mirror of
https://github.com/flatcar/scripts.git
synced 2025-10-02 11:01:14 +02:00
bump(metadata/glsa): sync with upstream
This commit is contained in:
David Michael
parent
5638e2f91e
commit
d5ee825435
@ -5,13 +5,13 @@
|
||||
<synopsis>A vulnerability in sudo allows local users to gain root privileges.</synopsis>
|
||||
<product type="ebuild">sudo,privilege</product>
|
||||
<announced>2017-05-30</announced>
|
||||
<revised>2017-10-07: 3</revised>
|
||||
<revised>2017-10-10: 4</revised>
|
||||
<bug>620182</bug>
|
||||
<access>local</access>
|
||||
<affected>
|
||||
<package name="app-admin/sudo" auto="yes" arch="*">
|
||||
<unaffected range="ge">1.8.20_p2</unaffected>
|
||||
<vulnerable range="lt">1.8.20_p2</vulnerable>
|
||||
<unaffected range="ge">1.8.20_p1</unaffected>
|
||||
<vulnerable range="lt">1.8.20_p1</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
@ -45,7 +45,7 @@
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=app-admin/sudo-1.8.20_p2"
|
||||
# emerge --ask --oneshot --verbose ">=app-admin/sudo-1.8.20_p1"
|
||||
</code>
|
||||
|
||||
</resolution>
|
||||
@ -58,5 +58,5 @@
|
||||
</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2017-05-30T07:27:08Z">K_F</metadata>
|
||||
<metadata tag="submitter" timestamp="2017-10-07T14:23:55Z">K_F</metadata>
|
||||
<metadata tag="submitter" timestamp="2017-10-10T00:11:49Z">K_F</metadata>
|
||||
</glsa>
|
||||
|
||||
82
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-10.xml
vendored
Normal file
82
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-10.xml
vendored
Normal file
@ -0,0 +1,82 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201710-10">
|
||||
<title>elfutils: Multiple vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in elfutils, the worst of
|
||||
which may allow remote attackers to cause a Denial of Service condition.
|
||||
</synopsis>
|
||||
<product type="ebuild">elfutils</product>
|
||||
<announced>2017-10-13</announced>
|
||||
<revised>2017-10-13: 1</revised>
|
||||
<bug>614002</bug>
|
||||
<bug>614004</bug>
|
||||
<bug>618004</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="dev-libs/elfutils" auto="yes" arch="*">
|
||||
<unaffected range="ge">0.169-r1</unaffected>
|
||||
<vulnerable range="lt">0.169-r1</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>Elfutils provides a library and utilities to access, modify and analyse
|
||||
ELF objects.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in elfutils. Please review
|
||||
the referenced CVE identifiers for details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote attacker could possibly cause a Denial of Service condition via
|
||||
specially crafted ELF files.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All elfutils users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=dev-libs/elfutils-0.169-r1"
|
||||
</code>
|
||||
|
||||
<p>Packages which depend on this library may need to be recompiled. Tools
|
||||
such as revdep-rebuild may assist in identifying some of these packages.
|
||||
</p>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10254">
|
||||
CVE-2016-10254
|
||||
</uri>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10255">
|
||||
CVE-2016-10255
|
||||
</uri>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7607">
|
||||
CVE-2017-7607
|
||||
</uri>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7608">
|
||||
CVE-2017-7608
|
||||
</uri>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7609">
|
||||
CVE-2017-7609
|
||||
</uri>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7610">
|
||||
CVE-2017-7610
|
||||
</uri>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7611">
|
||||
CVE-2017-7611
|
||||
</uri>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7612">
|
||||
CVE-2017-7612
|
||||
</uri>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7613">
|
||||
CVE-2017-7613
|
||||
</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2017-10-08T18:46:38Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2017-10-13T22:31:20Z">chrisadr</metadata>
|
||||
</glsa>
|
||||
63
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-11.xml
vendored
Normal file
63
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-11.xml
vendored
Normal file
@ -0,0 +1,63 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201710-11">
|
||||
<title>GNU Libtasn1: Multiple vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in GNU Libtasn1, the worst
|
||||
of which may allow remote attackers to execute arbitrary code.
|
||||
</synopsis>
|
||||
<product type="ebuild">libtasn1</product>
|
||||
<announced>2017-10-13</announced>
|
||||
<revised>2017-10-13: 1</revised>
|
||||
<bug>619686</bug>
|
||||
<bug>627014</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="dev-libs/libtasn1" auto="yes" arch="*">
|
||||
<unaffected range="ge">4.12-r1</unaffected>
|
||||
<vulnerable range="lt">4.12-r1</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>A library that provides Abstract Syntax Notation One (ASN.1, as
|
||||
specified by the X.680 ITU-T recommendation) parsing and structures
|
||||
management, and Distinguished Encoding Rules (DER, as per X.690) encoding
|
||||
and decoding functions.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in GNU Libtasn1. Please
|
||||
review the referenced CVE identifiers for details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote attacker could possibly execute arbitrary code with the
|
||||
privileges of the process, cause a Denial of Service condition, or have
|
||||
other unspecified impacts.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All GNU Libtasn1 users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=dev-libs/libtasn1-4.12-r1"
|
||||
</code>
|
||||
|
||||
<p>Packages which depend on this library may need to be recompiled. Tools
|
||||
such as revdep-rebuild may assist in identifying some of these packages.
|
||||
</p>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10790">
|
||||
CVE-2017-10790
|
||||
</uri>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6891">
|
||||
CVE-2017-6891
|
||||
</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2017-10-08T19:04:08Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2017-10-13T22:47:29Z">chrisadr</metadata>
|
||||
</glsa>
|
||||
56
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-12.xml
vendored
Normal file
56
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-12.xml
vendored
Normal file
@ -0,0 +1,56 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201710-12">
|
||||
<title>Puppet Agent: Multiple vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in Puppet Agent, the worst
|
||||
of which could result in the execution of arbitrary code.
|
||||
</synopsis>
|
||||
<product type="ebuild">puppetagent</product>
|
||||
<announced>2017-10-13</announced>
|
||||
<revised>2017-10-13: 1</revised>
|
||||
<bug>597684</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="app-admin/puppet-agent" auto="yes" arch="*">
|
||||
<unaffected range="ge">1.7.1</unaffected>
|
||||
<vulnerable range="lt">1.7.1</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>Puppet Agent contains Puppet’s main code and all of the dependencies
|
||||
needed to run it, including Facter, Hiera, and bundled versions of Ruby
|
||||
and OpenSSL.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in Puppet Agent. Please
|
||||
review the references for details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote attacker could possibly execute arbitrary code with the
|
||||
privileges of the process or obtain sensitive information.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All Puppet Agent users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=app-admin/puppet-agent-1.7.1"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5714">
|
||||
CVE-2016-5714
|
||||
</uri>
|
||||
<uri link="https://puppet.com/security/cve/pxp-agent-oct-2016">Puppet
|
||||
Security Advise Oct 2016
|
||||
</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2017-10-08T20:07:35Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2017-10-13T23:32:46Z">chrisadr</metadata>
|
||||
</glsa>
|
||||
77
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-13.xml
vendored
Normal file
77
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-13.xml
vendored
Normal file
@ -0,0 +1,77 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201710-13">
|
||||
<title>Graphite: Multiple vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in Graphite, the worst of
|
||||
which could lead to the remote execution of arbitrary code.
|
||||
|
||||
</synopsis>
|
||||
<product type="ebuild">graphite2</product>
|
||||
<announced>2017-10-13</announced>
|
||||
<revised>2017-10-13: 1</revised>
|
||||
<bug>621724</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="media-gfx/graphite2" auto="yes" arch="*">
|
||||
<unaffected range="ge">1.3.10</unaffected>
|
||||
<vulnerable range="lt">1.3.10</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>Graphite is a “smart font” system developed specifically to handle
|
||||
the complexities of lesser-known languages of the world.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in Graphite. Please review
|
||||
the referenced CVE identifiers for details.
|
||||
</p>
|
||||
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote attacker could possibly execute arbitrary code with the
|
||||
privileges of the process, cause a Denial of Service condition, or have
|
||||
other unspecified impacts.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All Graphite users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=media-gfx/graphite2-1.3.10"
|
||||
</code>
|
||||
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7771">
|
||||
CVE-2017-7771
|
||||
</uri>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7772">
|
||||
CVE-2017-7772
|
||||
</uri>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7773">
|
||||
CVE-2017-7773
|
||||
</uri>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7774">
|
||||
CVE-2017-7774
|
||||
</uri>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7775">
|
||||
CVE-2017-7775
|
||||
</uri>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7776">
|
||||
CVE-2017-7776
|
||||
</uri>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7777">
|
||||
CVE-2017-7777
|
||||
</uri>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7778">
|
||||
CVE-2017-7778
|
||||
</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2017-10-08T16:43:14Z">chrisadr</metadata>
|
||||
<metadata tag="submitter" timestamp="2017-10-13T23:36:36Z">chrisadr</metadata>
|
||||
</glsa>
|
||||
72
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-14.xml
vendored
Normal file
72
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-14.xml
vendored
Normal file
@ -0,0 +1,72 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201710-14">
|
||||
<title>WebKitGTK+: Multiple Vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in WebkitGTK+, the worst
|
||||
of which may allow remote attackers to execute arbitrary code.
|
||||
</synopsis>
|
||||
<product type="ebuild">webkit-gtk</product>
|
||||
<announced>2017-10-13</announced>
|
||||
<revised>2017-10-13: 1</revised>
|
||||
<bug>626142</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="net-libs/webkit-gtk" auto="yes" arch="*">
|
||||
<unaffected range="ge" slot="4">2.16.6</unaffected>
|
||||
<vulnerable range="lt" slot="4">2.16.6</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>WebKitGTK+ is a full-featured port of the WebKit rendering engine,
|
||||
suitable for projects requiring any kind of web integration, offers
|
||||
Webkit’s full functionality and is used on a wide range of systems.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in WebkitGTK+. Please
|
||||
review the references below for details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote attacker could execute arbitrary code, cause a Denial of
|
||||
Service condition, bypass intended memory-read restrictions, conduct a
|
||||
timing side-channel attack to bypass the Same Origin Policy, obtain
|
||||
sensitive information, or spoof the address bar.
|
||||
</p>
|
||||
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All WebKitGTK+ users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.16.6"
|
||||
</code>
|
||||
|
||||
<p>Packages which depend on this library may need to be recompiled. Tools
|
||||
such as revdep-rebuild may assist in identifying some of these packages.
|
||||
</p>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7006">CVE-2017-7006</uri>
|
||||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7011">CVE-2017-7011</uri>
|
||||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7012">CVE-2017-7012</uri>
|
||||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7018">CVE-2017-7018</uri>
|
||||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7019">CVE-2017-7019</uri>
|
||||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7020">CVE-2017-7020</uri>
|
||||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7030">CVE-2017-7030</uri>
|
||||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7034">CVE-2017-7034</uri>
|
||||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7037">CVE-2017-7037</uri>
|
||||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7038">CVE-2017-7038</uri>
|
||||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7039">CVE-2017-7039</uri>
|
||||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7040">CVE-2017-7040</uri>
|
||||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7041">CVE-2017-7041</uri>
|
||||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7042">CVE-2017-7042</uri>
|
||||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7043">CVE-2017-7043</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2017-04-30T20:06:21Z">BlueKnight</metadata>
|
||||
<metadata tag="submitter" timestamp="2017-10-13T23:53:44Z">chrisadr</metadata>
|
||||
</glsa>
|
||||
52
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-15.xml
vendored
Normal file
52
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-15.xml
vendored
Normal file
@ -0,0 +1,52 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201710-15">
|
||||
<title>GnuTLS: Denial of Service</title>
|
||||
<synopsis>A null pointer dereference in GnuTLS might allow attackers to cause
|
||||
a Denial of Service condition.
|
||||
</synopsis>
|
||||
<product type="ebuild">gnutls</product>
|
||||
<announced>2017-10-15</announced>
|
||||
<revised>2017-10-15: 1</revised>
|
||||
<bug>622038</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="net-libs/gnutls" auto="yes" arch="*">
|
||||
<unaffected range="ge">3.5.13</unaffected>
|
||||
<vulnerable range="lt">3.5.13</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>GnuTLS is a secure communications library implementing the SSL, TLS and
|
||||
DTLS protocols and technologies around them.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>A null pointer dereference while decoding a status response TLS
|
||||
extension with valid contents was discovered in GnuTLS.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote attacker could possibly cause a Denial of Service condition.</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All GnuTLS users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=net-libs/gnutls-3.5.13"
|
||||
</code>
|
||||
|
||||
<p>Packages which depend on this library may need to be recompiled. Tools
|
||||
such as revdep-rebuild may assist in identifying some of these packages.
|
||||
</p>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-7507">CVE-2017-7507</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2017-09-17T19:52:42Z">chrisadr</metadata>
|
||||
<metadata tag="submitter" timestamp="2017-10-15T04:20:45Z">chrisadr</metadata>
|
||||
</glsa>
|
||||
51
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-16.xml
vendored
Normal file
51
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-16.xml
vendored
Normal file
@ -0,0 +1,51 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201710-16">
|
||||
<title>Shadow: Buffer overflow</title>
|
||||
<synopsis>A vulnerability found in Shadow may allow remote attackers to cause
|
||||
a Denial of Service condition or produce other unspecified behaviors.
|
||||
</synopsis>
|
||||
<product type="ebuild">shadow</product>
|
||||
<announced>2017-10-15</announced>
|
||||
<revised>2017-10-15: 1</revised>
|
||||
<bug>627044</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="sys-apps/shadow" auto="yes" arch="*">
|
||||
<unaffected range="ge">4.5</unaffected>
|
||||
<vulnerable range="lt">4.5</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>Shadow is a set of tools to deal with user accounts.</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Malformed input in the newusers tool may produce crashes and other
|
||||
unspecified behaviors.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote attacker could possibly cause a Denial of Service condition or
|
||||
bypass privilege boundaries in some web-hosting environments in which a
|
||||
Control Panel allows an unprivileged user account to create subaccounts.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All Shadow users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=sys-apps/shadow-4.5"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-12424">
|
||||
CVE-2017-12424
|
||||
</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2017-10-13T22:41:20Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2017-10-15T20:17:52Z">chrisadr</metadata>
|
||||
</glsa>
|
||||
@ -1 +1 @@
|
||||
Mon, 09 Oct 2017 18:08:59 +0000
|
||||
Sun, 15 Oct 2017 21:09:21 +0000
|
||||
|
||||
@ -1 +1 @@
|
||||
6563aef7bcf2b256b39e321f440df3efe76f81f4 1507473808 2017-10-08T14:43:28+00:00
|
||||
f5081800804d6a1f4598cbc03e5a8f2664f6a070 1508098974 2017-10-15T20:22:54+00:00
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user