mirror of
https://github.com/flatcar/scripts.git
synced 2025-08-19 05:21:23 +02:00
bump(metadata/glsa): sync with upstream
This commit is contained in:
David Michael
parent
dccb032032
commit
99aa76bc84
@ -1,23 +1,23 @@
|
||||
-----BEGIN PGP SIGNED MESSAGE-----
|
||||
Hash: SHA512
|
||||
|
||||
MANIFEST Manifest.files.gz 421384 BLAKE2B bfbe5e356f9fb5467472e01b9ffa4c7ab788e49c049d40c7633dfa4d2ebb5c4bf4f92a4fa43049b85dad5d10c593ecd0e243ea7c1975e84055fc34386f72a4e8 SHA512 f0c1e1729862aec592153456994003bbdbb8f9bff919d3e8a74ef963808bc6065be99f22297469abc9678fd65da4c09918d0a860c5e2f27c193f04efea6f9560
|
||||
TIMESTAMP 2018-04-16T16:38:37Z
|
||||
MANIFEST Manifest.files.gz 423767 BLAKE2B b4b02eedb610a1c6d9e2d0e9f57f61c0c0ddafb48679b275cd19d127faac6f1d44d72cf4d204e2e99bbdadfb9d1e296ea33c63e12cff5af0207e2e6247914ff9 SHA512 ba2fcf04666f32bf8235a27f099dd883ab13109b872e9d00eac03e3e02b976470b0d5a6f1b3ce76acd9005d909e8b6e04ffdfefb9cce629ec213bbe88eb4d8b4
|
||||
TIMESTAMP 2018-05-16T20:08:33Z
|
||||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlrU0Y1fFIAAAAAALgAo
|
||||
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlr8j8JfFIAAAAAALgAo
|
||||
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
|
||||
RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
|
||||
klBfbA/+II6sFbYzfmHBo4ga8eobS/m9HvPovkJSupaE/CJ52UMKsqp18Zr8Ja27
|
||||
WRGo6T1onvi916MCzxFgxXNoUQfGMOaXAecOEZUyQ+DlzGtXB7c8u1scUojzgG/0
|
||||
FtUEjMr5MUhbvj47OcbGrpnXY6eJEHwMbp/rQuftVORG1+e296B4bihALfpzP9J2
|
||||
6nb/Oby8qGY4eXOhENW6s2+U1f5AAYggvxssKxQ+WK24rxPIRKIQn/8jACwdaDyx
|
||||
YLyL+TXj4JFZ3HTjgDDn44aG1M2fkk/qViWpLw+F1jTaYmNUHUSk57aNtv6z15Yp
|
||||
7V5cBz+No2gJNPaz2BtIAQw7NhYFV78I1tiQ9FqpB+jPmeBDerhKz/6dcNyekwSk
|
||||
bGerQHuyO7SRhF+JWrust1OuKcn8z9b8WvV1XpWZo1eQuTSqU6JPFQWaBpVT7+CS
|
||||
Zb5YBIZuqKyvEwhx8LT7osCDX8cXq4AsRfRJ+PwUL1Eh3dRjPCDURW+0SrYKb+xf
|
||||
ppzUCJhQjk0iigYsow5d6v03pionjkl4xZWBBetnyGvH3lpb85AylEHCDbhLOx9z
|
||||
/zM5y3mOl2AddyVQkvEyCDy4z42MjE5gxSAoA4ixjwuFtYsCqrdoa4kotksPhPP5
|
||||
52d8oLEf3GvMNMxzILDBdkL6i2amqipA3q0MEyiB/2CblWsBccw=
|
||||
=AM/3
|
||||
klBLhA//RVNgrZDx/5ZGvC+E2NFZhybIh6MHFsCzYZjlm4GH1owjNTBz9Pb4qBmx
|
||||
I+Nmb9OW6GV+ZBIHG3xaVFeswQD+q4rFObbyF1Yxw/pDaAi3Bmlm6B4vMENcXYTK
|
||||
9d1QtaE5ronANqnq1tcA/+cHxJSTTqNoTzWPiyfv/mtajuhdI0z+7zTin8+CEELH
|
||||
SRXJDXjpStwVZbKNP6OrNk7zluuerY86mgAqVMrV2ZIQ0FnEYC3M69Y7U5lccFrc
|
||||
KxLpqZWNLhBYzrvP+aNdfpPSVrMJhPBnPOYvOm3Q+kP4iiwMuYKWEfgjn0GfepMi
|
||||
nHY5HUCZAxyB+kl5oHLAe8QL1yU8YfBjcfC9j3ZL25+M2/+WoZwaUNyOpwa5xx0t
|
||||
8grQY7Sz3/pHE5XIttn7yvRUt2R2kMIukkhY99GNEI0TzDVjZfIoxR9vquV6i7vM
|
||||
XGL9pGAEW91FSG9ZOeZ8Kb56DePEj7GY/d7lHPnAa10KBWN8YH4j0L+aBCbNiBLM
|
||||
ugnK9r0C4X5n0/kbPY+5OLP5bdP3RWxjl5aO0BHpx1jFAd0LJgyyAPYMlBC21cva
|
||||
3eaQjvLmdYab6zpIjJ3eg4Iwk96rgCddwRwWio5nZn50kKF2dnavndMzQIzNp+un
|
||||
iK7AonyV5Z+E8dgVF1dZd/QX6WecMObMZ50fAa/3zXDuYK+Ce54=
|
||||
=rOnb
|
||||
-----END PGP SIGNATURE-----
|
||||
|
||||
Binary file not shown.
63
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-13.xml
vendored
Normal file
63
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-13.xml
vendored
Normal file
@ -0,0 +1,63 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201804-13">
|
||||
<title>ncurses: Multiple vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in ncurses, the worst of
|
||||
which allows remote attackers to execute arbitrary code.
|
||||
</synopsis>
|
||||
<product type="ebuild">ncurses</product>
|
||||
<announced>2018-04-17</announced>
|
||||
<revised count="1">2018-04-17</revised>
|
||||
<bug>624644</bug>
|
||||
<bug>625830</bug>
|
||||
<bug>629276</bug>
|
||||
<bug>639706</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="sys-libs/ncurses" auto="yes" arch="*">
|
||||
<unaffected range="ge" slot="0">6.1</unaffected>
|
||||
<vulnerable range="lt" slot="0">6.1</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>Free software emulation of curses in System V.</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in ncurses. Please review
|
||||
the CVE identifiers referenced below for details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote attacker, by enticing the user to process untrusted terminfo or
|
||||
other data, could execute arbitrary code or cause a Denial of Service
|
||||
condition.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All ncurses users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=sys-libs/ncurses-6.1:0"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-10684">CVE-2017-10684</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-10685">CVE-2017-10685</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-11112">CVE-2017-11112</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-11113">CVE-2017-11113</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-13728">CVE-2017-13728</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-13729">CVE-2017-13729</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-13730">CVE-2017-13730</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-13731">CVE-2017-13731</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-13732">CVE-2017-13732</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-13733">CVE-2017-13733</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-13734">CVE-2017-13734</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-16879">CVE-2017-16879</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2018-04-15T18:38:59Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2018-04-17T18:18:44Z">b-man</metadata>
|
||||
</glsa>
|
||||
51
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-14.xml
vendored
Normal file
51
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-14.xml
vendored
Normal file
@ -0,0 +1,51 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201804-14">
|
||||
<title>GDK-PixBuf: Remote code execution</title>
|
||||
<synopsis>A vulnerability has been found in GDK-PixBuf that may allow a
|
||||
remote attacker to execute arbitrary code.
|
||||
</synopsis>
|
||||
<product type="ebuild">gdkpixbuf</product>
|
||||
<announced>2018-04-17</announced>
|
||||
<revised count="1">2018-04-17</revised>
|
||||
<bug>644770</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="x11-libs/gdk-pixbuf" auto="yes" arch="*">
|
||||
<unaffected range="ge">2.36.11</unaffected>
|
||||
<vulnerable range="lt">2.36.11</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>GDK-PixBuf is an image loading library for GTK+.</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Several integer overflows were discovered in GDK-PixBuf’s gif_get_lzw
|
||||
function.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote attacker, by enticing a user to process a specially crafted
|
||||
image file, could execute arbitrary code or cause a Denial of Service
|
||||
condition.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All GDK-PixBuf users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=x11-libs/gdk-pixbuf-2.36.11"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-1000422">
|
||||
CVE-2017-1000422
|
||||
</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2018-04-17T17:12:14Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2018-04-17T18:21:26Z">b-man</metadata>
|
||||
</glsa>
|
||||
52
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-15.xml
vendored
Normal file
52
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-15.xml
vendored
Normal file
@ -0,0 +1,52 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201804-15">
|
||||
<title>Evince: Command injection</title>
|
||||
<synopsis>A vulnerability has been found in Evince which may allow for
|
||||
arbitrary command execution.
|
||||
</synopsis>
|
||||
<product type="ebuild">evince</product>
|
||||
<announced>2018-04-17</announced>
|
||||
<revised count="1">2018-04-17</revised>
|
||||
<bug>650272</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="app-text/evince" auto="yes" arch="*">
|
||||
<unaffected range="ge">3.24.2-r1</unaffected>
|
||||
<vulnerable range="lt">3.24.2-r1</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>Evince is a document viewer for multiple document formats, including
|
||||
PostScript.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>A vulnerability was discovered in Evince’s handling of filenames while
|
||||
printing PDF files.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote attacker, by enticing the user to process a specially crafted
|
||||
file, could execute arbitrary commands.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All Evince users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=app-text/evince-3.24.2-r1"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-1000159">
|
||||
CVE-2017-1000159
|
||||
</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2018-04-17T17:27:38Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2018-04-17T18:22:39Z">b-man</metadata>
|
||||
</glsa>
|
||||
61
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-16.xml
vendored
Normal file
61
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-16.xml
vendored
Normal file
@ -0,0 +1,61 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201804-16">
|
||||
<title>ClamAV: Multiple vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in ClamAV, the worst of
|
||||
which may allow remote attackers to execute arbitrary code.
|
||||
</synopsis>
|
||||
<product type="ebuild">clamav</product>
|
||||
<announced>2018-04-22</announced>
|
||||
<revised count="1">2018-04-22</revised>
|
||||
<bug>623534</bug>
|
||||
<bug>625632</bug>
|
||||
<bug>628686</bug>
|
||||
<bug>628690</bug>
|
||||
<bug>649314</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="app-antivirus/clamav" auto="yes" arch="*">
|
||||
<unaffected range="ge">0.99.4</unaffected>
|
||||
<vulnerable range="lt">0.99.4</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>ClamAV is a GPL virus scanner.</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in ClamAV. Please review
|
||||
the CVE identifiers referenced below for details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote attacker, through multiple vectors, could execute arbitrary
|
||||
code, cause a Denial of Service condition, or have other unspecified
|
||||
impacts.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All ClamAV users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.99.4"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2012-6706">CVE-2012-6706</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-11423">CVE-2017-11423</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-6418">CVE-2017-6418</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-6419">CVE-2017-6419</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-6420">CVE-2017-6420</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-0202">CVE-2018-0202</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-1000085">
|
||||
CVE-2018-1000085
|
||||
</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2018-04-22T21:20:11Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2018-04-22T22:32:37Z">b-man</metadata>
|
||||
</glsa>
|
||||
53
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-17.xml
vendored
Normal file
53
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-17.xml
vendored
Normal file
@ -0,0 +1,53 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201804-17">
|
||||
<title>Quagga: Multiple vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in Quagga, the worst of
|
||||
which could allow remote attackers to execute arbitrary code.
|
||||
</synopsis>
|
||||
<product type="ebuild">quagga</product>
|
||||
<announced>2018-04-22</announced>
|
||||
<revised count="1">2018-04-22</revised>
|
||||
<bug>647788</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="net-misc/quagga" auto="yes" arch="*">
|
||||
<unaffected range="ge">1.2.4</unaffected>
|
||||
<vulnerable range="lt">1.2.4</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>Quagga is a free routing daemon replacing Zebra supporting RIP, OSPF and
|
||||
BGP.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in Quagga. Please review
|
||||
the CVE identifiers referenced below for details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="high">
|
||||
<p>A remote attacker, by sending specially crafted packets, could execute
|
||||
arbitrary code or cause a Denial of Service condition.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All Quagga users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=net-misc/quagga-1.2.4"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5378">CVE-2018-5378</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5379">CVE-2018-5379</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5380">CVE-2018-5380</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5381">CVE-2018-5381</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2018-04-20T13:52:43Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2018-04-22T22:35:42Z">b-man</metadata>
|
||||
</glsa>
|
||||
51
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-18.xml
vendored
Normal file
51
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-18.xml
vendored
Normal file
@ -0,0 +1,51 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201804-18">
|
||||
<title>tenshi: Privilege escalation</title>
|
||||
<synopsis>Gentoo's tenshi ebuild is vulnerable to privilege escalation due to
|
||||
the way pid files are handled.
|
||||
</synopsis>
|
||||
<product type="ebuild">tenshi</product>
|
||||
<announced>2018-04-22</announced>
|
||||
<revised count="1">2018-04-22</revised>
|
||||
<bug>626654</bug>
|
||||
<access>local</access>
|
||||
<affected>
|
||||
<package name="app-admin/tenshi" auto="yes" arch="*">
|
||||
<unaffected range="ge">0.17</unaffected>
|
||||
<vulnerable range="lt">0.17</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>A log monitoring program, designed to watch one or more log files for
|
||||
lines matching user defined regular expressions and report on the
|
||||
matches.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>It was discovered that the tenshi ebuild creates a tenshi.pid file after
|
||||
dropping privileges to a non-root account.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A local attacker could escalate privileges to root or kill arbitrary
|
||||
processes.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All tenshi users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=app-admin/tenshi-0.17"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-11746">CVE-2017-11746</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2018-04-18T00:37:51Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2018-04-22T22:37:25Z">b-man</metadata>
|
||||
</glsa>
|
||||
54
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-19.xml
vendored
Normal file
54
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-19.xml
vendored
Normal file
@ -0,0 +1,54 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201804-19">
|
||||
<title>mbed TLS: Multiple vulnerabilites</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in mbed TLS, the worst of
|
||||
which could allow remote attackers to execute arbitrary code.
|
||||
</synopsis>
|
||||
<product type="ebuild">mbedtls</product>
|
||||
<announced>2018-04-22</announced>
|
||||
<revised count="1">2018-04-22</revised>
|
||||
<bug>647800</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="net-libs/mbedtls" auto="yes" arch="*">
|
||||
<unaffected range="ge">2.7.2</unaffected>
|
||||
<vulnerable range="lt">2.7.2</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>mbed TLS (previously PolarSSL) is an “easy to understand, use,
|
||||
integrate and expand” implementation of the TLS and SSL protocols and
|
||||
the respective cryptographic algorithms and support code required.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in mbed TLS. Please review
|
||||
the CVE identifiers referenced below for details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="high">
|
||||
<p>A remote attacker, through multiple vectors, could possibly execute
|
||||
arbitrary code with the privileges of the process or cause a Denial of
|
||||
Service condition.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All mbed TLS users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=net-libs/mbedtls-2.7.2"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-18187">CVE-2017-18187</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-0487">CVE-2018-0487</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-0488">CVE-2018-0488</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2018-04-22T21:30:30Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2018-04-22T23:49:11Z">b-man</metadata>
|
||||
</glsa>
|
||||
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-20.xml
vendored
Normal file
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-20.xml
vendored
Normal file
@ -0,0 +1,50 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201804-20">
|
||||
<title>unADF: Remote code execution</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in unADF that may allow a
|
||||
remote attacker to execute arbitrary code.
|
||||
</synopsis>
|
||||
<product type="ebuild">unadf</product>
|
||||
<announced>2018-04-22</announced>
|
||||
<revised count="1">2018-04-22</revised>
|
||||
<bug>636388</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="app-arch/unadf" auto="yes" arch="*">
|
||||
<unaffected range="ge">0.7.12-r1</unaffected>
|
||||
<vulnerable range="lt">0.7.12-r1</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>An unzip like for .ADF files.</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities were discovered in unADF that can lead to
|
||||
remote code execution. Please review the CVE identifiers referenced below
|
||||
for details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote attacker, by enticing a user to process a specially crafted
|
||||
file, could execute arbitrary code.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All unADF users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=app-arch/unadf-0.7.12-r1"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2016-1243">CVE-2016-1243</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2016-1244">CVE-2016-1244</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2018-04-22T20:59:29Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2018-04-22T23:50:47Z">b-man</metadata>
|
||||
</glsa>
|
||||
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-21.xml
vendored
Normal file
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-21.xml
vendored
Normal file
@ -0,0 +1,50 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201804-21">
|
||||
<title>librelp: Remote code execution</title>
|
||||
<synopsis>A vulnerability has been found in librelp that may allow a remote
|
||||
attacker to execute arbitrary code.
|
||||
</synopsis>
|
||||
<product type="ebuild">librelp</product>
|
||||
<announced>2018-04-22</announced>
|
||||
<revised count="1">2018-04-22</revised>
|
||||
<bug>651192</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="dev-libs/librelp" auto="yes" arch="*">
|
||||
<unaffected range="ge">1.2.15</unaffected>
|
||||
<vulnerable range="lt">1.2.15</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>A reliable logging program.</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>A buffer overflow was discovered in librelp with the handling of x509
|
||||
certificates.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="high">
|
||||
<p>A remote attacker, by sending a specially crafted x509 certificate,
|
||||
could execute arbitrary code.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All librelp users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=dev-libs/librelp-1.2.15"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-1000140">
|
||||
CVE-2018-1000140
|
||||
</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2018-04-22T21:23:29Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2018-04-22T23:52:09Z">b-man</metadata>
|
||||
</glsa>
|
||||
104
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-22.xml
vendored
Normal file
104
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201804-22.xml
vendored
Normal file
@ -0,0 +1,104 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201804-22">
|
||||
<title>Chromium, Google Chrome: Multiple vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in Chromium and Google
|
||||
Chrome, the worst of which could result in the execution of arbitrary code.
|
||||
</synopsis>
|
||||
<product type="ebuild">chromium,chrome</product>
|
||||
<announced>2018-04-24</announced>
|
||||
<revised count="1">2018-04-24</revised>
|
||||
<bug>653696</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="www-client/chromium" auto="yes" arch="*">
|
||||
<unaffected range="ge">66.0.3359.117</unaffected>
|
||||
<vulnerable range="lt">66.0.3359.117</vulnerable>
|
||||
</package>
|
||||
<package name="www-client/google-chrome" auto="yes" arch="*">
|
||||
<unaffected range="ge">66.0.3359.117</unaffected>
|
||||
<vulnerable range="lt">66.0.3359.117</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>Chromium is an open-source browser project that aims to build a safer,
|
||||
faster, and more stable way for all users to experience the web.
|
||||
</p>
|
||||
|
||||
<p>Google Chrome is one fast, simple, and secure browser for all your
|
||||
devices.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in Chromium and Google
|
||||
Chrome. Please review the referenced CVE identifiers and Google Chrome
|
||||
Releases for details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote attacker could possibly execute arbitrary code with the
|
||||
privileges of the process, cause a Denial of Service condition, bypass
|
||||
content security controls, or conduct URL spoofing.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All Chromium users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose
|
||||
">=www-client/chromium-66.0.3359.117"
|
||||
</code>
|
||||
|
||||
<p>All Google Chrome users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose
|
||||
">=www-client/google-chrome-66.0.3359.117"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6085">CVE-2018-6085</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6086">CVE-2018-6086</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6087">CVE-2018-6087</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6088">CVE-2018-6088</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6089">CVE-2018-6089</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6090">CVE-2018-6090</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6091">CVE-2018-6091</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6092">CVE-2018-6092</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6093">CVE-2018-6093</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6094">CVE-2018-6094</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6095">CVE-2018-6095</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6096">CVE-2018-6096</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6097">CVE-2018-6097</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6098">CVE-2018-6098</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6099">CVE-2018-6099</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6100">CVE-2018-6100</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6101">CVE-2018-6101</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6102">CVE-2018-6102</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6103">CVE-2018-6103</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6104">CVE-2018-6104</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6105">CVE-2018-6105</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6106">CVE-2018-6106</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6107">CVE-2018-6107</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6108">CVE-2018-6108</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6109">CVE-2018-6109</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6110">CVE-2018-6110</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6111">CVE-2018-6111</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6112">CVE-2018-6112</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6113">CVE-2018-6113</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6114">CVE-2018-6114</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6115">CVE-2018-6115</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6116">CVE-2018-6116</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6117">CVE-2018-6117</uri>
|
||||
<uri link="https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html">
|
||||
Google Chrome Release 20180417
|
||||
</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2018-04-23T16:38:49Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2018-04-24T00:27:21Z">b-man</metadata>
|
||||
</glsa>
|
||||
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-01.xml
vendored
Normal file
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-01.xml
vendored
Normal file
@ -0,0 +1,50 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201805-01">
|
||||
<title>hesiod: Root privilege escalation </title>
|
||||
<synopsis>A vulnerability was discovered in hesiod which may allow remote
|
||||
attackers to gain root privileges.
|
||||
</synopsis>
|
||||
<product type="ebuild">hesiod</product>
|
||||
<announced>2018-05-02</announced>
|
||||
<revised count="1">2018-05-02</revised>
|
||||
<bug>606652</bug>
|
||||
<access>local, remote</access>
|
||||
<affected>
|
||||
<package name="net-dns/hesiod" auto="yes" arch="*">
|
||||
<vulnerable range="le">3.1.0</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>DNS functionality to access to DB of information that changes
|
||||
infrequently.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in hesiod that have
|
||||
remained unaddressed. Please review the referenced CVE identifiers for
|
||||
details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote or local attacker may be able to escalate privileges to root.</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>Gentoo has discontinued support for hesiod and recommends that users
|
||||
unmerge the package:
|
||||
</p>
|
||||
|
||||
<code>
|
||||
# emerge --unmerge "net-dns/hesiod"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2016-10151">CVE-2016-10151</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2016-10152">CVE-2016-10152</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2018-04-29T17:50:36Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2018-05-02T23:52:01Z">b-man</metadata>
|
||||
</glsa>
|
||||
52
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-02.xml
vendored
Normal file
52
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-02.xml
vendored
Normal file
@ -0,0 +1,52 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201805-02">
|
||||
<title>Python: Buffer overflow</title>
|
||||
<synopsis>A buffer overflow in Python might allow remote attackers to execute
|
||||
arbitrary code.
|
||||
</synopsis>
|
||||
<product type="ebuild">python</product>
|
||||
<announced>2018-05-02</announced>
|
||||
<revised count="1">2018-05-02</revised>
|
||||
<bug>637938</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="dev-lang/python" auto="yes" arch="*">
|
||||
<unaffected range="ge" slot="2.7">2.7.14</unaffected>
|
||||
<vulnerable range="lt" slot="2.7">2.7.14</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>Python is an interpreted, interactive, object-oriented programming
|
||||
language.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>A buffer overflow was discovered in Python’s PyString_DecodeEscape
|
||||
function in stringobject.c.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>Remote attackers, by enticing a user to process a specially crafted
|
||||
file, could execute arbitrary code.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All Python 2 users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.14:2.7"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-1000158">
|
||||
CVE-2017-1000158
|
||||
</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2018-04-24T00:27:08Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2018-05-02T23:53:50Z">b-man</metadata>
|
||||
</glsa>
|
||||
72
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-03.xml
vendored
Normal file
72
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-03.xml
vendored
Normal file
@ -0,0 +1,72 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201805-03">
|
||||
<title>Chromium, Google Chrome: Multiple vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in Chromium and Google
|
||||
Chrome, the worst of which could result in the execution of arbitrary code.
|
||||
</synopsis>
|
||||
<product type="ebuild">chromium, google-chrome</product>
|
||||
<announced>2018-05-02</announced>
|
||||
<revised count="1">2018-05-02</revised>
|
||||
<bug>654384</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="www-client/chromium" auto="yes" arch="*">
|
||||
<unaffected range="ge">66.0.3359.139</unaffected>
|
||||
<vulnerable range="lt">66.0.3359.139</vulnerable>
|
||||
</package>
|
||||
<package name="www-client/google-chrome" auto="yes" arch="*">
|
||||
<unaffected range="ge">66.0.3359.139</unaffected>
|
||||
<vulnerable range="lt">66.0.3359.139</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>Chromium is an open-source browser project that aims to build a safer,
|
||||
faster, and more stable way for all users to experience the web.
|
||||
</p>
|
||||
|
||||
<p>Google Chrome is one fast, simple, and secure browser for all your
|
||||
devices.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in Chromium and Google
|
||||
Chrome. Please review the referenced CVE identifiers and Google Chrome
|
||||
Releases for details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote attacker could possibly execute arbitrary code with the
|
||||
privileges of the process.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All Chromium users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose
|
||||
">=www-client/chromium-66.0.3359.139"
|
||||
</code>
|
||||
|
||||
<p>All Google Chrome users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose
|
||||
">=www-client/google-chrome-66.0.3359.139"
|
||||
</code>
|
||||
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6118">CVE-2018-6118</uri>
|
||||
<uri link="https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop_26.html">
|
||||
Google Chrome Release 20180426
|
||||
</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2018-05-01T23:39:45Z">chrisadr</metadata>
|
||||
<metadata tag="submitter" timestamp="2018-05-02T23:57:25Z">chrisadr</metadata>
|
||||
</glsa>
|
||||
48
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-04.xml
vendored
Normal file
48
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-04.xml
vendored
Normal file
@ -0,0 +1,48 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201805-04">
|
||||
<title>rsync: Arbitrary command execution</title>
|
||||
<synopsis>A vulnerability in rsync might allow remote attackers to execute
|
||||
arbitrary commands.
|
||||
</synopsis>
|
||||
<product type="ebuild">rsync</product>
|
||||
<announced>2018-05-08</announced>
|
||||
<revised count="1">2018-05-08</revised>
|
||||
<bug>646818</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="net-misc/rsync" auto="yes" arch="*">
|
||||
<unaffected range="ge">3.1.3</unaffected>
|
||||
<vulnerable range="lt">3.1.3</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>File transfer program to keep remote files into sync.</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>A vulnerability was discovered in rsync’s parse_arguments function in
|
||||
options.c.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>Remote attackers could possibly execute arbitrary commands with the
|
||||
privilege of the process.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All rsync users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=net-misc/rsync-3.1.3"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5764">CVE-2018-5764</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2018-05-03T08:10:23Z">Zlogene</metadata>
|
||||
<metadata tag="submitter" timestamp="2018-05-08T15:27:34Z">b-man</metadata>
|
||||
</glsa>
|
||||
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-05.xml
vendored
Normal file
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201805-05.xml
vendored
Normal file
@ -0,0 +1,50 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201805-05">
|
||||
<title>mpv: Remote code execution</title>
|
||||
<synopsis>A vulnerability has been found in mpv that may allow a remote
|
||||
attacker to execute arbitrary code.
|
||||
</synopsis>
|
||||
<product type="ebuild">mpv</product>
|
||||
<announced>2018-05-14</announced>
|
||||
<revised count="1">2018-05-14</revised>
|
||||
<bug>646886</bug>
|
||||
<access>local, remote</access>
|
||||
<affected>
|
||||
<package name="media-video/mpv" auto="yes" arch="*">
|
||||
<unaffected range="ge">0.27.2</unaffected>
|
||||
<vulnerable range="lt">0.27.2</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>Video player based on MPlayer/mplayer2</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>A vulnerability was discovered in mpv with the handling of HTML
|
||||
documents containing VIDEO elements. Additionally, mpv accepts arbitrary
|
||||
URLs in a src attribute without a protocol whitelist in
|
||||
player/lua/ytdl_hook.lua.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="high">
|
||||
<p>A remote attacker, by enticing the user to visit a specially crafted web
|
||||
site, could execute arbitrary code.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All mpv users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=media-video/mpv-0.27.2"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6360">CVE-2018-6360</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2018-05-07T16:02:12Z">jmbailey</metadata>
|
||||
<metadata tag="submitter" timestamp="2018-05-14T23:21:56Z">jmbailey</metadata>
|
||||
</glsa>
|
||||
@ -1 +1 @@
|
||||
Mon, 16 Apr 2018 16:38:33 +0000
|
||||
Wed, 16 May 2018 20:08:29 +0000
|
||||
|
||||
@ -1 +1 @@
|
||||
aa26a212e36fbca3a9091a00250a459fd6576eae 1523834733 2018-04-15T23:25:33+00:00
|
||||
40f254b177f3628d865f1e77c8fd7c94584de14e 1526340152 2018-05-14T23:22:32+00:00
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user