ users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.30.6" + + + + + CVE-2020-13558 + CVE-2020-27918 + CVE-2020-29623 + CVE-2020-9947 + CVE-2021-1765 + CVE-2021-1789 + CVE-2021-1799 + CVE-2021-1801 + CVE-2021-1870 + WSA-2021-0001 + WSA-2021-0002 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-04.xml new file mode 100644 index 0000000000..09f39c7237 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-04.xml @@ -0,0 +1,84 @@ + + + + Python: Multiple vulnerabilities + Multiple vulnerabilities have been found in Python, the worst of + which might allow attackers to access sensitive information. + + python + 2021-04-30 + 2021-04-30 + 770853 + 779841 + 779844 + local, remote + + + 2.7.18_p8 + 3.6.13_p1 + 3.7.10_p1 + 3.8.8_p1 + 3.9.2_p1 + 3.9.2_p1 + + + +

Python is an interpreted, interactive, object-oriented programming + language. +

+ + +

Multiple vulnerabilities have been discovered in Python. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Python 2.7 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.18_p8" + + +

All Python 3.6 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.6.13_p1" + + +

All Python 3.7 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.7.10_p1" + + +

All Python 3.8 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.8.8_p1" + + +

All Python 3.9 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.9.2_p1" + + + + + CVE-2021-23336 + CVE-2021-3426 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-05.xml new file mode 100644 index 0000000000..9f9c0ce72f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-05.xml @@ -0,0 +1,70 @@ + + + + GRUB: Multiple vulnerabilities + Multiple vulnerabilities have been found in GRUB, the worst might + allow for circumvention of UEFI Secure Boot. + + grub + 2021-04-30 + 2021-04-30 + 734654 + 773991 + local + + + 2.06_rc1 + 2.06_rc1 + + + +

GNU GRUB is a multiboot boot loader used by most Linux systems.

+ + +

Multiple vulnerabilities have been discovered in GRUB. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All GRUB users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-devel/grub-2.06_rc1" + + +

After upgrading, make sure to run the grub-install command with options + appropriate for your system. See the GRUB Quick Start guide in the + references below for examples. Your system will be vulnerable until this + action is performed. +

+ + + CVE-2020-10713 + CVE-2020-14308 + CVE-2020-14309 + CVE-2020-14310 + CVE-2020-14311 + CVE-2020-14372 + CVE-2020-15705 + CVE-2020-15706 + CVE-2020-15707 + CVE-2020-25632 + CVE-2020-25647 + CVE-2020-27749 + CVE-2020-27779 + CVE-2021-20225 + CVE-2021-20233 + GRUB Quick Start + guide + + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-06.xml new file mode 100644 index 0000000000..ec8e0eaa69 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-06.xml @@ -0,0 +1,56 @@ + + + + libTIFF: Multiple vulnerabilities + Multiple vulnerabilities have been found in LibTIFF, the worst of + which could result in the execution of arbitrary code. + + libtiff + 2021-04-30 + 2021-04-30 + 775125 + local, remote + + + 4.2.0 + 4.2.0 + + + +

The TIFF library contains encoding and decoding routines for the Tag + Image File Format. It is called by numerous programs, including GNOME and + KDE applications, to interpret TIFF images. +

+ + +

Multiple vulnerabilities have been discovered in LibTIFF. Please review + the referenced CVE identifiers for details. +

+ + +

A remote attacker, by enticing the user to process a specially crafted + TIFF file, could possibly execute arbitrary code with the privileges of + the process, or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All LibTIFF users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/tiff-4.2.0" + + + + + CVE-2020-35521 + CVE-2020-35522 + CVE-2020-35523 + CVE-2020-35524 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-07.xml new file mode 100644 index 0000000000..31900cf33c --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-07.xml @@ -0,0 +1,49 @@ + + + + ClamAV: Denial of service + A vulnerability in ClamAV could lead to a Denial of Service + condition. + + clamav + 2021-04-30 + 2021-04-30 + 780894 + local, remote + + + 0.103.2 + 0.103.2 + + + +

ClamAV is a GPL virus scanner.

+ + +

A vulnerability has been discovered in ClamAV. Please review the CVE + identifier referenced below for details. +

+ + +

A remote attacker could cause ClamAV to scan a specially crafted file, + possibly resulting a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All ClamAV users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.103.2" + + + + + CVE-2021-1405 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-08.xml new file mode 100644 index 0000000000..8fca53ce6b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-08.xml @@ -0,0 +1,163 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in the arbitrary execution of code. + + chromium,google-chrome + 2021-04-30 + 2021-04-30 + 768459 + 768831 + 771012 + 774015 + 776181 + 779493 + 782802 + 782970 + 784554 + 785889 + local, remote + + + 90.0.4430.93 + 90.0.4430.93 + + + 90.0.4430.93 + 90.0.4430.93 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-90.0.4430.93" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-90.0.4430.93" + + + + + CVE-2021-21142 + CVE-2021-21143 + CVE-2021-21144 + CVE-2021-21145 + CVE-2021-21146 + CVE-2021-21147 + CVE-2021-21148 + CVE-2021-21149 + CVE-2021-21150 + CVE-2021-21151 + CVE-2021-21152 + CVE-2021-21153 + CVE-2021-21154 + CVE-2021-21155 + CVE-2021-21156 + CVE-2021-21157 + CVE-2021-21159 + CVE-2021-21160 + CVE-2021-21161 + CVE-2021-21162 + CVE-2021-21163 + CVE-2021-21165 + CVE-2021-21166 + CVE-2021-21167 + CVE-2021-21168 + CVE-2021-21169 + CVE-2021-21170 + CVE-2021-21171 + CVE-2021-21172 + CVE-2021-21173 + CVE-2021-21174 + CVE-2021-21175 + CVE-2021-21176 + CVE-2021-21177 + CVE-2021-21178 + CVE-2021-21179 + CVE-2021-21180 + CVE-2021-21181 + CVE-2021-21182 + CVE-2021-21183 + CVE-2021-21184 + CVE-2021-21185 + CVE-2021-21186 + CVE-2021-21187 + CVE-2021-21188 + CVE-2021-21189 + CVE-2021-2119 + CVE-2021-21191 + CVE-2021-21192 + CVE-2021-21193 + CVE-2021-21194 + CVE-2021-21195 + CVE-2021-21196 + CVE-2021-21197 + CVE-2021-21198 + CVE-2021-21199 + CVE-2021-21201 + CVE-2021-21202 + CVE-2021-21203 + CVE-2021-21204 + CVE-2021-21205 + CVE-2021-21206 + CVE-2021-21207 + CVE-2021-21208 + CVE-2021-21209 + CVE-2021-21210 + CVE-2021-21211 + CVE-2021-21212 + CVE-2021-21213 + CVE-2021-21214 + CVE-2021-21215 + CVE-2021-21216 + CVE-2021-21217 + CVE-2021-21218 + CVE-2021-21219 + CVE-2021-21220 + CVE-2021-21221 + CVE-2021-21222 + CVE-2021-21223 + CVE-2021-21224 + CVE-2021-21225 + CVE-2021-21226 + CVE-2021-21227 + CVE-2021-21228 + CVE-2021-21229 + CVE-2021-21230 + CVE-2021-21231 + CVE-2021-21232 + CVE-2021-21233 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-09.xml new file mode 100644 index 0000000000..079925cdc2 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-09.xml @@ -0,0 +1,90 @@ + + + + Mozilla Thunderbird: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mozilla Thunderbird, + the worst of which could result in the arbitrary execution of code. + + thunderbird + 2021-04-30 + 2021-04-30 + 772287 + 778272 + 784578 + local, remote + + + 78.10.0 + 78.10.0 + + + 78.10.0 + 78.10.0 + + + +

Mozilla Thunderbird is a popular open-source email client from the + Mozilla project. +

+ + +

Multiple vulnerabilities have been discovered in Mozilla Thunderbird. + Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Thunderbird users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-78.10.0" + + +

All Mozilla Thunderbird binary users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=mail-client/thunderbird-bin-78.10.0" + + + + + CVE-2021-23961 + CVE-2021-23968 + CVE-2021-23969 + CVE-2021-23973 + CVE-2021-23978 + CVE-2021-23981 + CVE-2021-23982 + CVE-2021-23984 + CVE-2021-23987 + CVE-2021-23994 + CVE-2021-23995 + CVE-2021-23998 + CVE-2021-23999 + CVE-2021-24002 + CVE-2021-29945 + CVE-2021-29946 + CVE-2021-29948 + + MFSA-2021-09 + + + MFSA-2021-12 + + + MFSA-2021-14 + + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-10.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-10.xml new file mode 100644 index 0000000000..02a76e567b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202104-10.xml @@ -0,0 +1,115 @@ + + + + Mozilla Firefox: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mozilla Firefox, the + worst of which could result in the arbitrary execution of code. + + firefox + 2021-04-30 + 2021-04-30 + 772305 + 778269 + 784572 + local, remote + + + 78.10.0 + 88.0 + 88.0 + + + 78.10.0 + 88.0 + 88.0 + + + +

Mozilla Firefox is a popular open-source web browser from the Mozilla + project. +

+ + +

Multiple vulnerabilities have been discovered in Mozilla Firefox. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Firefox ESR users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-78.10.0" + + +

All Mozilla Firefox ESR binary users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-78.10.0" + + +

All Mozilla Firefox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-88.0" + + +

All Mozilla Firefox binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-88.0" + + + + + CVE-2021-23961 + CVE-2021-23968 + CVE-2021-23969 + CVE-2021-23970 + CVE-2021-23971 + CVE-2021-23972 + CVE-2021-23973 + CVE-2021-23974 + CVE-2021-23975 + CVE-2021-23976 + CVE-2021-23977 + CVE-2021-23978 + CVE-2021-23981 + CVE-2021-23982 + CVE-2021-23983 + CVE-2021-23984 + CVE-2021-23985 + CVE-2021-23986 + CVE-2021-23987 + CVE-2021-23988 + CVE-2021-23994 + CVE-2021-23995 + CVE-2021-23998 + CVE-2021-23999 + CVE-2021-24002 + CVE-2021-29945 + CVE-2021-29946 + + MFSA-2021-08 + + + MFSA-2021-11 + + + MFSA-2021-15 + + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-01.xml new file mode 100644 index 0000000000..9d471cc9a5 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-01.xml @@ -0,0 +1,74 @@ + + + + Exim: Multiple vulnerabilities + Multiple vulnerabilities have been found in Exim, the worst of + which allows remote attackers to execute arbitrary code. + + exim + 2021-05-04 + 2021-05-04 + 786945 + local, remote + + + 4.94.2 + 4.94.2 + + + +

Exim is a message transfer agent (MTA) designed to be a a highly + configurable, drop-in replacement for sendmail. +

+ + +

Multiple vulnerabilities have been discovered in Exim. Please review the + CVE identifiers referenced below for details. +

+ + +

A remote attacker, by connecting to the SMTP listener daemon, could + possibly execute arbitrary code with the privileges of the process or + cause a Denial of Service condition. Furthermore, a local attacker could + perform symlink attacks to overwrite arbitrary files with the privileges + of the user running the application or escalate privileges. +

+ + +

There is no known workaround at this time.

+ + +

All Exim users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-mta/exim-4.94.2" + + + + + CVE-2020-28007 + CVE-2020-28008 + CVE-2020-28009 + CVE-2020-28010 + CVE-2020-28011 + CVE-2020-28012 + CVE-2020-28013 + CVE-2020-28014 + CVE-2020-28015 + CVE-2020-28016 + CVE-2020-28017 + CVE-2020-28018 + CVE-2020-28019 + CVE-2020-28020 + CVE-2020-28021 + CVE-2020-28022 + CVE-2020-28023 + CVE-2020-28024 + CVE-2020-28025 + CVE-2020-28026 + CVE-2021-27216 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-02.xml new file mode 100644 index 0000000000..6033d07325 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-02.xml @@ -0,0 +1,51 @@ + + + + stunnel: Improper certificate validation + Stunnel was not properly verifying TLS certificates, possibly + allowing an integrity/confidentiality compromise. + + stunnel + 2021-05-26 + 2021-05-26 + 772146 + local, remote + + + 5.58 + 5.58 + + + +

The stunnel program is designed to work as an SSL/TLS encryption wrapper + between a client and a local or remote server. +

+ + +

It was discovered that stunnel did not correctly verified the client + certificate when options “redirect” and “verifyChain” are used. +

+ + +

A remote attacker could send a specially crafted certificate, possibly + resulting in a breach of integrity or confidentiality. +

+ + +

There is no known workaround at this time.

+ + +

All stunnel users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/stunnel-5.58" + + + + + CVE-2021-20230 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-03.xml new file mode 100644 index 0000000000..f866dd0624 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-03.xml @@ -0,0 +1,54 @@ + + + + GPT fdisk: Integer underflow + An integer underflow in sgdisk from GPT fdisk package might allow + local attacker(s) to escalate privileges. + + gptfdisk + 2021-05-26 + 2021-05-26 + 768762 + local + + + 1.0.6 + 1.0.6 + + + +

GPT fdisk (consisting of the gdisk, cgdisk, sgdisk, and fixparts + programs) is a set of text-mode partitioning tools for Linux, FreeBSD, + Mac OS X, and Windows. +

+ + +

It was discovered that ReadLogicalParts() function in basicmbr.cc was + missing a bounds check. +

+ + +

A local attacker could entice a user to insert a malicious formatted + block device (USB stick or SD card for example), that, when processed + with sgdisk, possibly resulting in local escalation of privileges or a + Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All GPT fdisk users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/gptfdisk-1.0.6" + + + + + CVE-2021-0308 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-04.xml new file mode 100644 index 0000000000..6c92bcfc9a --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-04.xml @@ -0,0 +1,55 @@ + + + + Boost: Buffer overflow + A buffer overflow in Boost might allow remote attacker(s) to + execute arbitrary code. + + boost + 2021-05-26 + 2021-05-26 + 620468 + local, remote + + + 1.74.0-r2 + 1.74.0-r2 + + + +

Boost is a set of C++ libraries, including the Boost.Regex library to + process regular expressions. +

+ + +

It was discovered that Boost incorrectly sanitized ‘next_size’ and + ‘max_size’ parameter in ordered_malloc() function when allocating + memory. +

+ + +

A remote attacker could provide a specially crafted application-specific + file (requiring runtime memory allocation to be processed correctly), + that, when opened with an application using Boost C++ source libraries, + possibly resulting in execution of arbitrary code with the privileges of + the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Boost users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/boost-1.74.0-r2" + + + + + CVE-2012-2677 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-05.xml new file mode 100644 index 0000000000..1473c2d892 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-05.xml @@ -0,0 +1,66 @@ + + + + Mutt, NeoMutt: Denial of service + A vulnerability in Mutt and NeoMutt could lead to a Denial of + Service condition. + + mutt,neomutt + 2021-05-26 + 2021-05-26 + 788388 + 788391 + remote + + + 2.0.7 + 2.0.7 + + + 20210205-r1 + 20210205-r1 + + + +

Mutt is a small but very powerful text-based mail client.

+ +

NeoMutt is a command line mail reader (or MUA). It’s a fork of Mutt + with added features. +

+ + +

It was discovered that Mutt, and NeoMutt did not properly handle certain + situations where an IMAP sequence set ends with a comma. +

+ + +

A remote attacker could entice a user to connect to a malicious IMAP + server to cause a Denial of Service condition, or other unspecified + impacts. +

+ + +

There is no known workaround at this time.

+ + +

All Mutt users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/mutt-2.0.7" + + +

All NeoMutt users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/neomutt-20210205-r1" + + + + + CVE-2021-32055 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-06.xml new file mode 100644 index 0000000000..84a6f01bc2 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-06.xml @@ -0,0 +1,48 @@ + + + + Smarty: Multiple vulnerabilities + Multiple vulnerabilities in the Smarty template engine might allow + remote attackers to execute arbitrary PHP code. + + smarty + 2021-05-26 + 2021-05-26 + 772206 + local, remote + + + 3.1.39 + 3.1.39 + + + +

Smarty is a template engine for PHP.

+ + +

Multiple vulnerabilities have been discovered in Smarty template engine. + Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Smarty template engine users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-php/smarty-3.1.39" + + + + + CVE-2021-26119 + CVE-2021-26120 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-07.xml new file mode 100644 index 0000000000..500983dbb9 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-07.xml @@ -0,0 +1,59 @@ + + + + Telegram: Security bypass + An insufficient session expiration has been reported in Telegram. + telegram + 2021-05-26 + 2021-05-26 + 771684 + remote + + + 2.4.11 + 2.4.11 + + + 2.4.11 + 2.4.11 + + + +

Telegram is a cloud-based mobile and desktop messaging app with a focus + on security and speed. +

+ + +

It was discovered that Telegram failed to invalidate a recently active + session. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Telegram users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-im/telegram-desktop-2.4.11" + + +

All Telegram binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=net-im/telegram-desktop-bin-2.4.11" + + + + + CVE-2021-27351 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-08.xml new file mode 100644 index 0000000000..72e5c50007 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-08.xml @@ -0,0 +1,55 @@ + + + + ICU: Multiple vulnerabilities + Multiple vulnerabilities have been found in ICU, the worst of which + could cause a Denial of Service condition. + + icu + 2021-05-26 + 2021-05-26 + 755704 + local, remote + + + 68.2 + 68.2 + + + +

ICU is a mature, widely used set of C/C++ and Java libraries providing + Unicode and Globalization support for software applications. +

+ + +

Multiple vulnerabilities have been discovered in ICU. Please review the + upstream bugs referenced below for details. +

+ + +

Remote attackers could cause a Denial of Service condition or possibly + have other unspecified impacts via unspecified vectors. +

+ + +

There is no known workaround at this time.

+ + +

All ICU users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/icu-68.2" + + + + + + Chromium Change-Id Iad839ac77d487d5e1b396bcdbc29bc7cd58a7ef8 + + ICU-21383 + ICU-21385 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-09.xml new file mode 100644 index 0000000000..404c199976 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-09.xml @@ -0,0 +1,51 @@ + + + + BusyBox: Denial of service + A vulnerability in BusyBox might allow remote attackers to cause a + Denial of Service condition. + + busybox + 2021-05-26 + 2021-05-26 + 777255 + local, remote + + + 1.32.1 + 1.32.1 + + + +

BusyBox is a set of tools for embedded systems and is a replacement for + GNU Coreutils. +

+ + +

It was discovered that BusyBox mishandled the error bit on the + huft_build result pointer when decompressing GZIP compressed data. +

+ + +

A remote attacker could entice a user to open a specially crafted GZIP + file using BusyBox, possibly resulting in a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All BusyBox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/busybox-1.32.1" + + + + + CVE-2021-28831 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-10.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-10.xml new file mode 100644 index 0000000000..aa151c4e9f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-10.xml @@ -0,0 +1,55 @@ + + + + GNOME Autoar: User-assisted execution of arbitrary code + A vulnerability has been found in GNOME Autoar that could allow a + remote attacker to execute arbitrary code. + + gnome-autoar + 2021-05-26 + 2021-05-26 + 768828 + 777126 + local, remote + + + 0.3.1 + 0.3.1 + + + +

GNOME Autoar provides functions and widgets for GNOME applications which + want to use archives as a method to transfer directories over the + internet. +

+ + +

It was discovered that GNOME Autoar could extract files outside of the + intended directory. +

+ + +

A remote attacker could entice a user to open a specially crafted + archive using GNOME Autoar, possibly resulting in execution of arbitrary + code with the privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All GNOME Autoar users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-arch/gnome-autoar-0.3.1" + + + + + CVE-2020-36241 + CVE-2021-28650 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-11.xml new file mode 100644 index 0000000000..548f498d4d --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-11.xml @@ -0,0 +1,55 @@ + + + + GNU Screen: User-assisted execution of arbitrary code + A vulnerability in GNU screen may allow a remote attacker to + execute arbitrary code. + + screen + 2021-05-26 + 2021-05-26 + 769770 + local, remote + + + 4.8.0-r2 + 4.8.0-r2 + + + +

GNU Screen is a full-screen window manager that multiplexes a physical + terminal between several processes, typically interactive shells. +

+ + +

It was discovered that GNU screen did not properly handle certain UTF-8 + character sequences. +

+ + +

A remote attacker could entice a user to run a program where attacker + controls the output inside a GNU screen session, possibly resulting in + execution of arbitrary code with the privileges of the process or a + Denial of Service condition. +

+ + +

This vulnerability can be mitigated by disabling UTF-8 processing in + .screenrc. +

+ + +

All GNU screen users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-misc/screen-4.8.0-r2" + + + + + CVE-2021-26937 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-12.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-12.xml new file mode 100644 index 0000000000..ad904d7afd --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-12.xml @@ -0,0 +1,50 @@ + + + + OpenSMTPD: Multiple vulnerabilities + Multiple vulnerabilities have been found in OpenSMTPD, the worst of + which could result in a Denial of Service condition. + + opensmtpd + 2021-05-26 + 2021-05-26 + 761945 + local, remote + + + 6.8.0_p2 + 6.8.0_p2 + + + +

OpenSMTPD is a lightweight but featured SMTP daemon from OpenBSD.

+ + +

Multiple vulnerabilities have been discovered in OpenSMTPD. Please + review the CVE identifiers referenced below for details. +

+ + +

A remote attacker, by connecting to the SMTP listener daemon, could + possibly cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All OpenSMTPD users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-mta/opensmtpd-6.8.0_p2" + + + + + CVE-2020-35679 + CVE-2020-35680 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-13.xml new file mode 100644 index 0000000000..6638a5a6dd --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-13.xml @@ -0,0 +1,49 @@ + + + + Mumble: User-assisted execution of arbitrary code + A vulnerability has been found in Mumble that could allow a remote + attacker to execute arbitrary code. + + mumble + 2021-05-26 + 2021-05-26 + 770973 + remote + + + 1.3.4 + 1.3.4 + + + +

Mumble is low-latency voice chat software intended for use with gaming.

+ + +

Please review the CVE identifiers referenced below for details.

+ + +

A remote attacker could entice a user to open a specially crafted server + list (web page) using Mumble, possibly resulting in execution of + arbitrary code with the privileges of the process or a Denial of Service + condition. +

+ + +

There is no known workaround at this time.

+ + +

All Mumble users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-sound/mumble-1.3.4" + + + + + CVE-2021-27229 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-14.xml new file mode 100644 index 0000000000..2469e2a8a6 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-14.xml @@ -0,0 +1,61 @@ + + + + Squid: Multiple vulnerabilities + Multiple vulnerabilities have been found in Squid, the worst of + which could result in a Denial of Service condition. + + squid + 2021-05-26 + 2021-05-26 + 775194 + 789309 + remote + + + 4.15 + 4.15 + + + +

Squid is a full-featured Web proxy cache designed to run on Unix + systems. It supports proxying and caching of HTTP, FTP, and other URLs, + as well as SSL support, cache hierarchies, transparent caching, access + control lists and many other features. +

+ + +

Multiple vulnerabilities have been discovered in Squid. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could send a specially crafted request, possibly + resulting in a Denial of Service condition or information leak. +

+ + +

There is no known workaround at this time.

+ + +

All Squid users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-proxy/squid-4.15" + + + + + CVE-2020-25097 + CVE-2021-28116 + CVE-2021-28651 + CVE-2021-28652 + CVE-2021-28662 + CVE-2021-31806 + CVE-2021-31807 + CVE-2021-31808 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-15.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-15.xml new file mode 100644 index 0000000000..5f2b4e50cd --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-15.xml @@ -0,0 +1,54 @@ + + + + Prosŏdy IM: Multiple vulnerabilities + Multiple vulnerabilities have been found in Prosŏdy IM, the worst + of which could result in a Denial of Service condition. + + prosody + 2021-05-26 + 2021-05-26 + 771144 + 789969 + remote + + + 0.11.9 + 0.11.9 + + + +

Prosŏdy IM is a modern XMPP communication server. It aims to be easy to + set up and configure, and efficient with system resources. +

+ + +

Multiple vulnerabilities have been discovered in Prosŏdy IM. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Prosŏdy IM users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-im/prosody-0.11.9" + + + + + CVE-2021-32917 + CVE-2021-32918 + CVE-2021-32919 + CVE-2021-32920 + CVE-2021-32921 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-16.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-16.xml new file mode 100644 index 0000000000..7d7d41ac76 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-16.xml @@ -0,0 +1,53 @@ + + + + X.Org X11 library: Denial of service + A vulnerability in X.Org X11 library could lead to a Denial of + Service condition. + + libx11 + 2021-05-26 + 2021-05-26 + 790824 + remote + + + 1.7.1 + 1.7.1 + + + +

X.Org is an implementation of the X Window System. The X.Org X11 library + provides the X11 protocol library files. +

+ + +

It was discovered that XLookupColor() and other X.Org X11 library + functions lacked proper validation of the length of their string + parameters. +

+ + +

An attacker could emit arbitrary X protocol requests to the X server + through malicious crafted string parameters in applications linked + against X.Org X11 library. +

+ + +

There is no known workaround at this time.

+ + +

All X.Org X11 library users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-libs/libX11-1.7.1" + + + + + CVE-2021-31535 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-17.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-17.xml new file mode 100644 index 0000000000..17d191c8e5 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-17.xml @@ -0,0 +1,51 @@ + + + + rxvt-unicode: User-assisted execution of arbitrary code + A vulnerability in rxvt-unicode may allow a remote attacker to + execute arbitrary code. + + rxvt-unicode + 2021-05-26 + 2021-05-26 + 790782 + local, remote + + + 9.22-r9 + 9.22-r9 + + + +

rxvt-unicode (urxvt) is a clone of the rxvt terminal emulator.

+ + +

It was discovered that rxvt-unicode did not properly handle certain + escape sequences. +

+ + +

A remote attacker could entice a user to run a program where attacker + controls the output inside a rxvt terminal window, possibly resulting in + execution of arbitrary code with the privileges of the process or a + Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All rxvt-unicode users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-terms/rxvt-unicode-9.22-r9" + + + + + CVE-2021-33477 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-18.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-18.xml new file mode 100644 index 0000000000..4e7c5707c1 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-18.xml @@ -0,0 +1,54 @@ + + + + LittleCMS: User-assisted execution of arbitrary code + A heap-based buffer overflow in LittleCMS might allow remote + attackers to execute arbitrary code. + + lcms + 2021-05-26 + 2021-05-26 + 761418 + local, remote + + + 2.10 + 2.10 + + + +

LittleCMS, or short lcms, is a color management system for working with + ICC profiles. It is used by many applications including GIMP, Firefox and + Chromium. +

+ + +

It was discovered that LittleCMS (aka Little Color Management System) + had an integer overflow in the AllocateDataSet function in cmscgats.c. +

+ + +

A remote attacker could entice a user or automated system to open a + specially crafted file containing malicious color data, possibly + resulting in execution of arbitrary code with the privileges of the + process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All LittleCMS users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/lcms-2.10" + + + + + CVE-2018-16435 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-19.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-19.xml new file mode 100644 index 0000000000..79e89f0c9f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-19.xml @@ -0,0 +1,53 @@ + + + + Firejail: Privilege escalation + A vulnerability was discovered in Firejail which may allow local + attackers to gain root privileges. + + firejail + 2021-05-26 + 2021-05-26 + 769542 + local + + + 0.9.64.4 + 0.9.64.4 + + + +

A SUID program that reduces the risk of security breaches by restricting + the running environment of untrusted applications using Linux namespaces + and seccomp-bpf. +

+ + +

It was discovered that a flaw in Firejail’s OverlayFS code allowed + restricted programs to escape sandbox. +

+ + +

A local attacker could obtain arbitrary file system access via an + application running within a Firejail sandbox, possibly resulting in + privilege escalation. +

+ + +

There is no known workaround at this time.

+ + +

All Firejail users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/firejail-0.9.64.4" + + + + + CVE-2021-26910 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-20.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-20.xml new file mode 100644 index 0000000000..359b42aa37 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-20.xml @@ -0,0 +1,54 @@ + + + + Dnsmasq: DNS cache poisoning + Use of insufficient randomness in Dnsmasq might lead to DNS Cache + Poisoning. + + dnsmasq + 2021-05-26 + 2021-05-26 + 782130 + local, remote + + + 2.85 + 2.85 + + + +

Dnsmasq is a lightweight and easily-configurable DNS forwarder and DHCP + server. +

+ + +

It was discovered that Dnsmasq, when configured with + --server=<address>@ or similar (e.g. through dbus), + configured a fixed UDP port for all outgoing queries to the specified + upstream DNS server. + +

+ + +

An attacker, by sending malicious crafted DNS responses, could perform a + DNS Cache Poisoning attack. +

+ + +

There is no known workaround at this time.

+ + +

All Dnsmasq users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-dns/dnsmasq-2.85" + + + + + CVE-2021-3448 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-21.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-21.xml new file mode 100644 index 0000000000..899bd2ffa0 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-21.xml @@ -0,0 +1,54 @@ + + + + Tcpreplay: Multiple vulnerabilities + Multiple vulnerabilities have been found in Tcpreplay, the worst of + which could result in a Denial of Service condition. + + tcpreplay + 2021-05-26 + 2021-05-26 + 750344 + local + + + 4.3.4 + 4.3.4 + + + +

Tcpreplay is a suite of utilities for UNIX systems for editing and + replaying network traffic which was previously captured by tools like + tcpdump and ethereal/wireshark. +

+ + +

Multiple vulnerabilities have been discovered in Tcpreplay. Please + review the CVE identifiers referenced below for details. +

+ + +

A remote attacker could entice a user to open a specially crafted + network capture file using Tcpreplay, possibly resulting in a Denial of + Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Tcpreplay users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-analyzer/tcpreplay-4.3.4" + + + + + CVE-2020-24265 + CVE-2020-24266 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-22.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-22.xml new file mode 100644 index 0000000000..3d44f02e43 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-22.xml @@ -0,0 +1,50 @@ + + + + Samba: Multiple vulnerabilities + Multiple vulnerabilities have been found in Samba, the worst of + which could result in a Denial of Service condition. + + samba + 2021-05-26 + 2021-05-26 + 778026 + 786825 + local, remote + + + 4.13.8 + 4.13.8 + + + +

Samba is a suite of SMB and CIFS client/server programs.

+ + +

Multiple vulnerabilities have been discovered in Samba. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Samba users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-fs/samba-4.13.8" + + + + + CVE-2020-27840 + CVE-2021-20254 + CVE-2021-20277 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-23.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-23.xml new file mode 100644 index 0000000000..a763f06588 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-23.xml @@ -0,0 +1,68 @@ + + + + PHP: Multiple vulnerabilities + Multiple vulnerabilities have been found in PHP, the worst of which + could result in a Denial of Service condition. + + php + 2021-05-26 + 2021-05-26 + 764314 + 768756 + 788892 + local, remote + + + 7.3.28 + 7.4.19 + 8.0.6 + 8.0.6 + + + +

PHP is an open source general-purpose scripting language that is + especially suited for web development. +

+ + +

Multiple vulnerabilities have been discovered in PHP. Please review the + CVE identifiers and bugs referenced below for details. +

+ + +

Please review the referenced CVE identifiers and bugs for details.

+ + +

There is no known workaround at this time.

+ + +

All PHP 7.3.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/php-7.3.28:7.3" + + +

All PHP 7.4.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/php-7.4.19:7.4" + + +

All PHP 8.0.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/php-8.0.6:8.0" + + + + + CVE-2020-7071 + CVE-2021-21702 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-24.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-24.xml new file mode 100644 index 0000000000..8075a96b41 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-24.xml @@ -0,0 +1,55 @@ + + + + FFmpeg: Multiple vulnerabilities + Multiple vulnerabilities have been found in FFmpeg, the worst of + which could result in the arbitrary execution of code. + + ffmpeg + 2021-05-26 + 2021-05-26 + 763315 + 781146 + local, remote + + + 4.4 + 4.4 + + + +

FFmpeg is a complete, cross-platform solution to record, convert and + stream audio and video. +

+ + +

Multiple vulnerabilities have been discovered in FFmpeg. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could entice a user to open a specially crafted media + file using FFmpeg, possibly resulting in execution of arbitrary code with + the privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All FFmpeg users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-video/ffmpeg-4.4" + + + + + CVE-2020-35964 + CVE-2020-35965 + CVE-2021-30123 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-25.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-25.xml new file mode 100644 index 0000000000..da213f1833 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-25.xml @@ -0,0 +1,49 @@ + + + + OpenVPN: Authentication bypass + A vulnerability has been found in OpenVPN, allowing attackers to + bypass the authentication process. + + openvpn + 2021-05-26 + 2021-05-26 + 785115 + remote + + + 2.5.2 + 2.5.2 + + + +

OpenVPN is a multi-platform, full-featured SSL VPN solution.

+ + +

It was discovered that OpenVPN incorrectly handled deferred + authentication. +

+ + +

A remote attacker could bypass authentication and access control channel + data and trigger further information leaks. +

+ + +

Configure OpenVPN server to not use deferred authentication.

+ + +

All OpenVPN users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-vpn/openvpn-2.5.2" + + + + + CVE-2020-15078 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-26.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-26.xml new file mode 100644 index 0000000000..70c75a3efa --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-26.xml @@ -0,0 +1,51 @@ + + + + SpamAssassin: Arbitrary command execution + A vulnerability in SpamAssassin might allow remote attackers to + execute arbitrary commands. + + SpamAssassin + 2021-05-26 + 2021-05-26 + 778002 + local, remote + + + 3.4.5 + 3.4.5 + + + +

SpamAssassin is an extensible email filter used to identify junk email.

+ + +

It was discovered that SpamAssassin incorrectly handled certain CF + files. +

+ + +

A remote attacker could entice a user or automated system to process a + specially crafted CF file using SpamAssassin, possibly resulting in + execution of arbitrary commands with the privileges of the process or a + Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All SpamAssassin users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-filter/spamassassin-3.4.5" + + + + + CVE-2020-1946 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-27.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-27.xml new file mode 100644 index 0000000000..030bb9ed2a --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-27.xml @@ -0,0 +1,247 @@ + + + + MySQL: Multiple vulnerabilities + Multiple vulnerabilities have been found in MySQL, the worst of + which could result in the arbitrary execution of code. + + mysql + 2021-05-26 + 2021-05-26 + 699876 + 708090 + 717628 + 732974 + 766339 + 789243 + local, remote + + + 5.7.34 + 8.0.24 + 8.0.24 + + + 8.0.24 + 8.0.24 + + + +

MySQL is a popular multi-threaded, multi-user SQL server.

+ + +

Multiple vulnerabilities have been discovered in MySQL. Please review + the CVE identifiers referenced below for details. +

+ + +

An attacker could possibly execute arbitrary code with the privileges of + the process, escalate privileges, gain access to critical data or + complete access to all MySQL server accessible data, or cause a Denial of + Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All MySQL users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/mysql-5.7.34" + + +

All mysql users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/mysql-8.0.24" + + + + + CVE-2019-2938 + CVE-2019-2974 + CVE-2020-14539 + CVE-2020-14540 + CVE-2020-14547 + CVE-2020-14550 + CVE-2020-14553 + CVE-2020-14559 + CVE-2020-14564 + CVE-2020-14567 + CVE-2020-14568 + CVE-2020-14575 + CVE-2020-14576 + CVE-2020-14586 + CVE-2020-14591 + CVE-2020-14597 + CVE-2020-14614 + CVE-2020-14619 + CVE-2020-14620 + CVE-2020-14623 + CVE-2020-14624 + CVE-2020-14626 + CVE-2020-14631 + CVE-2020-14632 + CVE-2020-14633 + CVE-2020-14634 + CVE-2020-14641 + CVE-2020-14643 + CVE-2020-14651 + CVE-2020-14654 + CVE-2020-14656 + CVE-2020-14663 + CVE-2020-14672 + CVE-2020-14678 + CVE-2020-14680 + CVE-2020-14697 + CVE-2020-14702 + CVE-2020-14725 + CVE-2020-14760 + CVE-2020-14765 + CVE-2020-14769 + CVE-2020-14771 + CVE-2020-14773 + CVE-2020-14775 + CVE-2020-14776 + CVE-2020-14777 + CVE-2020-14785 + CVE-2020-14786 + CVE-2020-14789 + CVE-2020-14790 + CVE-2020-14791 + CVE-2020-14793 + CVE-2020-14794 + CVE-2020-14799 + CVE-2020-14800 + CVE-2020-14804 + CVE-2020-14809 + CVE-2020-14812 + CVE-2020-14814 + CVE-2020-14821 + CVE-2020-14827 + CVE-2020-14828 + CVE-2020-14829 + CVE-2020-14830 + CVE-2020-14836 + CVE-2020-14837 + CVE-2020-14838 + CVE-2020-14839 + CVE-2020-14844 + CVE-2020-14845 + CVE-2020-14846 + CVE-2020-14848 + CVE-2020-14852 + CVE-2020-14853 + CVE-2020-14860 + CVE-2020-14861 + CVE-2020-14866 + CVE-2020-14867 + CVE-2020-14868 + CVE-2020-14869 + CVE-2020-14870 + CVE-2020-14873 + CVE-2020-14878 + CVE-2020-14888 + CVE-2020-14891 + CVE-2020-14893 + CVE-2020-2570 + CVE-2020-2572 + CVE-2020-2573 + CVE-2020-2574 + CVE-2020-2577 + CVE-2020-2579 + CVE-2020-2580 + CVE-2020-2584 + CVE-2020-2588 + CVE-2020-2589 + CVE-2020-2627 + CVE-2020-2660 + CVE-2020-2679 + CVE-2020-2686 + CVE-2020-2694 + CVE-2020-2752 + CVE-2020-2759 + CVE-2020-2760 + CVE-2020-2761 + CVE-2020-2762 + CVE-2020-2763 + CVE-2020-2765 + CVE-2020-2768 + CVE-2020-2770 + CVE-2020-2774 + CVE-2020-2779 + CVE-2020-2780 + CVE-2020-2790 + CVE-2020-2804 + CVE-2020-2806 + CVE-2020-2812 + CVE-2020-2814 + CVE-2020-2853 + CVE-2020-2875 + CVE-2020-2892 + CVE-2020-2893 + CVE-2020-2895 + CVE-2020-2896 + CVE-2020-2897 + CVE-2020-2898 + CVE-2020-2901 + CVE-2020-2903 + CVE-2020-2904 + CVE-2020-2921 + CVE-2020-2922 + CVE-2020-2923 + CVE-2020-2924 + CVE-2020-2925 + CVE-2020-2926 + CVE-2020-2928 + CVE-2020-2930 + CVE-2020-2933 + CVE-2020-2934 + CVE-2021-1998 + CVE-2021-2001 + CVE-2021-2002 + CVE-2021-2006 + CVE-2021-2007 + CVE-2021-2009 + CVE-2021-2010 + CVE-2021-2011 + CVE-2021-2012 + CVE-2021-2014 + CVE-2021-2016 + CVE-2021-2019 + CVE-2021-2020 + CVE-2021-2021 + CVE-2021-2022 + CVE-2021-2024 + CVE-2021-2028 + CVE-2021-2030 + CVE-2021-2031 + CVE-2021-2032 + CVE-2021-2036 + CVE-2021-2038 + CVE-2021-2042 + CVE-2021-2046 + CVE-2021-2048 + CVE-2021-2055 + CVE-2021-2056 + CVE-2021-2058 + CVE-2021-2060 + CVE-2021-2061 + CVE-2021-2065 + CVE-2021-2070 + CVE-2021-2072 + CVE-2021-2076 + CVE-2021-2081 + CVE-2021-2087 + CVE-2021-2088 + CVE-2021-2122 + CVE-2021-2154 + CVE-2021-2166 + CVE-2021-2180 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-28.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-28.xml new file mode 100644 index 0000000000..f020be9135 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-28.xml @@ -0,0 +1,75 @@ + + + + MariaDB: Multiple vulnerabilities + Multiple vulnerabilities have been found in MariaDB, the worst of + which could result in the arbitrary execution of code. + + mariadb + 2021-05-26 + 2021-05-26 + 777786 + 789240 + local, remote + + + 10.2.38 + 10.3.29 + 10.4.19 + 10.5.10 + 10.5.10 + + + +

MariaDB is an enhanced, drop-in replacement for MySQL.

+ + +

Multiple vulnerabilities have been discovered in MariaDB. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All MariaDB 10.2.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/mariadb-10.2.38:10.2" + + +

All MariaDB 10.3.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/mariadb-10.3.29:10.3" + + +

All MariaDB 10.3.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/mariadb-10.4.19:10.4" + + +

All MariaDB 10.5.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/mariadb-10.5.10:10.5" + + + + + CVE-2021-2154 + CVE-2021-2166 + CVE-2021-2180 + CVE-2021-27928 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-29.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-29.xml new file mode 100644 index 0000000000..e2507b22b9 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-29.xml @@ -0,0 +1,49 @@ + + + + Tar: Denial of service + A vulnerability in Tar could lead to a Denial of Service condition. + tar + 2021-05-26 + 2021-05-26 + 778548 + local, remote + + + 1.34 + 1.34 + + + +

The Tar program provides the ability to create and manipulate tar + archives. +

+ + +

It was discovered that GNU Tar had a memory leak when processing archive + headers. +

+ + +

A remote attacker could entice a user to open a specially crafted + archive using Tar, possibly resulting in a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Tar users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-arch/tar-1.34" + + + + + CVE-2021-20193 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-30.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-30.xml new file mode 100644 index 0000000000..4cbf0070e7 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-30.xml @@ -0,0 +1,52 @@ + + + + MuPDF: Multiple vulnerabilities + Multiple vulnerabilities have been found in MuPDF, the worst of + which could result in a Denial of Service condition. + + mupdf + 2021-05-26 + 2021-05-26 + 747151 + 772311 + local, remote + + + 1.18.0-r3 + 1.18.0-r3 + + + +

MuPDF is a lightweight PDF viewer and toolkit written in portable C.

+ + +

Multiple vulnerabilities have been discovered in MuPDF. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could entice a user to open a specially crafted PDF + document using MuPDF, possibly resulting in a Denial of Service condition + or have other unspecified impact. +

+ + +

There is no known workaround at this time.

+ + +

All MuPDF users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-text/mupdf-1.18.0-r3" + + + + + CVE-2020-26519 + CVE-2021-3407 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-31.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-31.xml new file mode 100644 index 0000000000..05d9ce89b5 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-31.xml @@ -0,0 +1,54 @@ + + + + Nettle: Denial of service + A vulnerability in Nettle could lead to a Denial of Service + condition. + + nettle + 2021-05-26 + 2021-05-26 + 780483 + local, remote + + + 3.7.2 + 3.7.2 + + + +

Nettle is a cryptographic library that is designed to fit easily in + almost any context: In cryptographic toolkits for object-oriented + languages, such as C++, Python, or Pike, in applications like lsh or + GnuPG, or even in kernel space. +

+ + +

It was discovered that Nettle incorrectly handled signature + verification. +

+ + +

A remote attacker could send a specially crafted valid-looking input + signature, possibly resulting in a Denial of Service condition or force + an invalid signature. +

+ + +

There is no known workaround at this time.

+ + +

All Nettle users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/nettle-3.7.2" + + + + + CVE-2021-20305 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-32.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-32.xml new file mode 100644 index 0000000000..44edeaa40b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-32.xml @@ -0,0 +1,92 @@ + + + + PostgreSQL: Multiple vulnerabilities + Multiple vulnerabilities have been found in PostgreSQL, the worst + of which could result in information disclosure. + + postgresql + 2021-05-26 + 2021-05-26 + 771942 + local, remote + + + 9.5.25 + 9.6.21 + 10.16 + 11.11 + 12.6 + 13.2 + 13.2 + + + +

PostgreSQL is an open source object-relational database management + system. +

+ + +

Multiple vulnerabilities have been discovered in PostgreSQL. Please + review the CVE identifiers referenced below for details. +

+ + +

An authenticated remote attacker, by executing malicious crafted + queries, could possibly disclose sensitive information. +

+ + +

There is no known workaround at this time.

+ + +

All PostgreSQL 9.5.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.5.25:9.5" + + +

All PostgreSQL 9.6.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.6.21:9.6" + + +

All PostgreSQL 10.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-10.16:10" + + +

All PostgreSQL 11.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-11.11:11" + + +

All PostgreSQL 12.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-12.6:12" + + +

All PostgreSQL 13.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-13.2:13" + + + + + CVE-2021-20229 + CVE-2021-3393 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-33.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-33.xml new file mode 100644 index 0000000000..dddf99d669 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-33.xml @@ -0,0 +1,55 @@ + + + + containerd: Multiple vulnerabilities + Multiple vulnerabilities have been found in containerd, the worst + of which could result in privilege escalation. + + containerd + 2021-05-26 + 2021-05-26 + 758137 + 775329 + local + + + 1.4.4 + 1.4.4 + + + +

Containerd is a daemon with an API and a command line client, to manage + containers on one machine. It uses runC to run containers according to + the OCI specification. +

+ + +

Multiple vulnerabilities have been discovered in containerd. Please + review the CVE identifiers referenced below for details. +

+ + +

A local attacker, able to run a malicious container in the same network + namespace as the shim, could possibly escalate privileges. Furthermore, + an attacker could disclose sensitive information. +

+ + +

There is no known workaround at this time.

+ + +

All containerd users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/containerd-1.4.4" + + + + + CVE-2020-15257 + CVE-2021-21334 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-34.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-34.xml new file mode 100644 index 0000000000..31c7e3ef70 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-34.xml @@ -0,0 +1,45 @@ + + + + Bash: Privilege escalation + A vulnerability in Bash may allow users to escalate privileges. + bash + 2021-05-26 + 2021-05-26 + 702488 + local + + + 5.0_p11-r1 + 5.0_p11-r1 + + + +

Bash is the standard GNU Bourne Again SHell.

+ + +

It was discovered that Bash incorrectly dropped privileges by setting + its effective UID to its real UID. +

+ + +

A local attacker could possibly escalate privileges.

+ + +

There is no known workaround at this time.

+ + +

All Bash users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-shells/bash-5.0_p11-r1" + + + + + CVE-2019-18276 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-35.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-35.xml new file mode 100644 index 0000000000..33ff95b8cb --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-35.xml @@ -0,0 +1,57 @@ + + + + OpenSSH: Multiple vulnerabilities + Multiple vulnerabilities have been found in OpenSSH, the worst of + which could allow a remote attacker to execute arbitrary code. + + openssh + 2021-05-26 + 2021-05-26 + 763048 + 774090 + local, remote + + + 8.5_p1 + 8.5_p1 + + + +

OpenSSH is a complete SSH protocol implementation that includes SFTP + client and server support. +

+ + +

Multiple vulnerabilities have been discovered in OpenSSH. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker, able to access the socket of the forwarding agent, + might be able to execute arbitrary code with the privileges of the + process or cause a Denial of Service condition. + Furthermore, a remote attacker might conduct a man-in-the-middle attack + targeting initial connection attempts where no host key for the server + has been cached by client yet. +

+ + +

There is no known workaround at this time.

+ + +

All OpenSSH users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/openssh-8.5_p1" + + + + + CVE-2020-14145 + CVE-2021-28041 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-36.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-36.xml new file mode 100644 index 0000000000..2183956951 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-36.xml @@ -0,0 +1,51 @@ + + + + cURL: Multiple vulnerabilities + Multiple vulnerabilities have been found in cURL, the worst of + which could result in the arbitrary execution of code. + + curl + 2021-05-26 + 2021-05-26 + 779535 + 792192 + local, remote + + + 7.77.0 + 7.77.0 + + + +

A command line tool and library for transferring data with URLs.

+ + +

Multiple vulnerabilities have been discovered in cURL. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All cURL users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/curl-7.77.0" + + + + + CVE-2021-22876 + CVE-2021-22890 + CVE-2021-22898 + CVE-2021-22901 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-37.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-37.xml new file mode 100644 index 0000000000..207f833941 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-37.xml @@ -0,0 +1,50 @@ + + + + Nextcloud Desktop Client: User-assisted execution of arbitrary code + A vulnerability in Nextcloud Desktop Client could allow a remote + attacker to execute arbitrary commands. + + nextcloud-client + 2021-05-26 + 2021-05-26 + 783531 + remote + + + 3.1.3 + 3.1.3 + + + +

The Nextcloud Desktop Client is a tool to synchronize files from + Nextcloud Server with your computer. +

+ + +

It was discovered that Nextcloud Desktop Client did not validate URLs.

+ + +

A remote attacker could entice a user to connect to a malicious + Nextcloud server to cause the execution of arbitrary commands with the + privileges of the user running the Nextcloud Desktop Client application. +

+ + +

There is no known workaround at this time.

+ + +

All Nextcloud Desktop Client users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/nextcloud-client-3.1.3" + + + + + CVE-2021-22879 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-38.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-38.xml new file mode 100644 index 0000000000..d5c53fccdb --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-38.xml @@ -0,0 +1,59 @@ + + + + nginx: Remote code execution + A vulnerability in nginx could lead to remote code execution. + nginx + 2021-05-26 + 2021-05-26 + 792087 + remote + + + 1.20.1 + 1.21.0 + 1.21.0 + + + +

nginx is a robust, small, and high performance HTTP and reverse proxy + server. +

+ + +

It was discovered that nginx did not properly handle DNS responses when + “resolver” directive is used. +

+ + +

A remote attacker, able to provide DNS responses to a nginx instance, + could cause the execution of arbitrary code with the privileges of the + process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All nginx users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.20.1" + + +

All nginx mainline users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-servers/nginx-1.21.0:mainline" + + + + + CVE-2021-23017 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-39.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-39.xml new file mode 100644 index 0000000000..83c8ceab4f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202105-39.xml @@ -0,0 +1,58 @@ + + + + Ceph: Multiple vulnerabilities + Multiple vulnerabilities have been found in Ceph, the worst of + which could result in privilege escalation. + + ceph + 2021-05-26 + 2021-05-26 + 760824 + 761969 + 783486 + 791253 + remote + + + 14.2.21 + 14.2.21 + + + +

Ceph is a distributed network file system designed to provide excellent + performance, reliability, and scalability. +

+ + +

Multiple vulnerabilities have been discovered in Ceph. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Ceph users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-cluster/ceph-14.2.21" + + + + + CVE-2020-10753 + CVE-2020-1759 + CVE-2020-1760 + CVE-2020-25660 + CVE-2020-25678 + CVE-2020-27781 + CVE-2021-20288 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-01.xml new file mode 100644 index 0000000000..032f9797ab --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-01.xml @@ -0,0 +1,52 @@ + + + + corosync: Denial of service + A vulnerability in corosync could lead to a Denial of Service + condition. + + corosync + 2021-07-03 + 2021-07-03 + 658354 + remote + + + 3.0.4 + 3.0.4 + + + +

The Corosync Cluster Engine is a Group Communication System with + additional features for implementing high availability within + applications. +

+ + +

It was discovered that corosync allowed an unauthenticated user to cause + a Denial of Service by application crash. +

+ + +

A remote attacker could send a malicious crafted packet, possibly + resulting in a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All corosync users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-cluster/corosync-3.0.4" + + + + + CVE-2018-1084 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-02.xml new file mode 100644 index 0000000000..befac3c0b7 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-02.xml @@ -0,0 +1,53 @@ + + + + FreeImage: Multiple vulnerabilities + Multiple vulnerabilities have been found in FreeImage, the worst of + which could result in a Denial of Service condition. + + freeimage + 2021-07-03 + 2021-07-03 + 701850 + local, remote + + + 3.18.0-r2 + 3.18.0-r2 + + + +

FreeImage is an Open Source library project for developers who would + like to support popular graphics image formats like PNG, BMP, JPEG, TIFF + and others as needed by today’s multimedia applications. +

+ + +

Multiple vulnerabilities have been discovered in FreeImage. Please + review the CVE identifiers referenced below for details. +

+ + +

A remote attacker, by enticing a user to process a specially crafted + image file, could possibly cause a Denial of Service condition or other + unspecified impact. +

+ + +

There is no known workaround at this time.

+ + +

All FreeImage users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/freeimage-3.18.0-r2" + + + + CVE-2019-12211 + CVE-2019-12213 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-03.xml new file mode 100644 index 0000000000..2de2f6eb59 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-03.xml @@ -0,0 +1,52 @@ + + + + libqb: Insecure temporary file + An insecure temporary file usage has been reported in libqb + possibly allowing local code execution. + + libqb + 2021-07-03 + 2021-07-03 + 699860 + local + + + 1.0.5 + 1.0.5 + + + +

libqb is a library with the primary purpose of providing + high-performance, reusable features for client-server architecture, such + as logging, tracing, inter-process communication (IPC), and polling. +

+ + +

It was discovered that libqb used predictable filenames (under /dev/shm + and /tmp) without O_EXCL. +

+ + +

A local attacker could perform symlink attacks to overwrite arbitrary + files with the privileges of the user running the application linked + against libqb. +

+ + +

There is no known workaround at this time.

+ + +

All libqb users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-cluster/libqb-1.0.5" + + + + CVE-2019-12779 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-04.xml new file mode 100644 index 0000000000..45df46de44 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-04.xml @@ -0,0 +1,52 @@ + + + + Graphviz: Multiple vulnerabilities + + Multiple vulnerabilities have been found in Graphviz, the worst of + which could result in the arbitrary execution of code. + + Graphviz + 2021-07-03 + 2021-07-03 + 684844 + local, remote + + + 2.47.1 + 2.47.1 + + + +

Graphviz is an open source graph visualization software.

+ + +

Multiple vulnerabilities have been discovered in Graphviz. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could entice a user to process a specially crafted + file using Graphviz, possibly resulting in execution of arbitrary code + with the privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Graphviz users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-gfx/graphviz-2.47.1" + + + + + CVE-2019-9904 + CVE-2020-18032 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-05.xml new file mode 100644 index 0000000000..292c32b550 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-05.xml @@ -0,0 +1,58 @@ + + + + libxml2: Multiple vulnerabilities + Multiple vulnerabilities have been found in libxml2, the worst of + which could result in a Denial of Service condition. + + libxml2 + 2021-07-06 + 2021-07-06 + 749849 + 790002 + local, remote + + + 2.9.11 + 2.9.11 + + + +

libxml2 is the XML (eXtended Markup Language) C parser and toolkit + initially developed for the GNOME project. +

+ + +

Multiple vulnerabilities have been discovered in libxml2. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could entice a user to process a specially crafted XML + document using an application linked against libxml2, possibly resulting + in a Denial of Service condition or obtaining sensitive information. +

+ + +

There is no known workaround at this time.

+ + +

All libxml2 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.9.12-r3" + + + + + CVE-2020-24977 + CVE-2021-3516 + CVE-2021-3517 + CVE-2021-3518 + CVE-2021-3537 + CVE-2021-3541 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-06.xml new file mode 100644 index 0000000000..369536037a --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-06.xml @@ -0,0 +1,119 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabillities have been found in Chromium and Google + Chrome, the worst of which could allow remote attackers to execute + arbitrary code. + + google-chrome,chromium + 2021-07-06 + 2021-07-06 + 789420 + 792084 + 795204 + 796338 + 796521 + remote + + + 91.0.4472.114 + 91.0.4472.114 + + + 91.0.4472.114 + 91.0.4472.114 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the CVE identifiers referenced below for details. +

+ + +

A remote attacker could execute arbitrary code, escalate privileges, + obtain sensitive information, spoof a URL or cause a Denial of Service + condition. +

+ + +

There is no known workaround at this time.

+ + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-91.0.4472.114" + + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-91.0.4472.114" + + + + + CVE-2021-30506 + CVE-2021-30507 + CVE-2021-30508 + CVE-2021-30509 + CVE-2021-30510 + CVE-2021-30511 + CVE-2021-30512 + CVE-2021-30513 + CVE-2021-30514 + CVE-2021-30515 + CVE-2021-30516 + CVE-2021-30517 + CVE-2021-30518 + CVE-2021-30519 + CVE-2021-30520 + CVE-2021-30521 + CVE-2021-30522 + CVE-2021-30523 + CVE-2021-30524 + CVE-2021-30525 + CVE-2021-30526 + CVE-2021-30527 + CVE-2021-30528 + CVE-2021-30530 + CVE-2021-30531 + CVE-2021-30532 + CVE-2021-30533 + CVE-2021-30534 + CVE-2021-30536 + CVE-2021-30537 + CVE-2021-30538 + CVE-2021-30539 + CVE-2021-30540 + CVE-2021-30544 + CVE-2021-30545 + CVE-2021-30546 + CVE-2021-30548 + CVE-2021-30549 + CVE-2021-30550 + CVE-2021-30551 + CVE-2021-30552 + CVE-2021-30553 + CVE-2021-30554 + CVE-2021-30555 + CVE-2021-30556 + CVE-2021-30557 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-07.xml new file mode 100644 index 0000000000..9a915ff459 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-07.xml @@ -0,0 +1,54 @@ + + + + glibc: Multiple vulnerabilities + Multiple vulnerabilities in glibc could result in Denial of + Service. + + glibc + 2021-07-06 + 2021-07-06 + 764176 + 767718 + 772425 + 792261 + local, remote + + + 2.33-r1 + 2.33-r1 + + + +

glibc is a package that contains the GNU C library.

+ + +

Multiple vulnerabilities have been discovered in glibc. Please review + the CVE identifiers referenced below for details. +

+ + +

An attacker could cause a possible Denial of Service condition.

+ + +

There is no known workaround at this time.

+ + +

All glibc users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.33-r1" + + + + + CVE-2019-25013 + CVE-2020-27618 + CVE-2021-27645 + CVE-2021-3326 + CVE-2021-33574 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-08.xml new file mode 100644 index 0000000000..07a104b936 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-08.xml @@ -0,0 +1,48 @@ + + + + PostSRSd: Denial of service + Multiple vulnerabilities in PostSRSd could lead to a Denial of + Service condition. + + postsrsd + 2021-07-06 + 2021-07-06 + 760821 + 793674 + remote + + + 1.11 + 1.11 + + + +

PostSRSd is a Postfix sender rewriting scheme daemon

+ + +

Multiple vulnerabilities have been discovered in PostSRSd. Please review + the CVE identifiers referenced below for details. +

+ + +

An attacker could cause a possible Denial of Service condition.

+ + +

There is no known workaround at this time.

+ + +

All postsrsd users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-filter/postsrsd-1.11" + + + + CVE-2020-35573 + CVE-2021-35525 + + whissi + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-09.xml new file mode 100644 index 0000000000..355d53f872 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-09.xml @@ -0,0 +1,80 @@ + + + + Mozilla Firefox: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mozilla Firefox, the + worst of which could result in the arbitrary execution of code. + + firefox + 2021-07-07 + 2021-07-07 + 794082 + local, remote + + + 78.11.0 + 89.0 + 89.0 + + + 78.11.0 + 89.0 + 89.0 + + + +

Mozilla Firefox is a popular open-source web browser from the Mozilla + project. +

+ + +

Multiple vulnerabilities have been discovered in Mozilla Firefox. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Firefox ESR users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-78.11.0" + + +

All Mozilla Firefox ESR binary users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-78.11.0" + + +

All Mozilla Firefox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-89.0" + + +

All Mozilla Firefox binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-89.0" + + + + CVE-2021-29959 + CVE-2021-29960 + CVE-2021-29961 + CVE-2021-29966 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-10.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-10.xml new file mode 100644 index 0000000000..b271ec42cb --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-10.xml @@ -0,0 +1,51 @@ + + + + TCG TPM2 Software Stack: Information disclosure + A bug in TCG TPM2 Software Stack may result in information + disclosure to a local attacker. + + tpm2-tss + 2021-07-07 + 2021-07-07 + 746563 + local + + + 2.4.3 + 2.4.3 + + + +

TCG TPM2 Software Stack is a library to interface with trusted platform + modules. +

+ + +

TCG TPM2 Software Stack did not appropriately apply FAPI policies to + protect data encrypted with the trusted platform module. +

+ + +

Data encrypted using TCG TPM2 Software Stack (tpm2-tss) may not be + protected from an attacker. +

+ + +

There is no known workaround at this time.

+ + +

All tpm2-tss users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-crypt/tpm2-tss-2.4.3" + + + + + CVE-2020-24455 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-11.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-11.xml new file mode 100644 index 0000000000..33c7a57948 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-11.xml @@ -0,0 +1,47 @@ + + + + OpenDoas: Insufficient environment filtering + A vulnerability in OpenDoas could lead to privilege escalation. + doas + 2021-07-07 + 2021-07-07 + 767781 + local + + + 6.8.1 + 6.8.1 + + + +

OpenDoas allows users to run commands as other users.

+ + +

OpenDoas does not properly filter the PATH variable from the resulting + shell after escalating privileges. +

+ + +

A local attacker with control of a user’s PATH variable could escalate + privileges if that user uses OpenDoas with a poisoned PATH variable. +

+ + +

There is no known workaround at this time.

+ + +

All OpenDoas users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-admin/doas-6.8.1" + + + + + CVE-2019-25016 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-12.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-12.xml new file mode 100644 index 0000000000..3dc6bc4692 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-12.xml @@ -0,0 +1,51 @@ + + + + Schism Tracker: Multiple vulnerabilities + Multiple vulnerabilities have been found in Schism Tracker, the + worst of which could result in denial of service. + + schismtracker + 2021-07-07 + 2021-07-07 + 711210 + local + + + 20190805 + 20190805 + + + +

Schism Tracker is a free implementation of Impulse Tracker, a tool used + to create high quality music. +

+ + +

Multiple vulnerabilities have been discovered in Schism Tracker. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Schism Tracker users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=media-sound/schismtracker-20190805" + + + + + CVE-2019-14465 + CVE-2019-14523 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-13.xml new file mode 100644 index 0000000000..bb98e4f013 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-13.xml @@ -0,0 +1,52 @@ + + + + GLib: Multiple vulnerabilities + Multiple vulnerabilities have been found in GLib, the worst of + which could result in the arbitrary execution of code. + + glib + 2021-07-07 + 2021-07-07 + 768753 + 775632 + local, remote + + + 2.66.8 + 2.66.8 + + + +

GLib is a library providing a number of GNOME’s core objects and + functions. +

+ + +

Multiple vulnerabilities have been discovered in GLib. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All GLib users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/glib-2.66.8" + + + + + CVE-2021-27218 + CVE-2021-27219 + CVE-2021-28153 + + whissi + whissi + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-14.xml new file mode 100644 index 0000000000..5a10a179d0 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-14.xml @@ -0,0 +1,51 @@ + + + + rclone: Weak random number generation + rclone uses weak random number generation such that generated + passwords can be easily cracked. + + rclone + 2021-07-08 + 2021-07-08 + 755638 + local + + + 1.53.3 + 1.53.3 + + + +

rclone is a problem to sync files to and from various cloud storage + providers. +

+ + +

Passwords generated with rclone were insecurely generated and are + vulnerable to brute force attacks. +

+ + +

Data kept secret with a password generated by rclone may be disclosed to + a local attacker. +

+ + +

There is no known workaround at this time.

+ + +

All rclone users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/rclone-1.53.3" + + + + + CVE-2020-28924 + + whissi + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-15.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-15.xml new file mode 100644 index 0000000000..79b937641f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-15.xml @@ -0,0 +1,50 @@ + + + + blktrace: Buffer overflow + A buffer overflow in blktrace might allow arbitrary code execution. + blktrace + 2021-07-08 + 2021-07-08 + 655146 + local, remote + + + 1.2.0_p20210419122502 + 1.2.0_p20210419122502 + + + +

blktrace shows detailed information about what is happening on a block + device IO queue. +

+ + +

A crafted file could cause a buffer overflow in the ‘dev_map_read’ + function because the device and devno arrays are too small. +

+ + +

A remote attacker could entice a user to open a specially crafted file + using blktrace, possibly resulting in execution of arbitrary code with + the privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All blktrace users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=sys-block/blktrace-1.2.0_p20210419122502" + + + + CVE-2018-10689 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-16.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-16.xml new file mode 100644 index 0000000000..389a5b9374 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-16.xml @@ -0,0 +1,65 @@ + + + + Privoxy: Multiple vulnerabilities + Multiple vulnerabilities have been found in Privoxy, the worst of + which could result in Denial of Service. + + privoxy + 2021-07-08 + 2021-07-08 + 758428 + 768096 + 771960 + remote + + + 3.0.32 + 3.0.32 + + + +

Privoxy is a web proxy with advanced filtering capabilities for + enhancing privacy. +

+ + +

Multiple vulnerabilities have been discovered in privoxy. Please review + the CVE identifiers referenced below for details. +

+ + +

An attacker could cause a possible Denial of Service condition.

+ + +

There is no known workaround at this time.

+ + +

All Privoxy users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-proxy/privoxy-3.0.32" + + + + + CVE-2020-35502 + CVE-2021-20209 + CVE-2021-20210 + CVE-2021-20211 + CVE-2021-20212 + CVE-2021-20213 + CVE-2021-20214 + CVE-2021-20215 + CVE-2021-20216 + CVE-2021-20217 + CVE-2021-20272 + CVE-2021-20273 + CVE-2021-20274 + CVE-2021-20275 + CVE-2021-20276 + + whissi + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-17.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-17.xml new file mode 100644 index 0000000000..4646661b63 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-17.xml @@ -0,0 +1,48 @@ + + + + Mechanize: Command injection + A file named by an attacker being utilized by Mechanize could + result in arbitrary code execution. + + mechanize + 2021-07-08 + 2021-07-08 + 768609 + local, remote + + + 2.7.7 + 2.7.7 + + + +

Mechanize is a Ruby library used for automating interaction with + websites. +

+ + +

Mechanize does not neutralize filename input and could allow arbitrary + code execution if an attacker can control filenames used by Mechanize. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mechanize users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-ruby/mechanize-2.7.7" + + + + CVE-2021-21289 + + whissi + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-18.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-18.xml new file mode 100644 index 0000000000..2b65f11463 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-18.xml @@ -0,0 +1,53 @@ + + + + BladeEnc: Buffer overflow + A buffer overflow in BladeEnc might allow arbitrary code execution. + bladeenc + 2021-07-08 + 2021-07-08 + 631394 + remote + + + 0.94.2-r1 + + + +

BladeEnc is an mp3 encoder.

+ + +

A crafted file could cause a buffer overflow in the iteration_loop + function in BladeEnc. +

+ + +

A remote attacker could entice a user to open a specially crafted using + BladeEnc, possibly resulting in execution of arbitrary code with the + privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

Gentoo has discontinued support for BladeEnc. We recommend that users + unmerge it: +

+ + + # emerge --ask --depclean "media-sound/bladeenc" + + +

NOTE: The Gentoo developer(s) maintaining BladeEnc have discontinued + support at this time. It may be possible that a new Gentoo developer will + update BladeEnc at a later date. We do not have a suggestion for a + replacement at this time. +

+ + + CVE-2017-14648 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-19.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-19.xml new file mode 100644 index 0000000000..75efc2f17d --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-19.xml @@ -0,0 +1,48 @@ + + + + Jinja: Denial of service + An inefficient regular expression could be exploited to cause a + Denial of Service condition. + + jinja2 + 2021-07-08 + 2021-07-08 + 768300 + remote + + + 2.11.3 + 2.11.3 + + + +

Jinja is a template engine written in pure Python.

+ + +

The ‘urlize’ filter in Jinja utilized an inefficient regular + expression that could be exploited to consume excess CPU. +

+ + +

An attacker could cause a Denial of Service condition via crafted input + to the ‘urlize’ Jinja filter. +

+ + +

There is no known workaround at this time.

+ + +

All Jinja users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-python/jinja-2.11.3" + + + + CVE-2020-28493 + + whissi + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-20.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-20.xml new file mode 100644 index 0000000000..669cd332a6 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-20.xml @@ -0,0 +1,57 @@ + + + + Redis: Multiple vulnerabilities + Multiple vulnerabilities have been found in Redis, the worst of + which could result in the arbitrary execution of code. + + redis + 2021-07-09 + 2021-07-09 + 788211 + remote + + + 6.0.13 + 6.2.3 + 6.0.13 + + + +

Redis is an open source (BSD licensed), in-memory data structure store, + used as a database, cache and message broker. +

+ + +

Multiple vulnerabilities have been discovered in Redis. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Redis 6.0.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/redis-6.0.13" + + +

All Redis 6.2.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/redis-6.2.3" + + + + CVE-2021-29477 + CVE-2021-29478 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-21.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-21.xml new file mode 100644 index 0000000000..b8f906df8a --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-21.xml @@ -0,0 +1,53 @@ + + + + Wireshark: Multiple vulnerabilities + Multiple vulnerabilities have been found in Wireshark, the worst of + which could result in the arbitrary execution of code. + + wireshark + 2021-07-09 + 2021-07-09 + 767907 + 775323 + 784899 + 793968 + remote + + + 3.4.6 + 3.4.6 + + + +

Wireshark is a network protocol analyzer formerly known as ethereal.

+ + +

Multiple vulnerabilities have been discovered in Wireshark. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Wireshark users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-analyzer/wireshark-3.4.6" + + + + CVE-2021-22173 + CVE-2021-22174 + CVE-2021-22191 + CVE-2021-22207 + CVE-2021-22222 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-22.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-22.xml new file mode 100644 index 0000000000..47009889f6 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-22.xml @@ -0,0 +1,51 @@ + + + + InspIRCd: Information disclosure + An information disclosure vulnerability in InspIRCd may allow + remote attackers to obtain sensitive information. + + inspircd + 2021-07-09 + 2021-07-09 + 791589 + remote + + + 3.10.0 + 3.10.0 + + + +

InspIRCd is a modular Internet Relay Chat (IRC) server written in C++ + which was created from scratch to be stable, modern and lightweight. +

+ + +

InspIRCd incorrectly handled malformed PONG messages, resulting in + access of freed memory. +

+ + +

A remote attacker could send crafted packets to the server, possibly + allowing them to obtain sensitive information. +

+ + +

There is no known workaround at this time.

+ + +

All InspIRCd users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-irc/inspircd-3.10.0" + + + + + CVE-2021-33586 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-23.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-23.xml new file mode 100644 index 0000000000..9c39ca6f7a --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-23.xml @@ -0,0 +1,55 @@ + + + + Docker: Multiple vulnerabilities + Multiple vulnerabilities have been found in Docker, the worst of + which could result in privilege escalation to root on the host. + + docker + 2021-07-10 + 2021-07-10 + 768612 + local + + + 19.03.15 + 20.10.3 + 20.10.3 + + + +

Docker is the world’s leading software containerization platform.

+ + +

Multiple vulnerabilities have been discovered in Docker. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Docker 19.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/docker-19.03.15" + + +

All Docker 20.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/docker-20.10.3" + + + + CVE-2021-21284 + CVE-2021-21285 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-24.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-24.xml new file mode 100644 index 0000000000..c5aea138e3 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-24.xml @@ -0,0 +1,65 @@ + + + + Binutils: Multiple vulnerabilities + Multiple vulnerabilities have been found in Binutils, the worst of + which could result in a Denial of Service condition. + + binutils + 2021-07-10 + 2021-07-10 + 678806 + 761957 + 764170 + local, remote + + + 2.35.2 + 2.35.2 + + + +

The GNU Binutils are a collection of tools to create, modify and analyse + binary files. Many of the files use BFD, the Binary File Descriptor + library, to do low-level manipulation. +

+ + +

Multiple vulnerabilities have been discovered in Binutils. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Binutils users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-devel/binutils-2.35.2" + + + + CVE-2019-9070 + CVE-2019-9071 + CVE-2019-9072 + CVE-2019-9073 + CVE-2019-9074 + CVE-2019-9075 + CVE-2019-9076 + CVE-2019-9077 + CVE-2020-19599 + CVE-2020-35448 + CVE-2020-35493 + CVE-2020-35494 + CVE-2020-35495 + CVE-2020-35496 + CVE-2020-35507 + + ajak + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-25.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-25.xml new file mode 100644 index 0000000000..5e9b2a4ff2 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-25.xml @@ -0,0 +1,69 @@ + + + + Tor: Multiple vulnerabilities + Multiple vulnerabilities have been found in Tor, the worst of which + could result in a Denial of Service condition. + + tor + 2021-07-10 + 2021-07-10 + 776586 + 795969 + remote + + + 0.4.6.5 + 0.4.5.9 + 0.4.4.9 + 0.4.6.5 + + + +

Tor is an implementation of second generation Onion Routing, a + connection-oriented anonymizing communication service. +

+ + +

Multiple vulnerabilities have been discovered in Tor. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Tor 0.4.6.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-vpn/tor-0.4.6.5" + + +

All Tor 0.4.5.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-vpn/tor-0.4.5.9" + + +

All Tor 0.4.4.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-vpn/tor-0.4.4.9" + + + + CVE-2021-28089 + CVE-2021-28090 + CVE-2021-34548 + CVE-2021-34549 + CVE-2021-34550 + + sam_c + sam_c + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-26.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-26.xml new file mode 100644 index 0000000000..311683d9ec --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-26.xml @@ -0,0 +1,51 @@ + + + + runC: Container breakout + A vulnerability has been found in runC which could result in + privilege escalation. + + runc + 2021-07-10 + 2021-07-10 + 790257 + remote + + + 1.0.0_rc95 + 1.0.0_rc95 + + + +

runC is a CLI tool for spawning and running containers according to the + OCI specification. +

+ + +

A vulnerability in runC could allow an attacker to achieve privilege + escalation if specific mount configuration prerequisites are satisfied. +

+ + +

An attacker may be able to escalation privileges to gain access to the + host system. +

+ + +

There is no known workaround at this time.

+ + +

All runC users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/runc-1.0.0_rc95" + + + + + CVE-2021-30465 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-27.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-27.xml new file mode 100644 index 0000000000..7e0b126848 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-27.xml @@ -0,0 +1,69 @@ + + + + OpenEXR: Multiple vulnerabilities + Multiple vulnerabilities have been found in OpenEXR, the worst of + which could result in the arbitrary execution of code. + + openexr + 2021-07-11 + 2021-07-11 + 717474 + 746794 + 762862 + 770229 + 776808 + remote + + + 2.5.6 + 2.5.6 + + + +

OpenEXR is a high dynamic-range (HDR) image file format developed by + Industrial Light & Magic for use in computer imaging applications. +

+ + +

Multiple vulnerabilities have been discovered in OpenEXR. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All OpenEXR users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/openexr-2.5.6" + + + + CVE-2020-11758 + CVE-2020-11759 + CVE-2020-11760 + CVE-2020-11761 + CVE-2020-11762 + CVE-2020-11763 + CVE-2020-11764 + CVE-2020-11765 + CVE-2020-15304 + CVE-2020-15305 + CVE-2020-15306 + CVE-2021-20296 + CVE-2021-3474 + CVE-2021-3475 + CVE-2021-3476 + CVE-2021-3477 + CVE-2021-3478 + CVE-2021-3479 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-28.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-28.xml new file mode 100644 index 0000000000..b7822d9afc --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-28.xml @@ -0,0 +1,50 @@ + + + + GNU Chess: Buffer overflow + A buffer overflow in GNU Chess might allow arbitrary code + execution. + + gnuchess + 2021-07-12 + 2021-07-12 + 780855 + remote + + + 6.2.8-r1 + 6.2.8-r1 + + + +

GNU Chess is a console based chess interfae.

+ + +

The cmd_pgnload() and cmd_pgnreplay() functions in cmd.cc in GNU Chess + to not sufficiently validate PGN file input, potentially resulting in a + buffer overflow. +

+ + +

A remote attacker could entice a user to open a specially crafted PGN + file using GNU Chess, possibly resulting in execution of arbitrary code + with the privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All GNU Chess users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=games-board/gnuchess-6.2.8-r1" + + + + CVE-2021-30184 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-29.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-29.xml new file mode 100644 index 0000000000..e67c3b566e --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-29.xml @@ -0,0 +1,49 @@ + + + + ConnMan: Multiple vulnerabilities + A buffer overflow in ConnMan might allow remote attacker(s) to + execute arbitrary code. + + connman + 2021-07-12 + 2021-07-12 + 769491 + 795084 + remote + + + 1.40 + 1.40 + + + +

ConnMan provides a daemon for managing Internet connections.

+ + +

Multiple vulnerabilities have been discovered in connman. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All ConnMan users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/connman-1.40" + + + + CVE-2021-26675 + CVE-2021-26676 + CVE-2021-33833 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-30.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-30.xml new file mode 100644 index 0000000000..bd790484fb --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-30.xml @@ -0,0 +1,73 @@ + + + + Xen: Multiple vulnerabilities + Multiple vulnerabilities have been found in Xen, the worst of which + could result in privilege escalation. + + xen + 2021-07-12 + 2021-07-12 + 760144 + 766474 + 783456 + 795054 + local, remote + + + 4.14.2-r1 + 4.15.0-r1 + 4.15.0-r1 + + + +

Xen is a bare-metal hypervisor.

+ + +

Multiple vulnerabilities have been discovered in Xen. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Xen 4.14.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/xen-4.14.2-r1" + + +

All Xen 4.15.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/xen-4.15.0-r1" + + + + CVE-2020-29479 + CVE-2020-29486 + CVE-2020-29487 + CVE-2020-29566 + CVE-2020-29567 + CVE-2020-29568 + CVE-2020-29569 + CVE-2020-29570 + CVE-2020-29571 + CVE-2021-0089 + CVE-2021-26313 + CVE-2021-28687 + CVE-2021-28690 + CVE-2021-28691 + CVE-2021-28692 + CVE-2021-28693 + CVE-2021-3308 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-31.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-31.xml new file mode 100644 index 0000000000..77846b9839 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-31.xml @@ -0,0 +1,49 @@ + + + + polkit: Privilege escalation + A vulnerability in polkit could lead to local root privilege + escalation. + + polkit + 2021-07-13 + 2021-07-13 + 794052 + local + + + 0.119 + 0.119 + + + +

polkit is a toolkit for managing policies related to unprivileged + processes communicating with privileged process. +

+ + +

The function polkit_system_bus_name_get_creds_sync() was called without + checking for error, and as such temporarily treats the authentication + request as coming from root. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All polkit users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-auth/polkit-0.119" + + + + CVE-2021-3560 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-32.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-32.xml new file mode 100644 index 0000000000..1471ab6248 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-32.xml @@ -0,0 +1,52 @@ + + + + Apache Thrift: Multiple vulnerabilities + Multiple vulnerabilities have been found in Apache Thrift, the + worst of which could result in a Denial of Service condition. + + thrift + 2021-07-14 + 2021-07-14 + 761409 + 770145 + remote + + + 0.14.1 + 0.14.1 + + + +

Apache Thrift is a software framework that combines a software stack + with a code generation engine to build services that work efficiently and + seamlessly between many languages. +

+ + +

Multiple vulnerabilities have been discovered in Apache Thrift. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Apache Thrift users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-python/thrift-0.14.1" + + + + CVE-2019-0205 + CVE-2019-0210 + CVE-2020-13949 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-33.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-33.xml new file mode 100644 index 0000000000..ab54702ebb --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-33.xml @@ -0,0 +1,62 @@ + + + + Pillow: Multiple vulnerabilities + Multiple vulnerabilities have been found in Pillow, the worst of + which could result in a Denial of Service condition. + + pillow + 2021-07-14 + 2021-07-14 + 773559 + 774387 + 779760 + remote + + + 8.2.0 + 8.2.0 + + + +

Python Imaging Library (fork)

+ + +

Multiple vulnerabilities have been discovered in Pillow. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Pillow users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-python/pillow-8.2.0" + + + + + CVE-2021-25287 + CVE-2021-25288 + CVE-2021-25289 + CVE-2021-25290 + CVE-2021-25291 + CVE-2021-25292 + CVE-2021-25293 + CVE-2021-27921 + CVE-2021-27922 + CVE-2021-27923 + CVE-2021-28675 + CVE-2021-28676 + CVE-2021-28677 + CVE-2021-28678 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-34.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-34.xml new file mode 100644 index 0000000000..45507b800e --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-34.xml @@ -0,0 +1,52 @@ + + + + FluidSynth: Remote code execution + A vulnerability was found in FluidSynth that could result in remote + code execution. + + fluidsynth + 2021-07-15 + 2021-07-15 + 782700 + remote + + + 2.2.0 + 2.2.0 + + + +

FluidSynth is a real-time synthesizer based on the Soundfont 2 + specifications. +

+ + +

FluidSynth contains a use-after-free in sfloader/fluid_sffile.c which + occurs when parsing Soundfile 2 files. +

+ + +

A remote attacker could entice a user to open a specially crafted + Soundfont 2 file using FluidSynth, possibly resulting in execution of + arbitrary code with the privileges of the process or a Denial of Service + condition. +

+ + +

There is no known workaround at this time.

+ + +

All FluidSynth users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-sound/fluidsynth-2.2.0" + + + + CVE-2021-28421 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-35.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-35.xml new file mode 100644 index 0000000000..392ebaa6e1 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-35.xml @@ -0,0 +1,47 @@ + + + + OpenSCAD: Buffer overflow + A buffer overflow in OpenSCAD might allow remote attacker(s) to + execute arbitrary code. + + openscad + 2021-07-15 + 2021-07-15 + 773217 + remote + + + 2021.01 + 2021.01 + + + +

OpenSCAD is the programmer’s solid 3D CAD modeller.

+ + +

A buffer overflow exists in OpenSCAD when parsing STL files.

+ + +

A remote attacker could entice a user to open a specially crafted STL + file using OpenSCAD, possibly resulting in execution of arbitrary code + with the privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All OpenSCAD users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-gfx/openscad-2021.01" + + + + CVE-2020-28599 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-36.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-36.xml new file mode 100644 index 0000000000..f5fc80d844 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-36.xml @@ -0,0 +1,50 @@ + + + + urllib3: Multiple vulnerabilities + Multiple vulnerabilities have been found in urllib3, the worst of + which could result in a Denial of Service condition. + + urllib3 + 2021-07-15 + 2021-07-15 + 776421 + 799413 + remote + + + 1.26.5 + 1.26.5 + + + +

The urllib3 library is an HTTP library with thread-safe connection + pooling, file post, and more. +

+ + +

Multiple vulnerabilities have been discovered in urllib3. Please review + the CVE identifiers referenced below for details. +

+ + +

An attacker could cause a possible Denial of Service condition.

+ + +

There is no known workaround at this time.

+ + +

All urllib3 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-python/urllib3-1.26.5" + + + + CVE-2021-28363 + CVE-2021-33503 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-37.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-37.xml new file mode 100644 index 0000000000..649bc79dca --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-37.xml @@ -0,0 +1,53 @@ + + + + Apache Commons Collections: Remote code execution + Apache Commons Collections unsafely deserializes untrusted input, + potentially resulting in arbitrary code execution. + + commons-collections + 2021-07-16 + 2021-07-16 + 739348 + remote + + + 3.2.2 + 3.2.2 + + + +

Apache Commons Collections extends the JCF classes with new interfaces, + implementations and utilities. +

+ + +

Some classes in the Apache Commons Collections functor package + deserialized potentially untrusted input by default. +

+ + +

Deserializing untrusted input using Apache Commons Collections could + result in remote code execution. +

+ + +

There is no known workaround at this time.

+ + +

All Apache Commons Collections users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=dev-java/commons-collections-3.2.2" + + + + CVE-2017-15708 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-38.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-38.xml new file mode 100644 index 0000000000..f727464eb5 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-38.xml @@ -0,0 +1,54 @@ + + + + Apache: Multiple vulnerabilities + Multiple vulnerabilities have been found in Apache, the worst of + which could result in a Denial of Service condition. + + apache + 2021-07-17 + 2021-07-17 + 795231 + remote + + + 2.4.48 + 2.4.48 + + + +

The Apache HTTP server is one of the most popular web servers on the + Internet. +

+ + +

Multiple vulnerabilities have been discovered in Apache. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Apache users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-servers/apache-2.4.48" + + + + CVE-2019-17567 + CVE-2020-13950 + CVE-2020-35452 + CVE-2021-26690 + CVE-2021-26691 + CVE-2021-30641 + CVE-2021-31618 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-39.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-39.xml new file mode 100644 index 0000000000..42a2dbf5f8 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-39.xml @@ -0,0 +1,59 @@ + + + + Apache Commons FileUpload: Multiple vulnerabilities + Multiple vulnerabilities have been found in Apache Commons + FileUpload, the worst of which could result in a Denial of Service + condition. + + commons-fileupload + 2021-07-17 + 2021-07-17 + 739350 + remote + + + 1.3 + + + +

The Apache Commons FileUpload package makes it easy to add robust, + high-performance, file upload capability to your servlets and web + applications. +

+ + +

Multiple vulnerabilities have been discovered in Apache Commons + FileUpload. Please review the CVE identifiers referenced below for + details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

Gentoo has discontinued support for Apache Commons FileUpload. We + recommend that users unmerge it: +

+ + + # emerge --ask --depclean "dev-java/commons-fileupload" + + +

NOTE: The Gentoo developer(s) maintaining Apache Commons FileUpload have + discontinued support at this time. It may be possible that a new Gentoo + developer will update Apache Commons FileUpload at a later date. We do + not have a suggestion for a replacement at this time. +

+ + + CVE-2013-0248 + CVE-2014-0050 + CVE-2016-3092 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-40.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-40.xml new file mode 100644 index 0000000000..3ad90ee21f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-40.xml @@ -0,0 +1,56 @@ + + + + MediaWiki: Multiple vulnerabilities + Multiple vulnerabilities have been found in MediaWiki, the worst of + which could result in a Denial of Service condition. + + mediawiki + 2021-07-17 + 2021-07-17 + 780654 + 797661 + remote + + + 1.36.1 + 1.36.1 + + + +

MediaWiki is a collaborative editing software used by large projects + such as Wikipedia. +

+ + +

Multiple vulnerabilities have been discovered in MediaWiki. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All MediaWiki users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.36.1" + + + + CVE-2021-30152 + CVE-2021-30154 + CVE-2021-30155 + CVE-2021-30157 + CVE-2021-30158 + CVE-2021-30159 + CVE-2021-30458 + CVE-2021-35197 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-41.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-41.xml new file mode 100644 index 0000000000..2e01572b21 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-41.xml @@ -0,0 +1,47 @@ + + + + Dovecot: Multiple vulnerabilities + Multiple vulnerabilities have been found in Dovecot, the worst of + which could result in a Denial of Service condition. + + dovecot + 2021-07-18 + 2021-07-18 + 797349 + remote + + + 2.3.14.1 + 2.3.14.1 + + + +

Dovecot is an open source IMAP and POP3 email server.

+ + +

Multiple vulnerabilities have been discovered in Dovecot. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Dovecot users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-mail/dovecot-2.3.14.1" + + + + CVE-2021-29157 + CVE-2021-33515 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-42.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-42.xml new file mode 100644 index 0000000000..8b6fc8a9b4 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-42.xml @@ -0,0 +1,50 @@ + + + + PJSIP: Multiple vulnerabilities + Multiple vulnerabilities have been found in PJSIP, the worst of + which could result in a Denial of Service condition. + + pjproject + 2021-07-20 + 2021-07-20 + 775359 + remote + + + 2.10-r1 + 2.10-r1 + + + +

PJSIP is a free and open source multimedia communication library written + in C language implementing standard based protocols such as SIP, SDP, + RTP, STUN, TURN, and ICE. +

+ + +

Multiple vulnerabilities have been discovered in PJSIP. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All PJSIP users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/pjproject-2.10-r1" + + + + CVE-2020-15260 + CVE-2021-21375 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-43.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-43.xml new file mode 100644 index 0000000000..aa7e48b719 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-43.xml @@ -0,0 +1,52 @@ + + + + RPM: Multiple vulnerabilities + Multiple vulnerabilities have been found in RPM, the worst of which + could result in remote code execution. + + rpm + 2021-07-20 + 2021-07-20 + 778533 + 787944 + remote + + + 4.16.1.3 + 4.16.1.3 + + + +

The Red Hat Package Manager (RPM) is a command line driven package + management system capable of installing, uninstalling, verifying, + querying, and updating computer software packages. +

+ + +

Multiple vulnerabilities have been discovered in RPM. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All RPM users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-arch/rpm-4.16.1.3" + + + + CVE-2021-20266 + CVE-2021-20271 + CVE-2021-3421 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-44.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-44.xml new file mode 100644 index 0000000000..30a974dc96 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-44.xml @@ -0,0 +1,51 @@ + + + + libslirp: Multiple vulnerabilities + Multiple vulnerabilities have been found in libslirp, the worst of + which could result in a Denial of Service condition. + + libslirp + 2021-07-20 + 2021-07-20 + 796347 + local + + + 4.6.0 + 4.6.0 + + + +

libslirp is a TCP/IP emulator used to provide virtual networking + services. +

+ + +

Multiple vulnerabilities have been discovered in libslirp. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All libslirp users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/libslirp-4.6.0" + + + + CVE-2021-3592 + CVE-2021-3593 + CVE-2021-3594 + CVE-2021-3595 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-45.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-45.xml new file mode 100644 index 0000000000..253cc37b6d --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-45.xml @@ -0,0 +1,61 @@ + + + + PyCharm Community, Professional: Remote code execution + A vulnerability has been found in PyCharm Community and + Professional, potentially resulting in arbitrary code execution. + + pycharm + 2021-07-20 + 2021-07-20 + 797892 + remote + + + 2021.1.2 + 2021.1.2 + + + 2021.1.2 + 2021.1.2 + + + +

PyCharm is the Python IDE for professional developers.

+ + +

Insufficient validation exists within PyCharm’s checks for fetching + projects from VCS. +

+ + +

If a victim can be enticed into fetching a VCS project via PyCharm, a + remote attacker could achieve remote code execution. +

+ + +

There is no known workaround at this time.

+ + +

All PyCharm Community users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=dev-util/pycharm-community-2021.1.2" + + +

All PyCharm Professional users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=dev-util/pycharm-professional-2021.1.2" + + + + CVE-2021-30005 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-46.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-46.xml new file mode 100644 index 0000000000..2c4b4415bd --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-46.xml @@ -0,0 +1,48 @@ + + + + mpv: Format string vulnerability + A format string vulnerability was found in mpv, potentially + resulting in arbitrary code execution. + + mpv + 2021-07-20 + 2021-07-20 + 780474 + remote + + + 0.33.1 + 0.33.1 + + + +

Video player based on MPlayer/mplayer2.

+ + +

mpv uses untrusted input within format strings.

+ + +

A remote attacker could entice a user to open a specially crafted m3u + playlist file using mpv, possibly resulting in execution of arbitrary + code with the privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All mpv users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-video/mpv-0.33.1" + + + + + CVE-2021-30145 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-47.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-47.xml new file mode 100644 index 0000000000..39653c3ca0 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-47.xml @@ -0,0 +1,49 @@ + + + + libpano13: Format string vulnerability + A format string vulnerability has been found in libpano13, + potentially resulting in arbitrary code execution. + + libpano13 + 2021-07-20 + 2021-07-20 + 780486 + remote + + + 2.9.20 + 2.9.20 + + + +

libpano13 is Helmut Dersch’s panorama toolbox library.

+ + +

A format string issue exists within panoFileOutputNamesCreate() where + unvalidated input is passed directly into the formatter. +

+ + +

A remote attacker could entice a user to open a specially crafted file + using libpano13, possibly resulting in execution of arbitrary code with + the privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All libpano13 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/libpano13-2.9.20" + + + + CVE-2021-20307 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-48.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-48.xml new file mode 100644 index 0000000000..93798cdc8b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-48.xml @@ -0,0 +1,49 @@ + + + + systemd: Multiple vulnerabilities + Multiple vulnerabilities have been found in systemd, the worst of + which could result in a Denial of Service condition. + + systemd + 2021-07-20 + 2021-07-20 + 789399 + 803041 + local, remote + + + 248.5 + 248.5 + + + +

A system and service manager.

+ + +

Multiple vulnerabilities have been discovered in systemd. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All systemd users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/systemd-248.5" + + + + CVE-2020-13529 + CVE-2021-33910 + + ajak + ajak + + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-49.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-49.xml new file mode 100644 index 0000000000..66db2e9ee5 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-49.xml @@ -0,0 +1,72 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in the arbitrary execution of code. + + chromium, google-chrome + 2021-07-22 + 2021-07-22 + 802540 + remote + + + 91.0.4472.164 + 91.0.4472.164 + + + 91.0.4472.164 + 91.0.4472.164 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

Multiple vulnerabilities have been discovered in chromium, and + google-chrome. Please review the CVE identifiers referenced below for + details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-91.0.4472.164" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-91.0.4472.164" + + + + CVE-2021-30541 + CVE-2021-30559 + CVE-2021-30560 + CVE-2021-30561 + CVE-2021-30562 + CVE-2021-30563 + CVE-2021-30564 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-50.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-50.xml new file mode 100644 index 0000000000..147944a9d2 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-50.xml @@ -0,0 +1,51 @@ + + + + Singularity: Remote code execution + A vulnerability in Singularity could result in remote code + execution. + + singularity + 2021-07-22 + 2021-07-22 + 792465 + remote + + + 3.7.4 + 3.7.4 + + + +

Singularity is the container platform for performance sensitive + workloads. +

+ + +

Singularity always uses the default remote endpoint, + ‘cloud.syslabs.io’, for action commands using the ‘library://’ + URI rather than the configured remote endpoint. +

+ + +

An attacker that that can push a malicious container to the default + remote endpoint could execute code on hosts that fetch the container. +

+ + +

There is no known workaround at this time.

+ + +

All Singularity users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-cluster/singularity-3.7.4" + + + + CVE-2021-32635 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-51.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-51.xml new file mode 100644 index 0000000000..0b667aeb20 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-51.xml @@ -0,0 +1,47 @@ + + + + IcedTeaWeb: Multiple vulnerabilities + Multiple vulnerabilities have been found in IcedTeaWeb, the worst + of which could result in the arbitrary execution of code. + + icedtea-web + 2021-07-23 + 2021-07-23 + 711392 + remote + + + 1.8.4-r1 + 1.8.4-r1 + + + +

FOSS Java browser plugin and Web Start implementation.

+ + +

Multiple vulnerabilities have been discovered in IcedTeaWeb. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All IcedTeaWeb users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-java/icedtea-web-1.8.4-r1" + + + + CVE-2019-10181 + CVE-2019-10185 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-52.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-52.xml new file mode 100644 index 0000000000..bab0fae4e8 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-52.xml @@ -0,0 +1,47 @@ + + + + Apache Velocity: Multiple vulnerabilities + Multiple vulnerabilities have been found in Apache Velocity, the + worst of which could result in the arbitrary execution of code. + + velocity + 2021-07-23 + 2021-07-23 + 775248 + remote + + + 2.3 + 2.3 + + + +

Apache Velocity is a general purpose template engine.

+ + +

Multiple vulnerabilities have been discovered in Apache Velocity. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Apache Velocity users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-java/velocity-2.3" + + + + CVE-2020-13936 + CVE-2020-13959 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-53.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-53.xml new file mode 100644 index 0000000000..5b93e892e5 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-53.xml @@ -0,0 +1,50 @@ + + + + Leptonica: Multiple vulnerabilities + Multiple vulnerabilities have been found in Leptonica, the worst of + which could result in a Denial of Service condition. + + leptonica + 2021-07-24 + 2021-07-24 + 775629 + remote + + + 1.80.0 + 1.80.0 + + + +

Leptonica is a C library for image processing and analysis.

+ + +

Multiple vulnerabilities have been discovered in Leptonica. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Leptonica users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/leptonica-1.80.0" + + + + CVE-2020-36277 + CVE-2020-36278 + CVE-2020-36279 + CVE-2020-36280 + CVE-2020-36281 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-54.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-54.xml new file mode 100644 index 0000000000..83bb578e11 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-54.xml @@ -0,0 +1,50 @@ + + + + libyang: Multiple vulnerabilities + Multiple vulnerabilities have been found in libyang, the worst of + which could result in a Denial of Service condition. + + libyang + 2021-07-24 + 2021-07-24 + 791373 + remote + + + 1.0.236 + 1.0.236 + + + +

YANG data modeling language library.

+ + +

Multiple vulnerabilities have been discovered in libyang. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All libyang users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/libyang-1.0.236" + + + + CVE-2021-28902 + CVE-2021-28903 + CVE-2021-28904 + CVE-2021-28905 + CVE-2021-28906 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-55.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-55.xml new file mode 100644 index 0000000000..15738c120b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202107-55.xml @@ -0,0 +1,50 @@ + + + + SDL 2: Multiple vulnerabilities + Multiple vulnerabilities have been found in libsdl2, the worst of + which could result in a Denial of Service condition. + + libsdl2 + 2021-07-24 + 2021-07-24 + 766204 + remote + + + 2.0.14-r1 + 2.0.14-r1 + + + +

Simple DirectMedia Layer is a cross-platform development library + designed to provide low level access to audio, keyboard, mouse, joystick, + and graphics hardware via OpenGL and Direct3D. +

+ + +

Multiple vulnerabilities have been discovered in SDL 2. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All SDL 2 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/libsdl2-2.0.14-r1" + + + + CVE-2020-14409 + CVE-2020-14410 + + ajak + ajak + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk index 0090a4e27d..7d44a0782c 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Fri, 15 May 2020 14:08:23 +0000 +Fri, 03 Sep 2021 09:39:05 +0000 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit index 1e05047643..bbcaf950a9 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit @@ -1 +1 @@ -8f997a18382e6fd1fe9722aff738fb088141123c 1589546660 2020-05-15T12:44:20+00:00 +7b9e3c731523fe15934efc37e813384c70ecd7b6 1627096087 2021-07-24T03:08:07+00:00