gentoo resync : 05.04.2018

7 files changed, 301 insertions, 17 deletions

diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest
index 3d2e3db38a0d..5a254b565d62 100644
--- a/metadata/glsa/Manifest
+++ b/metadata/glsa/Manifest
@@ -1,23 +1,23 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA512
 
-MANIFEST Manifest.files.gz 419322 BLAKE2B bce39d2884945f8b0837f04b097288921742142eb6b55a87c2b57dd813da0393accc39cdbc36b1a820a911d1643768c6e20f5e777dfbb00ce5c5e8a8cccb59ae SHA512 dc4a29347ba058490aabba547065505da49564b81a43273cfc09b72c95a82ddf4139c1b5cee3c714a13e2094579946b7283bffeb6f766247a44733ca3d2e3109
-TIMESTAMP 2018-04-02T15:38:24Z
+MANIFEST Manifest.files.gz 419802 BLAKE2B 77b61430b97be606d07e770dcefecad6df694cb9d174d02e411d0c9124496cc8f3c082d220e88b305fb15b10d7c63b688c68e4484d9efe6cf97b41aabe095755 SHA512 3f233f14b1531babe34f57d6f927c008a3406b144de3e74532b3bf23c806220ffc43906d40c476f43e773cfbdabd98ea035b95415e8a23d7ad3ed93384c13bf7
+TIMESTAMP 2018-04-05T20:08:26Z
 -----BEGIN PGP SIGNATURE-----
 
-iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlrCTnBfFIAAAAAALgAo
+iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlrGgjpfFIAAAAAALgAo
 aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
 RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
-klB24g/9HF1ezAgEC1SzmKM3o/jJYhbdPXyGU3eOObR+HHfbbnoKveck+eTagCpL
-8iLKYtwyeEUBjrmfM31917QREsRsO3GU/SkJS5G3jj4BFvehpEs5xZFYYtHSTm9n
-OggwM3QF8jaTuGVmzey7gp0mLYGlqhOl4fUIf26dQN9ICxNX3tuhJNCTi3rhC/Ix
-I/QObyooDvEzioPH3RWPUFbvLYiqtxptIjBgx9sKcyfeLS0GjPPoOc48Lnj6StL6
-+TnxJr/7NNRESaGxpgbnbxoVjaqsgb2iTqC39+dsFpY4YavOk0cPXWMRlq5TNiQl
-1csJ2rv92qnOJwFhvKjPTQU8kN17o51lyB5iYTei8G9/mAzSickQkhE2xNaAfUAD
-yZcEAqPqNr73KHm2QTDgbU37Je515lTbw2yczG1N6Jbze6fopDxriwKY0dj/UKjF
-RWWOFvwiXJGqoAE2YwSGaHUzBUgEe88ZpPh0m603lNJF7PCKfFJGQajSHRFXvDAP
-ED9TjHAic0b9Ckj2pLPpfju/vYWQo6XWBCRa73JJauWIjwPTFDfbn+TSBABt+aYu
-qm8KPz1GugrUoBcLGHbZgiLRccnikndbYnSG1/We54hPAJOaMMLyapDsSW1AyI30
-BfjW1XCYeR93XcL5+CwJ+gD46o6EnAKJ2DyBMu+rRzOts/ztwTg=
-=V8nL
+klB3Zg/8D45b3fgD07PCC6C+KMgpBdhjBaqhe9sV4rEjBQKsRKeLo5mA8P0tPn+b
+43GRG5EKerafRtvLSB0lflhiA1GEQ4jmx9w++/j9MmMYVAuz0VqAd95b2lU99aVe
+wE/wVauON3pB0DvJQwtKdj0ukIWS+3B1EfnAMHUOsN4QVBSFdEZAgfEdhe5wuuPT
+vi+ZwyD/Ef5ogWOXf2fWOlGiun/qhSnaKDjellBe7NHWSNqDoSjs98FJA6Z9rWdI
++C1O84YGZfnD3c6mKoy9ibYsqI8Ghvz9KZlX0rG2q2KrtazUpkRkJb2kBwXOWAIg
+AvxgWvj6MHwlhCZTtt9SQVR+Kn1wnmIsLVBi/17yXvxUS2OqbtLRMgkdI+c3ZYoC
+06FETlMxNwJ1LdZYeuKlan+OhG1a8w/EpT6mVX5zESXQP7LAw1pDdJ3NKHeoK/qq
+mz/jAPyMRpjJHB93OV5koSG3UQD6++m25r6DK5wWQCDklCsaVBnt3vz4Ex+iHhGb
+0eCjLp9kq9VtP4Vt5JecUmQh7rtBZEi7I2FHFwjhssW2xJj6qUoDV9I4zFQzGGp4
+OtVvL96XQUEJl7yd/mn8J5oDvgwwIglz+YCsKPRqDo8pLLhVw9p+MiUiGl+1xKXd
+VcynkW21ZjKPtv15ZIdUJgslIxKRNYv96k1TaAFk5eYTyT8Qp4E=
+=z0ML
 -----END PGP SIGNATURE-----
diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz
index 39a8552e5338..b5be97045f05 100644
--- a/metadata/glsa/Manifest.files.gz
+++ b/metadata/glsa/Manifest.files.gz
diff --git a/metadata/glsa/glsa-201803-14.xml b/metadata/glsa/glsa-201803-14.xml
new file mode 100644
index 000000000000..71ba666fb6ac
--- /dev/null
+++ b/metadata/glsa/glsa-201803-14.xml
@@ -0,0 +1,169 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201803-14">
+  <title>Mozilla Thunderbird: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in Mozilla Thunderbird,
+    the worst of which could lead to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">thunderbird,thunderbird-bin</product>
+  <announced>2018-03-28</announced>
+  <revised count="1">2018-03-28</revised>
+  <bug>627376</bug>
+  <bug>639048</bug>
+  <bug>643842</bug>
+  <bug>645812</bug>
+  <bug>645820</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/thunderbird" auto="yes" arch="*">
+      <unaffected range="ge">52.6.0</unaffected>
+      <vulnerable range="lt">52.6.0</vulnerable>
+    </package>
+    <package name="mail-client/thunderbird-bin" auto="yes" arch="*">
+      <unaffected range="ge">52.6.0</unaffected>
+      <vulnerable range="lt">52.6.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>Mozilla Thunderbird is a popular open-source email client from the
+      Mozilla project.
+    </p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in Mozilla Thunderbird.
+      Please review the referenced Mozilla Foundation Security Advisories and
+      CVE identifiers below for details.
+    </p>
+    
+  </description>
+  <impact type="normal">
+    <p>A remote attacker may be able to execute arbitrary code, cause a Denial
+      of Service condition, obtain sensitive information, conduct URL
+      hijacking, or conduct cross-site scripting (XSS).
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All Thunderbird users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=mail-client/thunderbird-52.6.0"
+    </code>
+    
+    <p>All Thunderbird binary users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose
+      "&gt;=mail-client/thunderbird-bin-52.6.0"
+    </code>
+  </resolution>
+  <references>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7753">
+      CVE-2017-7753
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7779">
+      CVE-2017-7779
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7784">
+      CVE-2017-7784
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7785">
+      CVE-2017-7785
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7786">
+      CVE-2017-7786
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7787">
+      CVE-2017-7787
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7791">
+      CVE-2017-7791
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7792">
+      CVE-2017-7792
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7793">
+      CVE-2017-7793
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7800">
+      CVE-2017-7800
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7801">
+      CVE-2017-7801
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7802">
+      CVE-2017-7802
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7803">
+      CVE-2017-7803
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7805">
+      CVE-2017-7805
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7807">
+      CVE-2017-7807
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7809">
+      CVE-2017-7809
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7810">
+      CVE-2017-7810
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7814">
+      CVE-2017-7814
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7818">
+      CVE-2017-7818
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7819">
+      CVE-2017-7819
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7823">
+      CVE-2017-7823
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7824">
+      CVE-2017-7824
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7825">
+      CVE-2017-7825
+    </uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-7826">CVE-2017-7826</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-7828">CVE-2017-7828</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-7829">CVE-2017-7829</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-7830">CVE-2017-7830</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-7846">CVE-2017-7846</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-7847">CVE-2017-7847</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-7848">CVE-2017-7848</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5089">CVE-2018-5089</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5095">CVE-2018-5095</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5096">CVE-2018-5096</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5097">CVE-2018-5097</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5098">CVE-2018-5098</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5099">CVE-2018-5099</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5102">CVE-2018-5102</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5103">CVE-2018-5103</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5104">CVE-2018-5104</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5117">CVE-2018-5117</uri>
+    <uri link="https://www.mozilla.org/en-US/security/advisories/mfsa2017-20/">
+      Mozilla Foundation Security Advisory 2017-20
+    </uri>
+    <uri link="https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/">
+      Mozilla Foundation Security Advisory 2017-23
+    </uri>
+    <uri link="https://www.mozilla.org/en-US/security/advisories/mfsa2017-26/">
+      Mozilla Foundation Security Advisory 2017-26
+    </uri>
+    <uri link="https://www.mozilla.org/en-US/security/advisories/mfsa2017-30/">
+      Mozilla Foundation Security Advisory 2017-30
+    </uri>
+    <uri link="https://www.mozilla.org/en-US/security/advisories/mfsa2018-04/">
+      Mozilla Foundation Security Advisory 2018-04
+    </uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-10-05T15:42:10Z">chrisadr</metadata>
+  <metadata tag="submitter" timestamp="2018-03-28T18:24:10Z">chrisadr</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201804-01.xml b/metadata/glsa/glsa-201804-01.xml
new file mode 100644
index 000000000000..96654f77e326
--- /dev/null
+++ b/metadata/glsa/glsa-201804-01.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201804-01">
+  <title>libxslt: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities were discovered in libxslt, the worst of
+    which may allow a remote attacker to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">libxslt</product>
+  <announced>2018-04-04</announced>
+  <revised count="1">2018-04-04</revised>
+  <bug>598204</bug>
+  <bug>612194</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/libxslt" auto="yes" arch="*">
+      <unaffected range="ge">1.1.30</unaffected>
+      <vulnerable range="lt">1.1.30</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>libxslt is the XSLT C library developed for the GNOME project. XSLT is
+      an XML language to define transformations for XML.
+    </p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in libxslt. Please review
+      the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker, via a crafted HTML page, could possibly execute
+      arbitrary code, cause a Denial of Service condition or leak information.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All libxslt users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=dev-libs/libxslt-1.1.30"
+    </code>
+  </resolution>
+  <references>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2016-4738">CVE-2016-4738</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-5029">CVE-2017-5029</uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-04-19T05:20:01Z">BlueKnight</metadata>
+  <metadata tag="submitter" timestamp="2018-04-04T01:51:21Z">b-man</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201804-02.xml b/metadata/glsa/glsa-201804-02.xml
new file mode 100644
index 000000000000..efd4696cb713
--- /dev/null
+++ b/metadata/glsa/glsa-201804-02.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201804-02">
+  <title>glibc: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in glibc, the worst of
+    which could allow remote attackers to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">glibc</product>
+  <announced>2018-04-04</announced>
+  <revised count="1">2018-04-04</revised>
+  <bug>632556</bug>
+  <bug>634920</bug>
+  <bug>635118</bug>
+  <bug>641644</bug>
+  <bug>644278</bug>
+  <bug>646490</bug>
+  <bug>646492</bug>
+  <access>local, remote</access>
+  <affected>
+    <package name="sys-libs/glibc" auto="yes" arch="*">
+      <unaffected range="ge">2.25-r11</unaffected>
+      <vulnerable range="lt">2.25-r11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>glibc is a package that contains the GNU C library.</p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in glibc. Please review
+      the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>An attacker could possibly execute arbitrary code, escalate privileges,
+      cause a Denial of Service condition, or have other unspecified impacts.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All glibc users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=sys-libs/glibc-2.25-r11"
+    </code>
+  </resolution>
+  <references>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-14062">CVE-2017-14062</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-15670">CVE-2017-15670</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-15671">CVE-2017-15671</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-15804">CVE-2017-15804</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-16997">CVE-2017-16997</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-1000001">
+      CVE-2018-1000001
+    </uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6485">CVE-2018-6485</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6551">CVE-2018-6551</uri>
+  </references>
+  <metadata tag="requester" timestamp="2018-03-12T23:08:50Z">chrisadr</metadata>
+  <metadata tag="submitter" timestamp="2018-04-04T01:53:52Z">b-man</metadata>
+</glsa>
diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk
index 6de0bc2888eb..b635badf5e6a 100644
--- a/metadata/glsa/timestamp.chk
+++ b/metadata/glsa/timestamp.chk
@@ -1 +1 @@
-Mon, 02 Apr 2018 15:38:20 +0000
+Thu, 05 Apr 2018 20:08:23 +0000
diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit
index 9a2f6c8de5f4..febf2abf42b1 100644
--- a/metadata/glsa/timestamp.commit
+++ b/metadata/glsa/timestamp.commit
@@ -1 +1 @@
-e77e32771f61fb0da58c84733fb97dfc54b01bb4 1522081689 2018-03-26T16:28:09+00:00
+e07af6df7a81524d31084c5565441abb9e572281 1522807580 2018-04-04T02:06:20+00:00