mirror of
https://github.com/flatcar/scripts.git
synced 2025-08-17 09:56:59 +02:00
bump(metadata/glsa): sync with upstream
This commit is contained in:
David Michael
parent
fdd776e3b5
commit
ac0c8ce016
@ -1,23 +1,23 @@
|
||||
-----BEGIN PGP SIGNED MESSAGE-----
|
||||
Hash: SHA512
|
||||
|
||||
MANIFEST Manifest.files.gz 435197 BLAKE2B 5ef1f755677fba588afa252a22622c045d099b3f39fb6b356786170399bb20e8c58212856a5ddc6f59dc6076e3f84a95376a4dc3b4d5154c7d540151a154c88a SHA512 fb541e904c3c6b5ec17c08e76f9ce1dcd0d8f0b31dee092dd3542b9a34a04890e9a1b1e6b0d78d3523fb451deb84b3316ae6b588a29aec6f4741dfb52941ecc9
|
||||
TIMESTAMP 2018-12-31T15:38:40Z
|
||||
MANIFEST Manifest.files.gz 436466 BLAKE2B 1592f1e1bb1660fe56598a716be2722c8f9b14d74fcc7bf4086935ca129dff18da9e9a7deb43b3b3ab5e34487a04b37269914fde19e2c86f3d80a1165fc058e0 SHA512 814ba1ee894cf6c7438051199c5078a6339901cdea60b6848add142bf264fc54ba915b91229a96a1404f81bdbc5177e162144d5b97ce8351358c43ca91c86df7
|
||||
TIMESTAMP 2019-03-11T01:38:51Z
|
||||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlwqOABfFIAAAAAALgAo
|
||||
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlyFvCtfFIAAAAAALgAo
|
||||
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
|
||||
RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
|
||||
klBxRBAAtUgUnM+koOIrHy98B5Uj8vQ0YUz+hHXxfPZ5I3DjG138tNv+kSSfZtZ1
|
||||
VC9QQSG0svtCjDOUG1CZ6b31Kf1ySFALtcelgTgNp8Y8R1CqoC0UIhd6jhxIEzU3
|
||||
QThllPuldQOr8pOf/3pxDO0gZ/eeXeBF2rnrDq8nDkkqLNTnPBg998fJZGLFTi+S
|
||||
yWYh4Dtyq53TbbQ4tjKwFL8MZnIv9tDt5Xol6socrhWdZvScnpoHgg7W5+LemdYb
|
||||
J/CGgtl9LYn9xvUCCKl5YV/BF3rLH1tJUdZHDrcl1jqSSnmF59uQ17XDOyb47xZH
|
||||
bPU9gxGNvqdDdizqb8mRKILzQqzzBuSiOshuSO29wX4Xh+GcO76JBamw9U6B8O+O
|
||||
G+IjxAN9HaDj0nRzzCqQkhkBpN4dNsySt1bYyqzcTXaLUre6EQAerQE943exCQGX
|
||||
p+UiE4as/EMg6S1EA95K/hshidQHXMbCpqzoK4BCJ9AXgm3WULAJy6JhTEma+4M4
|
||||
7cIKiGtl4G61SxVCt/hVjqKKUZVkjUMo/+PMyclJ1Xrhgomxs1Pv+waX6RQ7ldgs
|
||||
dBALSFUehLiBDCC1HTSUEniPjDmgNNaAclze37jLhjOZUoVaiCDD6wuLHqIFajlC
|
||||
nLejRPqU6qWCOk6ig6UgA68G48Ttf7WXSZ9i/3d1Tw5B5ASWAMM=
|
||||
=qJUW
|
||||
klAPHA/+P/U8xHLyUo0llv8FWLgjEhNDQzpJYEckpNbjTTLXZueHWKItVRvIgY+O
|
||||
VVLeZp4MgQih16YB1lIzYwDMcsYdt1kk/5oytqjkpNgLeude+G5Z65cLw0C1//Y2
|
||||
1+yXTiWs6XpWdVqh3Or7/muHcxpoyxHtVBbbAThx3uv8sgsCEKFxdEC5TTod/i3s
|
||||
+5syLAHAy/0EAO5H3WUEiuh9PZCEZZ+2j9VKLySNQQa6IoYAweXxBQ7+B+ongJAZ
|
||||
s5r/34AiXM3bE7OREc/RnbbtRbjY080BHzrUetFPKdFEH1cNYd/L9OwRqz+j9HpN
|
||||
S9MKO0BMn1Lt/osnAIiPiiRW4/QM9rVSe1yx6gqn4+Z8bubVYEn964Ryo+TRGYOJ
|
||||
eMpf49JbNFjRfqyhr4F/NZpAyxl6m2d1rnI754hgRvAtq/QFZ6777IBGMKePRoqj
|
||||
Z8te+9hP8PG8AJsgx5ZSJXRC0qxhLYPSVx6fVsY+eRe/ykLZdpUz7jZP63xSsz7r
|
||||
sTrA0e10kMp9u9vBzzni8OI8hUratTZLxlTgucNeytXCjCpZh+8XBBTNZD3JwYaG
|
||||
j/pr8JOXrIJ626TQ3lqfTLXc+fwC38/r6hLm1QWuR2fP57V4aXRmJmn99RROb5cX
|
||||
tZNVNGO+xhaQzhBq+3P8ycPDtC1I1x4XQEFLtyFJUIFeCkak3Fk=
|
||||
=J9ze
|
||||
-----END PGP SIGNATURE-----
|
||||
|
||||
Binary file not shown.
55
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-01.xml
vendored
Normal file
55
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-01.xml
vendored
Normal file
@ -0,0 +1,55 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201903-01">
|
||||
<title>Keepalived: Multiple vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in Keepalived, the worst
|
||||
of which could allow an attacker to cause Denial of Service condition.
|
||||
</synopsis>
|
||||
<product type="ebuild">keepalived</product>
|
||||
<announced>2019-03-10</announced>
|
||||
<revised count="1">2019-03-10</revised>
|
||||
<bug>670856</bug>
|
||||
<access>local, remote</access>
|
||||
<affected>
|
||||
<package name="sys-cluster/keepalived" auto="yes" arch="*">
|
||||
<unaffected range="ge">2.0.10</unaffected>
|
||||
<vulnerable range="lt">2.0.10</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>Keepalived is a strong & robust keepalive facility to the Linux
|
||||
Virtual Server project.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in keepalived. Please
|
||||
review the CVE identifiers referenced below for details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote attacker could send a specially crafted request possibly
|
||||
resulting in a Denial of Service condition. A local attacker could
|
||||
perform symlink attacks to overwrite arbitrary files with the privileges
|
||||
of the user running the application.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All Keepalived users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=sys-cluster/keepalived-2.0.10"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-19044">CVE-2018-19044</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-19045">CVE-2018-19045</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-19046">CVE-2018-19046</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-19115">CVE-2018-19115</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2019-01-07T16:53:52Z">whissi</metadata>
|
||||
<metadata tag="submitter" timestamp="2019-03-10T02:16:03Z">pinkbyte</metadata>
|
||||
</glsa>
|
||||
62
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-02.xml
vendored
Normal file
62
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-02.xml
vendored
Normal file
@ -0,0 +1,62 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201903-02">
|
||||
<title>Zsh: User-assisted execution of arbitrary code</title>
|
||||
<synopsis>Input validation errors in Zsh could result in arbitrary code
|
||||
execution.
|
||||
</synopsis>
|
||||
<product type="ebuild">zsh</product>
|
||||
<announced>2019-03-10</announced>
|
||||
<revised count="1">2019-03-10</revised>
|
||||
<bug>665278</bug>
|
||||
<access>local, remote</access>
|
||||
<affected>
|
||||
<package name="app-shells/zsh" auto="yes" arch="*">
|
||||
<unaffected range="ge">5.6</unaffected>
|
||||
<vulnerable range="lt">5.6</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>A shell designed for interactive use, although it is also a powerful
|
||||
scripting language.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Two input validation errors have been discovered in how Zsh parses
|
||||
scripts:
|
||||
</p>
|
||||
|
||||
<ul>
|
||||
<li>Parsing a malformed shebang line could cause Zsh to call a program
|
||||
listed in the second line (CVE-2018-0502)
|
||||
</li>
|
||||
<li>Shebang lines longer than 64 characters are truncated
|
||||
(CVE-2018-13259)
|
||||
</li>
|
||||
</ul>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>An attacker could entice a user to execute a specially crafted script
|
||||
using Zsh, possibly resulting in execution of arbitrary code with the
|
||||
privileges of the process.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All Zsh users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=app-shells/zsh-5.6"
|
||||
</code>
|
||||
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-0502">CVE-2018-0502</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-13259">CVE-2018-13259</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2018-12-31T07:32:39Z">Zlogene</metadata>
|
||||
<metadata tag="submitter" timestamp="2019-03-10T02:21:31Z">ackle</metadata>
|
||||
</glsa>
|
||||
53
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-03.xml
vendored
Normal file
53
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-03.xml
vendored
Normal file
@ -0,0 +1,53 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201903-03">
|
||||
<title>cURL: Multiple vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in cURL, the worst of
|
||||
which could result in a Denial of Service condition.
|
||||
</synopsis>
|
||||
<product type="ebuild">curl</product>
|
||||
<announced>2019-03-10</announced>
|
||||
<revised count="1">2019-03-10</revised>
|
||||
<bug>665292</bug>
|
||||
<bug>670026</bug>
|
||||
<bug>677346</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="net-misc/curl" auto="yes" arch="*">
|
||||
<unaffected range="ge">7.64.0</unaffected>
|
||||
<vulnerable range="lt">7.64.0</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>A command line tool and library for transferring data with URLs.</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in cURL. Please review the
|
||||
CVE identifiers referenced below for details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>Remote attackers could cause a Denial of Service condition.</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All cURL users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=net-misc/curl-7.64.0"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-14618">CVE-2018-14618</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-16839">CVE-2018-16839</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-16840">CVE-2018-16840</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-16842">CVE-2018-16842</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-3822">CVE-2019-3822</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-3823">CVE-2019-3823</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2019-03-10T02:44:40Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2019-03-10T19:47:40Z">b-man</metadata>
|
||||
</glsa>
|
||||
73
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-04.xml
vendored
Normal file
73
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-04.xml
vendored
Normal file
@ -0,0 +1,73 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201903-04">
|
||||
<title>Mozilla Firefox: Multiple vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in Mozilla Firefox, the
|
||||
worst of which may allow execution of arbitrary code.
|
||||
</synopsis>
|
||||
<product type="ebuild">firefox</product>
|
||||
<announced>2019-03-10</announced>
|
||||
<revised count="1">2019-03-10</revised>
|
||||
<bug>672956</bug>
|
||||
<bug>676892</bug>
|
||||
<bug>677856</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="www-client/firefox" auto="yes" arch="*">
|
||||
<unaffected range="ge">60.5.1</unaffected>
|
||||
<vulnerable range="lt">60.5.1</vulnerable>
|
||||
</package>
|
||||
<package name="www-client/firefox-bin" auto="yes" arch="*">
|
||||
<unaffected range="ge">60.5.1</unaffected>
|
||||
<vulnerable range="lt">60.5.1</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>Mozilla Firefox is a popular open-source web browser from the Mozilla
|
||||
Project.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in Mozilla Firefox. Please
|
||||
review the CVE identifiers referenced below for details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote attacker could entice a user to view a specially crafted web
|
||||
page possibly resulting in the execution of arbitrary code with the
|
||||
privileges of the process or cause a Denial of Service condition.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All Mozilla FireFox users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=www-client/firefox-60.5.1"
|
||||
</code>
|
||||
|
||||
<p>All Mozilla FireFox bin users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=www-client/firefox-bin-60.5.1"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-12405">CVE-2018-12405</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-18356">CVE-2018-18356</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-18492">CVE-2018-18492</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-18493">CVE-2018-18493</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-18494">CVE-2018-18494</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-18498">CVE-2018-18498</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-18500">CVE-2018-18500</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-18501">CVE-2018-18501</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-18505">CVE-2018-18505</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-5785">CVE-2019-5785</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2019-02-06T14:21:19Z">whissi</metadata>
|
||||
<metadata tag="submitter" timestamp="2019-03-10T19:49:50Z">b-man</metadata>
|
||||
</glsa>
|
||||
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-05.xml
vendored
Normal file
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-05.xml
vendored
Normal file
@ -0,0 +1,50 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201903-05">
|
||||
<title>Tar: Denial of Service</title>
|
||||
<synopsis>A vulnerability in Tar could led to a Denial of Service condition.</synopsis>
|
||||
<product type="ebuild">tar</product>
|
||||
<announced>2019-03-10</announced>
|
||||
<revised count="1">2019-03-10</revised>
|
||||
<bug>674210</bug>
|
||||
<access>local</access>
|
||||
<affected>
|
||||
<package name="app-arch/tar" auto="yes" arch="*">
|
||||
<unaffected range="ge">1.30-r1</unaffected>
|
||||
<vulnerable range="lt">1.30-r1</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>The Tar program provides the ability to create and manipulate tar
|
||||
archives.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>The sparse_dump_region function in sparse.c file in Tar allows an
|
||||
infinite loop using the --sparse option.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A local attacker could cause a Denial of Service condition by modifying
|
||||
a file that is supposed to be archived by a different user’s process
|
||||
(e.g., a system backup running as root).
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All Tar users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=app-arch/tar-1.30-r1"
|
||||
</code>
|
||||
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-20482">CVE-2018-20482</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2019-03-10T16:20:01Z">Zlogene</metadata>
|
||||
<metadata tag="submitter" timestamp="2019-03-10T20:04:34Z">Zlogene</metadata>
|
||||
</glsa>
|
||||
66
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-06.xml
vendored
Normal file
66
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-06.xml
vendored
Normal file
@ -0,0 +1,66 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201903-06">
|
||||
<title>rdesktop: Multiple vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been discovered in rdesktop, the
|
||||
worst of which could result in the remote execution of arbitrary code.
|
||||
</synopsis>
|
||||
<product type="ebuild">rdesktop</product>
|
||||
<announced>2019-03-10</announced>
|
||||
<revised count="1">2019-03-10</revised>
|
||||
<bug>674558</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="net-misc/rdesktop" auto="yes" arch="*">
|
||||
<unaffected range="ge">1.8.4</unaffected>
|
||||
<vulnerable range="lt">1.8.4</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>rdesktop is a Remote Desktop Protocol (RDP) Client.</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in rdesktop. Please review
|
||||
the CVE identifiers referenced below for details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote attacker could cause a Denial of Service condition, obtain
|
||||
sensitive information, or execute arbitrary code.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All rdesktop users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=net-misc/rdesktop-1.8.4"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-20174">CVE-2018-20174</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-20175">CVE-2018-20175</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-20176">CVE-2018-20176</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-20177">CVE-2018-20177</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-20178">CVE-2018-20178</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-20179">CVE-2018-20179</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-20180">CVE-2018-20180</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-20181">CVE-2018-20181</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-20182">CVE-2018-20182</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-8791">CVE-2018-8791</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-8792">CVE-2018-8792</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-8793">CVE-2018-8793</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-8794">CVE-2018-8794</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-8795">CVE-2018-8795</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-8796">CVE-2018-8796</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-8797">CVE-2018-8797</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-8798">CVE-2018-8798</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-8799">CVE-2018-8799</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-8800">CVE-2018-8800</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2019-03-10T19:30:37Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2019-03-10T20:45:00Z">b-man</metadata>
|
||||
</glsa>
|
||||
52
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-07.xml
vendored
Normal file
52
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-07.xml
vendored
Normal file
@ -0,0 +1,52 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201903-07">
|
||||
<title>systemd: Multiple vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in systemd, the worst of
|
||||
which may allow execution of arbitrary code.
|
||||
</synopsis>
|
||||
<product type="ebuild">systemd</product>
|
||||
<announced>2019-03-10</announced>
|
||||
<revised count="1">2019-03-10</revised>
|
||||
<bug>674144</bug>
|
||||
<bug>677944</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="sys-apps/systemd" auto="yes" arch="*">
|
||||
<unaffected range="ge">239-r4</unaffected>
|
||||
<vulnerable range="lt">239-r4</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>A system and service manager.</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in systemd. Please review
|
||||
the CVE identifiers referenced below for details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>An attacker could cause a Denial of Service condition or possibly
|
||||
execute arbitrary code.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All systemd users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=sys-apps/systemd-239-r4"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-16864">CVE-2018-16864</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-16865">CVE-2018-16865</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-16866">CVE-2018-16866</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-6454">CVE-2019-6454</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2019-03-10T19:34:40Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2019-03-10T20:47:25Z">b-man</metadata>
|
||||
</glsa>
|
||||
48
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-08.xml
vendored
Normal file
48
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201903-08.xml
vendored
Normal file
@ -0,0 +1,48 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201903-08">
|
||||
<title>GNU Wget: Password and metadata leak</title>
|
||||
<synopsis>A vulnerability in GNU Wget which could allow an attacker to obtain
|
||||
sensitive information.
|
||||
</synopsis>
|
||||
<product type="ebuild">wget</product>
|
||||
<announced>2019-03-10</announced>
|
||||
<revised count="1">2019-03-10</revised>
|
||||
<bug>674170</bug>
|
||||
<access>local</access>
|
||||
<affected>
|
||||
<package name="net-misc/wget" auto="yes" arch="*">
|
||||
<unaffected range="ge">1.20.1</unaffected>
|
||||
<vulnerable range="lt">1.20.1</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>GNU Wget is a free software package for retrieving files using HTTP,
|
||||
HTTPS and FTP, the most widely-used Internet protocols.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>A vulnerability was discovered in GNU Wget’s file_metadata in xattr.c.</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A local attacker could obtain sensitive information to include
|
||||
credentials.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All GNU Wget users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=net-misc/wget-1.20.1"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-20483">CVE-2018-20483</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2019-03-10T06:22:02Z">BlueKnight</metadata>
|
||||
<metadata tag="submitter" timestamp="2019-03-10T20:49:49Z">b-man</metadata>
|
||||
</glsa>
|
||||
@ -1 +1 @@
|
||||
Mon, 31 Dec 2018 15:38:36 +0000
|
||||
Mon, 11 Mar 2019 01:38:48 +0000
|
||||
|
||||
@ -1 +1 @@
|
||||
baa5a86124960e22df1f11ab63da9f282dd4cdd3 1546204642 2018-12-30T21:17:22+00:00
|
||||
579d79ed98752445ffce6122ab66094d1cb0110e 1552251022 2019-03-10T20:50:22+00:00
|
||||
|
||||
Loading…
Reference in New Issue
Block a user