From b49088575eb777ced2551f484da86317332d6087 Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Sat, 24 Jul 2021 02:11:45 +0100 Subject: gentoo resync : 24.07.2021 --- metadata/glsa/Manifest | 30 ++++++++-------- metadata/glsa/Manifest.files.gz | Bin 515403 -> 517009 bytes metadata/glsa/glsa-202107-41.xml | 47 +++++++++++++++++++++++++ metadata/glsa/glsa-202107-42.xml | 50 +++++++++++++++++++++++++++ metadata/glsa/glsa-202107-43.xml | 52 ++++++++++++++++++++++++++++ metadata/glsa/glsa-202107-44.xml | 51 +++++++++++++++++++++++++++ metadata/glsa/glsa-202107-45.xml | 61 +++++++++++++++++++++++++++++++++ metadata/glsa/glsa-202107-46.xml | 48 ++++++++++++++++++++++++++ metadata/glsa/glsa-202107-47.xml | 49 ++++++++++++++++++++++++++ metadata/glsa/glsa-202107-48.xml | 49 ++++++++++++++++++++++++++ metadata/glsa/glsa-202107-49.xml | 72 +++++++++++++++++++++++++++++++++++++++ metadata/glsa/glsa-202107-50.xml | 51 +++++++++++++++++++++++++++ metadata/glsa/timestamp.chk | 2 +- metadata/glsa/timestamp.commit | 2 +- 14 files changed, 547 insertions(+), 17 deletions(-) create mode 100644 metadata/glsa/glsa-202107-41.xml create mode 100644 metadata/glsa/glsa-202107-42.xml create mode 100644 metadata/glsa/glsa-202107-43.xml create mode 100644 metadata/glsa/glsa-202107-44.xml create mode 100644 metadata/glsa/glsa-202107-45.xml create mode 100644 metadata/glsa/glsa-202107-46.xml create mode 100644 metadata/glsa/glsa-202107-47.xml create mode 100644 metadata/glsa/glsa-202107-48.xml create mode 100644 metadata/glsa/glsa-202107-49.xml create mode 100644 metadata/glsa/glsa-202107-50.xml (limited to 'metadata/glsa') diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest index dae4120315e4..233040c09ae1 100644 --- a/metadata/glsa/Manifest +++ b/metadata/glsa/Manifest @@ -1,23 +1,23 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 -MANIFEST Manifest.files.gz 515403 BLAKE2B 2c3efe7a5a7d2ab8e90e9b1bd7118eceae943d57d96054bc9b9f1f28ce3625d956a0ef4b37dc99a8f53983d4cb1c230b5d63cdaf2310372c379209c8703ec67f SHA512 3314ee13046d68813f7a4f6d648d5b31496fb976d5d8456229403081e0e0f9369fa83c271c4d6eb3dbe296b3a72758271782ca5d805b74a5deaa07e14742bafb -TIMESTAMP 2021-07-17T17:39:10Z +MANIFEST Manifest.files.gz 517009 BLAKE2B 7dfe2c6f0d3c02fd13a4ff92c8b43527ed90bc991cb77cf23a6b6f4d95a096baf241470cf7a0758af0ac5a10a8c455ea6117a88ca56d9619752cbe7f94a48887 SHA512 a547d3f7e4ce6646a0fd7f1bbc0c170ce1ad5c251ff3df4af3717aeb9fe49d0376f58f7a94715f226b5ed2e9b7f27692afb69b78d807ec8b830b728935a0bcbd +TIMESTAMP 2021-07-24T00:39:02Z -----BEGIN PGP SIGNATURE----- -iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmDzFb5fFIAAAAAALgAo +iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmD7YSZfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY -klDTaRAAiEapxlJpnLp5i442vw3FGhXvzblQCEiX/58EfEx0FZ/OsnvkGWhC55p5 -7SUCZNE0doIskdzXItmenbaWy+BBmzWtqMTSkt3mMDddxt9ElaU1LWlr9XefH/BM -sjlwAJfeJndyw60i7JMTETTjX3scBM+Z9wP8n0uyuiLFQQ0kNM8DrwxyKOlEV5Fy -xQv9DieSnnPaMiQZ+yLuZQM4lpiwTEToGjs9MgC2d032AL9G1TiZFFjFYRcaJWKS -mhZeGUHUI81VYa93a7yeHCYC6fE19S0bsg+KPccyMYcxa4e3UwebT+zNPWQHA50c -89YLMVAGTIgR7qweUzfgDOM2M5Si1Rj1gtq442Hg78p+uoE9gdKicAxyW9qiMBBs -LkgD5HMM6+x/x2VwdNHszYPfbKKJX5Av52KSLqy2hX8fHZAvSIIogxQftr2SJqsU -/OIZKqzgksB/masJn6BdDGrE/EyeyoQxSeXTgfHrytOzWaZkTnnSZmoF2aLEQf5y -H6gB7PyCQgCw5rtPc/eyl0Zhu1FXwq9soK4a6BJW0WCQHL0AWdM/xR7P7ZTJKc2e -haCmlIBwxbWtk1656Zm/JcEgOvsgkYrH+g8RBtD3UtMgOWpXS+TSM1HEslM6rgkL -1hFP5bztPPwgcs0vHkwVy9bm0y9t4vgCDibxJ/1M94WlFvUHG14= -=jtEe +klC5Mw/9GsZ9wpwdz+PbVdusr4HHAV59IT+qhg3/55VhmeVfPaFMIsfVpxbhZPtj +EjaHeBD/iOblkKhN7ctyFMe3Vf/r63bMmhT6ERpV3mKu8h43LsHN5qcjQ4TlvCvD +kT+IJiMI3LfxdRlYQMGr572aclA/xd194LiPJyUj4j0p2slbrbtzp3OEKTO+BI/a +6ZVULgMrMowWbAZTeqqusOK1RC5z4URqhAHun+7piyBmtc3tph3KcpQKRpBon2Kv ++6ONA1LzmHrbvEJnjsuTSx1irS1b5prQgU8CPJ6h9Y6QObDDxjmut4JHfC0MBXeI +RUaIQHxgqfcetTh+WwjY9mGVxVS2NlgCeOUQU5pgKZJ40mWQDbFId2BYs4ih8WzU +YFl5zbzie3mxyFoo5ssc8/Q/HOoOU+sG6Ld8M8Wu9BwP1us7GE8dRaVrW+xSKkDc +7Fj09YZbKpD7HiQZOyjf3xK3D6W80ZPs5VujslWE+YPuV/V4sy516hJ2QmYJlFvI +mrjk3mwocKx/Zyhm45z+g5AkRCA8g2leHNX5SwF38+ZkOXTtIiQdbrO2IT6MoO/Q +/ticUcLzITIDwfsN5fXUSO1hOAXl3FzDLsUvKw+yPmbIhXIK5bwgHPk5QE/ACdpo +j0PRo+XX2V1BYzJg1n3aU4M8nVuYaKEah7vp3GhvPiLKxMB9msg= +=EP+w -----END PGP SIGNATURE----- diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz index 0db27d5d926b..7f2ba8300b23 100644 Binary files a/metadata/glsa/Manifest.files.gz and b/metadata/glsa/Manifest.files.gz differ diff --git a/metadata/glsa/glsa-202107-41.xml b/metadata/glsa/glsa-202107-41.xml new file mode 100644 index 000000000000..2e01572b2113 --- /dev/null +++ b/metadata/glsa/glsa-202107-41.xml @@ -0,0 +1,47 @@ + + + + Dovecot: Multiple vulnerabilities + Multiple vulnerabilities have been found in Dovecot, the worst of + which could result in a Denial of Service condition. + + dovecot + 2021-07-18 + 2021-07-18 + 797349 + remote + + + 2.3.14.1 + 2.3.14.1 + + + +

Dovecot is an open source IMAP and POP3 email server.

+ + +

Multiple vulnerabilities have been discovered in Dovecot. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Dovecot users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-mail/dovecot-2.3.14.1" + + + + CVE-2021-29157 + CVE-2021-33515 + + ajak + ajak + diff --git a/metadata/glsa/glsa-202107-42.xml b/metadata/glsa/glsa-202107-42.xml new file mode 100644 index 000000000000..8b6fc8a9b409 --- /dev/null +++ b/metadata/glsa/glsa-202107-42.xml @@ -0,0 +1,50 @@ + + + + PJSIP: Multiple vulnerabilities + Multiple vulnerabilities have been found in PJSIP, the worst of + which could result in a Denial of Service condition. + + pjproject + 2021-07-20 + 2021-07-20 + 775359 + remote + + + 2.10-r1 + 2.10-r1 + + + +

PJSIP is a free and open source multimedia communication library written + in C language implementing standard based protocols such as SIP, SDP, + RTP, STUN, TURN, and ICE. +

+ + +

Multiple vulnerabilities have been discovered in PJSIP. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All PJSIP users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/pjproject-2.10-r1" + + + + CVE-2020-15260 + CVE-2021-21375 + + ajak + ajak + diff --git a/metadata/glsa/glsa-202107-43.xml b/metadata/glsa/glsa-202107-43.xml new file mode 100644 index 000000000000..aa7e48b71929 --- /dev/null +++ b/metadata/glsa/glsa-202107-43.xml @@ -0,0 +1,52 @@ + + + + RPM: Multiple vulnerabilities + Multiple vulnerabilities have been found in RPM, the worst of which + could result in remote code execution. + + rpm + 2021-07-20 + 2021-07-20 + 778533 + 787944 + remote + + + 4.16.1.3 + 4.16.1.3 + + + +

The Red Hat Package Manager (RPM) is a command line driven package + management system capable of installing, uninstalling, verifying, + querying, and updating computer software packages. +

+ + +

Multiple vulnerabilities have been discovered in RPM. Please review the + CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All RPM users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-arch/rpm-4.16.1.3" + + + + CVE-2021-20266 + CVE-2021-20271 + CVE-2021-3421 + + ajak + ajak + diff --git a/metadata/glsa/glsa-202107-44.xml b/metadata/glsa/glsa-202107-44.xml new file mode 100644 index 000000000000..30a974dc968c --- /dev/null +++ b/metadata/glsa/glsa-202107-44.xml @@ -0,0 +1,51 @@ + + + + libslirp: Multiple vulnerabilities + Multiple vulnerabilities have been found in libslirp, the worst of + which could result in a Denial of Service condition. + + libslirp + 2021-07-20 + 2021-07-20 + 796347 + local + + + 4.6.0 + 4.6.0 + + + +

libslirp is a TCP/IP emulator used to provide virtual networking + services. +

+ + +

Multiple vulnerabilities have been discovered in libslirp. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All libslirp users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/libslirp-4.6.0" + + + + CVE-2021-3592 + CVE-2021-3593 + CVE-2021-3594 + CVE-2021-3595 + + ajak + ajak + diff --git a/metadata/glsa/glsa-202107-45.xml b/metadata/glsa/glsa-202107-45.xml new file mode 100644 index 000000000000..253cc37b6db7 --- /dev/null +++ b/metadata/glsa/glsa-202107-45.xml @@ -0,0 +1,61 @@ + + + + PyCharm Community, Professional: Remote code execution + A vulnerability has been found in PyCharm Community and + Professional, potentially resulting in arbitrary code execution. + + pycharm + 2021-07-20 + 2021-07-20 + 797892 + remote + + + 2021.1.2 + 2021.1.2 + + + 2021.1.2 + 2021.1.2 + + + +

PyCharm is the Python IDE for professional developers.

+ + +

Insufficient validation exists within PyCharm’s checks for fetching + projects from VCS. +

+ + +

If a victim can be enticed into fetching a VCS project via PyCharm, a + remote attacker could achieve remote code execution. +

+ + +

There is no known workaround at this time.

+ + +

All PyCharm Community users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=dev-util/pycharm-community-2021.1.2" + + +

All PyCharm Professional users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=dev-util/pycharm-professional-2021.1.2" + + + + CVE-2021-30005 + + ajak + ajak + diff --git a/metadata/glsa/glsa-202107-46.xml b/metadata/glsa/glsa-202107-46.xml new file mode 100644 index 000000000000..2c4b4415bdd9 --- /dev/null +++ b/metadata/glsa/glsa-202107-46.xml @@ -0,0 +1,48 @@ + + + + mpv: Format string vulnerability + A format string vulnerability was found in mpv, potentially + resulting in arbitrary code execution. + + mpv + 2021-07-20 + 2021-07-20 + 780474 + remote + + + 0.33.1 + 0.33.1 + + + +

Video player based on MPlayer/mplayer2.

+ + +

mpv uses untrusted input within format strings.

+ + +

A remote attacker could entice a user to open a specially crafted m3u + playlist file using mpv, possibly resulting in execution of arbitrary + code with the privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All mpv users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-video/mpv-0.33.1" + + + + + CVE-2021-30145 + + ajak + ajak + diff --git a/metadata/glsa/glsa-202107-47.xml b/metadata/glsa/glsa-202107-47.xml new file mode 100644 index 000000000000..39653c3ca06c --- /dev/null +++ b/metadata/glsa/glsa-202107-47.xml @@ -0,0 +1,49 @@ + + + + libpano13: Format string vulnerability + A format string vulnerability has been found in libpano13, + potentially resulting in arbitrary code execution. + + libpano13 + 2021-07-20 + 2021-07-20 + 780486 + remote + + + 2.9.20 + 2.9.20 + + + +

libpano13 is Helmut Dersch’s panorama toolbox library.

+ + +

A format string issue exists within panoFileOutputNamesCreate() where + unvalidated input is passed directly into the formatter. +

+ + +

A remote attacker could entice a user to open a specially crafted file + using libpano13, possibly resulting in execution of arbitrary code with + the privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All libpano13 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/libpano13-2.9.20" + + + + CVE-2021-20307 + + ajak + ajak + diff --git a/metadata/glsa/glsa-202107-48.xml b/metadata/glsa/glsa-202107-48.xml new file mode 100644 index 000000000000..93798cdc8b89 --- /dev/null +++ b/metadata/glsa/glsa-202107-48.xml @@ -0,0 +1,49 @@ + + + + systemd: Multiple vulnerabilities + Multiple vulnerabilities have been found in systemd, the worst of + which could result in a Denial of Service condition. + + systemd + 2021-07-20 + 2021-07-20 + 789399 + 803041 + local, remote + + + 248.5 + 248.5 + + + +

A system and service manager.

+ + +

Multiple vulnerabilities have been discovered in systemd. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All systemd users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/systemd-248.5" + + + + CVE-2020-13529 + CVE-2021-33910 + + ajak + ajak + + diff --git a/metadata/glsa/glsa-202107-49.xml b/metadata/glsa/glsa-202107-49.xml new file mode 100644 index 000000000000..66db2e9ee5f0 --- /dev/null +++ b/metadata/glsa/glsa-202107-49.xml @@ -0,0 +1,72 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which could result in the arbitrary execution of code. + + chromium, google-chrome + 2021-07-22 + 2021-07-22 + 802540 + remote + + + 91.0.4472.164 + 91.0.4472.164 + + + 91.0.4472.164 + 91.0.4472.164 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

Multiple vulnerabilities have been discovered in chromium, and + google-chrome. Please review the CVE identifiers referenced below for + details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-91.0.4472.164" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-91.0.4472.164" + + + + CVE-2021-30541 + CVE-2021-30559 + CVE-2021-30560 + CVE-2021-30561 + CVE-2021-30562 + CVE-2021-30563 + CVE-2021-30564 + + ajak + ajak + diff --git a/metadata/glsa/glsa-202107-50.xml b/metadata/glsa/glsa-202107-50.xml new file mode 100644 index 000000000000..147944a9d215 --- /dev/null +++ b/metadata/glsa/glsa-202107-50.xml @@ -0,0 +1,51 @@ + + + + Singularity: Remote code execution + A vulnerability in Singularity could result in remote code + execution. + + singularity + 2021-07-22 + 2021-07-22 + 792465 + remote + + + 3.7.4 + 3.7.4 + + + +

Singularity is the container platform for performance sensitive + workloads. +

+ + +

Singularity always uses the default remote endpoint, + ‘cloud.syslabs.io’, for action commands using the ‘library://’ + URI rather than the configured remote endpoint. +

+ + +

An attacker that that can push a malicious container to the default + remote endpoint could execute code on hosts that fetch the container. +

+ + +

There is no known workaround at this time.

+ + +

All Singularity users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-cluster/singularity-3.7.4" + + + + CVE-2021-32635 + + ajak + ajak + diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk index 598a38ee3e84..33f7bb267cb6 100644 --- a/metadata/glsa/timestamp.chk +++ b/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Sat, 17 Jul 2021 17:39:07 +0000 +Sat, 24 Jul 2021 00:38:58 +0000 diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit index 4a0f4bdf44a0..5a39cf9d5775 100644 --- a/metadata/glsa/timestamp.commit +++ b/metadata/glsa/timestamp.commit @@ -1 +1 @@ -8869d4a8d53cf7ba0e777627877b7a395ba645d6 1626498718 2021-07-17T05:11:58+00:00 +b771364599953f210f7a780b5aacba265c26034b 1626929656 2021-07-22T04:54:16+00:00 -- cgit v1.2.3