mirrors/flatcar-scripts
1
0
Fork 0
mirror of https://github.com/flatcar/scripts.git synced 2025-08-18 10:27:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #493 from mischief/glsa-2016-12-07

Browse Source 
bump(metadata/glsa): sync with upstream
This commit is contained in:
Nick Owens 2016-12-07 11:05:47 -08:00 committed by GitHub
commit b24d8e0a12
9 changed files with 460 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-12.xml vendored Normal file
View File

@ -0,0 +1,53 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="201612-12">
<title>Patch: Denial of Service</title>
<synopsis>Patch is vulnerable to a locally generated Denial of Service
condition.
</synopsis>
<product type="ebuild">patch</product>
<announced>December 05, 2016</announced>
<revised>December 05, 2016: 1</revised>
<bug>538658</bug>
<access>local</access>
<affected>
<package name="sys-devel/patch" auto="yes" arch="*">
<unaffected range="ge">2.7.4</unaffected>
<vulnerable range="lt">2.7.4</vulnerable>
</package>
</affected>
<background>
<p>Patch takes a patch file containing a difference listing produced by the
diff program and applies those differences to one or more original files,
producing patched versions.
</p>
</background>
<description>
<p>Due to a flaw in Patch, the application can enter an infinite loop when
processing a specially crafted diff file.
</p>
</description>
<impact type="normal">
<p>A local attacker could pass a specially crafted diff file to Patch,
possibly resulting in a Denial of Service condition.
</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All patch users should upgrade to the latest version:</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose "&gt;=sys-devel/patch-2.7.4"
</code>
</resolution>
<references>
</references>
<metadata tag="requester" timestamp="Thu, 25 Feb 2016 07:47:45 +0000">
BlueKnight
</metadata>
<metadata tag="submitter" timestamp="Mon, 05 Dec 2016 01:16:43 +0000">whissi</metadata>
</glsa>

48
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-13.xml vendored Normal file
View File

@ -0,0 +1,48 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="201612-13">
<title>nghttp2: Denial of Service</title>
<synopsis>Nghttp2 is vulnerable to a Denial of Service attack.</synopsis>
<product type="ebuild">nghttp2</product>
<announced>December 05, 2016</announced>
<revised>December 05, 2016: 1</revised>
<bug>574780</bug>
<access>remote</access>
<affected>
<package name="net-libs/nghttp2" auto="yes" arch="*">
<unaffected range="ge">1.7.1</unaffected>
<vulnerable range="lt">1.7.1</vulnerable>
</package>
</affected>
<background>
<p>Nghttp2 is an implementation of HTTP/2 and its header compression
algorithm HPACK in C.
</p>
</background>
<description>
<p>Nghttpd, nghttp, and libnghttp2_asio applications do not limit the
memory usage for the incoming HTTP header field. If a peer sends a
specially crafted HTTP/2 HEADERS frame and CONTINUATION frame, they will
crash with an out of memory error.
</p>
</description>
<impact type="normal">
<p>A remote attacker could possibly cause a Denial of Service condition.</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All nghttp2 users should upgrade to the latest version:</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose "&gt;=net-libs/nghttp2-1.7.1"
</code>
</resolution>
<references>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1544">CVE-2016-1544</uri>
</references>
<metadata tag="requester" timestamp="Tue, 22 Nov 2016 13:39:02 +0000">whissi</metadata>
<metadata tag="submitter" timestamp="Mon, 05 Dec 2016 01:23:37 +0000">whissi</metadata>
</glsa>

55
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-14.xml vendored Normal file
View File

@ -0,0 +1,55 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="201612-14">
<title>util-linux: Arbitrary code execution</title>
<synopsis>A vulnerability was discovered in util-linux, which could
potentially lead to the execution of arbitrary code.
</synopsis>
<product type="ebuild">util-linux</product>
<announced>December 06, 2016</announced>
<revised>December 06, 2016: 1</revised>
<bug>530844</bug>
<access>local</access>
<affected>
<package name="sys-apps/util-linux" auto="yes" arch="*">
<unaffected range="ge">2.26</unaffected>
<vulnerable range="lt">2.26</vulnerable>
</package>
</affected>
<background>
<p>util-linux is a suite of Linux programs including mount and umount,
programs used to mount and unmount filesystems.
</p>
</background>
<description>
<p>A command injection flaw was discovered in util-linux’s “blkid”
utility. It uses caching files (/dev/.blkid.tab or /run/blkid/blkid.tab)
to store info about the UUID, LABEL etc. it finds on certain devices.
However, it does not strip ‘”’ character, so it can be confused to
build variable names containing shell metacharacters, which it would
usually encode inside the value.
</p>
</description>
<impact type="normal">
<p>A local attacker could create a specially crafted partition label
containing arbitrary code which would get executed when the “blkid”
utility processes that value.
</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All util-linux users should upgrade to the latest version:</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose "&gt;=sys-apps/util-linux-2.26"
</code>
</resolution>
<references>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9114">CVE-2014-9114</uri>
</references>
<metadata tag="requester" timestamp="Tue, 22 Nov 2016 22:56:21 +0000">whissi</metadata>
<metadata tag="submitter" timestamp="Tue, 06 Dec 2016 03:44:24 +0000">whissi</metadata>
</glsa>

52
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-15.xml vendored Normal file
View File

@ -0,0 +1,52 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="201612-15">
<title>ARJ: Multiple vulnerabilities</title>
<synopsis>Multiple vulnerabilities have been found in ARJ, the worst of which
may allow attackers to execute arbitrary code.
</synopsis>
<product type="ebuild">arj</product>
<announced>December 06, 2016</announced>
<revised>December 06, 2016: 1</revised>
<bug>535708</bug>
<bug>541500</bug>
<access>local, remote</access>
<affected>
<package name="app-arch/arj" auto="yes" arch="*">
<unaffected range="ge">3.10.22-r5</unaffected>
<vulnerable range="lt">3.10.22-r5</vulnerable>
</package>
</affected>
<background>
<p>Open-source implementation of the ARJ archiver.</p>
</background>
<description>
<p>Multiple vulnerabilities have been discovered in ARJ. Please review the
CVE identifiers referenced below for details.
</p>
</description>
<impact type="normal">
<p>An attacker, using a specially crafted ARJ archive, could possibly
execute arbitrary code with the privileges of the process, or cause a
Denial of Service condition.
</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All ARJ users should upgrade to the latest version:</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose "&gt;=app-arch/arj-3.10.22-r5"
</code>
</resolution>
<references>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0556">CVE-2015-0556</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0557">CVE-2015-0557</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2782">CVE-2015-2782</uri>
</references>
<metadata tag="requester" timestamp="Mon, 28 Nov 2016 01:08:04 +0000">whissi</metadata>
<metadata tag="submitter" timestamp="Tue, 06 Dec 2016 03:45:36 +0000">whissi</metadata>
</glsa>

80
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-16.xml vendored Normal file
View File

@ -0,0 +1,80 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="201612-16">
<title>OpenSSL: Multiple vulnerabilities</title>
<synopsis>Multiple vulnerabilities have been found in OpenSSL, the worst of
which allows attackers to conduct a time based side-channel attack.
</synopsis>
<product type="ebuild">openssl</product>
<announced>December 07, 2016</announced>
<revised>December 07, 2016: 1</revised>
<bug>581234</bug>
<bug>585142</bug>
<bug>585276</bug>
<bug>591454</bug>
<bug>592068</bug>
<bug>592074</bug>
<bug>592082</bug>
<bug>594500</bug>
<bug>595186</bug>
<access>local, remote</access>
<affected>
<package name="dev-libs/openssl" auto="yes" arch="*">
<unaffected range="ge">1.0.2j</unaffected>
<vulnerable range="lt">1.0.2j</vulnerable>
</package>
</affected>
<background>
<p>OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer
(SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general
purpose cryptography library.
</p>
</background>
<description>
<p>Multiple vulnerabilities have been discovered in OpenSSL. Please review
the CVE identifiers and the International Association for Cryptologic
Research’s (IACR) paper, “Make Sure DSA Signing Exponentiations
Really are Constant-Time” for further details.
</p>
</description>
<impact type="normal">
<p>Remote attackers could cause a Denial of Service condition or have other
unspecified impacts. Additionally, a time based side-channel attack may
allow a local attacker to recover a private DSA key.
</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All OpenSSL users should upgrade to the latest version:</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose "&gt;=dev-libs/openssl-1.0.2j"
</code>
</resolution>
<references>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2105">CVE-2016-2105</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2106">CVE-2016-2106</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2107">CVE-2016-2107</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2108">CVE-2016-2108</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2109">CVE-2016-2109</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2176">CVE-2016-2176</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2177">CVE-2016-2177</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2178">CVE-2016-2178</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2180">CVE-2016-2180</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2183">CVE-2016-2183</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6304">CVE-2016-6304</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6305">CVE-2016-6305</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6306">CVE-2016-6306</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7052">CVE-2016-7052</uri>
<uri link="http://eprint.iacr.org/2016/594.pdf">Make Sure DSA Signing
Exponentiations Really are Constant-Time
</uri>
</references>
<metadata tag="requester" timestamp="Mon, 06 Jun 2016 21:30:06 +0000">
BlueKnight
</metadata>
<metadata tag="submitter" timestamp="Wed, 07 Dec 2016 10:26:27 +0000">b-man</metadata>
</glsa>

51
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-17.xml vendored Normal file
View File

@ -0,0 +1,51 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="201612-17">
<title>PECL HTTP: Remote execution of arbitrary code</title>
<synopsis>A buffer overflow in PECL HTTP might allow remote attackers to
execute arbitrary code.
</synopsis>
<product type="ebuild">pecl_http</product>
<announced>December 07, 2016</announced>
<revised>December 07, 2016: 1</revised>
<bug>587466</bug>
<access>remote</access>
<affected>
<package name="dev-php/pecl-http" auto="yes" arch="*">
<unaffected range="rge">2.5.6</unaffected>
<vulnerable range="lt">2.5.6</vulnerable>
</package>
</affected>
<background>
<p>This HTTP extension aims to provide a convenient and powerful
set of functionality for one of PHPs major applications.
</p>
</background>
<description>
<p>A buffer overflow can be triggered in the URL parsing functions of the
PECL HTTP extension. This allows overflowing
a buffer with data originating from an arbitrary HTTP request.
</p>
</description>
<impact type="normal">
<p>A remote attacker, through a specially crafted URI, could possibly
execute arbitrary code with the privileges of the process.
</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All PECL HTTP users should upgrade to the latest version:</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose "&gt;=dev-php/pecl-http-2.5.6"
</code>
</resolution>
<references>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5873">CVE-2016-5873</uri>
</references>
<metadata tag="requester" timestamp="Fri, 25 Nov 2016 03:43:01 +0000">b-man</metadata>
<metadata tag="submitter" timestamp="Wed, 07 Dec 2016 10:29:47 +0000">b-man</metadata>
</glsa>

61
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-18.xml vendored Normal file
View File

@ -0,0 +1,61 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="201612-18">
<title>OpenSSH: Multiple vulnerabilities</title>
<synopsis>Multiple vulnerabilities have been found in OpenSSH, the worst of
which allows remote attackers to cause Denial of Service.
</synopsis>
<product type="ebuild"></product>
<announced>December 07, 2016</announced>
<revised>December 07, 2016: 1</revised>
<bug>576954</bug>
<bug>580410</bug>
<bug>589088</bug>
<bug>590202</bug>
<bug>595342</bug>
<bug>597360</bug>
<access>remote</access>
<affected>
<package name="net-misc/openssh" auto="yes" arch="*">
<unaffected range="ge">7.3_p1-r7</unaffected>
<vulnerable range="lt">7.3_p1-r7</vulnerable>
</package>
</affected>
<background>
<p>OpenSSH is a complete SSH protocol implementation that includes SFTP
client and server support.
</p>
</background>
<description>
<p>Multiple vulnerabilities have been discovered in OpenSSH. Please review
the CVE identifiers referenced below for details.
</p>
</description>
<impact type="normal">
<p>Remote attackers could cause Denial of Service and conduct user
enumeration.
</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All OpenSSH users should upgrade to the latest version:</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose "&gt;=net-misc/openssh-7.3_p1-r7"
</code>
</resolution>
<references>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8325">CVE-2015-8325</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1908">CVE-2016-1908</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3115">CVE-2016-3115</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6210">CVE-2016-6210</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8858">CVE-2016-8858</uri>
</references>
<metadata tag="requester" timestamp="Sat, 17 Sep 2016 05:14:39 +0000">
BlueKnight
</metadata>
<metadata tag="submitter" timestamp="Wed, 07 Dec 2016 10:31:11 +0000">b-man</metadata>
</glsa>

59
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201612-19.xml vendored Normal file
View File

@ -0,0 +1,59 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="201612-19">
<title>Mercurial: Multiple vulnerabilities</title>
<synopsis>Multiple vulnerabilities have been found in Mercurial, the worst of
which could lead to the remote execution of arbitrary code.
</synopsis>
<product type="ebuild">mercurial</product>
<announced>December 07, 2016</announced>
<revised>December 07, 2016: 1</revised>
<bug>533008</bug>
<bug>544332</bug>
<bug>578546</bug>
<bug>582238</bug>
<access>remote</access>
<affected>
<package name="dev-vcs/mercurial" auto="yes" arch="*">
<unaffected range="ge">3.8.4</unaffected>
<vulnerable range="lt">3.8.4</vulnerable>
</package>
</affected>
<background>
<p>Mercurial is a distributed source control management system.</p>
</background>
<description>
<p>Multiple vulnerabilities have been discovered in Mercurial. Please
review the CVE identifier and bug reports referenced for details.
</p>
</description>
<impact type="normal">
<p>A remote attacker could possibly execute arbitrary code with the
privileges of the process.
</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All mercurial users should upgrade to the latest version:</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose "&gt;=dev-vcs/mercurial-3.8.4"
</code>
</resolution>
<references>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9390">CVE-2014-9390</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9462">CVE-2014-9462</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3068">CVE-2016-3068</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3069">CVE-2016-3069</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3105">CVE-2016-3105</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3630">CVE-2016-3630</uri>
</references>
<metadata tag="requester" timestamp="Thu, 15 Jan 2015 22:49:35 +0000">
BlueKnight
</metadata>
<metadata tag="submitter" timestamp="Wed, 07 Dec 2016 10:35:02 +0000">b-man</metadata>
</glsa>

2
sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk vendored
View File

@ -1 +1 @@
Mon, 05 Dec 2016 01:13:17 +0000
Wed, 07 Dec 2016 18:13:28 +0000