diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest index eb5b254c6b..3a2c80d1dd 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest @@ -1,23 +1,23 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 -MANIFEST Manifest.files.gz 421384 BLAKE2B bfbe5e356f9fb5467472e01b9ffa4c7ab788e49c049d40c7633dfa4d2ebb5c4bf4f92a4fa43049b85dad5d10c593ecd0e243ea7c1975e84055fc34386f72a4e8 SHA512 f0c1e1729862aec592153456994003bbdbb8f9bff919d3e8a74ef963808bc6065be99f22297469abc9678fd65da4c09918d0a860c5e2f27c193f04efea6f9560 -TIMESTAMP 2018-04-16T16:38:37Z +MANIFEST Manifest.files.gz 423767 BLAKE2B b4b02eedb610a1c6d9e2d0e9f57f61c0c0ddafb48679b275cd19d127faac6f1d44d72cf4d204e2e99bbdadfb9d1e296ea33c63e12cff5af0207e2e6247914ff9 SHA512 ba2fcf04666f32bf8235a27f099dd883ab13109b872e9d00eac03e3e02b976470b0d5a6f1b3ce76acd9005d909e8b6e04ffdfefb9cce629ec213bbe88eb4d8b4 +TIMESTAMP 2018-05-16T20:08:33Z -----BEGIN PGP SIGNATURE----- -iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlrU0Y1fFIAAAAAALgAo +iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlr8j8JfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY -klBfbA/+II6sFbYzfmHBo4ga8eobS/m9HvPovkJSupaE/CJ52UMKsqp18Zr8Ja27 -WRGo6T1onvi916MCzxFgxXNoUQfGMOaXAecOEZUyQ+DlzGtXB7c8u1scUojzgG/0 -FtUEjMr5MUhbvj47OcbGrpnXY6eJEHwMbp/rQuftVORG1+e296B4bihALfpzP9J2 -6nb/Oby8qGY4eXOhENW6s2+U1f5AAYggvxssKxQ+WK24rxPIRKIQn/8jACwdaDyx -YLyL+TXj4JFZ3HTjgDDn44aG1M2fkk/qViWpLw+F1jTaYmNUHUSk57aNtv6z15Yp -7V5cBz+No2gJNPaz2BtIAQw7NhYFV78I1tiQ9FqpB+jPmeBDerhKz/6dcNyekwSk -bGerQHuyO7SRhF+JWrust1OuKcn8z9b8WvV1XpWZo1eQuTSqU6JPFQWaBpVT7+CS -Zb5YBIZuqKyvEwhx8LT7osCDX8cXq4AsRfRJ+PwUL1Eh3dRjPCDURW+0SrYKb+xf -ppzUCJhQjk0iigYsow5d6v03pionjkl4xZWBBetnyGvH3lpb85AylEHCDbhLOx9z -/zM5y3mOl2AddyVQkvEyCDy4z42MjE5gxSAoA4ixjwuFtYsCqrdoa4kotksPhPP5 -52d8oLEf3GvMNMxzILDBdkL6i2amqipA3q0MEyiB/2CblWsBccw= -=AM/3 +klBLhA//RVNgrZDx/5ZGvC+E2NFZhybIh6MHFsCzYZjlm4GH1owjNTBz9Pb4qBmx +I+Nmb9OW6GV+ZBIHG3xaVFeswQD+q4rFObbyF1Yxw/pDaAi3Bmlm6B4vMENcXYTK +9d1QtaE5ronANqnq1tcA/+cHxJSTTqNoTzWPiyfv/mtajuhdI0z+7zTin8+CEELH +SRXJDXjpStwVZbKNP6OrNk7zluuerY86mgAqVMrV2ZIQ0FnEYC3M69Y7U5lccFrc +KxLpqZWNLhBYzrvP+aNdfpPSVrMJhPBnPOYvOm3Q+kP4iiwMuYKWEfgjn0GfepMi +nHY5HUCZAxyB+kl5oHLAe8QL1yU8YfBjcfC9j3ZL25+M2/+WoZwaUNyOpwa5xx0t +8grQY7Sz3/pHE5XIttn7yvRUt2R2kMIukkhY99GNEI0TzDVjZfIoxR9vquV6i7vM +XGL9pGAEW91FSG9ZOeZ8Kb56DePEj7GY/d7lHPnAa10KBWN8YH4j0L+aBCbNiBLM +ugnK9r0C4X5n0/kbPY+5OLP5bdP3RWxjl5aO0BHpx1jFAd0LJgyyAPYMlBC21cva +3eaQjvLmdYab6zpIjJ3eg4Iwk96rgCddwRwWio5nZn50kKF2dnavndMzQIzNp+un +iK7AonyV5Z+E8dgVF1dZd/QX6WecMObMZ50fAa/3zXDuYK+Ce54= +=rOnb -----END PGP SIGNATURE----- diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz index 88a05be6bc..595bc6ad9a 100644 Binary files a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz and b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz differ diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-13.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-13.xml new file mode 100644 index 0000000000..7b1706348f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-13.xml @@ -0,0 +1,63 @@ + + + + ncurses: Multiple vulnerabilities + Multiple vulnerabilities have been found in ncurses, the worst of + which allows remote attackers to execute arbitrary code. + + ncurses + 2018-04-17 + 2018-04-17 + 624644 + 625830 + 629276 + 639706 + remote + + + 6.1 + 6.1 + + + +

Free software emulation of curses in System V.

+
+ +

Multiple vulnerabilities have been discovered in ncurses. Please review + the CVE identifiers referenced below for details. +

+
+ +

A remote attacker, by enticing the user to process untrusted terminfo or + other data, could execute arbitrary code or cause a Denial of Service + condition. +

+
+ +

There is no known workaround at this time.

+
+ +

All ncurses users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-libs/ncurses-6.1:0" + +
+ + CVE-2017-10684 + CVE-2017-10685 + CVE-2017-11112 + CVE-2017-11113 + CVE-2017-13728 + CVE-2017-13729 + CVE-2017-13730 + CVE-2017-13731 + CVE-2017-13732 + CVE-2017-13733 + CVE-2017-13734 + CVE-2017-16879 + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-14.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-14.xml new file mode 100644 index 0000000000..474c1588cb --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-14.xml @@ -0,0 +1,51 @@ + + + + GDK-PixBuf: Remote code execution + A vulnerability has been found in GDK-PixBuf that may allow a + remote attacker to execute arbitrary code. + + gdkpixbuf + 2018-04-17 + 2018-04-17 + 644770 + remote + + + 2.36.11 + 2.36.11 + + + +

GDK-PixBuf is an image loading library for GTK+.

+
+ +

Several integer overflows were discovered in GDK-PixBuf’s gif_get_lzw + function. +

+
+ +

A remote attacker, by enticing a user to process a specially crafted + image file, could execute arbitrary code or cause a Denial of Service + condition. +

+
+ +

There is no known workaround at this time.

+
+ +

All GDK-PixBuf users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-libs/gdk-pixbuf-2.36.11" + +
+ + + CVE-2017-1000422 + + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-15.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-15.xml new file mode 100644 index 0000000000..fe0526b63a --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-15.xml @@ -0,0 +1,52 @@ + + + + Evince: Command injection + A vulnerability has been found in Evince which may allow for + arbitrary command execution. + + evince + 2018-04-17 + 2018-04-17 + 650272 + remote + + + 3.24.2-r1 + 3.24.2-r1 + + + +

Evince is a document viewer for multiple document formats, including + PostScript. +

+
+ +

A vulnerability was discovered in Evince’s handling of filenames while + printing PDF files. +

+
+ +

A remote attacker, by enticing the user to process a specially crafted + file, could execute arbitrary commands. +

+
+ +

There is no known workaround at this time.

+
+ +

All Evince users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-text/evince-3.24.2-r1" + +
+ + + CVE-2017-1000159 + + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-16.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-16.xml new file mode 100644 index 0000000000..14bc438d2f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-16.xml @@ -0,0 +1,61 @@ + + + + ClamAV: Multiple vulnerabilities + Multiple vulnerabilities have been found in ClamAV, the worst of + which may allow remote attackers to execute arbitrary code. + + clamav + 2018-04-22 + 2018-04-22 + 623534 + 625632 + 628686 + 628690 + 649314 + remote + + + 0.99.4 + 0.99.4 + + + +

ClamAV is a GPL virus scanner.

+
+ +

Multiple vulnerabilities have been discovered in ClamAV. Please review + the CVE identifiers referenced below for details. +

+
+ +

A remote attacker, through multiple vectors, could execute arbitrary + code, cause a Denial of Service condition, or have other unspecified + impacts. +

+
+ +

There is no known workaround at this time.

+
+ +

All ClamAV users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.99.4" + +
+ + CVE-2012-6706 + CVE-2017-11423 + CVE-2017-6418 + CVE-2017-6419 + CVE-2017-6420 + CVE-2018-0202 + + CVE-2018-1000085 + + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-17.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-17.xml new file mode 100644 index 0000000000..7390b995ad --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-17.xml @@ -0,0 +1,53 @@ + + + + Quagga: Multiple vulnerabilities + Multiple vulnerabilities have been found in Quagga, the worst of + which could allow remote attackers to execute arbitrary code. + + quagga + 2018-04-22 + 2018-04-22 + 647788 + remote + + + 1.2.4 + 1.2.4 + + + +

Quagga is a free routing daemon replacing Zebra supporting RIP, OSPF and + BGP. +

+
+ +

Multiple vulnerabilities have been discovered in Quagga. Please review + the CVE identifiers referenced below for details. +

+
+ +

A remote attacker, by sending specially crafted packets, could execute + arbitrary code or cause a Denial of Service condition. +

+
+ +

There is no known workaround at this time.

+
+ +

All Quagga users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/quagga-1.2.4" + +
+ + CVE-2018-5378 + CVE-2018-5379 + CVE-2018-5380 + CVE-2018-5381 + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-18.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-18.xml new file mode 100644 index 0000000000..11d18817a8 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-18.xml @@ -0,0 +1,51 @@ + + + + tenshi: Privilege escalation + Gentoo's tenshi ebuild is vulnerable to privilege escalation due to + the way pid files are handled. + + tenshi + 2018-04-22 + 2018-04-22 + 626654 + local + + + 0.17 + 0.17 + + + +

A log monitoring program, designed to watch one or more log files for + lines matching user defined regular expressions and report on the + matches. +

+
+ +

It was discovered that the tenshi ebuild creates a tenshi.pid file after + dropping privileges to a non-root account. +

+
+ +

A local attacker could escalate privileges to root or kill arbitrary + processes. +

+
+ +

There is no known workaround at this time.

+
+ +

All tenshi users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-admin/tenshi-0.17" + +
+ + CVE-2017-11746 + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-19.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-19.xml new file mode 100644 index 0000000000..0bdefb18b2 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-19.xml @@ -0,0 +1,54 @@ + + + + mbed TLS: Multiple vulnerabilites + Multiple vulnerabilities have been found in mbed TLS, the worst of + which could allow remote attackers to execute arbitrary code. + + mbedtls + 2018-04-22 + 2018-04-22 + 647800 + remote + + + 2.7.2 + 2.7.2 + + + +

mbed TLS (previously PolarSSL) is an “easy to understand, use, + integrate and expand” implementation of the TLS and SSL protocols and + the respective cryptographic algorithms and support code required. +

+
+ +

Multiple vulnerabilities have been discovered in mbed TLS. Please review + the CVE identifiers referenced below for details. +

+
+ +

A remote attacker, through multiple vectors, could possibly execute + arbitrary code with the privileges of the process or cause a Denial of + Service condition. +

+
+ +

There is no known workaround at this time.

+
+ +

All mbed TLS users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/mbedtls-2.7.2" + +
+ + CVE-2017-18187 + CVE-2018-0487 + CVE-2018-0488 + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-20.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-20.xml new file mode 100644 index 0000000000..e097d700a0 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-20.xml @@ -0,0 +1,50 @@ + + + + unADF: Remote code execution + Multiple vulnerabilities have been found in unADF that may allow a + remote attacker to execute arbitrary code. + + unadf + 2018-04-22 + 2018-04-22 + 636388 + remote + + + 0.7.12-r1 + 0.7.12-r1 + + + +

An unzip like for .ADF files.

+
+ +

Multiple vulnerabilities were discovered in unADF that can lead to + remote code execution. Please review the CVE identifiers referenced below + for details. +

+
+ +

A remote attacker, by enticing a user to process a specially crafted + file, could execute arbitrary code. +

+
+ +

There is no known workaround at this time.

+
+ +

All unADF users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-arch/unadf-0.7.12-r1" + +
+ + CVE-2016-1243 + CVE-2016-1244 + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-21.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-21.xml new file mode 100644 index 0000000000..f73a5903ab --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-21.xml @@ -0,0 +1,50 @@ + + + + librelp: Remote code execution + A vulnerability has been found in librelp that may allow a remote + attacker to execute arbitrary code. + + librelp + 2018-04-22 + 2018-04-22 + 651192 + remote + + + 1.2.15 + 1.2.15 + + + +

A reliable logging program.

+
+ +

A buffer overflow was discovered in librelp with the handling of x509 + certificates. +

+
+ +

A remote attacker, by sending a specially crafted x509 certificate, + could execute arbitrary code. +

+
+ +

There is no known workaround at this time.

+
+ +

All librelp users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/librelp-1.2.15" + +
+ + + CVE-2018-1000140 + + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-22.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-22.xml new file mode 100644 index 0000000000..ae516bd2d3 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-22.xml @@ -0,0 +1,104 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in the execution of arbitrary code. + + chromium,chrome + 2018-04-24 + 2018-04-24 + 653696 + remote + + + 66.0.3359.117 + 66.0.3359.117 + + + 66.0.3359.117 + 66.0.3359.117 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+
+ +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the referenced CVE identifiers and Google Chrome + Releases for details. +

+
+ +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, cause a Denial of Service condition, bypass + content security controls, or conduct URL spoofing. +

+
+ +

There is no known workaround at this time.

+
+ +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-66.0.3359.117" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-66.0.3359.117" + +
+ + CVE-2018-6085 + CVE-2018-6086 + CVE-2018-6087 + CVE-2018-6088 + CVE-2018-6089 + CVE-2018-6090 + CVE-2018-6091 + CVE-2018-6092 + CVE-2018-6093 + CVE-2018-6094 + CVE-2018-6095 + CVE-2018-6096 + CVE-2018-6097 + CVE-2018-6098 + CVE-2018-6099 + CVE-2018-6100 + CVE-2018-6101 + CVE-2018-6102 + CVE-2018-6103 + CVE-2018-6104 + CVE-2018-6105 + CVE-2018-6106 + CVE-2018-6107 + CVE-2018-6108 + CVE-2018-6109 + CVE-2018-6110 + CVE-2018-6111 + CVE-2018-6112 + CVE-2018-6113 + CVE-2018-6114 + CVE-2018-6115 + CVE-2018-6116 + CVE-2018-6117 + + Google Chrome Release 20180417 + + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-01.xml new file mode 100644 index 0000000000..36f4038742 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-01.xml @@ -0,0 +1,50 @@ + + + + hesiod: Root privilege escalation + A vulnerability was discovered in hesiod which may allow remote + attackers to gain root privileges. + + hesiod + 2018-05-02 + 2018-05-02 + 606652 + local, remote + + + 3.1.0 + + + +

DNS functionality to access to DB of information that changes + infrequently. +

+
+ +

Multiple vulnerabilities have been discovered in hesiod that have + remained unaddressed. Please review the referenced CVE identifiers for + details. +

+
+ +

A remote or local attacker may be able to escalate privileges to root.

+
+ +

There is no known workaround at this time.

+
+ +

Gentoo has discontinued support for hesiod and recommends that users + unmerge the package: +

+ + + # emerge --unmerge "net-dns/hesiod" + +
+ + CVE-2016-10151 + CVE-2016-10152 + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-02.xml new file mode 100644 index 0000000000..d23f963400 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-02.xml @@ -0,0 +1,52 @@ + + + + Python: Buffer overflow + A buffer overflow in Python might allow remote attackers to execute + arbitrary code. + + python + 2018-05-02 + 2018-05-02 + 637938 + remote + + + 2.7.14 + 2.7.14 + + + +

Python is an interpreted, interactive, object-oriented programming + language. +

+
+ +

A buffer overflow was discovered in Python’s PyString_DecodeEscape + function in stringobject.c. +

+
+ +

Remote attackers, by enticing a user to process a specially crafted + file, could execute arbitrary code. +

+
+ +

There is no known workaround at this time.

+
+ +

All Python 2 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.14:2.7" + +
+ + + CVE-2017-1000158 + + + b-man + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-03.xml new file mode 100644 index 0000000000..4b3387ed8c --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-03.xml @@ -0,0 +1,72 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in the execution of arbitrary code. + + chromium, google-chrome + 2018-05-02 + 2018-05-02 + 654384 + remote + + + 66.0.3359.139 + 66.0.3359.139 + + + 66.0.3359.139 + 66.0.3359.139 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+
+ +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the referenced CVE identifiers and Google Chrome + Releases for details. +

+
+ +

A remote attacker could possibly execute arbitrary code with the + privileges of the process. +

+
+ +

There is no known workaround at this time.

+
+ +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-66.0.3359.139" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-66.0.3359.139" + + +
+ + CVE-2018-6118 + + Google Chrome Release 20180426 + + + chrisadr + chrisadr +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-04.xml new file mode 100644 index 0000000000..f63ce11ab6 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-04.xml @@ -0,0 +1,48 @@ + + + + rsync: Arbitrary command execution + A vulnerability in rsync might allow remote attackers to execute + arbitrary commands. + + rsync + 2018-05-08 + 2018-05-08 + 646818 + remote + + + 3.1.3 + 3.1.3 + + + +

File transfer program to keep remote files into sync.

+
+ +

A vulnerability was discovered in rsync’s parse_arguments function in + options.c. +

+
+ +

Remote attackers could possibly execute arbitrary commands with the + privilege of the process. +

+
+ +

There is no known workaround at this time.

+
+ +

All rsync users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/rsync-3.1.3" + +
+ + CVE-2018-5764 + + Zlogene + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-05.xml new file mode 100644 index 0000000000..ef4b236a7e --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-05.xml @@ -0,0 +1,50 @@ + + + + mpv: Remote code execution + A vulnerability has been found in mpv that may allow a remote + attacker to execute arbitrary code. + + mpv + 2018-05-14 + 2018-05-14 + 646886 + local, remote + + + 0.27.2 + 0.27.2 + + + +

Video player based on MPlayer/mplayer2

+
+ +

A vulnerability was discovered in mpv with the handling of HTML + documents containing VIDEO elements. Additionally, mpv accepts arbitrary + URLs in a src attribute without a protocol whitelist in + player/lua/ytdl_hook.lua. +

+
+ +

A remote attacker, by enticing the user to visit a specially crafted web + site, could execute arbitrary code. +

+
+ +

There is no known workaround at this time.

+
+ +

All mpv users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-video/mpv-0.27.2" + +
+ + CVE-2018-6360 + + jmbailey + jmbailey +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk index 14d5754e1d..b9507068ed 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Mon, 16 Apr 2018 16:38:33 +0000 +Wed, 16 May 2018 20:08:29 +0000 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit index 3c4f54fe8d..2680641b2a 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit @@ -1 +1 @@ -aa26a212e36fbca3a9091a00250a459fd6576eae 1523834733 2018-04-15T23:25:33+00:00 +40f254b177f3628d865f1e77c8fd7c94584de14e 1526340152 2018-05-14T23:22:32+00:00