gentoo resync : 25.05.2018

7 files changed, 192 insertions, 17 deletions

diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest
index 42d14a5e8db9..2c9803a78d0b 100644
--- a/metadata/glsa/Manifest
+++ b/metadata/glsa/Manifest
@@ -1,23 +1,23 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA512
 
-MANIFEST Manifest.files.gz 423926 BLAKE2B ef432334c8c41dcc3beb779f71caadf29384449b3e8258f043d5ba442df8bec61eb0e37f0cffe178b49845e496a10322c4f299da85b1bef970a8198b7030cc19 SHA512 0362ff52a0a0f49a21f40c02923be72cf39507aeca71c57ba328332b55d1e4bad4c29b86943b37860f673358dafc794b408fa2b01f8a8d43fb4c3f1ae168a8c9
-TIMESTAMP 2018-05-22T12:08:39Z
+MANIFEST Manifest.files.gz 424400 BLAKE2B 9a73c11ed4c1391d31d1574a9de4d159bae31fe3f5714411d8384fe4e643e59a86fea9f31f62f9bf6ec36e61f4753cce7561cd7aac8bc004d5ad304a9cbd5fd0 SHA512 0fabe1e7393fe3aa88503bbf861fd29966bc3149d4306beec0ac9dd8c1ca947a5da2e44f96f0574aa884a1a3191f2c44649c75b64b46bf96048e6516ea5dcb4b
+TIMESTAMP 2018-05-25T13:38:48Z
 -----BEGIN PGP SIGNATURE-----
 
-iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlsECEdfFIAAAAAALgAo
+iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlsIEehfFIAAAAAALgAo
 aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
 RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
-klC6ERAAsISjzASzQtwX2Qxz+kHc7ZJ9x4risbP+f53v/qt9Z9yYcM/CBJaj9A6D
-Oj+/dnDVx1TqNbBS7OVXWuL02E7NyqQGV/6vjQ5YzcWJB2+2/5wt6tBWbiuf71eF
-IAvro3ZNr2XVeuqXMGfUE5M5AzGpib4jT5ZapDZv89rdOM0LA1ASnLM6TQjFWZ9w
-t4j5jwz9B0fd7bnxcYTHZf/gapp2Zfs+BO3C27NbYUhR9k2nsEdxpZN4+m3grQcD
-Zh5VCPidbXgJNnvrvWu1jNIMx1sDHjla3ClgacB2I7DuUUpuX1Qn3jcVISbgM7+n
-t7Aqx+78TutydnwcqHHbrvyldUQK3FV82rYN0twwvIdrDZy7aMSkGhtvP00gLpST
-MupXPuaZZ4W8PNZjs14vPkYFsRXiW9xtERA4uE6/HvDeTaQwh9y7wZZyWQ8VS2Xb
-guw2A7be3S6KOh1jmrzGzt+v1QEpMhDmk2NSJujUfjf1nXJ9rshLOzTgLhuataiu
-7LF26gAX5W6nOuCoalapM/LBdg6HyJIkihv+mMZtOrCREdqJq8plF4J46HiHVyIg
-ncj445vdqsowxaVLPy6CZ94xW3SfQmHzCboDqN2xA27FkTTEifsKWn3IsFTqKtNh
-Ftvcdk0NmBCxgzHe2m4R06CVLW2hcDhAyYarg5FOXsMPUDGzVdk=
-=fYcE
+klA9QQ/+PMvah9YFz+dqGel6WnojoODRBfcaJmNPluFlguaoesOhyGh6Vga3Wdqn
+fbC4YK9EOWEIxK5b/LLYWxhIfMemK3/bkEzzewDhQlZS5eVq+4UWSa8fp7kwcYRR
+jIBur8P08cqf8KXZGV/nc6qcGk0S2S1Ewp9pDqOJMdSJXpTQDalTOHti3G6hBSqC
+i3NaLyc0rBu7tMM21mV8YvMrLJ2hR+tUqOtSsYLY4wN6p9RpqMQ53y76uRmlRpOO
+egTVzbVSVNXJJu36wfdivEORsLQYf17bIpcYuJo2zHHxblGF2q7BgKy6g92C4OJU
+ZsMCUG2mF9ZckZB0CChh9cKgV9m1KNeiHEqcuL86ghJa4DK4P1hySSJABJrmJFi/
+pwtuUgEVKWPC2lc4ComTyIXufmYhU9XmKsX0TS2Pza3ecCcvoVhvPCTTYEIObQvu
+3HE2EaO821yXgV+mvhy7TQkl/yfL4MkY24gJUn8aY8AVAqReTq6uShDAY5SIh06b
+47l68W8ODXs03cQkLUjYDwNCFz58Bg2o9JyI6slSg5y+nv2FFgXnCG2lcU1Z/HdE
+s016fmLwmyZneC1i43/RuZULeD7cXoelBiDd2S/uafPztc/t7+e+WdRaawg9C5Y0
+YYSadRlI+UyxPJomg1+ncZGuOwpnI4WNhdUVUr8ErxBgSA7yIEM=
+=cpLK
 -----END PGP SIGNATURE-----
diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz
index 8d89a3629bf8..07e00db62d75 100644
--- a/metadata/glsa/Manifest.files.gz
+++ b/metadata/glsa/Manifest.files.gz
diff --git a/metadata/glsa/glsa-201805-07.xml b/metadata/glsa/glsa-201805-07.xml
new file mode 100644
index 000000000000..f57a6fb9d6d1
--- /dev/null
+++ b/metadata/glsa/glsa-201805-07.xml
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201805-07">
+  <title>Samba: Multiple vulnerabilities </title>
+  <synopsis>Multiple vulnerabilities have been found in Samba, the worst of
+    which may allow remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">samba</product>
+  <announced>2018-05-22</announced>
+  <revised count="1">2018-05-22</revised>
+  <bug>588262</bug>
+  <bug>619516</bug>
+  <bug>639024</bug>
+  <bug>650382</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-fs/samba" auto="yes" arch="*">
+      <unaffected range="ge">4.5.16</unaffected>
+      <vulnerable range="lt">4.5.16</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>Samba is a suite of SMB and CIFS client/server programs.</p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in Samba. Please review
+      the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker could possibly execute arbitrary code, cause a Denial
+      of Service condition, conduct a man-in-the-middle attack, or obtain
+      sensitive information.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All Samba users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=net-fs/samba-4.5.16"
+    </code>
+  </resolution>
+  <references>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2016-2119">CVE-2016-2119</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-14746">CVE-2017-14746</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-15275">CVE-2017-15275</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-7494">CVE-2017-7494</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-1050">CVE-2018-1050</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-1057">CVE-2018-1057</uri>
+  </references>
+  <metadata tag="requester" timestamp="2018-05-15T00:36:47Z">b-man</metadata>
+  <metadata tag="submitter" timestamp="2018-05-22T22:29:53Z">b-man</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201805-08.xml b/metadata/glsa/glsa-201805-08.xml
new file mode 100644
index 000000000000..5b8b52935500
--- /dev/null
+++ b/metadata/glsa/glsa-201805-08.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201805-08">
+  <title>VirtualBox: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in VirtualBox, the worst
+    of which could allow an attacker to take control of VirtualBox.
+  </synopsis>
+  <product type="ebuild">virtualbox</product>
+  <announced>2018-05-22</announced>
+  <revised count="1">2018-05-22</revised>
+  <bug>655186</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-emulation/virtualbox" auto="yes" arch="*">
+      <unaffected range="ge">5.1.36</unaffected>
+      <vulnerable range="lt">5.1.36</vulnerable>
+    </package>
+    <package name="app-emulation/virtualbox-bin" auto="yes" arch="*">
+      <unaffected range="ge">5.1.36.122089</unaffected>
+      <vulnerable range="lt">5.1.36.122089</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>VirtualBox is a powerful virtualization product from Oracle.</p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in VirtualBox. Please
+      review the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>An attacker could take control of VirtualBox resulting in the execution
+      of arbitrary code with the privileges of the process, a Denial of Service
+      condition, or other unspecified impacts.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All VirtualBox users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=app-emulation/virtualbox-5.1.36"
+    </code>
+    
+    <p>All VirtualBox binary users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose
+      "&gt;=app-emulation/virtualbox-bin-5.1.36.122089"
+    </code>
+  </resolution>
+  <references>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-2830">CVE-2018-2830</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-2831">CVE-2018-2831</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-2835">CVE-2018-2835</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-2836">CVE-2018-2836</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-2837">CVE-2018-2837</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-2842">CVE-2018-2842</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-2843">CVE-2018-2843</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-2844">CVE-2018-2844</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-2845">CVE-2018-2845</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-2860">CVE-2018-2860</uri>
+  </references>
+  <metadata tag="requester" timestamp="2018-05-14T23:15:39Z">b-man</metadata>
+  <metadata tag="submitter" timestamp="2018-05-22T22:32:13Z">b-man</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201805-09.xml b/metadata/glsa/glsa-201805-09.xml
new file mode 100644
index 000000000000..f4af27e4d2fc
--- /dev/null
+++ b/metadata/glsa/glsa-201805-09.xml
@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201805-09">
+  <title>Shadow: security bypass</title>
+  <synopsis>A vulnerability found in Shadow may allow local attackers to bypass
+    security restrictions.
+  </synopsis>
+  <product type="ebuild">shadow</product>
+  <announced>2018-05-22</announced>
+  <revised count="1">2018-05-22</revised>
+  <bug>647790</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-apps/shadow" auto="yes" arch="*">
+      <unaffected range="ge">4.6</unaffected>
+      <vulnerable range="lt">4.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>Shadow is a set of tools to deal with user accounts.</p>
+  </background>
+  <description>
+    <p>A local attacker could possibly bypass security restrictions if an
+      administrator used “group blacklisting” to restrict access to file
+      system paths.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A local attacker could possibly bypass security restrictions.</p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All shadow users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=sys-apps/shadow-4.6"
+    </code>
+    
+  </resolution>
+  <references>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-7169">CVE-2018-7169</uri>
+  </references>
+  <metadata tag="requester" timestamp="2018-05-22T22:21:35Z">Zlogene</metadata>
+  <metadata tag="submitter" timestamp="2018-05-22T22:36:37Z">Zlogene</metadata>
+</glsa>
diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk
index 9c2593d3e940..82049acb5f24 100644
--- a/metadata/glsa/timestamp.chk
+++ b/metadata/glsa/timestamp.chk
@@ -1 +1 @@
-Tue, 22 May 2018 12:08:36 +0000
+Fri, 25 May 2018 13:38:44 +0000
diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit
index d21b59c7a136..fcae362f2608 100644
--- a/metadata/glsa/timestamp.commit
+++ b/metadata/glsa/timestamp.commit
@@ -1 +1 @@
-255e6e014a866f68f8eba7d65248d45008988f31 1526827283 2018-05-20T14:41:23+00:00
+000a4ecebe264f405efd60fbeab45f98ae1183f7 1527028655 2018-05-22T22:37:35+00:00