summaryrefslogtreecommitdiff
path: root/metadata/glsa
diff options
context:
space:
mode:
Diffstat (limited to 'metadata/glsa')
-rw-r--r--metadata/glsa/Manifest30
-rw-r--r--metadata/glsa/Manifest.files.gzbin419322 -> 419802 bytes
-rw-r--r--metadata/glsa/glsa-201803-14.xml169
-rw-r--r--metadata/glsa/glsa-201804-01.xml52
-rw-r--r--metadata/glsa/glsa-201804-02.xml63
-rw-r--r--metadata/glsa/timestamp.chk2
-rw-r--r--metadata/glsa/timestamp.commit2
7 files changed, 301 insertions, 17 deletions
diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest
index 3d2e3db38a0d..5a254b565d62 100644
--- a/metadata/glsa/Manifest
+++ b/metadata/glsa/Manifest
@@ -1,23 +1,23 @@
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
-MANIFEST Manifest.files.gz 419322 BLAKE2B bce39d2884945f8b0837f04b097288921742142eb6b55a87c2b57dd813da0393accc39cdbc36b1a820a911d1643768c6e20f5e777dfbb00ce5c5e8a8cccb59ae SHA512 dc4a29347ba058490aabba547065505da49564b81a43273cfc09b72c95a82ddf4139c1b5cee3c714a13e2094579946b7283bffeb6f766247a44733ca3d2e3109
-TIMESTAMP 2018-04-02T15:38:24Z
+MANIFEST Manifest.files.gz 419802 BLAKE2B 77b61430b97be606d07e770dcefecad6df694cb9d174d02e411d0c9124496cc8f3c082d220e88b305fb15b10d7c63b688c68e4484d9efe6cf97b41aabe095755 SHA512 3f233f14b1531babe34f57d6f927c008a3406b144de3e74532b3bf23c806220ffc43906d40c476f43e773cfbdabd98ea035b95415e8a23d7ad3ed93384c13bf7
+TIMESTAMP 2018-04-05T20:08:26Z
-----BEGIN PGP SIGNATURE-----
-iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlrCTnBfFIAAAAAALgAo
+iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlrGgjpfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
-klB24g/9HF1ezAgEC1SzmKM3o/jJYhbdPXyGU3eOObR+HHfbbnoKveck+eTagCpL
-8iLKYtwyeEUBjrmfM31917QREsRsO3GU/SkJS5G3jj4BFvehpEs5xZFYYtHSTm9n
-OggwM3QF8jaTuGVmzey7gp0mLYGlqhOl4fUIf26dQN9ICxNX3tuhJNCTi3rhC/Ix
-I/QObyooDvEzioPH3RWPUFbvLYiqtxptIjBgx9sKcyfeLS0GjPPoOc48Lnj6StL6
-+TnxJr/7NNRESaGxpgbnbxoVjaqsgb2iTqC39+dsFpY4YavOk0cPXWMRlq5TNiQl
-1csJ2rv92qnOJwFhvKjPTQU8kN17o51lyB5iYTei8G9/mAzSickQkhE2xNaAfUAD
-yZcEAqPqNr73KHm2QTDgbU37Je515lTbw2yczG1N6Jbze6fopDxriwKY0dj/UKjF
-RWWOFvwiXJGqoAE2YwSGaHUzBUgEe88ZpPh0m603lNJF7PCKfFJGQajSHRFXvDAP
-ED9TjHAic0b9Ckj2pLPpfju/vYWQo6XWBCRa73JJauWIjwPTFDfbn+TSBABt+aYu
-qm8KPz1GugrUoBcLGHbZgiLRccnikndbYnSG1/We54hPAJOaMMLyapDsSW1AyI30
-BfjW1XCYeR93XcL5+CwJ+gD46o6EnAKJ2DyBMu+rRzOts/ztwTg=
-=V8nL
+klB3Zg/8D45b3fgD07PCC6C+KMgpBdhjBaqhe9sV4rEjBQKsRKeLo5mA8P0tPn+b
+43GRG5EKerafRtvLSB0lflhiA1GEQ4jmx9w++/j9MmMYVAuz0VqAd95b2lU99aVe
+wE/wVauON3pB0DvJQwtKdj0ukIWS+3B1EfnAMHUOsN4QVBSFdEZAgfEdhe5wuuPT
+vi+ZwyD/Ef5ogWOXf2fWOlGiun/qhSnaKDjellBe7NHWSNqDoSjs98FJA6Z9rWdI
++C1O84YGZfnD3c6mKoy9ibYsqI8Ghvz9KZlX0rG2q2KrtazUpkRkJb2kBwXOWAIg
+AvxgWvj6MHwlhCZTtt9SQVR+Kn1wnmIsLVBi/17yXvxUS2OqbtLRMgkdI+c3ZYoC
+06FETlMxNwJ1LdZYeuKlan+OhG1a8w/EpT6mVX5zESXQP7LAw1pDdJ3NKHeoK/qq
+mz/jAPyMRpjJHB93OV5koSG3UQD6++m25r6DK5wWQCDklCsaVBnt3vz4Ex+iHhGb
+0eCjLp9kq9VtP4Vt5JecUmQh7rtBZEi7I2FHFwjhssW2xJj6qUoDV9I4zFQzGGp4
+OtVvL96XQUEJl7yd/mn8J5oDvgwwIglz+YCsKPRqDo8pLLhVw9p+MiUiGl+1xKXd
+VcynkW21ZjKPtv15ZIdUJgslIxKRNYv96k1TaAFk5eYTyT8Qp4E=
+=z0ML
-----END PGP SIGNATURE-----
diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz
index 39a8552e5338..b5be97045f05 100644
--- a/metadata/glsa/Manifest.files.gz
+++ b/metadata/glsa/Manifest.files.gz
Binary files differ
diff --git a/metadata/glsa/glsa-201803-14.xml b/metadata/glsa/glsa-201803-14.xml
new file mode 100644
index 000000000000..71ba666fb6ac
--- /dev/null
+++ b/metadata/glsa/glsa-201803-14.xml
@@ -0,0 +1,169 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201803-14">
+ <title>Mozilla Thunderbird: Multiple vulnerabilities</title>
+ <synopsis>Multiple vulnerabilities have been found in Mozilla Thunderbird,
+ the worst of which could lead to the execution of arbitrary code.
+ </synopsis>
+ <product type="ebuild">thunderbird,thunderbird-bin</product>
+ <announced>2018-03-28</announced>
+ <revised count="1">2018-03-28</revised>
+ <bug>627376</bug>
+ <bug>639048</bug>
+ <bug>643842</bug>
+ <bug>645812</bug>
+ <bug>645820</bug>
+ <access>remote</access>
+ <affected>
+ <package name="mail-client/thunderbird" auto="yes" arch="*">
+ <unaffected range="ge">52.6.0</unaffected>
+ <vulnerable range="lt">52.6.0</vulnerable>
+ </package>
+ <package name="mail-client/thunderbird-bin" auto="yes" arch="*">
+ <unaffected range="ge">52.6.0</unaffected>
+ <vulnerable range="lt">52.6.0</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>Mozilla Thunderbird is a popular open-source email client from the
+ Mozilla project.
+ </p>
+ </background>
+ <description>
+ <p>Multiple vulnerabilities have been discovered in Mozilla Thunderbird.
+ Please review the referenced Mozilla Foundation Security Advisories and
+ CVE identifiers below for details.
+ </p>
+
+ </description>
+ <impact type="normal">
+ <p>A remote attacker may be able to execute arbitrary code, cause a Denial
+ of Service condition, obtain sensitive information, conduct URL
+ hijacking, or conduct cross-site scripting (XSS).
+ </p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All Thunderbird users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose "&gt;=mail-client/thunderbird-52.6.0"
+ </code>
+
+ <p>All Thunderbird binary users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose
+ "&gt;=mail-client/thunderbird-bin-52.6.0"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7753">
+ CVE-2017-7753
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7779">
+ CVE-2017-7779
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7784">
+ CVE-2017-7784
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7785">
+ CVE-2017-7785
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7786">
+ CVE-2017-7786
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7787">
+ CVE-2017-7787
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7791">
+ CVE-2017-7791
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7792">
+ CVE-2017-7792
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7793">
+ CVE-2017-7793
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7800">
+ CVE-2017-7800
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7801">
+ CVE-2017-7801
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7802">
+ CVE-2017-7802
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7803">
+ CVE-2017-7803
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7805">
+ CVE-2017-7805
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7807">
+ CVE-2017-7807
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7809">
+ CVE-2017-7809
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7810">
+ CVE-2017-7810
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7814">
+ CVE-2017-7814
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7818">
+ CVE-2017-7818
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7819">
+ CVE-2017-7819
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7823">
+ CVE-2017-7823
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7824">
+ CVE-2017-7824
+ </uri>
+ <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7825">
+ CVE-2017-7825
+ </uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-7826">CVE-2017-7826</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-7828">CVE-2017-7828</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-7829">CVE-2017-7829</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-7830">CVE-2017-7830</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-7846">CVE-2017-7846</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-7847">CVE-2017-7847</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-7848">CVE-2017-7848</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5089">CVE-2018-5089</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5095">CVE-2018-5095</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5096">CVE-2018-5096</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5097">CVE-2018-5097</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5098">CVE-2018-5098</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5099">CVE-2018-5099</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5102">CVE-2018-5102</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5103">CVE-2018-5103</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5104">CVE-2018-5104</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-5117">CVE-2018-5117</uri>
+ <uri link="https://www.mozilla.org/en-US/security/advisories/mfsa2017-20/">
+ Mozilla Foundation Security Advisory 2017-20
+ </uri>
+ <uri link="https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/">
+ Mozilla Foundation Security Advisory 2017-23
+ </uri>
+ <uri link="https://www.mozilla.org/en-US/security/advisories/mfsa2017-26/">
+ Mozilla Foundation Security Advisory 2017-26
+ </uri>
+ <uri link="https://www.mozilla.org/en-US/security/advisories/mfsa2017-30/">
+ Mozilla Foundation Security Advisory 2017-30
+ </uri>
+ <uri link="https://www.mozilla.org/en-US/security/advisories/mfsa2018-04/">
+ Mozilla Foundation Security Advisory 2018-04
+ </uri>
+ </references>
+ <metadata tag="requester" timestamp="2017-10-05T15:42:10Z">chrisadr</metadata>
+ <metadata tag="submitter" timestamp="2018-03-28T18:24:10Z">chrisadr</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201804-01.xml b/metadata/glsa/glsa-201804-01.xml
new file mode 100644
index 000000000000..96654f77e326
--- /dev/null
+++ b/metadata/glsa/glsa-201804-01.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201804-01">
+ <title>libxslt: Multiple vulnerabilities</title>
+ <synopsis>Multiple vulnerabilities were discovered in libxslt, the worst of
+ which may allow a remote attacker to execute arbitrary code.
+ </synopsis>
+ <product type="ebuild">libxslt</product>
+ <announced>2018-04-04</announced>
+ <revised count="1">2018-04-04</revised>
+ <bug>598204</bug>
+ <bug>612194</bug>
+ <access>remote</access>
+ <affected>
+ <package name="dev-libs/libxslt" auto="yes" arch="*">
+ <unaffected range="ge">1.1.30</unaffected>
+ <vulnerable range="lt">1.1.30</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>libxslt is the XSLT C library developed for the GNOME project. XSLT is
+ an XML language to define transformations for XML.
+ </p>
+ </background>
+ <description>
+ <p>Multiple vulnerabilities have been discovered in libxslt. Please review
+ the CVE identifiers referenced below for details.
+ </p>
+ </description>
+ <impact type="normal">
+ <p>A remote attacker, via a crafted HTML page, could possibly execute
+ arbitrary code, cause a Denial of Service condition or leak information.
+ </p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All libxslt users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose "&gt;=dev-libs/libxslt-1.1.30"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2016-4738">CVE-2016-4738</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-5029">CVE-2017-5029</uri>
+ </references>
+ <metadata tag="requester" timestamp="2017-04-19T05:20:01Z">BlueKnight</metadata>
+ <metadata tag="submitter" timestamp="2018-04-04T01:51:21Z">b-man</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201804-02.xml b/metadata/glsa/glsa-201804-02.xml
new file mode 100644
index 000000000000..efd4696cb713
--- /dev/null
+++ b/metadata/glsa/glsa-201804-02.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201804-02">
+ <title>glibc: Multiple vulnerabilities</title>
+ <synopsis>Multiple vulnerabilities have been found in glibc, the worst of
+ which could allow remote attackers to execute arbitrary code.
+ </synopsis>
+ <product type="ebuild">glibc</product>
+ <announced>2018-04-04</announced>
+ <revised count="1">2018-04-04</revised>
+ <bug>632556</bug>
+ <bug>634920</bug>
+ <bug>635118</bug>
+ <bug>641644</bug>
+ <bug>644278</bug>
+ <bug>646490</bug>
+ <bug>646492</bug>
+ <access>local, remote</access>
+ <affected>
+ <package name="sys-libs/glibc" auto="yes" arch="*">
+ <unaffected range="ge">2.25-r11</unaffected>
+ <vulnerable range="lt">2.25-r11</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>glibc is a package that contains the GNU C library.</p>
+ </background>
+ <description>
+ <p>Multiple vulnerabilities have been discovered in glibc. Please review
+ the CVE identifiers referenced below for details.
+ </p>
+ </description>
+ <impact type="normal">
+ <p>An attacker could possibly execute arbitrary code, escalate privileges,
+ cause a Denial of Service condition, or have other unspecified impacts.
+ </p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All glibc users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose "&gt;=sys-libs/glibc-2.25-r11"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-14062">CVE-2017-14062</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-15670">CVE-2017-15670</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-15671">CVE-2017-15671</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-15804">CVE-2017-15804</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-16997">CVE-2017-16997</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-1000001">
+ CVE-2018-1000001
+ </uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6485">CVE-2018-6485</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-6551">CVE-2018-6551</uri>
+ </references>
+ <metadata tag="requester" timestamp="2018-03-12T23:08:50Z">chrisadr</metadata>
+ <metadata tag="submitter" timestamp="2018-04-04T01:53:52Z">b-man</metadata>
+</glsa>
diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk
index 6de0bc2888eb..b635badf5e6a 100644
--- a/metadata/glsa/timestamp.chk
+++ b/metadata/glsa/timestamp.chk
@@ -1 +1 @@
-Mon, 02 Apr 2018 15:38:20 +0000
+Thu, 05 Apr 2018 20:08:23 +0000
diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit
index 9a2f6c8de5f4..febf2abf42b1 100644
--- a/metadata/glsa/timestamp.commit
+++ b/metadata/glsa/timestamp.commit
@@ -1 +1 @@
-e77e32771f61fb0da58c84733fb97dfc54b01bb4 1522081689 2018-03-26T16:28:09+00:00
+e07af6df7a81524d31084c5565441abb9e572281 1522807580 2018-04-04T02:06:20+00:00
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-02 18:53:29 +0000