From 7fa5018e6fd738400e6ef2a5590f306ef83e9c92 Mon Sep 17 00:00:00 2001 From: Nick Owens Date: Wed, 22 Jun 2016 11:21:22 -0700 Subject: [PATCH] bump(metadata/glsa): sync with upstream --- .../metadata/glsa/glsa-201605-03.xml | 53 +++ .../metadata/glsa/glsa-201605-04.xml | 51 +++ .../metadata/glsa/glsa-201605-05.xml | 59 ++++ .../metadata/glsa/glsa-201605-06.xml | 309 ++++++++++++++++++ .../metadata/glsa/glsa-201606-01.xml | 55 ++++ .../metadata/glsa/glsa-201606-02.xml | 64 ++++ .../metadata/glsa/glsa-201606-03.xml | 55 ++++ .../metadata/glsa/glsa-201606-04.xml | 79 +++++ .../metadata/glsa/glsa-201606-05.xml | 60 ++++ .../metadata/glsa/glsa-201606-06.xml | 59 ++++ .../metadata/glsa/glsa-201606-07.xml | 51 +++ .../metadata/glsa/glsa-201606-08.xml | 68 ++++ .../metadata/glsa/glsa-201606-09.xml | 62 ++++ .../metadata/glsa/glsa-201606-10.xml | 120 +++++++ .../metadata/glsa/timestamp.chk | 2 +- 15 files changed, 1146 insertions(+), 1 deletion(-) create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-03.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-04.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-05.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-06.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-01.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-02.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-03.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-04.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-05.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-06.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-07.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-08.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-09.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-10.xml diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-03.xml new file mode 100644 index 0000000000..d8be23ebd6 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-03.xml @@ -0,0 +1,53 @@ + + + + libfpx: Denial of Service + A double free vulnerability has been discovered in libfpx that + allows remote attackers to cause a Denial of Service. + + libfpx + May 30, 2016 + May 30, 2016: 1 + 395367 + remote + + + 1.3.1_p6 + 1.3.1_p6 + + + +

A library for manipulating FlashPIX images.

+ + +

A double free vulnerability has been discovered in the Free_All_Memory + function in jpeg/dectile.c. +

+ + +

A remote attacker could entice a user to open a specially crafted FPX + image using an application linked against libfpx, possibly resulting in a + Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All libfpx users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/libfpx-1.3.1_p6" + + +

Packages which depend on this library may need to be recompiled. Tools + such as revdep-rebuild may assist in identifying these packages. +

+ + + CVE-2012-0025 + + b-man + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-04.xml new file mode 100644 index 0000000000..b568f84a94 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-04.xml @@ -0,0 +1,51 @@ + + + + rsync: Multiple vulnerabilities + Multiple vulnerabilities have been found in rsync, the worst of + which could allow remote attackers to write arbitrary files. + + + May 30, 2016 + May 30, 2016: 1 + 519108 + 540000 + 569140 + remote + + + 3.1.2 + 3.1.2 + + + +

File transfer program to keep remote files into sync.

+ + +

Multiple vulnerabilities have been discovered in rsync. Please review + the CVE identifiers referenced below for details. +

+ + +

Remote attackers could write arbitrary files via symlink attacks.

+ + +

There is no known workaround at this time.

+ + +

All rsync users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/rsync-3.1.2" + + + + CVE-2014-8242 + CVE-2014-9512 + + + BlueKnight + + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-05.xml new file mode 100644 index 0000000000..f27dedd727 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-05.xml @@ -0,0 +1,59 @@ + + + + Linux-PAM: Multiple vulnerabilities + Multiple vulnerabilities have been found in Linux-PAM, allowing + remote attackers to bypass the auth process and cause Denial of Service. + + pam + May 31, 2016 + May 31, 2016: 1 + 493432 + 505604 + 553302 + remote + + + 1.2.1 + 1.2.1 + + + +

Linux-PAM (Pluggable Authentication Modules) is an architecture allowing + the separation of the development of privilege granting software from the + development of secure and appropriate authentication schemes. +

+ + +

Multiple vulnerabilities have been discovered in Linux-PAM. Please + review the CVE identifiers referenced below for details. +

+ + +

Remote attackers could cause Denial of Service, conduct brute force + attacks, and conduct username enumeration. +

+ + +

There is no known workaround at this time.

+ + +

All Linux-PAM users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-libs/pam-1.2.1" + + + + + CVE-2013-7041 + CVE-2014-2583 + CVE-2015-3238 + CVE-2015-3238 + + + BlueKnight + + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-06.xml new file mode 100644 index 0000000000..2945ac200f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201605-06.xml @@ -0,0 +1,309 @@ + + + + Mozilla Products: Multiple vulnerabilities + Multiple vulnerabilities have been found in Firefox, Thunderbird, + Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with + the worst of which may allow remote execution of arbitrary code. + + firefox + May 31, 2016 + May 31, 2016: 1 + 549356 + 557590 + 559186 + 561246 + 563230 + 564834 + 573074 + 574596 + 576862 + remote + + + 4.12 + 4.12 + + + 3.22.2 + 3.22.2 + + + 38.7.0 + 38.7.0 + + + 38.7.0 + 38.7.0 + + + 38.7.0 + 38.7.0 + + + 38.7.0 + 38.7.0 + + + +

Mozilla Firefox is an open-source web browser, Mozilla Thunderbird an + open-source email client, and the Network Security Service (NSS) is a + library implementing security features like SSL v.2/v.3, TLS, PKCS #5, + PKCS #7, PKCS #11, PKCS #12, S/MIME and X.509 certificates. The + SeaMonkey project is a community effort to deliver production-quality + releases of code derived from the application formerly known as + ‘Mozilla Application Suite’. +

+ + +

Multiple vulnerabilities have been discovered in Firefox, NSS, NSPR, and + Thunderbird. Please review the CVE identifiers referenced below for + details. +

+ + +

A remote attacker could entice a user to view a specially crafted web + page or email, possibly resulting in execution of arbitrary code or a + Denial of Service condition. Furthermore, a remote attacker may be able + to perform Man-in-the-Middle attacks, obtain sensitive information, spoof + the address bar, conduct clickjacking attacks, bypass security + restrictions and protection mechanisms, or have other unspecified + impacts. +

+ + +

There is no known workaround at this time.

+ + +

All NSS users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.22.2" + + +

All Thunderbird users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-38.7.0" + + +

All users of the Thunderbird binary package should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=mail-client/thunderbird-bin-38.7.0" + + +

All Firefox 38.7.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-38.7.0" + + +

All users of the Firefox 38.7.x binary package should upgrade to the + latest version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-38.7.0" + + + + CVE-2015-2708 + CVE-2015-2708 + CVE-2015-2709 + CVE-2015-2709 + CVE-2015-2710 + CVE-2015-2710 + CVE-2015-2711 + CVE-2015-2711 + CVE-2015-2712 + CVE-2015-2712 + CVE-2015-2713 + CVE-2015-2713 + CVE-2015-2714 + CVE-2015-2714 + CVE-2015-2715 + CVE-2015-2715 + CVE-2015-2716 + CVE-2015-2716 + CVE-2015-2717 + CVE-2015-2717 + CVE-2015-2718 + CVE-2015-2718 + CVE-2015-4473 + CVE-2015-4473 + CVE-2015-4474 + CVE-2015-4474 + CVE-2015-4475 + CVE-2015-4475 + CVE-2015-4477 + CVE-2015-4477 + CVE-2015-4478 + CVE-2015-4478 + CVE-2015-4479 + CVE-2015-4479 + CVE-2015-4480 + CVE-2015-4480 + CVE-2015-4481 + CVE-2015-4481 + CVE-2015-4482 + CVE-2015-4482 + CVE-2015-4483 + CVE-2015-4483 + CVE-2015-4484 + CVE-2015-4484 + CVE-2015-4485 + CVE-2015-4485 + CVE-2015-4486 + CVE-2015-4486 + CVE-2015-4487 + CVE-2015-4487 + CVE-2015-4488 + CVE-2015-4488 + CVE-2015-4489 + CVE-2015-4489 + CVE-2015-4490 + CVE-2015-4490 + CVE-2015-4491 + CVE-2015-4491 + CVE-2015-4492 + CVE-2015-4492 + CVE-2015-4493 + CVE-2015-4493 + CVE-2015-7181 + CVE-2015-7182 + CVE-2015-7183 + CVE-2016-1523 + CVE-2016-1523 + CVE-2016-1930 + CVE-2016-1930 + CVE-2016-1931 + CVE-2016-1931 + CVE-2016-1933 + CVE-2016-1933 + CVE-2016-1935 + CVE-2016-1935 + CVE-2016-1937 + CVE-2016-1937 + CVE-2016-1938 + CVE-2016-1938 + CVE-2016-1939 + CVE-2016-1939 + CVE-2016-1940 + CVE-2016-1940 + CVE-2016-1941 + CVE-2016-1941 + CVE-2016-1942 + CVE-2016-1942 + CVE-2016-1943 + CVE-2016-1943 + CVE-2016-1944 + CVE-2016-1944 + CVE-2016-1945 + CVE-2016-1945 + CVE-2016-1946 + CVE-2016-1946 + CVE-2016-1947 + CVE-2016-1947 + CVE-2016-1948 + CVE-2016-1948 + CVE-2016-1949 + CVE-2016-1949 + CVE-2016-1950 + CVE-2016-1950 + CVE-2016-1952 + CVE-2016-1952 + CVE-2016-1953 + CVE-2016-1953 + CVE-2016-1954 + CVE-2016-1954 + CVE-2016-1955 + CVE-2016-1955 + CVE-2016-1956 + CVE-2016-1956 + CVE-2016-1957 + CVE-2016-1957 + CVE-2016-1958 + CVE-2016-1958 + CVE-2016-1959 + CVE-2016-1959 + CVE-2016-1960 + CVE-2016-1960 + CVE-2016-1961 + CVE-2016-1961 + CVE-2016-1962 + CVE-2016-1962 + CVE-2016-1963 + CVE-2016-1963 + CVE-2016-1964 + CVE-2016-1964 + CVE-2016-1965 + CVE-2016-1965 + CVE-2016-1966 + CVE-2016-1966 + CVE-2016-1967 + CVE-2016-1967 + CVE-2016-1968 + CVE-2016-1968 + CVE-2016-1969 + CVE-2016-1969 + CVE-2016-1970 + CVE-2016-1970 + CVE-2016-1971 + CVE-2016-1971 + CVE-2016-1972 + CVE-2016-1972 + CVE-2016-1973 + CVE-2016-1973 + CVE-2016-1974 + CVE-2016-1974 + CVE-2016-1975 + CVE-2016-1975 + CVE-2016-1976 + CVE-2016-1976 + CVE-2016-1977 + CVE-2016-1977 + CVE-2016-1978 + CVE-2016-1978 + CVE-2016-1979 + CVE-2016-1979 + CVE-2016-2790 + CVE-2016-2790 + CVE-2016-2791 + CVE-2016-2791 + CVE-2016-2792 + CVE-2016-2792 + CVE-2016-2793 + CVE-2016-2793 + CVE-2016-2794 + CVE-2016-2794 + CVE-2016-2795 + CVE-2016-2795 + CVE-2016-2796 + CVE-2016-2796 + CVE-2016-2797 + CVE-2016-2797 + CVE-2016-2798 + CVE-2016-2798 + CVE-2016-2799 + CVE-2016-2799 + CVE-2016-2800 + CVE-2016-2800 + CVE-2016-2801 + CVE-2016-2801 + CVE-2016-2802 + CVE-2016-2802 + + + BlueKnight + + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-01.xml new file mode 100644 index 0000000000..a06cdb60a8 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-01.xml @@ -0,0 +1,55 @@ + + + + PuTTY: Multiple vulnerabilities + Multiple vulnerabilities have been found in PuTTY, the worst of + which could lead to arbitrary code execution, or cause a Denial of Service + condition. + + + June 05, 2016 + June 05, 2016: 2 + 565080 + 576524 + remote + + + 0.67 + 0.67 + + + +

PuTTY is a telnet and SSH client.

+ + +

Multiple vulnerabilities have been discovered in PuTTY. Please review + the CVE identifiers referenced below for details. +

+ + +

Stack-based buffer overflow in the SCP command-line utility allows + remote servers to execute arbitrary code or cause a denial of service + condition via a crafted SCP-SINK file-size response to an SCP download + request. +

+ + +

There is no known workaround at this time.

+ + +

All PuTTY users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/putty-0.67" + + + + CVE-2015-5309 + CVE-2016-2563 + + + BlueKnight + + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-02.xml new file mode 100644 index 0000000000..c2d4bbc0b2 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-02.xml @@ -0,0 +1,64 @@ + + + + Puppet Server and Agent: Multiple vulnerabilities + Multiple vulnerabilities have been found in Puppet Server and + Agent, the worst of which could lead to arbitrary code execution. + + + June 05, 2016 + June 05, 2016: 3 + 577450 + 581372 + remote + + + 1.4.2 + 1.4.2 + + + 2.3.2 + 2.3.2 + + + +

Puppet Agent contains Puppet’s main code and all of the dependencies + needed to run it, including Facter, Hiera, and bundled versions of Ruby + and OpenSSL. +

+ + +

Multiple vulnerabilities have been discovered in Puppet Server and + Agent. Please review the CVE identifiers referenced below for details. +

+ + +

Remote attackers, impersonating a trusted broker, could potentially + execute arbitrary code. +

+ + +

There is no known workaround at this time.

+ + +

All Puppet Agent users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-admin/puppet-agent-1.4.2" + + +

All Puppet Server users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-admin/puppetserver-2.3.2" + + + + CVE-2016-2785 + CVE-2016-2786 + + b-man + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-03.xml new file mode 100644 index 0000000000..09e90db955 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-03.xml @@ -0,0 +1,55 @@ + + + + libjpeg-turbo: Multiple vulnerabilities + Two vulnerabilities have been discovered in libjpeg-turbo, the + worse of which could allow remote attackers access to sensitive + information. + + libjpeg-turbo + June 05, 2016 + June 05, 2016: 2 + 491150 + 531418 + remote + + + 1.4.2 + 1.4.2 + + + +

libjpeg-turbo is a MMX, SSE, and SSE2 SIMD accelerated JPEG library

+ + +

libjpeg-turbo does not check for certain duplications of component data + during the reading of segments that follow Start Of Scan (SOS) JPEG + markers. +

+ + +

Remote attackers could obtain sensitive information from uninitialized + memory locations via a crafted JPEG images. +

+ + +

There is no known workaround at this time.

+ + +

All libjpeg-turbo users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/libjpeg-turbo-1.4.2" + + + + + CVE-2013-6629 + CVE-2013-6630 + + + BlueKnight + + mrueg + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-04.xml new file mode 100644 index 0000000000..c1a28955be --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-04.xml @@ -0,0 +1,79 @@ + + + + GnuPG: Multiple vulnerabilities + Multiple vulnerabilities have been found in GnuPG and libgcrypt, + the worst of which may allow a local attacker to obtain confidential key + information. + + gnupg + June 05, 2016 + June 10, 2016: 2 + 534110 + 541564 + 541568 + local, remote + + + 2.0.26-r3 + 1.4.19 + 1.4.20 + 1.4.21 + 1.4.22 + 2.0.26-r3 + + + 1.6.3-r4 + 1.6.3-r4 + + + +

The GNU Privacy Guard, GnuPG, is a free replacement for the PGP suite of + cryptographic software. +

+ + +

Multiple vulnerabilities have been discovered in GnuPG and libgcrypt, + please review the CVE identifiers referenced below for details. +

+ + +

A local attacker could possibly cause a Denial of Service condition. + Side-channel attacks could be leveraged to obtain key material. +

+ + +

There is no known workaround at this time.

+ + +

All GnuPG 2 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-crypt/gnupg-2.0.26-r3" + + +

All GnuPG 1 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-crypt/gnupg-1.4.19" + + +

All libgcrypt users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/libgcrypt-1.6.3-r4" + + + + + CVE-2014-3591 + CVE-2015-0837 + + + BlueKnight + + stanley + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-05.xml new file mode 100644 index 0000000000..057c5fd281 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-05.xml @@ -0,0 +1,60 @@ + + + + spice: Multiple vulnerabilities + Multiple vulnerabilities have been found in spice, the worst of + which may result in the remote execution of arbitrary code. + + + June 16, 2016 + June 16, 2016: 1 + 560006 + 562890 + 584126 + local, remote + + + 0.12.7-r1 + 0.12.7-r1 + + + +

Provides a complete open source solution for remote access to virtual + machines in a seamless way so you can play videos, record audio, share + usb devices and share folders without complications. +

+ + +

Multiple vulnerabilities have been discovered in spice, please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could possibly execute arbitrary code. Additionally, a + local attacker could cause a Denial of Service. +

+ + +

There is no known workaround at this time.

+ + +

All spice users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/spice-0.12.7-r1" + + + + CVE-2015-5260 + CVE-2015-5260 + CVE-2015-5261 + CVE-2015-5261 + CVE-2016-0749 + CVE-2016-2150 + + + BlueKnight + + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-06.xml new file mode 100644 index 0000000000..a9cd5355ac --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-06.xml @@ -0,0 +1,59 @@ + + + + nginx: Multiple vulnerabilities + Multiple vulnerabilities have been found in nginx, the worst of + which may allow a remote attacker to cause a Denial of Service. + + + June 17, 2016 + June 17, 2016: 1 + 560854 + 573046 + 584744 + remote + + + 1.10.1 + 1.10.1 + + + +

nginx is a robust, small, and high performance HTTP and reverse proxy + server. +

+ + +

Multiple vulnerabilities have been discovered in nginx. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could possibly cause a Denial of Service condition via + a crafted packet. +

+ + +

There is no known workaround at this time.

+ + +

All nginx users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.10.1" + + + + + CVE-2013-3587 + + CVE-2016-0742 + CVE-2016-0746 + CVE-2016-0747 + CVE-2016-4450 + CVE-2016-4450 + + b-man + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-07.xml new file mode 100644 index 0000000000..c589b40def --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-07.xml @@ -0,0 +1,51 @@ + + + + dhcpcd: Multiple vulnerabilities + Multiple vulnerabilities have been found in dhcpcd allowing remote + attackers to possibly execute arbitrary code or cause a Denial of Service. + + + June 18, 2016 + June 18, 2016: 2 + 571152 + remote + + + 6.10.0 + 6.10.0 + + + +

A fully featured, yet light weight RFC2131 compliant DHCP client

+ + +

A heap overflow can be triggered via malformed DHCP responses in the + print_option (via dhcp_envoption1) due to incorrect option length values. + These vulnerabilities could also allow remote attackers to trigger an + invalid read/crash via malformed DHCP responses. +

+ + +

Remote attackers could possibly execute arbitrary code with the + privileges of the process or cause Denial of Service. +

+ + +

There is no known workaround at this time.

+ + +

All dhcpcd users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/dhcpcd-6.10.0” + + + + CVE-2016-1503 + CVE-2016-1504 + + K_F + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-08.xml new file mode 100644 index 0000000000..8824cfd36f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-08.xml @@ -0,0 +1,68 @@ + + + + Adobe Flash Player: Multiple vulnerabilities + Multiple vulnerabilities have been found in Adobe Flash Player, the + worst of which allows remote attackers to execute arbitrary code. + + + June 18, 2016 + June 18, 2016: 1 + 579166 + 582670 + 586044 + remote + + + 11.2.202.626 + 11.2.202.626 + + + +

The Adobe Flash Player is a renderer for the SWF file format, which is + commonly used to provide interactive websites. +

+ + +

Multiple vulnerabilities have been discovered in Adobe Flash Player. + Please review the CVE identifiers referenced below for details. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, cause a Denial of Service condition, obtain + sensitive information, or bypass security restrictions. +

+ + +

There is no known workaround at this time.

+ + +

All Adobe Flash Player users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose "www-plugins/adobe-flash-11.2.202.626" + + + + CVE-2016-1019 + CVE-2016-1019 + CVE-2016-1019 + CVE-2016-4117 + CVE-2016-4117 + CVE-2016-4120 + CVE-2016-4120 + CVE-2016-4120 + CVE-2016-4121 + CVE-2016-4160 + CVE-2016-4161 + CVE-2016-4162 + CVE-2016-4163 + CVE-2016-4171 + CVE-2016-4171 + CVE-2016-4171 + + b-man + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-09.xml new file mode 100644 index 0000000000..46661c8205 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-09.xml @@ -0,0 +1,62 @@ + + + + FFmpeg: Multiple vulnerabilities + Multiple vulnerabilities have been found in FFmpeg, the worst of + which could lead to arbitrary code execution or Denial of Service + condition. + + + June 18, 2016 + June 18, 2016: 1 + 528554 + 553732 + 571868 + 577458 + remote + + + 2.8.6 + 2.8.6 + + + +

FFmpeg is a complete, cross-platform solution to record, convert and + stream audio and video. +

+ + +

Multiple vulnerabilities have been discovered in FFmpeg. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could possibly execute arbitrary code or cause a + Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All FFmpeg users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-video/ffmpeg-2.8.6" + + + + CVE-2014-9676 + CVE-2016-1897 + CVE-2016-1898 + CVE-2016-2213 + CVE-2016-2326 + CVE-2016-2327 + CVE-2016-2328 + CVE-2016-2329 + CVE-2016-2330 + + b-man + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-10.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-10.xml new file mode 100644 index 0000000000..16f5d40e2e --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201606-10.xml @@ -0,0 +1,120 @@ + + + + PHP: Multiple vulnerabilities + Multiple vulnerabilities have been found in PHP, the worst of which + could lead to arbitrary code execution, or cause a Denial of Service + condition. + + php + June 19, 2016 + June 19, 2016: 2 + 537586 + 541098 + 544186 + 544330 + 546872 + 549538 + 552408 + 555576 + 555830 + 556952 + 559612 + 562882 + 571254 + 573892 + 577376 + remote + + + 5.6.19 + 5.5.33 + 5.5.34 + 5.5.35 + 5.5.36 + 5.5.37 + 5.5.38 + 5.6.19 + + + +

PHP is a widely-used general-purpose scripting language that is + especially suited for Web development and can be embedded into HTML. +

+ + +

Multiple vulnerabilities have been discovered in PHP. Please review the + CVE identifiers referenced below for details. +

+ + +

An attacker can possibly execute arbitrary code or create a Denial of + Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All PHP 5.4 users should upgrade to the latest 5.5 stable branch, as PHP + 5.4 is now masked in Portage: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev=lang/php-5.5.33" + + +

All PHP 5.5 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev=lang/php-5.5.33" + + +

All PHP 5.6 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev=lang/php-5.6.19" + + + + CVE-2013-6501 + CVE-2014-9705 + CVE-2014-9709 + CVE-2015-0231 + CVE-2015-0273 + CVE-2015-1351 + CVE-2015-1352 + CVE-2015-2301 + CVE-2015-2348 + CVE-2015-2783 + CVE-2015-2787 + CVE-2015-3329 + CVE-2015-3330 + CVE-2015-4021 + CVE-2015-4022 + CVE-2015-4025 + CVE-2015-4026 + CVE-2015-4147 + CVE-2015-4148 + CVE-2015-4642 + CVE-2015-4643 + CVE-2015-4644 + CVE-2015-6831 + CVE-2015-6832 + CVE-2015-6833 + CVE-2015-6834 + CVE-2015-6835 + CVE-2015-6836 + CVE-2015-6837 + CVE-2015-6838 + CVE-2015-7803 + CVE-2015-7804 + + + BlueKnight + + b-man + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk index 50b50e6704..26cd059be4 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Tue, 17 May 2016 17:40:45 +0000 +Wed, 22 Jun 2016 17:40:47 +0000