diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest index 7180587ae0..4f017eb9f8 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest @@ -1,23 +1,23 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 -MANIFEST Manifest.files.gz 590436 BLAKE2B 15aabc4185729e136cdcfaf5f8f985f8037a950c2674b40f4a60d6db55b6e66ddf62465183eec797a8745737731f08c9f5b7997b3092ca23932abe139760e3a2 SHA512 d4bc062a4c9898005fcd53314c2db40baaef3e5725ab92e762d55ae3747dcb34a1602299c2aa4bdf60a06b6f322e89ee0b897eafffb10de6e5392274ab828bc5 -TIMESTAMP 2024-11-01T06:40:36Z +MANIFEST Manifest.files.gz 591718 BLAKE2B cd53ee1575b57b03315f3e2b15f89a06fbc6711259ee7a82e1ca6f8970d8fdd183ea1f95f313b15f9f7f905c2c8641fa9ae9f0d8a12e8fedc6851ee3f7c15bbd SHA512 1cf337d112115a521c08a9fa208a2c60a1ef9651426b5a20b7ff05709eda7e21b384c627f1dedd2abb84476daf5fadea280b479585390abd903daec89814b24f +TIMESTAMP 2024-12-01T06:40:23Z -----BEGIN PGP SIGNATURE----- -iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmckd+RfFIAAAAAALgAo +iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmdMBNdfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY -klAv1g//cwbcCZg8/G48F/uV4ZD8IQCCiBnCHZO0rj2oufMpVzWlBV3WqIR2B1Cq -YoFg5S6GmXBTdYFgpTLHlHR4WzEH5qTaEzI8jXRovvHSQmWfeewUJZJe9h1v77C8 -ez4Voj4nW1065mpgfuzYsOhC27pkxPI2OjD+YxgsGiZrJb/68OeTGGH5Xj10Bgv8 -sLeVeC7QiVmbiG2a0wP+qm+gAgpyULYRF+568feHfSu5LotUQ1SYWcBoRQFQSdgP -/LqkhQH/+MVUWoDaOBjPWu6MHLUy+Ut7URiKpCD/l/9xrBjoyo9Ey5HFUym2b1sW -/4tQ6vd4TC9h7M5kT67hobmgQIfMNp3lz/zCOpr9ygD6kRBpP8GzTf+NKfrpUy1z -ToT61J7W3Vzxk6kNjV5Yci6JrLBejFSHtp/2RN2KMms/4upff7xSx3CA36jj/pJB -Haep3fkPtghjXdLbRHdoNvZCMB8NxYhrkxzjweyuOO91gQquivrYM5NqjGevSZ0O -2/PM9G7SqvxMSsrxcvv/gcZI8CGZozUmYbmfK3K/2V7radzVCHc1G/c0l7w0z0JL -MNI4vjCSN/hQa82Fz8I9fAuiUUeEl4LygT8KKqbi51bcHGMRaTcQ+V1w6fOjstvy -WteXEDDV5cKhj3lkSUFR/GySEsa0s7ADtvHmVU4u3fPNjMfPYLM= -=S2X5 +klANZw/+KSWqV2sDOVWslomj90wmI4kWrUE4ZC46YZtvjGz4Faf9D8i9RzkuV9nB +Lt6HhwNbrTFYYyFv0wAYLBUbNzQUDKl0KwOXs7SjRD+hV2lNRakA/dM1FbHsN0wF +qUd+S3Slmis3NGaIQ5UstxqdG5wjZ04q6BnjdrA5Yaqxj+S8bS04D3HUr5jhKU8A +vR9e7h6fkiABZW52mXVcBvqkSTmqrZcxGss3LpTiWU1VDcbFoVXcjsNQKYUEj9dt +IgWaVX/LwVj3yPSI2TPF2PO8lenyiroADclFwXPHHyuDm6qxXb0v0nie3h4PuG5O +yFVWmpLPkgdO2oCnJhh1W2sh+vu5iV4xnfoxT5U0BMp24s2wt2oKzPieJUhslk4s +lINvCPAVF8VFwgvop3rdwvwQWE7yZCAZuKxD0Y6m8WORExR/MB33Qmc0gm7b6ksC +yFG7AjN6y0qUd2yL1vpl9lvy4Rv0izZnVmuhd0+Jsq/8lgzY8+oiiZMzTxEc8Y/e +8BcxWkB64/Sta0U+GYEYypxS2nPtPAb7BvPu1f2dyBEqO+vDRN5M+0LuhfucKDTo +fuNw7Ri6zyv4thIvUJI7f54AHcGvAGmxQ+ObXHoHrBHtKacSXG6VF/P48rAwX165 +WblhbkW1T4kqLrUiFl/pt9BHP2zCXFkphVMrw4GJyp6KquSqfFA= +=l52K -----END PGP SIGNATURE----- diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz index 3b2eab36a0..22441536c9 100644 Binary files a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz and b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz differ diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-01.xml new file mode 100644 index 0000000000..3cd99d6fb5 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-01.xml @@ -0,0 +1,41 @@ + + + + Neat VNC: Authentication Bypass + A vulnerability has been discovered in Neat VNC, which can lead to authentication bypass. + neatvnc + 2024-11-06 + 2024-11-06 + 937140 + remote + + + 0.8.1 + 0.8.1 + + + +

Neat VNC is a liberally licensed VNC server library that's intended to be fast and neat.

+
+ +

Neat VNC allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server, as originally demonstrated using a long password.

+
+ +

A remote attacker can opt not to use any authentication method and access the VNC server.

+
+ +

There is no known workaround at this time.

+
+ +

All Neat VNC users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=gui-libs/neatvnc-0.8.1" + +
+ + + graaff + graaff +
\ No newline at end of file diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-02.xml new file mode 100644 index 0000000000..12faaef09e --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-02.xml @@ -0,0 +1,43 @@ + + + + Flatpak: Sandbox Escape + A vulnerability has been discovered in Flatpak, which can lead to a sandbox escape. + flatpak + 2024-11-06 + 2024-11-06 + 937936 + remote + + + 1.4.10 + 1.4.10 + + + +

Flatpak is a Linux application sandboxing and distribution framework.

+
+ +

A vulnerability has been discovered in Flatpak. Please review the CVE identifier referenced below for details.

+
+ +

A malicious or compromised Flatpak app using persistent directories could +read and write files in locations it would not normally have access to.

+
+ +

There is no known workaround at this time.

+
+ +

All Flatpak users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/flatpak-1.4.10" + +
+ + CVE-2024-42472 + + graaff + graaff +
\ No newline at end of file diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-03.xml new file mode 100644 index 0000000000..3b801a3310 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-03.xml @@ -0,0 +1,42 @@ + + + + Ubiquiti UniFi: Privilege Escalation + A vulnerability has been discovered in Ubiquiti UniFi, which can lead to local privilege escalation. + unifi + 2024-11-06 + 2024-11-06 + 941922 + local + + + 8.5.6 + 8.5.6 + + + +

Ubiquiti UniFi is a Management Controller for Ubiquiti Networks UniFi APs.

+
+ +

A vulnerability has been discovered in Ubiquiti UniFi. Please review the CVE identifier referenced below for details.

+
+ +

The vulnerability allows a malicious actor with a local operational system user to execute high privilege actions on UniFi Network Server.

+
+ +

There is no known workaround at this time.

+
+ +

All Ubiquiti UniFi users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-wireless/unifi-8.5.6" + +
+ + CVE-2024-42028 + + graaff + graaff +
\ No newline at end of file diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-04.xml new file mode 100644 index 0000000000..719a3378d3 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-04.xml @@ -0,0 +1,42 @@ + + + + EditorConfig core C library: arbitrary stack write + A vulnerability has been discovered in EditorConfig Core C library, which may lead to arbitrary code execution. + editorconfig-core-c + 2024-11-06 + 2024-11-06 + 905308 + local and remote + + + 0.12.6 + 0.12.6 + + + +

EditorConfig core library written in C (for use by plugins supporting EditorConfig parsing)

+
+ +

A vulnerability has been discovered in EditorConfig Core C library. Please review the CVE identifier referenced below for details.

+
+ +

Please review the referenced CVE identifier for details.

+
+ +

There is no known workaround at this time.

+
+ +

All EditorConfig core C library users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-text/editorconfig-core-c-0.12.6" + +
+ + CVE-2023-0341 + + graaff + graaff +
\ No newline at end of file diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-05.xml new file mode 100644 index 0000000000..bbff68c04a --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-05.xml @@ -0,0 +1,43 @@ + + + + libgit2: Multiple Vulnerabilities + Multiple vulnerabilities have been discovered in libgit2, the worst of which could lead to arbitrary code execution. + libgit2 + 2024-11-06 + 2024-11-06 + 891525 + 923971 + remote + + + 1.7.2 + 1.7.2 + + + +

libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language that supports C bindings.

+
+ +

Multiple vulnerabilities have been discovered in libgit2. Please review the CVE identifiers referenced below for details.

+
+ +

Please review the referenced CVE identifiers for details.

+
+ +

There is no known workaround at this time.

+
+ +

All libgit2 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/libgit2-1.7.2" + +
+ + CVE-2023-22742 + + graaff + graaff +
\ No newline at end of file diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-07.xml new file mode 100644 index 0000000000..70b0592be1 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-07.xml @@ -0,0 +1,42 @@ + + + + Pillow: Arbitrary code execution + A vulnerability has been discovered in Pillow, which may lead to arbitrary code execution. + pillow + 2024-11-17 + 2024-11-17 + 928391 + local and remote + + + 10.3.0 + 10.3.0 + + + +

The friendly PIL fork.

+
+ +

A vulnerability has been discovered in Pillow. Please review the CVE identifier referenced below for details.

+
+ +

Please review the referenced CVE identifier for details.

+
+ +

There is no known workaround at this time.

+
+ +

All Pillow users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-python/pillow-10.3.0" + +
+ + CVE-2024-28219 + + graaff + graaff +
\ No newline at end of file diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-08.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-08.xml new file mode 100644 index 0000000000..922593fd67 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-08.xml @@ -0,0 +1,58 @@ + + + + X.Org X server, XWayland: Multiple Vulnerabilities + A vulnerability has been discovered in the Xorg Server and XWayland, the worst of which can result in privilege escalation. + xorg-server,xwayland + 2024-11-17 + 2024-11-17 + 928531 + 942465 + local + + + 21.1.14 + 21.1.14 + + + 24.1.4 + 24.1.4 + + + +

The X Window System is a graphical windowing system based on a client/server model.

+
+ +

Multiple vulnerabilities have been discovered in X.Org X server and XWayland. Please review the CVE identifiers referenced below for details.

+
+ +

Please review the referenced CVE identifiers for details.

+
+ +

There is no known workaround at this time.

+
+ +

All X.Org X server users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-21.1.14" + + +

All XWayland users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-base/xwayland-24.1.4" + +
+ + CVE-2024-9632 + CVE-2024-31080 + CVE-2024-31081 + CVE-2024-31082 + CVE-2024-31083 + + graaff + graaff +
\ No newline at end of file diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-09.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-09.xml new file mode 100644 index 0000000000..69504e0c5d --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-09.xml @@ -0,0 +1,46 @@ + + + + Perl: Multiple Vulnerabilities + Multiple vulnerabilities have been discovered in Perl, the worst of which can lead to arbitrary code execution. + perl + 2024-11-17 + 2024-11-17 + 807307 + 905296 + 918612 + remote + + + 5.38.2 + 5.38.2 + + + +

Perl is Larry Wall’s Practical Extraction and Report Language.

+
+ +

Multiple vulnerabilities have been discovered in Perl. Please review the CVE identifiers referenced below for details.

+
+ +

Please review the referenced CVE identifiers for details.

+
+ +

There is no known workaround at this time.

+
+ +

All Perl users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/perl-5.38.2" + +
+ + CVE-2021-36770 + CVE-2023-31486 + CVE-2023-47038 + + graaff + graaff +
\ No newline at end of file diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk index 7536ea00a2..264273a75f 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Fri, 01 Nov 2024 06:40:34 +0000 +Sun, 01 Dec 2024 06:40:21 +0000 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit index 7474dc84ac..0858bad8cc 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit @@ -1 +1 @@ -93155fde00088b123d8b46acf068ecadcf7bcfdb 1727512056 2024-09-28T08:27:36Z +06b1665a387d4d7cb73b9b91b99b6ed644d013ed 1731837118 2024-11-17T09:51:58Z