gentoo resync : 29.05.2018

7 files changed, 179 insertions, 17 deletions

diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest
index 2c9803a78d0b..ed0f2c74140f 100644
--- a/metadata/glsa/Manifest
+++ b/metadata/glsa/Manifest
@@ -1,23 +1,23 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA512
 
-MANIFEST Manifest.files.gz 424400 BLAKE2B 9a73c11ed4c1391d31d1574a9de4d159bae31fe3f5714411d8384fe4e643e59a86fea9f31f62f9bf6ec36e61f4753cce7561cd7aac8bc004d5ad304a9cbd5fd0 SHA512 0fabe1e7393fe3aa88503bbf861fd29966bc3149d4306beec0ac9dd8c1ca947a5da2e44f96f0574aa884a1a3191f2c44649c75b64b46bf96048e6516ea5dcb4b
-TIMESTAMP 2018-05-25T13:38:48Z
+MANIFEST Manifest.files.gz 424877 BLAKE2B 9d258b6aa1aa8e8e08f8f0afae68fbee91f9c7497a691d1aec15eca7e3ef32b96d49d9309e7844b624df64c2356eb5a9c1126959674d96e04d672536f6687961 SHA512 4fe1b9686dadb6ce5e833dc3f29fc503fbc6e39f30944b93f8acc36bb52e1926d9405c9347321c6f2e2d6fdf2f57b5f27ad1b101abe6a37a7bac5ac5bdecd39d
+TIMESTAMP 2018-05-29T01:38:31Z
 -----BEGIN PGP SIGNATURE-----
 
-iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlsIEehfFIAAAAAALgAo
+iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlsMrxdfFIAAAAAALgAo
 aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
 RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
-klA9QQ/+PMvah9YFz+dqGel6WnojoODRBfcaJmNPluFlguaoesOhyGh6Vga3Wdqn
-fbC4YK9EOWEIxK5b/LLYWxhIfMemK3/bkEzzewDhQlZS5eVq+4UWSa8fp7kwcYRR
-jIBur8P08cqf8KXZGV/nc6qcGk0S2S1Ewp9pDqOJMdSJXpTQDalTOHti3G6hBSqC
-i3NaLyc0rBu7tMM21mV8YvMrLJ2hR+tUqOtSsYLY4wN6p9RpqMQ53y76uRmlRpOO
-egTVzbVSVNXJJu36wfdivEORsLQYf17bIpcYuJo2zHHxblGF2q7BgKy6g92C4OJU
-ZsMCUG2mF9ZckZB0CChh9cKgV9m1KNeiHEqcuL86ghJa4DK4P1hySSJABJrmJFi/
-pwtuUgEVKWPC2lc4ComTyIXufmYhU9XmKsX0TS2Pza3ecCcvoVhvPCTTYEIObQvu
-3HE2EaO821yXgV+mvhy7TQkl/yfL4MkY24gJUn8aY8AVAqReTq6uShDAY5SIh06b
-47l68W8ODXs03cQkLUjYDwNCFz58Bg2o9JyI6slSg5y+nv2FFgXnCG2lcU1Z/HdE
-s016fmLwmyZneC1i43/RuZULeD7cXoelBiDd2S/uafPztc/t7+e+WdRaawg9C5Y0
-YYSadRlI+UyxPJomg1+ncZGuOwpnI4WNhdUVUr8ErxBgSA7yIEM=
-=cpLK
+klA1Pg//fHSs8igloUbaDT2i3XEkIAICNBU5mou6V+8mpz+TAO4VSSwB94lmQdLJ
+7zoOFp4yHU4oA5gkBwi4H64rf44/mFDk9B8UBEuKTxRUNQW/CLQOS0cZ9FWLNxmV
+ZJu7Ly1krx0WPZoSUWueZ+PKl/tjxhzdZ/kv9HahN5EMXmPEbCq4MANBxE3I/Ol+
+8+6NWMAryfcTJwCS7tgt4X/LkQX7kc1ap7aESvH/Pu5sYhOBV7U57KvElptA/3qa
+fdZWICv/enkXaDq6CqtiQy0Ku7QRhlthPCWJW2gXyf9UYnPXziWgqRBacvWDuSAR
+M1dfmhQOe2HMb/4xDMmOHiiAyfQKl0sbsGHxdwwQA9x9m/TpRpSVFgljA/BDJgTN
+1bFk0QBjMIGS8w2VYuIExLGQfdHLlpdD5fizx4h45IeYVDW4WmCGdCibG59kSv9v
+C0diWZ2kEl01kel5G0/4BQOnKypABr/6jnxUFTic+niVaI19Wfnv1blWVQ7eikff
+Yi17FN/ax+XVcQox/IE6TDGPu4Yz0pH8O/4gTC5WZNXgWgDCku8ZvpZUnFee9Tm/
+tqZX+neGZtKfaeHC1YM3K+0m6gJUpmpSy2gYFEunGOGUL5YKkYcRLzJ3IOngGwur
+OxDDqBUEOe4K6VJkBCjGifOtEZlzFhpsz2+shtbBs50tqImYVGQ=
+=dznZ
 -----END PGP SIGNATURE-----
diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz
index 07e00db62d75..6046dcbced99 100644
--- a/metadata/glsa/Manifest.files.gz
+++ b/metadata/glsa/Manifest.files.gz
diff --git a/metadata/glsa/glsa-201805-10.xml b/metadata/glsa/glsa-201805-10.xml
new file mode 100644
index 000000000000..75dcf4ebe6b4
--- /dev/null
+++ b/metadata/glsa/glsa-201805-10.xml
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201805-10">
+  <title>Zsh: Multiple vulnerabilities </title>
+  <synopsis>Multiple vulnerabilities have been found in Zsh, the worst of which
+    could allow local attackers to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">zsh</product>
+  <announced>2018-05-26</announced>
+  <revised count="1">2018-05-26</revised>
+  <bug>649614</bug>
+  <bug>651860</bug>
+  <bug>655708</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-shells/zsh" auto="yes" arch="*">
+      <unaffected range="ge">5.5</unaffected>
+      <vulnerable range="lt">5.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>A shell designed for interactive use, although it is also a powerful
+      scripting language.
+    </p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in Zsh. Please review the
+      CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A local attacker could execute arbitrary code, escalate privileges, or
+      cause a Denial of Service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All Zsh users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=app-shells/zsh-5.5"
+    </code>
+  </resolution>
+  <references>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-18205">CVE-2017-18205</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-18206">CVE-2017-18206</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-1071">CVE-2018-1071</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-1083">CVE-2018-1083</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-1100">CVE-2018-1100</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-7548">CVE-2018-7548</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-7549">CVE-2018-7549</uri>
+  </references>
+  <metadata tag="requester" timestamp="2018-05-26T14:04:43Z">b-man</metadata>
+  <metadata tag="submitter" timestamp="2018-05-26T15:33:08Z">b-man</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201805-11.xml b/metadata/glsa/glsa-201805-11.xml
new file mode 100644
index 000000000000..6e793ac2cc61
--- /dev/null
+++ b/metadata/glsa/glsa-201805-11.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201805-11">
+  <title>Rootkit Hunter: User-assisted execution of arbitrary code</title>
+  <synopsis>A vulnerability has been found in Rootkit Hunter that allows a
+    remote attacker to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">rkhunter</product>
+  <announced>2018-05-26</announced>
+  <revised count="1">2018-05-26</revised>
+  <bug>623150</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-forensics/rkhunter" auto="yes" arch="*">
+      <unaffected range="ge">1.4.6</unaffected>
+      <vulnerable range="lt">1.4.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>Scans for known and unknown rootkits, backdoors, and sniffers.</p>
+  </background>
+  <description>
+    <p>A vulnerability was discovered in Rootkit Hunter that allows the
+      downloading of mirror updates over insecure channels (HTTP). 
+      Furthermore, the mirror update is then executed in Bash.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker, by performing a man-in-the-middle attack, could
+      execute arbitrary code, conduct a Denial of Service, or have other
+      unspecified impacts.
+    </p>
+  </impact>
+  <workaround>
+    <p>Users are advised to not trust insecure protocols such as HTTP and to
+      turn off any mirror updates utilizing such channels.
+    </p>
+  </workaround>
+  <resolution>
+    <p>All Rootkit Hunter users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=app-forensics/rkhunter-1.4.6"
+    </code>
+  </resolution>
+  <references>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-7480">CVE-2017-7480</uri>
+  </references>
+  <metadata tag="requester" timestamp="2018-05-26T14:19:37Z">b-man</metadata>
+  <metadata tag="submitter" timestamp="2018-05-26T15:45:59Z">b-man</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201805-12.xml b/metadata/glsa/glsa-201805-12.xml
new file mode 100644
index 000000000000..a3a9dfc3d6cf
--- /dev/null
+++ b/metadata/glsa/glsa-201805-12.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201805-12">
+  <title>NTP: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in NTP, the worst of which
+    could lead to remote code execution.
+  </synopsis>
+  <product type="ebuild">ntp</product>
+  <announced>2018-05-26</announced>
+  <revised count="1">2018-05-26</revised>
+  <bug>649612</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/ntp" auto="yes" arch="*">
+      <unaffected range="ge">4.2.8_p11</unaffected>
+      <vulnerable range="lt">4.2.8_p11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>NTP contains software for the Network Time Protocol.</p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in NTP. Please review the
+      CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker could possibly execute arbitrary code or cause a
+      Denial of Service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All NTP users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=net-misc/ntp-4.2.8_p11"
+    </code>
+  </resolution>
+  <references>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-7170">CVE-2018-7170</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-7182">CVE-2018-7182</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-7183">CVE-2018-7183</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-7184">CVE-2018-7184</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-7185">CVE-2018-7185</uri>
+  </references>
+  <metadata tag="requester" timestamp="2018-05-26T14:29:05Z">b-man</metadata>
+  <metadata tag="submitter" timestamp="2018-05-26T15:54:33Z">b-man</metadata>
+</glsa>
diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk
index 82049acb5f24..8344c981c7b5 100644
--- a/metadata/glsa/timestamp.chk
+++ b/metadata/glsa/timestamp.chk
@@ -1 +1 @@
-Fri, 25 May 2018 13:38:44 +0000
+Tue, 29 May 2018 01:38:27 +0000
diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit
index fcae362f2608..3ea0d85593b7 100644
--- a/metadata/glsa/timestamp.commit
+++ b/metadata/glsa/timestamp.commit
@@ -1 +1 @@
-000a4ecebe264f405efd60fbeab45f98ae1183f7 1527028655 2018-05-22T22:37:35+00:00
+be2cb1458d4134bc7640ad3be9ba831a525b5b72 1527350128 2018-05-26T15:55:28+00:00