summaryrefslogtreecommitdiff
path: root/metadata/glsa
diff options
context:
space:
mode:
Diffstat (limited to 'metadata/glsa')
-rw-r--r--metadata/glsa/Manifest30
-rw-r--r--metadata/glsa/Manifest.files.gzbin515403 -> 517009 bytes
-rw-r--r--metadata/glsa/glsa-202107-41.xml47
-rw-r--r--metadata/glsa/glsa-202107-42.xml50
-rw-r--r--metadata/glsa/glsa-202107-43.xml52
-rw-r--r--metadata/glsa/glsa-202107-44.xml51
-rw-r--r--metadata/glsa/glsa-202107-45.xml61
-rw-r--r--metadata/glsa/glsa-202107-46.xml48
-rw-r--r--metadata/glsa/glsa-202107-47.xml49
-rw-r--r--metadata/glsa/glsa-202107-48.xml49
-rw-r--r--metadata/glsa/glsa-202107-49.xml72
-rw-r--r--metadata/glsa/glsa-202107-50.xml51
-rw-r--r--metadata/glsa/timestamp.chk2
-rw-r--r--metadata/glsa/timestamp.commit2
14 files changed, 547 insertions, 17 deletions
diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest
index dae4120315e4..233040c09ae1 100644
--- a/metadata/glsa/Manifest
+++ b/metadata/glsa/Manifest
@@ -1,23 +1,23 @@
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
-MANIFEST Manifest.files.gz 515403 BLAKE2B 2c3efe7a5a7d2ab8e90e9b1bd7118eceae943d57d96054bc9b9f1f28ce3625d956a0ef4b37dc99a8f53983d4cb1c230b5d63cdaf2310372c379209c8703ec67f SHA512 3314ee13046d68813f7a4f6d648d5b31496fb976d5d8456229403081e0e0f9369fa83c271c4d6eb3dbe296b3a72758271782ca5d805b74a5deaa07e14742bafb
-TIMESTAMP 2021-07-17T17:39:10Z
+MANIFEST Manifest.files.gz 517009 BLAKE2B 7dfe2c6f0d3c02fd13a4ff92c8b43527ed90bc991cb77cf23a6b6f4d95a096baf241470cf7a0758af0ac5a10a8c455ea6117a88ca56d9619752cbe7f94a48887 SHA512 a547d3f7e4ce6646a0fd7f1bbc0c170ce1ad5c251ff3df4af3717aeb9fe49d0376f58f7a94715f226b5ed2e9b7f27692afb69b78d807ec8b830b728935a0bcbd
+TIMESTAMP 2021-07-24T00:39:02Z
-----BEGIN PGP SIGNATURE-----
-iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmDzFb5fFIAAAAAALgAo
+iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmD7YSZfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
-klDTaRAAiEapxlJpnLp5i442vw3FGhXvzblQCEiX/58EfEx0FZ/OsnvkGWhC55p5
-7SUCZNE0doIskdzXItmenbaWy+BBmzWtqMTSkt3mMDddxt9ElaU1LWlr9XefH/BM
-sjlwAJfeJndyw60i7JMTETTjX3scBM+Z9wP8n0uyuiLFQQ0kNM8DrwxyKOlEV5Fy
-xQv9DieSnnPaMiQZ+yLuZQM4lpiwTEToGjs9MgC2d032AL9G1TiZFFjFYRcaJWKS
-mhZeGUHUI81VYa93a7yeHCYC6fE19S0bsg+KPccyMYcxa4e3UwebT+zNPWQHA50c
-89YLMVAGTIgR7qweUzfgDOM2M5Si1Rj1gtq442Hg78p+uoE9gdKicAxyW9qiMBBs
-LkgD5HMM6+x/x2VwdNHszYPfbKKJX5Av52KSLqy2hX8fHZAvSIIogxQftr2SJqsU
-/OIZKqzgksB/masJn6BdDGrE/EyeyoQxSeXTgfHrytOzWaZkTnnSZmoF2aLEQf5y
-H6gB7PyCQgCw5rtPc/eyl0Zhu1FXwq9soK4a6BJW0WCQHL0AWdM/xR7P7ZTJKc2e
-haCmlIBwxbWtk1656Zm/JcEgOvsgkYrH+g8RBtD3UtMgOWpXS+TSM1HEslM6rgkL
-1hFP5bztPPwgcs0vHkwVy9bm0y9t4vgCDibxJ/1M94WlFvUHG14=
-=jtEe
+klC5Mw/9GsZ9wpwdz+PbVdusr4HHAV59IT+qhg3/55VhmeVfPaFMIsfVpxbhZPtj
+EjaHeBD/iOblkKhN7ctyFMe3Vf/r63bMmhT6ERpV3mKu8h43LsHN5qcjQ4TlvCvD
+kT+IJiMI3LfxdRlYQMGr572aclA/xd194LiPJyUj4j0p2slbrbtzp3OEKTO+BI/a
+6ZVULgMrMowWbAZTeqqusOK1RC5z4URqhAHun+7piyBmtc3tph3KcpQKRpBon2Kv
++6ONA1LzmHrbvEJnjsuTSx1irS1b5prQgU8CPJ6h9Y6QObDDxjmut4JHfC0MBXeI
+RUaIQHxgqfcetTh+WwjY9mGVxVS2NlgCeOUQU5pgKZJ40mWQDbFId2BYs4ih8WzU
+YFl5zbzie3mxyFoo5ssc8/Q/HOoOU+sG6Ld8M8Wu9BwP1us7GE8dRaVrW+xSKkDc
+7Fj09YZbKpD7HiQZOyjf3xK3D6W80ZPs5VujslWE+YPuV/V4sy516hJ2QmYJlFvI
+mrjk3mwocKx/Zyhm45z+g5AkRCA8g2leHNX5SwF38+ZkOXTtIiQdbrO2IT6MoO/Q
+/ticUcLzITIDwfsN5fXUSO1hOAXl3FzDLsUvKw+yPmbIhXIK5bwgHPk5QE/ACdpo
+j0PRo+XX2V1BYzJg1n3aU4M8nVuYaKEah7vp3GhvPiLKxMB9msg=
+=EP+w
-----END PGP SIGNATURE-----
diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz
index 0db27d5d926b..7f2ba8300b23 100644
--- a/metadata/glsa/Manifest.files.gz
+++ b/metadata/glsa/Manifest.files.gz
Binary files differ
diff --git a/metadata/glsa/glsa-202107-41.xml b/metadata/glsa/glsa-202107-41.xml
new file mode 100644
index 000000000000..2e01572b2113
--- /dev/null
+++ b/metadata/glsa/glsa-202107-41.xml
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202107-41">
+ <title>Dovecot: Multiple vulnerabilities</title>
+ <synopsis>Multiple vulnerabilities have been found in Dovecot, the worst of
+ which could result in a Denial of Service condition.
+ </synopsis>
+ <product type="ebuild">dovecot</product>
+ <announced>2021-07-18</announced>
+ <revised count="2">2021-07-18</revised>
+ <bug>797349</bug>
+ <access>remote</access>
+ <affected>
+ <package name="net-mail/dovecot" auto="yes" arch="*">
+ <unaffected range="ge">2.3.14.1</unaffected>
+ <vulnerable range="lt">2.3.14.1</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>Dovecot is an open source IMAP and POP3 email server.</p>
+ </background>
+ <description>
+ <p>Multiple vulnerabilities have been discovered in Dovecot. Please review
+ the CVE identifiers referenced below for details.
+ </p>
+ </description>
+ <impact type="low">
+ <p>Please review the referenced CVE identifiers for details.</p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All Dovecot users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose "&gt;=net-mail/dovecot-2.3.14.1"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-29157">CVE-2021-29157</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-33515">CVE-2021-33515</uri>
+ </references>
+ <metadata tag="requester" timestamp="2021-07-17T16:37:03Z">ajak</metadata>
+ <metadata tag="submitter" timestamp="2021-07-18T03:45:21Z">ajak</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-202107-42.xml b/metadata/glsa/glsa-202107-42.xml
new file mode 100644
index 000000000000..8b6fc8a9b409
--- /dev/null
+++ b/metadata/glsa/glsa-202107-42.xml
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202107-42">
+ <title>PJSIP: Multiple vulnerabilities</title>
+ <synopsis>Multiple vulnerabilities have been found in PJSIP, the worst of
+ which could result in a Denial of Service condition.
+ </synopsis>
+ <product type="ebuild">pjproject</product>
+ <announced>2021-07-20</announced>
+ <revised count="1">2021-07-20</revised>
+ <bug>775359</bug>
+ <access>remote</access>
+ <affected>
+ <package name="net-libs/pjproject" auto="yes" arch="*">
+ <unaffected range="ge">2.10-r1</unaffected>
+ <vulnerable range="lt">2.10-r1</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>PJSIP is a free and open source multimedia communication library written
+ in C language implementing standard based protocols such as SIP, SDP,
+ RTP, STUN, TURN, and ICE.
+ </p>
+ </background>
+ <description>
+ <p>Multiple vulnerabilities have been discovered in PJSIP. Please review
+ the CVE identifiers referenced below for details.
+ </p>
+ </description>
+ <impact type="low">
+ <p>Please review the referenced CVE identifiers for details.</p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All PJSIP users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose "&gt;=net-libs/pjproject-2.10-r1"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-15260">CVE-2020-15260</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-21375">CVE-2021-21375</uri>
+ </references>
+ <metadata tag="requester" timestamp="2021-07-16T02:16:25Z">ajak</metadata>
+ <metadata tag="submitter" timestamp="2021-07-20T03:48:47Z">ajak</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-202107-43.xml b/metadata/glsa/glsa-202107-43.xml
new file mode 100644
index 000000000000..aa7e48b71929
--- /dev/null
+++ b/metadata/glsa/glsa-202107-43.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202107-43">
+ <title>RPM: Multiple vulnerabilities</title>
+ <synopsis>Multiple vulnerabilities have been found in RPM, the worst of which
+ could result in remote code execution.
+ </synopsis>
+ <product type="ebuild">rpm</product>
+ <announced>2021-07-20</announced>
+ <revised count="1">2021-07-20</revised>
+ <bug>778533</bug>
+ <bug>787944</bug>
+ <access>remote</access>
+ <affected>
+ <package name="app-arch/rpm" auto="yes" arch="*">
+ <unaffected range="ge">4.16.1.3</unaffected>
+ <vulnerable range="lt">4.16.1.3</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>The Red Hat Package Manager (RPM) is a command line driven package
+ management system capable of installing, uninstalling, verifying,
+ querying, and updating computer software packages.
+ </p>
+ </background>
+ <description>
+ <p>Multiple vulnerabilities have been discovered in RPM. Please review the
+ CVE identifiers referenced below for details.
+ </p>
+ </description>
+ <impact type="normal">
+ <p>Please review the referenced CVE identifiers for details.</p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All RPM users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose "&gt;=app-arch/rpm-4.16.1.3"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-20266">CVE-2021-20266</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-20271">CVE-2021-20271</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3421">CVE-2021-3421</uri>
+ </references>
+ <metadata tag="requester" timestamp="2021-07-16T01:57:38Z">ajak</metadata>
+ <metadata tag="submitter" timestamp="2021-07-20T04:06:54Z">ajak</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-202107-44.xml b/metadata/glsa/glsa-202107-44.xml
new file mode 100644
index 000000000000..30a974dc968c
--- /dev/null
+++ b/metadata/glsa/glsa-202107-44.xml
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202107-44">
+ <title>libslirp: Multiple vulnerabilities</title>
+ <synopsis>Multiple vulnerabilities have been found in libslirp, the worst of
+ which could result in a Denial of Service condition.
+ </synopsis>
+ <product type="ebuild">libslirp</product>
+ <announced>2021-07-20</announced>
+ <revised count="1">2021-07-20</revised>
+ <bug>796347</bug>
+ <access>local</access>
+ <affected>
+ <package name="net-libs/libslirp" auto="yes" arch="*">
+ <unaffected range="ge">4.6.0</unaffected>
+ <vulnerable range="lt">4.6.0</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>libslirp is a TCP/IP emulator used to provide virtual networking
+ services.
+ </p>
+ </background>
+ <description>
+ <p>Multiple vulnerabilities have been discovered in libslirp. Please review
+ the CVE identifiers referenced below for details.
+ </p>
+ </description>
+ <impact type="low">
+ <p>Please review the referenced CVE identifiers for details.</p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All libslirp users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose "&gt;=net-libs/libslirp-4.6.0"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3592">CVE-2021-3592</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3593">CVE-2021-3593</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3594">CVE-2021-3594</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3595">CVE-2021-3595</uri>
+ </references>
+ <metadata tag="requester" timestamp="2021-07-10T00:29:05Z">ajak</metadata>
+ <metadata tag="submitter" timestamp="2021-07-20T04:11:18Z">ajak</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-202107-45.xml b/metadata/glsa/glsa-202107-45.xml
new file mode 100644
index 000000000000..253cc37b6db7
--- /dev/null
+++ b/metadata/glsa/glsa-202107-45.xml
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202107-45">
+ <title>PyCharm Community, Professional: Remote code execution</title>
+ <synopsis>A vulnerability has been found in PyCharm Community and
+ Professional, potentially resulting in arbitrary code execution.
+ </synopsis>
+ <product type="ebuild">pycharm</product>
+ <announced>2021-07-20</announced>
+ <revised count="1">2021-07-20</revised>
+ <bug>797892</bug>
+ <access>remote</access>
+ <affected>
+ <package name="dev-util/pycharm-community" auto="yes" arch="*">
+ <unaffected range="ge">2021.1.2</unaffected>
+ <vulnerable range="lt">2021.1.2</vulnerable>
+ </package>
+ <package name="dev-util/pycharm-professional" auto="yes" arch="*">
+ <unaffected range="ge">2021.1.2</unaffected>
+ <vulnerable range="lt">2021.1.2</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>PyCharm is the Python IDE for professional developers.</p>
+ </background>
+ <description>
+ <p>Insufficient validation exists within PyCharm’s checks for fetching
+ projects from VCS.
+ </p>
+ </description>
+ <impact type="normal">
+ <p>If a victim can be enticed into fetching a VCS project via PyCharm, a
+ remote attacker could achieve remote code execution.
+ </p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All PyCharm Community users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose
+ "&gt;=dev-util/pycharm-community-2021.1.2"
+ </code>
+
+ <p>All PyCharm Professional users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose
+ "&gt;=dev-util/pycharm-professional-2021.1.2"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-30005">CVE-2021-30005</uri>
+ </references>
+ <metadata tag="requester" timestamp="2021-07-16T02:00:34Z">ajak</metadata>
+ <metadata tag="submitter" timestamp="2021-07-20T04:13:01Z">ajak</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-202107-46.xml b/metadata/glsa/glsa-202107-46.xml
new file mode 100644
index 000000000000..2c4b4415bdd9
--- /dev/null
+++ b/metadata/glsa/glsa-202107-46.xml
@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202107-46">
+ <title>mpv: Format string vulnerability</title>
+ <synopsis>A format string vulnerability was found in mpv, potentially
+ resulting in arbitrary code execution.
+ </synopsis>
+ <product type="ebuild">mpv</product>
+ <announced>2021-07-20</announced>
+ <revised count="1">2021-07-20</revised>
+ <bug>780474</bug>
+ <access>remote</access>
+ <affected>
+ <package name="media-video/mpv" auto="yes" arch="*">
+ <unaffected range="ge">0.33.1</unaffected>
+ <vulnerable range="lt">0.33.1</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>Video player based on MPlayer/mplayer2.</p>
+ </background>
+ <description>
+ <p>mpv uses untrusted input within format strings.</p>
+ </description>
+ <impact type="normal">
+ <p>A remote attacker could entice a user to open a specially crafted m3u
+ playlist file using mpv, possibly resulting in execution of arbitrary
+ code with the privileges of the process or a Denial of Service condition.
+ </p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All mpv users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose "&gt;=media-video/mpv-0.33.1"
+ </code>
+
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-30145">CVE-2021-30145</uri>
+ </references>
+ <metadata tag="requester" timestamp="2021-07-16T02:03:07Z">ajak</metadata>
+ <metadata tag="submitter" timestamp="2021-07-20T04:16:47Z">ajak</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-202107-47.xml b/metadata/glsa/glsa-202107-47.xml
new file mode 100644
index 000000000000..39653c3ca06c
--- /dev/null
+++ b/metadata/glsa/glsa-202107-47.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202107-47">
+ <title>libpano13: Format string vulnerability</title>
+ <synopsis>A format string vulnerability has been found in libpano13,
+ potentially resulting in arbitrary code execution.
+ </synopsis>
+ <product type="ebuild">libpano13</product>
+ <announced>2021-07-20</announced>
+ <revised count="1">2021-07-20</revised>
+ <bug>780486</bug>
+ <access>remote</access>
+ <affected>
+ <package name="media-libs/libpano13" auto="yes" arch="*">
+ <unaffected range="ge">2.9.20</unaffected>
+ <vulnerable range="lt">2.9.20</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>libpano13 is Helmut Dersch’s panorama toolbox library.</p>
+ </background>
+ <description>
+ <p>A format string issue exists within panoFileOutputNamesCreate() where
+ unvalidated input is passed directly into the formatter.
+ </p>
+ </description>
+ <impact type="normal">
+ <p>A remote attacker could entice a user to open a specially crafted file
+ using libpano13, possibly resulting in execution of arbitrary code with
+ the privileges of the process or a Denial of Service condition.
+ </p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All libpano13 users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose "&gt;=media-libs/libpano13-2.9.20"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-20307">CVE-2021-20307</uri>
+ </references>
+ <metadata tag="requester" timestamp="2021-07-16T01:54:06Z">ajak</metadata>
+ <metadata tag="submitter" timestamp="2021-07-20T04:19:22Z">ajak</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-202107-48.xml b/metadata/glsa/glsa-202107-48.xml
new file mode 100644
index 000000000000..93798cdc8b89
--- /dev/null
+++ b/metadata/glsa/glsa-202107-48.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202107-48">
+ <title>systemd: Multiple vulnerabilities</title>
+ <synopsis>Multiple vulnerabilities have been found in systemd, the worst of
+ which could result in a Denial of Service condition.
+ </synopsis>
+ <product type="ebuild">systemd</product>
+ <announced>2021-07-20</announced>
+ <revised count="1">2021-07-20</revised>
+ <bug>789399</bug>
+ <bug>803041</bug>
+ <access>local, remote</access>
+ <affected>
+ <package name="sys-apps/systemd" auto="yes" arch="*">
+ <unaffected range="ge">248.5</unaffected>
+ <vulnerable range="lt">248.5</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>A system and service manager.</p>
+ </background>
+ <description>
+ <p>Multiple vulnerabilities have been discovered in systemd. Please review
+ the CVE identifiers referenced below for details.
+ </p>
+ </description>
+ <impact type="normal">
+ <p>Please review the referenced CVE identifiers for details.</p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All systemd users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose "&gt;=sys-apps/systemd-248.5"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-13529">CVE-2020-13529</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-33910">CVE-2021-33910</uri>
+ </references>
+ <metadata tag="requester" timestamp="2021-07-20T18:35:40Z">ajak</metadata>
+ <metadata tag="submitter" timestamp="2021-07-20T19:14:28Z">ajak</metadata>
+</glsa>
+
diff --git a/metadata/glsa/glsa-202107-49.xml b/metadata/glsa/glsa-202107-49.xml
new file mode 100644
index 000000000000..66db2e9ee5f0
--- /dev/null
+++ b/metadata/glsa/glsa-202107-49.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202107-49">
+ <title>Chromium, Google Chrome: Multiple vulnerabilities</title>
+ <synopsis>Multiple vulnerabilities have been found in Chromium and Google
+ Chrome, the worst of which could result in the arbitrary execution of code.
+ </synopsis>
+ <product type="ebuild">chromium, google-chrome</product>
+ <announced>2021-07-22</announced>
+ <revised count="2">2021-07-22</revised>
+ <bug>802540</bug>
+ <access>remote</access>
+ <affected>
+ <package name="www-client/chromium" auto="yes" arch="*">
+ <unaffected range="ge">91.0.4472.164</unaffected>
+ <vulnerable range="lt">91.0.4472.164</vulnerable>
+ </package>
+ <package name="www-client/google-chrome" auto="yes" arch="*">
+ <unaffected range="ge">91.0.4472.164</unaffected>
+ <vulnerable range="lt">91.0.4472.164</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>Chromium is an open-source browser project that aims to build a safer,
+ faster, and more stable way for all users to experience the web.
+ </p>
+
+ <p>Google Chrome is one fast, simple, and secure browser for all your
+ devices.
+ </p>
+ </background>
+ <description>
+ <p>Multiple vulnerabilities have been discovered in chromium, and
+ google-chrome. Please review the CVE identifiers referenced below for
+ details.
+ </p>
+ </description>
+ <impact type="high">
+ <p>Please review the referenced CVE identifiers for details.</p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All Chromium users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose
+ "&gt;=www-client/chromium-91.0.4472.164"
+ </code>
+
+ <p>All Google Chrome users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose
+ "&gt;=www-client/google-chrome-91.0.4472.164"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-30541">CVE-2021-30541</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-30559">CVE-2021-30559</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-30560">CVE-2021-30560</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-30561">CVE-2021-30561</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-30562">CVE-2021-30562</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-30563">CVE-2021-30563</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-30564">CVE-2021-30564</uri>
+ </references>
+ <metadata tag="requester" timestamp="2021-07-19T02:47:55Z">ajak</metadata>
+ <metadata tag="submitter" timestamp="2021-07-22T04:51:59Z">ajak</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-202107-50.xml b/metadata/glsa/glsa-202107-50.xml
new file mode 100644
index 000000000000..147944a9d215
--- /dev/null
+++ b/metadata/glsa/glsa-202107-50.xml
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202107-50">
+ <title>Singularity: Remote code execution</title>
+ <synopsis>A vulnerability in Singularity could result in remote code
+ execution.
+ </synopsis>
+ <product type="ebuild">singularity</product>
+ <announced>2021-07-22</announced>
+ <revised count="1">2021-07-22</revised>
+ <bug>792465</bug>
+ <access>remote</access>
+ <affected>
+ <package name="sys-cluster/singularity" auto="yes" arch="*">
+ <unaffected range="ge">3.7.4</unaffected>
+ <vulnerable range="lt">3.7.4</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>Singularity is the container platform for performance sensitive
+ workloads.
+ </p>
+ </background>
+ <description>
+ <p>Singularity always uses the default remote endpoint,
+ ‘cloud.syslabs.io’, for action commands using the ‘library://’
+ URI rather than the configured remote endpoint.
+ </p>
+ </description>
+ <impact type="high">
+ <p>An attacker that that can push a malicious container to the default
+ remote endpoint could execute code on hosts that fetch the container.
+ </p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All Singularity users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose "&gt;=sys-cluster/singularity-3.7.4"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-32635">CVE-2021-32635</uri>
+ </references>
+ <metadata tag="requester" timestamp="2021-07-19T02:57:15Z">ajak</metadata>
+ <metadata tag="submitter" timestamp="2021-07-22T04:54:09Z">ajak</metadata>
+</glsa>
diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk
index 598a38ee3e84..33f7bb267cb6 100644
--- a/metadata/glsa/timestamp.chk
+++ b/metadata/glsa/timestamp.chk
@@ -1 +1 @@
-Sat, 17 Jul 2021 17:39:07 +0000
+Sat, 24 Jul 2021 00:38:58 +0000
diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit
index 4a0f4bdf44a0..5a39cf9d5775 100644
--- a/metadata/glsa/timestamp.commit
+++ b/metadata/glsa/timestamp.commit
@@ -1 +1 @@
-8869d4a8d53cf7ba0e777627877b7a395ba645d6 1626498718 2021-07-17T05:11:58+00:00
+b771364599953f210f7a780b5aacba265c26034b 1626929656 2021-07-22T04:54:16+00:00
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-09 22:49:32 +0000