gentoo resync : 17.10.2017

7 files changed, 310 insertions, 2 deletions

diff --git a/metadata/glsa/glsa-201710-12.xml b/metadata/glsa/glsa-201710-12.xml
new file mode 100644
index 000000000000..a8e08cdda1a6
--- /dev/null
+++ b/metadata/glsa/glsa-201710-12.xml
@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201710-12">
+  <title>Puppet Agent: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in Puppet Agent, the worst
+    of which could result in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">puppetagent</product>
+  <announced>2017-10-13</announced>
+  <revised>2017-10-13: 1</revised>
+  <bug>597684</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-admin/puppet-agent" auto="yes" arch="*">
+      <unaffected range="ge">1.7.1</unaffected>
+      <vulnerable range="lt">1.7.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>Puppet Agent contains Puppet’s main code and all of the dependencies
+      needed to run it, including Facter, Hiera, and bundled versions of Ruby
+      and OpenSSL.
+    </p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in Puppet Agent. Please
+      review the references for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker could possibly execute arbitrary code with the
+      privileges of the process or obtain sensitive information.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All Puppet Agent users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=app-admin/puppet-agent-1.7.1"
+    </code>
+  </resolution>
+  <references>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5714">
+      CVE-2016-5714
+    </uri>
+    <uri link="https://puppet.com/security/cve/pxp-agent-oct-2016">Puppet
+      Security Advise Oct 2016
+    </uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-10-08T20:07:35Z">b-man</metadata>
+  <metadata tag="submitter" timestamp="2017-10-13T23:32:46Z">chrisadr</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201710-13.xml b/metadata/glsa/glsa-201710-13.xml
new file mode 100644
index 000000000000..3e94863a037b
--- /dev/null
+++ b/metadata/glsa/glsa-201710-13.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201710-13">
+  <title>Graphite: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in Graphite, the worst of
+    which could lead to the remote execution of arbitrary code.
+    
+  </synopsis>
+  <product type="ebuild">graphite2</product>
+  <announced>2017-10-13</announced>
+  <revised>2017-10-13: 1</revised>
+  <bug>621724</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/graphite2" auto="yes" arch="*">
+      <unaffected range="ge">1.3.10</unaffected>
+      <vulnerable range="lt">1.3.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>Graphite is a “smart font” system developed specifically to handle
+      the complexities of lesser-known languages of the world.
+    </p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in Graphite. Please review
+      the referenced CVE identifiers for details.
+    </p>
+    
+  </description>
+  <impact type="normal">
+    <p>A remote attacker could possibly execute arbitrary code with the
+      privileges of the process, cause a Denial of Service condition, or have
+      other unspecified impacts.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All Graphite users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=media-gfx/graphite2-1.3.10"
+    </code>
+    
+  </resolution>
+  <references>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7771">
+      CVE-2017-7771
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7772">
+      CVE-2017-7772
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7773">
+      CVE-2017-7773
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7774">
+      CVE-2017-7774
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7775">
+      CVE-2017-7775
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7776">
+      CVE-2017-7776
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7777">
+      CVE-2017-7777
+    </uri>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7778">
+      CVE-2017-7778
+    </uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-10-08T16:43:14Z">chrisadr</metadata>
+  <metadata tag="submitter" timestamp="2017-10-13T23:36:36Z">chrisadr</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201710-14.xml b/metadata/glsa/glsa-201710-14.xml
new file mode 100644
index 000000000000..f5e253bc8fc5
--- /dev/null
+++ b/metadata/glsa/glsa-201710-14.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201710-14">
+  <title>WebKitGTK+: Multiple Vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in WebkitGTK+, the worst
+    of which may allow remote attackers to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">webkit-gtk</product>
+  <announced>2017-10-13</announced>
+  <revised>2017-10-13: 1</revised>
+  <bug>626142</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-libs/webkit-gtk" auto="yes" arch="*">
+      <unaffected range="ge" slot="4">2.16.6</unaffected>
+      <vulnerable range="lt" slot="4">2.16.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>WebKitGTK+ is a full-featured port of the WebKit rendering engine,
+      suitable for projects requiring any kind of web integration, offers
+      Webkit’s full functionality and is used on a wide range of systems.
+    </p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in WebkitGTK+. Please
+      review the references below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker could execute arbitrary code, cause a Denial of
+      Service condition, bypass intended memory-read restrictions, conduct a
+      timing side-channel attack to bypass the Same Origin Policy, obtain
+      sensitive information, or spoof the address bar.
+    </p>
+    
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All WebKitGTK+ users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=net-libs/webkit-gtk-2.16.6"
+    </code>
+    
+    <p>Packages which depend on this library may need to be recompiled. Tools
+      such as revdep-rebuild may assist in identifying some of these packages.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7006">CVE-2017-7006</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7011">CVE-2017-7011</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7012">CVE-2017-7012</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7018">CVE-2017-7018</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7019">CVE-2017-7019</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7020">CVE-2017-7020</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7030">CVE-2017-7030</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7034">CVE-2017-7034</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7037">CVE-2017-7037</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7038">CVE-2017-7038</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7039">CVE-2017-7039</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7040">CVE-2017-7040</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7041">CVE-2017-7041</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7042">CVE-2017-7042</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7043">CVE-2017-7043</uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-04-30T20:06:21Z">BlueKnight</metadata>
+  <metadata tag="submitter" timestamp="2017-10-13T23:53:44Z">chrisadr</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201710-15.xml b/metadata/glsa/glsa-201710-15.xml
new file mode 100644
index 000000000000..60c2f5ccd17d
--- /dev/null
+++ b/metadata/glsa/glsa-201710-15.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201710-15">
+  <title>GnuTLS: Denial of Service</title>
+  <synopsis>A null pointer dereference in GnuTLS might allow attackers to cause
+    a Denial of Service condition.
+  </synopsis>
+  <product type="ebuild">gnutls</product>
+  <announced>2017-10-15</announced>
+  <revised>2017-10-15: 1</revised>
+  <bug>622038</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-libs/gnutls" auto="yes" arch="*">
+      <unaffected range="ge">3.5.13</unaffected>
+      <vulnerable range="lt">3.5.13</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>GnuTLS is a secure communications library implementing the SSL, TLS and
+      DTLS protocols and technologies around them.
+    </p>
+  </background>
+  <description>
+    <p>A null pointer dereference while decoding a status response TLS
+      extension with valid contents was discovered in GnuTLS.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker could possibly cause a Denial of Service condition.</p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All GnuTLS users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=net-libs/gnutls-3.5.13"
+    </code>
+    
+    <p>Packages which depend on this library may need to be recompiled. Tools
+      such as revdep-rebuild may assist in identifying some of these packages.
+    </p>
+  </resolution>
+  <references>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-7507">CVE-2017-7507</uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-09-17T19:52:42Z">chrisadr</metadata>
+  <metadata tag="submitter" timestamp="2017-10-15T04:20:45Z">chrisadr</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201710-16.xml b/metadata/glsa/glsa-201710-16.xml
new file mode 100644
index 000000000000..2328ec60a129
--- /dev/null
+++ b/metadata/glsa/glsa-201710-16.xml
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201710-16">
+  <title>Shadow: Buffer overflow</title>
+  <synopsis>A vulnerability found in Shadow may allow remote attackers to cause
+    a Denial of Service condition or produce other unspecified behaviors.
+  </synopsis>
+  <product type="ebuild">shadow</product>
+  <announced>2017-10-15</announced>
+  <revised>2017-10-15: 1</revised>
+  <bug>627044</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-apps/shadow" auto="yes" arch="*">
+      <unaffected range="ge">4.5</unaffected>
+      <vulnerable range="lt">4.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>Shadow is a set of tools to deal with user accounts.</p>
+  </background>
+  <description>
+    <p>Malformed input in the newusers tool may produce crashes and other
+      unspecified behaviors.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker could possibly cause a Denial of Service condition or
+      bypass privilege boundaries in some web-hosting environments in which a
+      Control Panel allows an unprivileged user account to create subaccounts.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All Shadow users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=sys-apps/shadow-4.5"
+    </code>
+  </resolution>
+  <references>
+    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-12424">
+      CVE-2017-12424
+    </uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-10-13T22:41:20Z">b-man</metadata>
+  <metadata tag="submitter" timestamp="2017-10-15T20:17:52Z">chrisadr</metadata>
+</glsa>
diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk
index 5da5bf2af708..7abd667dd6de 100644
--- a/metadata/glsa/timestamp.chk
+++ b/metadata/glsa/timestamp.chk
@@ -1 +1 @@
-Sun, 15 Oct 2017 00:09:18 +0000
+Tue, 17 Oct 2017 16:08:56 +0000
diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit
index e36f8be6f680..a05cb7436324 100644
--- a/metadata/glsa/timestamp.commit
+++ b/metadata/glsa/timestamp.commit
@@ -1 +1 @@
-73e44e2cacf09551930e343dbe6a24425f52af50 1507934888 2017-10-13T22:48:08+00:00
+f5081800804d6a1f4598cbc03e5a8f2664f6a070 1508098974 2017-10-15T20:22:54+00:00