From 8d314707a0c339d5fc492f58863a05674dbd0917 Mon Sep 17 00:00:00 2001 From: David Michael Date: Tue, 11 Apr 2017 11:54:59 -0700 Subject: [PATCH] bump(metadata/glsa): sync with upstream --- .../metadata/glsa/glsa-201704-01.xml | 64 ++++++++ .../metadata/glsa/glsa-201704-02.xml | 56 +++++++ .../metadata/glsa/glsa-201704-03.xml | 144 ++++++++++++++++++ .../metadata/glsa/timestamp.chk | 2 +- 4 files changed, 265 insertions(+), 1 deletion(-) create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201704-01.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201704-02.xml create mode 100644 sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201704-03.xml diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201704-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201704-01.xml new file mode 100644 index 0000000000..a06e4cbc03 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201704-01.xml @@ -0,0 +1,64 @@ + + + + QEMU: Multiple vulnerabilities + Multiple vulnerabilities have been found in QEMU, the worst of + which could the worst of which could lead to arbitrary code execution, or + cause a Denial of Service condition. + + QEMU + 2017-04-10 + 2017-04-10: 1 + 606088 + 609206 + 609334 + 609396 + 609398 + 609638 + 612220 + local, remote + + + 2.8.0-r9 + 2.8.0-r9 + + + +

QEMU is a generic and open source machine emulator and virtualizer.

+ + +

Multiple vulnerabilities have been discovered in QEMU. Please review the + CVE identifiers referenced below for details. +

+ + +

Remote server can cause a crash in the client causing execution of + arbitrary code, and a Denial of Service within the QEMU process. Remote + or Local users within a guest QEMU environment can cause a Denial of + Service condition of the QEMU guest process. +

+ + +

There is no known workaround at this time.

+ + +

All QEMU users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/qemu-2.8.0-r9" + + + + + CVE-2016-9602 + CVE-2017-2620 + CVE-2017-2630 + CVE-2017-5973 + CVE-2017-5987 + CVE-2017-6058 + CVE-2017-6505 + + BlueKnight + BlueKnight + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201704-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201704-02.xml new file mode 100644 index 0000000000..81408b303f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201704-02.xml @@ -0,0 +1,56 @@ + + + + Chromium: Multiple vulnerabilities + Multiple vulnerabilities have been found in the Chromium web + browser, the worst of which allows remote attackers to execute arbitrary + code. + + chromium + 2017-04-10 + 2017-04-10: 1 + 614276 + remote + + + 57.0.2987.133 + 57.0.2987.133 + + + +

Chromium is the open-source web browser project behind Google Chrome

+ + +

Multiple vulnerabilities have been discovered in the Chromium web + browser. Please review the CVE identifiers referenced below for details. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, cause a Denial of Service condition, obtain + sensitive information, or bypass security restrictions. +

+ + +

There is no known workaround at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-57.0.2987.133" + + + + + CVE-2017-5052 + CVE-2017-5053 + CVE-2017-5054 + CVE-2017-5055 + CVE-2017-5056 + + BlueKnight + BlueKnight + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201704-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201704-03.xml new file mode 100644 index 0000000000..b8e18bb3da --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201704-03.xml @@ -0,0 +1,144 @@ + + + + X.Org: Multiple vulnerabilities + Multiple vulnerabilities have been found in X.Org server and + libraries, the worse of which allowing local attackers to execute arbitrary + code. + + xorg-server + 2017-04-10 + 2017-04-10: 1 + 596182 + 611350 + 611352 + 611354 + local, remote + + + 1.19.2 + 1.19.2 + + + 1.0.9-r1 + 1.0.9-r1 + + + 1.1.2-r1 + 1.1.2-r1 + + + 0.9.10 + 0.9.10 + + + 1.7.7 + 1.7.7 + + + 1.5.1 + 1.5.1 + + + 5.0.3 + 5.0.3 + + + 1.0.11 + 1.0.11 + + + +

X.Org X servers

+ + +

Multiple vulnerabilities have been discovered in X.Org server and + libraries. Please review the CVE identifiers referenced below for + details. +

+ + +

A local or remote users can utilize the vulnerabilities to attach to the + X.Org session as a user and execute arbitrary code. +

+ + +

There is no known workaround at this time.

+ + +

All X.Org-server users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.19.2" + + +

All libICE users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-libs/libICE-1.0.9-r1" + + +

All libXdmcp users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-libs/libXdmcp-1.1.2-r1" + + +

All libXrender users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-libs/libXrender-0.9.10" + + +

All libXi users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-libs/libXi-1.7.7" + + +

All libXrandr users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-libs/libXrandr-1.5.1" + + +

All libXfixes users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-libs/libXfixes-5.0.3" + + +

All libXv users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-libs/libXv-1.0.11" + + + + + CVE-2016-5407 + CVE-2016-7942 + CVE-2016-7943 + CVE-2016-7944 + CVE-2016-7945 + CVE-2016-7946 + CVE-2016-7947 + CVE-2016-7948 + CVE-2016-7949 + CVE-2016-7950 + CVE-2016-7953 + CVE-2017-2624 + CVE-2017-2625 + CVE-2017-2626 + + whissi + BlueKnight + diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk index b8e8cb3734..44d6e6ad8b 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Fri, 07 Apr 2017 21:09:29 +0000 +Tue, 11 Apr 2017 18:09:39 +0000