mirror of
https://github.com/flatcar/scripts.git
synced 2025-08-17 18:06:59 +02:00
bump(metadata/glsa): sync with upstream
This commit is contained in:
Benjamin Gilbert
Kai Lüke
parent
8e6121e55e
commit
c98c795dc7
@ -1,23 +1,23 @@
|
|||||||
-----BEGIN PGP SIGNED MESSAGE-----
|
-----BEGIN PGP SIGNED MESSAGE-----
|
||||||
Hash: SHA512
|
Hash: SHA512
|
||||||
|
|
||||||
MANIFEST Manifest.files.gz 462212 BLAKE2B 5776c6001abb402454a2b47a7b9bf3bf9047598d1aece9f78d5b9c3c27b9e2beb04358067b23d0aab0fa3a39a6704dbc7989395dc50e173ff19712be407974d6 SHA512 b5ee2fe405b23fa0d01a4455e021e430490898b9d86f37bdd8cdf6f3e1e612bc5782cde9c380e6d19690d6c9d75154b7ece632c229e69202510fa1255c1cb2a6
|
MANIFEST Manifest.files.gz 465570 BLAKE2B a62e99817e32fd8ff7f82db3f63ecd455d8d078254d12926bca9349cd7d4cb7525d19b5ca213653d7ca3a28e5f51b7e4f978944f6a7c39fec3994650ada13ff2 SHA512 ee24891578ae08c29634185ea42adbf62dff9fd502bd411c413a0b0088f0d305dd4dba72180ac6793f6d434a7cc1a30d883831d3d40443eae468994ac283a7ef
|
||||||
TIMESTAMP 2020-04-16T05:39:02Z
|
TIMESTAMP 2020-05-15T14:08:26Z
|
||||||
-----BEGIN PGP SIGNATURE-----
|
-----BEGIN PGP SIGNATURE-----
|
||||||
|
|
||||||
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAl6X73ZfFIAAAAAALgAo
|
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAl6+olpfFIAAAAAALgAo
|
||||||
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
|
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
|
||||||
RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
|
RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
|
||||||
klAwzA/8Dv2dDluNwUU99HrcwRPXsD+VHkUsSIYQz+76O01a+3ypffDSHH8/fTx3
|
klBInA//UsEYg3X87qjYposFYkbACD9iS4i63RKctLCgMXD3wNQLH2hP6A3CmAQT
|
||||||
Z+vH4aT5UPTzB5pKfmmo8zdgJwJosj8Squ/YCE90pVyiChQHk1GTMMpl0rK3va81
|
rEuWnPDuWyWJ7NX7RlWWO0IsNn6lcy628Aw/h4fpM8t0NvtmnZflyt1tXznmez/i
|
||||||
/higcbCeLg9rAu+9qruPkjLGzbXFEkQLIt8lhPlnh2ddE1R8MTeYKIkNa0g1IFyD
|
0Ws4eyP86Kygz+wBfLWeqc+rKY2GHcB+BtY99SxZ9dr9XoK8/DaLbpN7Af1ljkmK
|
||||||
5lPQxDy3D7R5U1Wn3eqnLNzSmZhXum2Ko/pALX9jHTVt3Tfc2pmVqaS0AuTrUpGf
|
pdLRKW04PMMUVAoLTolqK5C2SoveY/AkjH6MA4+oKuaQtTQVCjnfgB3O8RumrdBK
|
||||||
Lxha0BFnig4lMWHzniIz7zgwzo8A2upnFRl+caYxNAQwBvBCoJWBSWoGB4Kecwa2
|
WdWPyDR2W45Bp0a25pFcBcIb8KQdbKk8Rr3c/7rpae7UUG62aKzHo6Ej1d5Ih81B
|
||||||
D+HY/7Y/J1n83//0h+3krFsamRJCwYt4pdFIdv2bBsxWUPlVPLMQWEmN7v06MUCN
|
FWtN2cKeUKSrI5FY8oZnZGVfhzJjKGkTwYm6SsNJ9Oa01/Lt/Vb5RBRgozhdVUdj
|
||||||
mX4bDu/L25m0xeFeGzlU+LiqeVoyIl6I429OfSovMvSn3Xou8kSx31kAgZVThvGK
|
3zihSZ+2h3JJlo/FGLUnqFK8oihZ21wPdztkWre5moVaQ3gg9DIOSl6w5+MT7gqc
|
||||||
xPYGokcU0SAyJket82M5O4NyH+1sNeJEnLj4uya35a6w6u1ZLc7xawpiDxB8Rw5u
|
X6qkpkAOxxsKz/EiVJHPqtdzEAwLAGK15qoaiKxoHFHqGDrPjTyWA+qcrZmUo9l8
|
||||||
/bEgf6InZrX2XHD77dmfGOEEujYVnOrR32+8F9lUVzk8HkR+2ZRRM2bA32QeDQVq
|
MfJ1KPMT+O9uWaOaA4Pnp2enS13q2XpzcoRcsYBKomFezDBOjuZ/Yrq3Cr21ABp+
|
||||||
4RGhSSYJHP6uMpipCEGE3NN79y4/t1oAhAREBm4LIRBoi2uwxX7nB9c15rXnTGem
|
rxdlMO1tV0C992S7W9KxEZGHYNaP0kUkIR/jtLWsaTabVqiSJe6IZGsypr8SbEiU
|
||||||
XRqZUh1Ady6wN+N1iWrsJTmB9I/kaAfMgCjtmfZpsqcnQL5rub8=
|
wISVxlE6KbWGSJmaP/F7e7MnBckTOrLB0vx41r/9+kZbR1whfRQ=
|
||||||
=eM2y
|
=VfoR
|
||||||
-----END PGP SIGNATURE-----
|
-----END PGP SIGNATURE-----
|
||||||
|
|||||||
Binary file not shown.
@ -7,7 +7,7 @@
|
|||||||
</synopsis>
|
</synopsis>
|
||||||
<product type="ebuild">PHP</product>
|
<product type="ebuild">PHP</product>
|
||||||
<announced>2020-03-26</announced>
|
<announced>2020-03-26</announced>
|
||||||
<revised count="1">2020-03-26</revised>
|
<revised count="2">2020-04-23</revised>
|
||||||
<bug>671872</bug>
|
<bug>671872</bug>
|
||||||
<bug>706168</bug>
|
<bug>706168</bug>
|
||||||
<bug>710304</bug>
|
<bug>710304</bug>
|
||||||
@ -15,10 +15,12 @@
|
|||||||
<access>local, remote</access>
|
<access>local, remote</access>
|
||||||
<affected>
|
<affected>
|
||||||
<package name="dev-lang/php" auto="yes" arch="*">
|
<package name="dev-lang/php" auto="yes" arch="*">
|
||||||
<unaffected range="rge">7.2.29</unaffected>
|
<unaffected range="ge" slot="7.2">7.2.29</unaffected>
|
||||||
<unaffected range="rge">7.3.16</unaffected>
|
<unaffected range="ge" slot="7.3">7.3.16</unaffected>
|
||||||
<unaffected range="rge">7.4.4</unaffected>
|
<unaffected range="ge" slot="7.4">7.4.4</unaffected>
|
||||||
<vulnerable range="lt">7.4.4</vulnerable>
|
<vulnerable range="lt" slot="7.2">7.2.29</vulnerable>
|
||||||
|
<vulnerable range="lt" slot="7.3">7.3.16</vulnerable>
|
||||||
|
<vulnerable range="lt" slot="7.4">7.4.4</vulnerable>
|
||||||
</package>
|
</package>
|
||||||
</affected>
|
</affected>
|
||||||
<background>
|
<background>
|
||||||
@ -44,21 +46,21 @@
|
|||||||
|
|
||||||
<code>
|
<code>
|
||||||
# emerge --sync
|
# emerge --sync
|
||||||
# emerge --ask --oneshot --verbose ">=dev-lang/php-7.2.29"
|
# emerge --ask --oneshot --verbose ">=dev-lang/php-7.2.29:7.2"
|
||||||
</code>
|
</code>
|
||||||
|
|
||||||
<p>All PHP 7.3.x users should upgrade to the latest version:</p>
|
<p>All PHP 7.3.x users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
<code>
|
<code>
|
||||||
# emerge --sync
|
# emerge --sync
|
||||||
# emerge --ask --oneshot --verbose ">=dev-lang/php-7.3.16"
|
# emerge --ask --oneshot --verbose ">=dev-lang/php-7.3.16:7.3"
|
||||||
</code>
|
</code>
|
||||||
|
|
||||||
<p>All PHP 7.4.x users should upgrade to the latest version:</p>
|
<p>All PHP 7.4.x users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
<code>
|
<code>
|
||||||
# emerge --sync
|
# emerge --sync
|
||||||
# emerge --ask --oneshot --verbose ">=dev-lang/php-7.4.4"
|
# emerge --ask --oneshot --verbose ">=dev-lang/php-7.4.4:7.4"
|
||||||
</code>
|
</code>
|
||||||
|
|
||||||
</resolution>
|
</resolution>
|
||||||
@ -74,5 +76,5 @@
|
|||||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-7066">CVE-2020-7066</uri>
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-7066">CVE-2020-7066</uri>
|
||||||
</references>
|
</references>
|
||||||
<metadata tag="requester" timestamp="2020-03-26T13:24:45Z">whissi</metadata>
|
<metadata tag="requester" timestamp="2020-03-26T13:24:45Z">whissi</metadata>
|
||||||
<metadata tag="submitter" timestamp="2020-03-26T13:30:45Z">whissi</metadata>
|
<metadata tag="submitter" timestamp="2020-04-23T15:24:32Z">whissi</metadata>
|
||||||
</glsa>
|
</glsa>
|
||||||
|
|||||||
@ -7,21 +7,17 @@
|
|||||||
</synopsis>
|
</synopsis>
|
||||||
<product type="ebuild">virtualbox</product>
|
<product type="ebuild">virtualbox</product>
|
||||||
<announced>2020-04-01</announced>
|
<announced>2020-04-01</announced>
|
||||||
<revised count="1">2020-04-01</revised>
|
<revised count="2">2020-04-26</revised>
|
||||||
<bug>714064</bug>
|
<bug>714064</bug>
|
||||||
<access>local, remote</access>
|
<access>local, remote</access>
|
||||||
<affected>
|
<affected>
|
||||||
<package name="app-emulation/virtualbox" auto="yes" arch="*">
|
<package name="app-emulation/virtualbox" auto="yes" arch="*">
|
||||||
<unaffected range="rge">5.2.36</unaffected>
|
<unaffected range="ge">5.2.36</unaffected>
|
||||||
<unaffected range="rge">6.0.16</unaffected>
|
<vulnerable range="lt">5.2.36</vulnerable>
|
||||||
<unaffected range="rge">6.1.2</unaffected>
|
|
||||||
<vulnerable range="lt">6.1.2</vulnerable>
|
|
||||||
</package>
|
</package>
|
||||||
<package name="app-emulation/virtualbox-bin" auto="yes" arch="*">
|
<package name="app-emulation/virtualbox-bin" auto="yes" arch="*">
|
||||||
<unaffected range="rge">5.2.36</unaffected>
|
<unaffected range="ge">5.2.36</unaffected>
|
||||||
<unaffected range="rge">6.0.16</unaffected>
|
<vulnerable range="lt">5.2.36</vulnerable>
|
||||||
<unaffected range="rge">6.1.2</unaffected>
|
|
||||||
<vulnerable range="lt">6.1.2</vulnerable>
|
|
||||||
</package>
|
</package>
|
||||||
</affected>
|
</affected>
|
||||||
<background>
|
<background>
|
||||||
@ -118,5 +114,5 @@
|
|||||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-2727">CVE-2020-2727</uri>
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-2727">CVE-2020-2727</uri>
|
||||||
</references>
|
</references>
|
||||||
<metadata tag="requester" timestamp="2020-04-01T19:35:27Z">whissi</metadata>
|
<metadata tag="requester" timestamp="2020-04-01T19:35:27Z">whissi</metadata>
|
||||||
<metadata tag="submitter" timestamp="2020-04-01T19:41:08Z">whissi</metadata>
|
<metadata tag="submitter" timestamp="2020-04-26T19:47:03Z">whissi</metadata>
|
||||||
</glsa>
|
</glsa>
|
||||||
|
|||||||
@ -7,14 +7,13 @@
|
|||||||
</synopsis>
|
</synopsis>
|
||||||
<product type="ebuild">firefox</product>
|
<product type="ebuild">firefox</product>
|
||||||
<announced>2020-04-04</announced>
|
<announced>2020-04-04</announced>
|
||||||
<revised count="1">2020-04-04</revised>
|
<revised count="2">2020-04-17</revised>
|
||||||
<bug>716098</bug>
|
<bug>716098</bug>
|
||||||
<access>remote</access>
|
<access>remote</access>
|
||||||
<affected>
|
<affected>
|
||||||
<package name="www-client/firefox" auto="yes" arch="*">
|
<package name="www-client/firefox" auto="yes" arch="*">
|
||||||
<unaffected range="rge">68.6.1</unaffected>
|
<unaffected range="ge">68.6.1</unaffected>
|
||||||
<unaffected range="rge">74.0.1</unaffected>
|
<vulnerable range="lt">68.6.1</vulnerable>
|
||||||
<vulnerable range="lt">74.0.1</vulnerable>
|
|
||||||
</package>
|
</package>
|
||||||
</affected>
|
</affected>
|
||||||
<background>
|
<background>
|
||||||
@ -43,14 +42,6 @@
|
|||||||
# emerge --sync
|
# emerge --sync
|
||||||
# emerge --ask --oneshot --verbose ">=www-client/firefox-68.6.1"
|
# emerge --ask --oneshot --verbose ">=www-client/firefox-68.6.1"
|
||||||
</code>
|
</code>
|
||||||
|
|
||||||
<p>All Mozilla Firefox users should upgrade to the latest version:</p>
|
|
||||||
|
|
||||||
<code>
|
|
||||||
# emerge --sync
|
|
||||||
# emerge --ask --oneshot --verbose ">=www-client/firefox-74.0.1"
|
|
||||||
</code>
|
|
||||||
|
|
||||||
</resolution>
|
</resolution>
|
||||||
<references>
|
<references>
|
||||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6819">CVE-2020-6819</uri>
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6819">CVE-2020-6819</uri>
|
||||||
@ -60,5 +51,5 @@
|
|||||||
</uri>
|
</uri>
|
||||||
</references>
|
</references>
|
||||||
<metadata tag="requester" timestamp="2020-04-04T10:59:17Z">whissi</metadata>
|
<metadata tag="requester" timestamp="2020-04-04T10:59:17Z">whissi</metadata>
|
||||||
<metadata tag="submitter" timestamp="2020-04-04T11:03:31Z">whissi</metadata>
|
<metadata tag="submitter" timestamp="2020-04-17T23:06:54Z">whissi</metadata>
|
||||||
</glsa>
|
</glsa>
|
||||||
|
|||||||
57
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-10.xml
vendored
Normal file
57
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-10.xml
vendored
Normal file
@ -0,0 +1,57 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202004-10">
|
||||||
|
<title>OpenSSL: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities were found in OpenSSL, the worst of which
|
||||||
|
could allow remote attackers to cause a Denial of Service condition.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">openssl</product>
|
||||||
|
<announced>2020-04-23</announced>
|
||||||
|
<revised count="1">2020-04-23</revised>
|
||||||
|
<bug>702176</bug>
|
||||||
|
<bug>717442</bug>
|
||||||
|
<access>local, remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="dev-libs/openssl" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">1.1.1g</unaffected>
|
||||||
|
<vulnerable range="lt">1.1.1g</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer
|
||||||
|
(SSL v2/v3) and Transport Layer Security (TLS v1/v1.1/v1.2/v1.3) as well
|
||||||
|
as a general purpose cryptography library.
|
||||||
|
</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in OpenSSL. Please review
|
||||||
|
the CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>A remote attacker could perform a malicious crafted TLS 1.3 handshake
|
||||||
|
against an application using OpenSSL, possibly resulting in a Denial of
|
||||||
|
Service condition.
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<p>In addition, it’s feasible that an attacker might attack DH512.</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All OpenSSL users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.1.1g"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-1551">CVE-2019-1551</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-1967">CVE-2020-1967</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-04-23T14:05:13Z">whissi</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-04-23T14:18:55Z">whissi</metadata>
|
||||||
|
</glsa>
|
||||||
69
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-11.xml
vendored
Normal file
69
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-11.xml
vendored
Normal file
@ -0,0 +1,69 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202004-11">
|
||||||
|
<title>Mozilla Firefox: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in Mozilla Firefox, the
|
||||||
|
worst of which could result in the arbitrary execution of code.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">firefox</product>
|
||||||
|
<announced>2020-04-23</announced>
|
||||||
|
<revised count="1">2020-04-23</revised>
|
||||||
|
<bug>716644</bug>
|
||||||
|
<access>local, remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="www-client/firefox" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">68.7.0</unaffected>
|
||||||
|
<vulnerable range="lt">68.7.0</vulnerable>
|
||||||
|
</package>
|
||||||
|
<package name="www-client/firefox-bin" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">68.7.0</unaffected>
|
||||||
|
<vulnerable range="lt">68.7.0</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>Mozilla Firefox is a popular open-source web browser from the Mozilla
|
||||||
|
Project.
|
||||||
|
</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in Mozilla Firefox. Please
|
||||||
|
review the CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>A remote attacker could entice a user to view a specially crafted web
|
||||||
|
page, possibly resulting in the execution of arbitrary code with the
|
||||||
|
privileges of the process, an information leak or a Denial of Service
|
||||||
|
condition.
|
||||||
|
</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All Mozilla Firefox users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=www-client/firefox-68.7.0"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
<p>All Mozilla Firefox binary users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=www-client/firefox-bin-68.7.0"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6821">CVE-2020-6821</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6822">CVE-2020-6822</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6823">CVE-2020-6823</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6824">CVE-2020-6824</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6825">CVE-2020-6825</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6826">CVE-2020-6826</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-04-16T06:32:49Z">BlueKnight</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-04-23T14:28:43Z">whissi</metadata>
|
||||||
|
</glsa>
|
||||||
75
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-12.xml
vendored
Normal file
75
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-12.xml
vendored
Normal file
@ -0,0 +1,75 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202004-12">
|
||||||
|
<title>Chromium, Google Chrome: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in Chromium and Google
|
||||||
|
Chrome, the worst of which could allow remote attackers to execute
|
||||||
|
arbitrary code.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">chromium,google-chrome</product>
|
||||||
|
<announced>2020-04-23</announced>
|
||||||
|
<revised count="1">2020-04-23</revised>
|
||||||
|
<bug>717652</bug>
|
||||||
|
<bug>718826</bug>
|
||||||
|
<access>local, remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="www-client/chromium" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">81.0.4044.122</unaffected>
|
||||||
|
<vulnerable range="lt">81.0.4044.122</vulnerable>
|
||||||
|
</package>
|
||||||
|
<package name="www-client/google-chrome" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">81.0.4044.122</unaffected>
|
||||||
|
<vulnerable range="lt">81.0.4044.122</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>Chromium is an open-source browser project that aims to build a safer,
|
||||||
|
faster, and more stable way for all users to experience the web.
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<p>Google Chrome is one fast, simple, and secure browser for all your
|
||||||
|
devices.
|
||||||
|
</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in Chromium and Google
|
||||||
|
Chrome. Please review the referenced CVE identifiers for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>A remote attacker could entice a user to open a specially crafted HTML
|
||||||
|
or multimedia file using Chromium or Google Chrome, possibly resulting in
|
||||||
|
execution of arbitrary code with the privileges of the process or a
|
||||||
|
Denial of Service condition.
|
||||||
|
</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All Chromium users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose
|
||||||
|
">=www-client/chromium-81.0.4044.122"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
<p>All Google Chrome users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose
|
||||||
|
">=www-client/google-chrome-81.0.4044.122"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6457">CVE-2020-6457</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6458">CVE-2020-6458</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6459">CVE-2020-6459</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6460">CVE-2020-6460</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-04-23T14:33:31Z">whissi</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-04-23T14:36:00Z">whissi</metadata>
|
||||||
|
</glsa>
|
||||||
78
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-13.xml
vendored
Normal file
78
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-13.xml
vendored
Normal file
@ -0,0 +1,78 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202004-13">
|
||||||
|
<title>Git: Information disclosure</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in Git which might all
|
||||||
|
allow attackers to access sensitive information.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">git</product>
|
||||||
|
<announced>2020-04-23</announced>
|
||||||
|
<revised count="1">2020-04-23</revised>
|
||||||
|
<bug>717156</bug>
|
||||||
|
<bug>718710</bug>
|
||||||
|
<access>remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="dev-vcs/git" auto="yes" arch="*">
|
||||||
|
<unaffected range="rge">2.23.3</unaffected>
|
||||||
|
<unaffected range="rge">2.24.3</unaffected>
|
||||||
|
<unaffected range="rge">2.25.4</unaffected>
|
||||||
|
<unaffected range="rge">2.26.2</unaffected>
|
||||||
|
<vulnerable range="lt">2.26.2</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>Git is a free and open source distributed version control system
|
||||||
|
designed to handle everything from small to very large projects with
|
||||||
|
speed and efficiency.
|
||||||
|
</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in Git. Please review the
|
||||||
|
CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="low">
|
||||||
|
<p>A remote attacker, by providing a specially crafted URL, could possibly
|
||||||
|
trick Git into returning credential information for a wrong host.
|
||||||
|
</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>Disabling credential helpers will prevent this vulnerability.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All Git 2.23.x users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=dev-vcs/git-2.23.3"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
<p>All Git 2.24.x users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=dev-vcs/git-2.24.3"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
<p>All Git 2.25.x users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=dev-vcs/git-2.25.4"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
<p>All Git 2.26.x users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=dev-vcs/git-2.26.2"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-11008">CVE-2020-11008</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-5260">CVE-2020-5260</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-04-23T14:48:48Z">whissi</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-04-23T15:16:30Z">whissi</metadata>
|
||||||
|
</glsa>
|
||||||
53
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-14.xml
vendored
Normal file
53
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-14.xml
vendored
Normal file
@ -0,0 +1,53 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202004-14">
|
||||||
|
<title>FontForge: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in FontForge, the worst of
|
||||||
|
which could result in the arbitrary execution of code.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">fontforge</product>
|
||||||
|
<announced>2020-04-30</announced>
|
||||||
|
<revised count="1">2020-04-30</revised>
|
||||||
|
<bug>706778</bug>
|
||||||
|
<bug>715808</bug>
|
||||||
|
<access>local, remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="media-gfx/fontforge" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">20200314</unaffected>
|
||||||
|
<vulnerable range="lt">20200314</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>FontForge is a PostScript font editor and converter.</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in FontForge. Please
|
||||||
|
review the CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>A remote attacker could entice a user to open a specially crafted font
|
||||||
|
using FontForge, possibly resulting in execution of arbitrary code with
|
||||||
|
the privileges of the process or a Denial of Service condition.
|
||||||
|
</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All FontForge users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=media-gfx/fontforge-20200314"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-15785">CVE-2019-15785</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-5395">CVE-2020-5395</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-5496">CVE-2020-5496</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-04-01T20:32:15Z">whissi</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-04-30T23:00:58Z">whissi</metadata>
|
||||||
|
</glsa>
|
||||||
51
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-15.xml
vendored
Normal file
51
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-15.xml
vendored
Normal file
@ -0,0 +1,51 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202004-15">
|
||||||
|
<title>libu2f-host: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in libu2f-host, the worst
|
||||||
|
of which could result in the execution of code.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">libu2f-host</product>
|
||||||
|
<announced>2020-04-30</announced>
|
||||||
|
<revised count="1">2020-04-30</revised>
|
||||||
|
<bug>678580</bug>
|
||||||
|
<bug>679724</bug>
|
||||||
|
<access>local, remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="app-crypt/libu2f-host" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">1.1.10</unaffected>
|
||||||
|
<vulnerable range="lt">1.1.10</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>Yubico Universal 2nd Factor (U2F) Host C Library.</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in libu2f-host. Please
|
||||||
|
review the CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="high">
|
||||||
|
<p>A remote attacker could entice a user to plug-in a malicious USB device,
|
||||||
|
possibly resulting in execution of arbitrary code with the privileges of
|
||||||
|
the process or a Denial of Service condition.
|
||||||
|
</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All libu2f-host users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=app-crypt/libu2f-host-1.1.10"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-20340">CVE-2018-20340</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-9578">CVE-2019-9578</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-04-16T07:16:39Z">BlueKnight</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-04-30T23:12:17Z">b-man</metadata>
|
||||||
|
</glsa>
|
||||||
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-16.xml
vendored
Normal file
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-16.xml
vendored
Normal file
@ -0,0 +1,50 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202004-16">
|
||||||
|
<title>Cacti: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in Cacti, the worst of
|
||||||
|
which could result in the arbitrary execution of code.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">cacti</product>
|
||||||
|
<announced>2020-04-30</announced>
|
||||||
|
<revised count="1">2020-04-30</revised>
|
||||||
|
<bug>715166</bug>
|
||||||
|
<bug>716406</bug>
|
||||||
|
<access>remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="net-analyzer/cacti" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">1.2.11</unaffected>
|
||||||
|
<vulnerable range="lt">1.2.11</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>Cacti is a complete frontend to rrdtool.</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in Cacti. Please review
|
||||||
|
the CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>Please review the referenced CVE identifiers for details.</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All Cacti users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=net-analyzer/cacti-1.2.11"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-8813">CVE-2020-8813</uri>
|
||||||
|
<uri link="https://github.com/Cacti/cacti/releases/tag/release%2F1.2.11">
|
||||||
|
Cacti 1.2.11 Release Notes
|
||||||
|
</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-04-08T05:48:28Z">BlueKnight</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-04-30T23:18:03Z">b-man</metadata>
|
||||||
|
</glsa>
|
||||||
60
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-17.xml
vendored
Normal file
60
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202004-17.xml
vendored
Normal file
@ -0,0 +1,60 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202004-17">
|
||||||
|
<title>Django: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in Django, the worst of
|
||||||
|
which could result in privilege escalation.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">django</product>
|
||||||
|
<announced>2020-04-30</announced>
|
||||||
|
<revised count="1">2020-04-30</revised>
|
||||||
|
<bug>692384</bug>
|
||||||
|
<bug>701744</bug>
|
||||||
|
<bug>706204</bug>
|
||||||
|
<bug>707998</bug>
|
||||||
|
<bug>711522</bug>
|
||||||
|
<access>remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="dev-python/django" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">2.2.11</unaffected>
|
||||||
|
<vulnerable range="lt">2.2.11</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>Django is a Python-based web framework.</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in Django. Please review
|
||||||
|
the CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>A remote attacker, by sending specially crafted input, could possibly
|
||||||
|
cause a Denial of Service condition, or alter the database.
|
||||||
|
</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All Django users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=dev-python/django-2.2.11"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-12308">CVE-2019-12308</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-14232">CVE-2019-14232</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-14233">CVE-2019-14233</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-14234">CVE-2019-14234</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-14235">CVE-2019-14235</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-19118">CVE-2019-19118</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-19844">CVE-2019-19844</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-7471">CVE-2020-7471</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-9402">CVE-2020-9402</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-04-08T04:55:21Z">BlueKnight</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-04-30T23:30:28Z">b-man</metadata>
|
||||||
|
</glsa>
|
||||||
56
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-01.xml
vendored
Normal file
56
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-01.xml
vendored
Normal file
@ -0,0 +1,56 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202005-01">
|
||||||
|
<title>Long Range ZIP: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in Long Range ZIP, the
|
||||||
|
worst of which could result in a Denial of Service condition.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">lrzip</product>
|
||||||
|
<announced>2020-05-12</announced>
|
||||||
|
<revised count="1">2020-05-12</revised>
|
||||||
|
<bug>617930</bug>
|
||||||
|
<bug>624462</bug>
|
||||||
|
<access>local, remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="app-arch/lrzip" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">0.631_p20190619</unaffected>
|
||||||
|
<vulnerable range="lt">0.631_p20190619</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>Optimized for compressing large files</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in Long Range ZIP. Please
|
||||||
|
review the CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="low">
|
||||||
|
<p>A remote attacker could entice a user to open a specially crafted
|
||||||
|
archive file possibly resulting in a Denial of Service condition.
|
||||||
|
</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All Long Range ZIP users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=app-arch/lrzip-0.631_p20190619"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-8842">CVE-2017-8842</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-8843">CVE-2017-8843</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-8844">CVE-2017-8844</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-8845">CVE-2017-8845</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-8846">CVE-2017-8846</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-8847">CVE-2017-8847</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-9928">CVE-2017-9928</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-9929">CVE-2017-9929</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-04-05T23:09:43Z">BlueKnight</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-05-12T23:29:01Z">b-man</metadata>
|
||||||
|
</glsa>
|
||||||
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-02.xml
vendored
Normal file
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-02.xml
vendored
Normal file
@ -0,0 +1,50 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202005-02">
|
||||||
|
<title>QEMU: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in QEMU, the worst of
|
||||||
|
which could result in the arbitrary execution of code.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">qemu</product>
|
||||||
|
<announced>2020-05-12</announced>
|
||||||
|
<revised count="1">2020-05-12</revised>
|
||||||
|
<bug>716518</bug>
|
||||||
|
<bug>717154</bug>
|
||||||
|
<bug>717770</bug>
|
||||||
|
<access>local</access>
|
||||||
|
<affected>
|
||||||
|
<package name="app-emulation/qemu" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">4.2.0-r5</unaffected>
|
||||||
|
<vulnerable range="lt">4.2.0-r5</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>QEMU is a generic and open source machine emulator and virtualizer.</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in QEMU. Please review the
|
||||||
|
CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>Please review the referenced CVE identifiers for details.</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All QEMU users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=app-emulation/qemu-4.2.0-r5"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-11102">CVE-2020-11102</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-1711">CVE-2020-1711</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-7039">CVE-2020-7039</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-05-04T02:29:17Z">b-man</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-05-12T23:31:56Z">b-man</metadata>
|
||||||
|
</glsa>
|
||||||
72
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-03.xml
vendored
Normal file
72
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-03.xml
vendored
Normal file
@ -0,0 +1,72 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202005-03">
|
||||||
|
<title>Mozilla Thunderbird: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in Mozilla Thunderbird,
|
||||||
|
the worst of which could result in the arbitrary execution of code.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">thunderbird</product>
|
||||||
|
<announced>2020-05-12</announced>
|
||||||
|
<revised count="1">2020-05-12</revised>
|
||||||
|
<bug>721324</bug>
|
||||||
|
<access>remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="mail-client/thunderbird" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">68.8.0</unaffected>
|
||||||
|
<vulnerable range="lt">68.8.0</vulnerable>
|
||||||
|
</package>
|
||||||
|
<package name="mail-client/thunderbird-bin" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">68.8.0</unaffected>
|
||||||
|
<vulnerable range="lt">68.8.0</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>Mozilla Thunderbird is a popular open-source email client from the
|
||||||
|
Mozilla project.
|
||||||
|
</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in Mozilla Thunderbird.
|
||||||
|
Please review the CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>A remote attacker may be able to execute arbitrary code, cause a Denial
|
||||||
|
of Service condition or spoof sender email address.
|
||||||
|
</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All Mozilla Thunderbird users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=mail-client/thunderbird-68.8.0"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
<p>All Mozilla Thunderbird binary users should upgrade to the latest
|
||||||
|
version:
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose
|
||||||
|
">=mail-client/thunderbird-bin-68.8.0"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-12387">CVE-2020-12387</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-12392">CVE-2020-12392</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-12395">CVE-2020-12395</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-12397">CVE-2020-12397</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6831">CVE-2020-6831</uri>
|
||||||
|
<uri link="https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/">
|
||||||
|
MFSA-2020-18
|
||||||
|
</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-05-06T20:22:31Z">sam_c</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-05-12T23:34:15Z">sam_c</metadata>
|
||||||
|
</glsa>
|
||||||
72
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-04.xml
vendored
Normal file
72
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-04.xml
vendored
Normal file
@ -0,0 +1,72 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202005-04">
|
||||||
|
<title>Mozilla Firefox: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in Mozilla Firefox, the
|
||||||
|
worst of which could result in the arbitrary execution of code.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">firefox</product>
|
||||||
|
<announced>2020-05-12</announced>
|
||||||
|
<revised count="1">2020-05-12</revised>
|
||||||
|
<bug>721090</bug>
|
||||||
|
<access>remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="www-client/firefox" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">68.8.0</unaffected>
|
||||||
|
<vulnerable range="lt">68.8.0</vulnerable>
|
||||||
|
</package>
|
||||||
|
<package name="www-client/firefox-bin" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">68.8.0</unaffected>
|
||||||
|
<vulnerable range="lt">68.8.0</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>Mozilla Firefox is a popular open-source web browser from the Mozilla
|
||||||
|
Project.
|
||||||
|
</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in Mozilla Firefox. Please
|
||||||
|
review the CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>A remote attacker could entice a user to view a specially crafted web
|
||||||
|
page, possibly resulting in the execution of arbitrary code with the
|
||||||
|
privileges of the process, an information leak or a Denial of Service
|
||||||
|
condition.
|
||||||
|
</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All Mozilla Firefox users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=www-client/firefox-68.8.0"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
<p>All Mozilla Firefox binary users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=www-client/firefox-bin-68.8.0"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-12387">CVE-2020-12387</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-12392">CVE-2020-12392</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-12394">CVE-2020-12394</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-12395">CVE-2020-12395</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-12396">CVE-2020-12396</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6831">CVE-2020-6831</uri>
|
||||||
|
<uri link="https://www.mozilla.org/en-US/security/advisories/mfsa2020-17/">
|
||||||
|
MFSA-2020-17
|
||||||
|
</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-05-06T14:48:10Z">sam_c</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-05-12T23:36:01Z">sam_c</metadata>
|
||||||
|
</glsa>
|
||||||
53
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-05.xml
vendored
Normal file
53
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-05.xml
vendored
Normal file
@ -0,0 +1,53 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202005-05">
|
||||||
|
<title>Squid: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in Squid, the worst of
|
||||||
|
which could result in the arbitrary execution of code.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">squid</product>
|
||||||
|
<announced>2020-05-12</announced>
|
||||||
|
<revised count="1">2020-05-12</revised>
|
||||||
|
<bug>719046</bug>
|
||||||
|
<access>remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="net-proxy/squid" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">4.11</unaffected>
|
||||||
|
<vulnerable range="lt">4.11</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>Squid is a full-featured Web proxy cache designed to run on Unix
|
||||||
|
systems. It supports proxying and caching of HTTP, FTP, and other URLs,
|
||||||
|
as well as SSL support, cache hierarchies, transparent caching, access
|
||||||
|
control lists and many other features.
|
||||||
|
</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in Squid. Please review
|
||||||
|
the CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="high">
|
||||||
|
<p>Please review the referenced CVE identifiers for details.</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All Squid users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=net-proxy/squid-4.11"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-12519">CVE-2019-12519</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-12521">CVE-2019-12521</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-11945">CVE-2020-11945</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-05-04T11:10:13Z">sam_c</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-05-12T23:40:20Z">sam_c</metadata>
|
||||||
|
</glsa>
|
||||||
53
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-06.xml
vendored
Normal file
53
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-06.xml
vendored
Normal file
@ -0,0 +1,53 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202005-06">
|
||||||
|
<title>LIVE555 Media Server: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in LIVE555 Media Server,
|
||||||
|
the worst of which could result in the arbitrary execution of code.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">live555</product>
|
||||||
|
<announced>2020-05-14</announced>
|
||||||
|
<revised count="1">2020-05-14</revised>
|
||||||
|
<bug>669276</bug>
|
||||||
|
<bug>677276</bug>
|
||||||
|
<bug>717722</bug>
|
||||||
|
<access>remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="media-plugins/live" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">2020.03.06</unaffected>
|
||||||
|
<vulnerable range="lt">2020.03.06</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>LIVE555 Media Server is a set of libraries for multimedia streaming.</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in LIVE555 Media Server.
|
||||||
|
Please review the CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>Please review the referenced CVE identifiers for details.</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All LIVE555 Media Server users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=media-plugins/live-2020.03.06"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-4013">CVE-2018-4013</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-15232">CVE-2019-15232</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-6256">CVE-2019-6256</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-7314">CVE-2019-7314</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-7733">CVE-2019-7733</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-9215">CVE-2019-9215</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-05-04T11:34:40Z">sam_c</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-05-14T22:04:59Z">sam_c</metadata>
|
||||||
|
</glsa>
|
||||||
52
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-07.xml
vendored
Normal file
52
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-07.xml
vendored
Normal file
@ -0,0 +1,52 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202005-07">
|
||||||
|
<title>FreeRDP: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in FreeRDP, the worst of
|
||||||
|
which could result in a Denial of Service condition.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">freerdp</product>
|
||||||
|
<announced>2020-05-14</announced>
|
||||||
|
<revised count="1">2020-05-14</revised>
|
||||||
|
<bug>716830</bug>
|
||||||
|
<access>remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="net-misc/freerdp" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">2.1.0</unaffected>
|
||||||
|
<vulnerable range="lt">2.1.0</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>FreeRDP is a free implementation of the Remote Desktop Protocol.</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in FreeRDP. Please review
|
||||||
|
the CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>An attacker could possibly cause a Denial of Service condition.</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All FreeRDP users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=net-misc/freerdp-2.1.0"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-17177">CVE-2019-17177</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-11521">CVE-2020-11521</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-11522">CVE-2020-11522</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-11523">CVE-2020-11523</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-11524">CVE-2020-11524</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-11525">CVE-2020-11525</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-11526">CVE-2020-11526</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-05-04T02:51:48Z">sam_c</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-05-14T22:10:55Z">sam_c</metadata>
|
||||||
|
</glsa>
|
||||||
62
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-08.xml
vendored
Normal file
62
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-08.xml
vendored
Normal file
@ -0,0 +1,62 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202005-08">
|
||||||
|
<title>Xen: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in Xen, the worst of which
|
||||||
|
could allow privilege escalation.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">xen</product>
|
||||||
|
<announced>2020-05-14</announced>
|
||||||
|
<revised count="2">2020-05-15</revised>
|
||||||
|
<bug>717446</bug>
|
||||||
|
<access>local</access>
|
||||||
|
<affected>
|
||||||
|
<package name="app-emulation/xen" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">4.12.2-r2</unaffected>
|
||||||
|
<vulnerable range="lt">4.12.2-r2</vulnerable>
|
||||||
|
</package>
|
||||||
|
<package name="app-emulation/xen-tools" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">4.12.2-r1</unaffected>
|
||||||
|
<vulnerable range="lt">4.12.2-r1</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>Xen is a bare-metal hypervisor.</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in Xen. Please review the
|
||||||
|
CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>Please review the referenced CVE identifiers for details.</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All Xen users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=app-emulation/xen-4.12.2-r2"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
<p>All Xen Tools users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose
|
||||||
|
">=app-emulation/xen-tools-4.12.2-r1"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-11739">CVE-2020-11739</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-11740">CVE-2020-11740</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-11741">CVE-2020-11741</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-11742">CVE-2020-11742</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-11743">CVE-2020-11743</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-05-04T11:20:31Z">sam_c</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-05-15T12:42:31Z">sam_c</metadata>
|
||||||
|
</glsa>
|
||||||
77
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-09.xml
vendored
Normal file
77
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-09.xml
vendored
Normal file
@ -0,0 +1,77 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202005-09">
|
||||||
|
<title>Python: Denial of Service</title>
|
||||||
|
<synopsis>A vulnerability in Python could lead to a Denial of Service
|
||||||
|
condition.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">python</product>
|
||||||
|
<announced>2020-05-14</announced>
|
||||||
|
<revised count="1">2020-05-14</revised>
|
||||||
|
<bug>707822</bug>
|
||||||
|
<access>remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="dev-lang/python" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge" slot="2.7">2.7.18</unaffected>
|
||||||
|
<unaffected range="ge" slot="3.6">3.6.10-r2</unaffected>
|
||||||
|
<unaffected range="ge" slot="3.7">3.7.7-r2</unaffected>
|
||||||
|
<unaffected range="ge" slot="3.8">3.8.2-r2</unaffected>
|
||||||
|
<vulnerable range="lt" slot="2.7">2.7.18</vulnerable>
|
||||||
|
<vulnerable range="lt" slot="3.6">3.6.10-r2</vulnerable>
|
||||||
|
<vulnerable range="lt" slot="3.7">3.7.7-r2</vulnerable>
|
||||||
|
<vulnerable range="lt" slot="3.8">3.8.2-r2</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>Python is an interpreted, interactive, object-oriented programming
|
||||||
|
language.
|
||||||
|
</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>An issue was discovered in urllib.request.AbstractBasicAuthHandler which
|
||||||
|
allowed a remote attacker to send malicious data causing extensive
|
||||||
|
regular expression backtracking.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>An attacker could cause a possible Denial of Service condition.</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All Python 2.7 users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.18:2.7"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
<p>All Python 3.6 users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.6.10-r2:3.6"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
<p>All Python 3.7 users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.7.7-r2:3.7"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
<p>All Python 3.8 users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.8.2-r2:3.8"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-8492">CVE-2020-8492</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-05-07T23:04:03Z">sam_c</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-05-14T22:18:15Z">sam_c</metadata>
|
||||||
|
</glsa>
|
||||||
58
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-10.xml
vendored
Normal file
58
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-10.xml
vendored
Normal file
@ -0,0 +1,58 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202005-10">
|
||||||
|
<title>libmicrodns: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in libmicrodns, the worst
|
||||||
|
of which could result in the arbitrary execution of code.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">libmicrodns</product>
|
||||||
|
<announced>2020-05-14</announced>
|
||||||
|
<revised count="1">2020-05-14</revised>
|
||||||
|
<bug>714606</bug>
|
||||||
|
<access>remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="net-libs/libmicrodns" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">0.1.2</unaffected>
|
||||||
|
<vulnerable range="lt">0.1.2</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>libmicrodns is an mDNS library, focused on being simple and
|
||||||
|
cross-platform.
|
||||||
|
</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in libmicrodns. Please
|
||||||
|
review the CVE identifiers and the upstream advisory referenced below for
|
||||||
|
details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>Please review the referenced CVE identifiers for details.</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All libmicrodns users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=net-libs/libmicrodns-0.1.2"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6071">CVE-2020-6071</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6072">CVE-2020-6072</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6073">CVE-2020-6073</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6077">CVE-2020-6077</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6078">CVE-2020-6078</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6079">CVE-2020-6079</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6080">CVE-2020-6080</uri>
|
||||||
|
<uri link="https://www.videolan.org/security/sb-vlc309.html">
|
||||||
|
VideoLAN-SB-VLC-309
|
||||||
|
</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-05-13T00:35:54Z">sam_c</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-05-14T22:21:44Z">sam_c</metadata>
|
||||||
|
</glsa>
|
||||||
55
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-11.xml
vendored
Normal file
55
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-11.xml
vendored
Normal file
@ -0,0 +1,55 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202005-11">
|
||||||
|
<title>VLC: Buffer overflow</title>
|
||||||
|
<synopsis>A buffer overflow in VLC might allow local or remote attacker(s) to
|
||||||
|
execute arbitrary code.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">vlc</product>
|
||||||
|
<announced>2020-05-14</announced>
|
||||||
|
<revised count="1">2020-05-14</revised>
|
||||||
|
<bug>721940</bug>
|
||||||
|
<access>local, remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="media-video/vlc" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">3.0.10</unaffected>
|
||||||
|
<vulnerable range="lt">3.0.10</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>VLC is a cross-platform media player and streaming server.</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>A buffer overflow in DecodeBlock in sdl_image.c was discovered.</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>A remote user could craft a specifically crafted image file that could
|
||||||
|
execute arbitrary code or cause denial of service.
|
||||||
|
</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>The user should refrain from opening files from untrusted third parties
|
||||||
|
or accessing untrusted remote sites (or disable the VLC browser plugins),
|
||||||
|
until they upgrade.
|
||||||
|
</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All VLC users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose ">=media-video/vlc-3.0.10"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-19721">CVE-2019-19721</uri>
|
||||||
|
<uri link="https://git.videolan.org/?p=vlc/vlc-3.0.git;a=commit;h=72afe7ebd8305bf4f5360293b8621cde52ec506b">
|
||||||
|
Upstream patch
|
||||||
|
</uri>
|
||||||
|
<uri link="https://www.videolan.org/security/sb-vlc309.html">
|
||||||
|
VideoLAN-SB-VLC-309
|
||||||
|
</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-05-12T16:12:42Z">sam_c</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-05-14T22:24:24Z">sam_c</metadata>
|
||||||
|
</glsa>
|
||||||
56
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-12.xml
vendored
Normal file
56
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-12.xml
vendored
Normal file
@ -0,0 +1,56 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202005-12">
|
||||||
|
<title>OpenSLP: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in OpenSLP, the worst of
|
||||||
|
which could result in the arbitrary execution of code.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild">openslp</product>
|
||||||
|
<announced>2020-05-14</announced>
|
||||||
|
<revised count="2">2020-05-14</revised>
|
||||||
|
<bug>662878</bug>
|
||||||
|
<access>remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="net-misc/openslp" auto="yes" arch="*">
|
||||||
|
<vulnerable range="le">2.0.0-r5</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>OpenSLP is an open-source implementation of Service Location Protocol
|
||||||
|
(SLP).
|
||||||
|
</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in OpenSLP. Please review
|
||||||
|
the CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>Please review the referenced CVE identifiers for details.</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>Gentoo has discontinued support for OpenSLP. We recommend that users
|
||||||
|
unmerge OpenSLP:
|
||||||
|
<code>
|
||||||
|
# emerge --unmerge "net-libs/openslp"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
<p>NOTE: The Gentoo developer(s) maintaining OpenSLP have discontinued
|
||||||
|
support at this time. It may be possible that a new Gentoo developer
|
||||||
|
will update OpenSLP at a later date. No known alternatives to OpenSLP
|
||||||
|
are in the tree at this time.
|
||||||
|
</p>
|
||||||
|
</p>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-17833">
|
||||||
|
CVE-2017-17833
|
||||||
|
</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-5544">CVE-2019-5544</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-05-13T01:13:11Z">sam_c</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-05-14T22:31:01Z">sam_c</metadata>
|
||||||
|
</glsa>
|
||||||
74
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-13.xml
vendored
Normal file
74
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202005-13.xml
vendored
Normal file
@ -0,0 +1,74 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||||
|
<glsa id="202005-13">
|
||||||
|
<title>Chromium, Google Chrome: Multiple vulnerabilities</title>
|
||||||
|
<synopsis>Multiple vulnerabilities have been found in Chromium and Google
|
||||||
|
Chrome, the worst of which could result in the arbitrary execution of code.
|
||||||
|
</synopsis>
|
||||||
|
<product type="ebuild"></product>
|
||||||
|
<announced>2020-05-14</announced>
|
||||||
|
<revised count="1">2020-05-14</revised>
|
||||||
|
<bug>719902</bug>
|
||||||
|
<bug>721310</bug>
|
||||||
|
<access>remote</access>
|
||||||
|
<affected>
|
||||||
|
<package name="www-client/chromium" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">81.0.4044.138</unaffected>
|
||||||
|
<vulnerable range="lt">81.0.4044.138</vulnerable>
|
||||||
|
</package>
|
||||||
|
<package name="www-client/google-chrome" auto="yes" arch="*">
|
||||||
|
<unaffected range="ge">81.0.4044.138</unaffected>
|
||||||
|
<vulnerable range="lt">81.0.4044.138</vulnerable>
|
||||||
|
</package>
|
||||||
|
</affected>
|
||||||
|
<background>
|
||||||
|
<p>Chromium is an open-source browser project that aims to build a safer,
|
||||||
|
faster, and more stable way for all users to experience the web.
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<p>Google Chrome is one fast, simple, and secure browser for all your
|
||||||
|
devices.
|
||||||
|
</p>
|
||||||
|
</background>
|
||||||
|
<description>
|
||||||
|
<p>Multiple vulnerabilities have been discovered in Chromium and Google
|
||||||
|
Chrome. Please review the CVE identifiers referenced below for details.
|
||||||
|
</p>
|
||||||
|
</description>
|
||||||
|
<impact type="normal">
|
||||||
|
<p>Please review the referenced CVE identifiers for details.</p>
|
||||||
|
</impact>
|
||||||
|
<workaround>
|
||||||
|
<p>There is no known workaround at this time.</p>
|
||||||
|
</workaround>
|
||||||
|
<resolution>
|
||||||
|
<p>All Chromium users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose
|
||||||
|
">=www-client/chromium-81.0.4044.138"
|
||||||
|
</code>
|
||||||
|
|
||||||
|
<p>All Google Chrome users should upgrade to the latest version:</p>
|
||||||
|
|
||||||
|
<code>
|
||||||
|
# emerge --sync
|
||||||
|
# emerge --ask --oneshot --verbose
|
||||||
|
">=www-client/google-chrome-81.0.4044.138"
|
||||||
|
</code>
|
||||||
|
</resolution>
|
||||||
|
<references>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6461">CVE-2020-6461</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6462">CVE-2020-6462</uri>
|
||||||
|
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6464">CVE-2020-6464</uri>
|
||||||
|
<uri link="https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_27.html">
|
||||||
|
Release notes (81.0.4044.129)
|
||||||
|
</uri>
|
||||||
|
<uri link="https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop.html">
|
||||||
|
Release notes (81.0.4044.138)
|
||||||
|
</uri>
|
||||||
|
</references>
|
||||||
|
<metadata tag="requester" timestamp="2020-05-13T00:58:25Z">sam_c</metadata>
|
||||||
|
<metadata tag="submitter" timestamp="2020-05-14T22:35:22Z">sam_c</metadata>
|
||||||
|
</glsa>
|
||||||
@ -1 +1 @@
|
|||||||
Thu, 16 Apr 2020 05:38:59 +0000
|
Fri, 15 May 2020 14:08:23 +0000
|
||||||
|
|||||||
@ -1 +1 @@
|
|||||||
f2cb9b0eb0e16fd065838568dbe36727be807027 1586556154 2020-04-10T22:02:34+00:00
|
8f997a18382e6fd1fe9722aff738fb088141123c 1589546660 2020-05-15T12:44:20+00:00
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user