gentoo resync : 19.04.2018

7 files changed, 183 insertions, 17 deletions

diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest
index dfc8ee5bad2f..ef104e53da7d 100644
--- a/metadata/glsa/Manifest
+++ b/metadata/glsa/Manifest
@@ -1,23 +1,23 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA512
 
-MANIFEST Manifest.files.gz 421384 BLAKE2B bfbe5e356f9fb5467472e01b9ffa4c7ab788e49c049d40c7633dfa4d2ebb5c4bf4f92a4fa43049b85dad5d10c593ecd0e243ea7c1975e84055fc34386f72a4e8 SHA512 f0c1e1729862aec592153456994003bbdbb8f9bff919d3e8a74ef963808bc6065be99f22297469abc9678fd65da4c09918d0a860c5e2f27c193f04efea6f9560
-TIMESTAMP 2018-04-16T15:08:35Z
+MANIFEST Manifest.files.gz 421853 BLAKE2B 1455395962a18ec555da3b924331a3c3d1949b66ce1a960d2b01f823a6484858192d344637523a331c9eb80780a3c1a8b84b64f86021c2dd3acb13a90a4ab7ef SHA512 41bb22594fbb475f187ff9f69f493f69a0b0c1743516600c65f1993fdb43df98716283668ceab5400de005ee1ccd7aaf2592ae42b90669a40334270ab5bf2df6
+TIMESTAMP 2018-04-19T12:08:18Z
 -----BEGIN PGP SIGNATURE-----
 
-iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlrUvHNfFIAAAAAALgAo
+iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlrYhrJfFIAAAAAALgAo
 aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
 RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
-klCY0BAAqZNm01XKR8+NAmnCrYYtSCAwaCaF0Nb3iffw+a2VlxGqYBBxMF/P5NSg
-asnD9IITG4Kl8FNGk2+DkqstEKdEjrcNxvavbtWX0PjVVlqyzmsLOCK3b6v41y/I
-S4XOcJx4TJdQWaLiLXKXPAl6kZ65fSsx8GA2wHE3/L7unZB2xfH4ykHYS5TlpLEO
-sRSx2kPJySsG4SB0Uc/Q4woEcOJlcKQAxAP+j+iBcrGR8T8ZEZRO6oyxcjvHM6yG
-PZRZOkq3m4BCy0sL0eqq4ITeyAu2LNXRf4o80k3rvmf+n86YLl0yi3/+LU4GW73W
-AkA/LNEJXxaxpB+NHkSkQnjXOxExUCCtoIHQMAwj8jejDurIvImEB5OV/DRcfgme
-V8IcWxhQFRblhUfNQ8g9KDqPwWCHf9Py1OSz8ywlHaHFUpim7BlqdFrw2z+Ic+/D
-jzvqOkgdv5HX1/bxPQA8q531mcWQ8N8QnnC52S2FsfSPhgdGXOl71G31rKGJBB56
-W6hxomPk++9F848S5vqC7lnEjEs0HeiF8M+CKr9ol8F11LHKpJ0rd/AlDDfM8zQz
-/6YZnLX9WzcQ2LKWOPIfxjnA4Yuckmn7IlfjPcM3kRadPBuNeNET+/bfq9XOOQRS
-DKA+D5qZWVX5F3O9cZWCsT1J7z4QgbBVROTs2kwbbgsfjpuUTEg=
-=AlW9
+klCjGw/+P/7trheqb0ij+eYjvTLkCxotjj6mfeyYhKFB/X0kyd8OLBdAf0eKe2Wl
+SVXFbf592vStlb/s6LQO9C1RrcSakYlHqJg0/FtVMT7fB9Vdkl45wdpS8Bf7m3oy
+cQDWxXJYcGrK/xLypCC+rnycxx+oXnsNPzfN3APGATF/tuaSsaioHWDhwZApSiju
+hXj4+GV8Zf8f72pTc2EaLxjv0w9q8XF9mhy7SZby1zZZG3CF+jIZZQrhAx7v017i
+exOG+0jaYA1a5t7kzcle+7/pwD0DJEQvsZ0m3X5UmDylfUsK4hyvplq3ntya0gqj
+sRJ0pbaVpI6ccWHh8AkIoJ86gbp1idfbrquzEcUiQl5oG6SeVOooftJ2REi/ls1y
+uj75TrSN5zlII+hX7c+W+61lHG+tpQkYXdzD1rgUKMsVAel426X5AtxNetYoTMKM
+TTO3Ks+wIRSWVrdapFgPC3gmyW8mJwRnNzbLyy1jOCTr5591ZUCq8h1cK1maXMFg
+pGPWrQqvg+wNImuyjSGGeTjzDm6KRGin16ExiGml/OINX7ObNeK25L/SttdluSd7
+4v/bIYpdZuNBdKfLg9SSA46IloGJObcRkZCuk//cV6LcaOViw+qPEZ+S040+p1wf
+Ln1ArCdt1UNhnSxMHdii34M/NcdYZqeiO4ONslKDi9lgjUE5aPQ=
+=kNJV
 -----END PGP SIGNATURE-----
diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz
index 88a05be6bc96..a0ed9e5e5000 100644
--- a/metadata/glsa/Manifest.files.gz
+++ b/metadata/glsa/Manifest.files.gz
diff --git a/metadata/glsa/glsa-201804-13.xml b/metadata/glsa/glsa-201804-13.xml
new file mode 100644
index 000000000000..7b1706348f35
--- /dev/null
+++ b/metadata/glsa/glsa-201804-13.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201804-13">
+  <title>ncurses: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in ncurses, the worst of
+    which allows remote attackers to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">ncurses</product>
+  <announced>2018-04-17</announced>
+  <revised count="1">2018-04-17</revised>
+  <bug>624644</bug>
+  <bug>625830</bug>
+  <bug>629276</bug>
+  <bug>639706</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-libs/ncurses" auto="yes" arch="*">
+      <unaffected range="ge" slot="0">6.1</unaffected>
+      <vulnerable range="lt" slot="0">6.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>Free software emulation of curses in System V.</p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in ncurses. Please review
+      the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker, by enticing the user to process untrusted terminfo or
+      other data, could execute arbitrary code or cause a Denial of Service
+      condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All ncurses users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=sys-libs/ncurses-6.1:0"
+    </code>
+  </resolution>
+  <references>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-10684">CVE-2017-10684</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-10685">CVE-2017-10685</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-11112">CVE-2017-11112</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-11113">CVE-2017-11113</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-13728">CVE-2017-13728</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-13729">CVE-2017-13729</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-13730">CVE-2017-13730</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-13731">CVE-2017-13731</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-13732">CVE-2017-13732</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-13733">CVE-2017-13733</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-13734">CVE-2017-13734</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-16879">CVE-2017-16879</uri>
+  </references>
+  <metadata tag="requester" timestamp="2018-04-15T18:38:59Z">b-man</metadata>
+  <metadata tag="submitter" timestamp="2018-04-17T18:18:44Z">b-man</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201804-14.xml b/metadata/glsa/glsa-201804-14.xml
new file mode 100644
index 000000000000..474c1588cbdc
--- /dev/null
+++ b/metadata/glsa/glsa-201804-14.xml
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201804-14">
+  <title>GDK-PixBuf: Remote code execution</title>
+  <synopsis>A vulnerability has been found in GDK-PixBuf that may allow a
+    remote attacker to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">gdkpixbuf</product>
+  <announced>2018-04-17</announced>
+  <revised count="1">2018-04-17</revised>
+  <bug>644770</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-libs/gdk-pixbuf" auto="yes" arch="*">
+      <unaffected range="ge">2.36.11</unaffected>
+      <vulnerable range="lt">2.36.11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>GDK-PixBuf is an image loading library for GTK+.</p>
+  </background>
+  <description>
+    <p>Several integer overflows were discovered in GDK-PixBuf’s gif_get_lzw
+      function.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker, by enticing a user to process a specially crafted
+      image file, could execute arbitrary code or cause a Denial of Service
+      condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All GDK-PixBuf users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=x11-libs/gdk-pixbuf-2.36.11"
+    </code>
+  </resolution>
+  <references>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-1000422">
+      CVE-2017-1000422
+    </uri>
+  </references>
+  <metadata tag="requester" timestamp="2018-04-17T17:12:14Z">b-man</metadata>
+  <metadata tag="submitter" timestamp="2018-04-17T18:21:26Z">b-man</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201804-15.xml b/metadata/glsa/glsa-201804-15.xml
new file mode 100644
index 000000000000..fe0526b63a13
--- /dev/null
+++ b/metadata/glsa/glsa-201804-15.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201804-15">
+  <title>Evince: Command injection</title>
+  <synopsis>A vulnerability has been found in Evince which may allow for
+    arbitrary command execution.
+  </synopsis>
+  <product type="ebuild">evince</product>
+  <announced>2018-04-17</announced>
+  <revised count="1">2018-04-17</revised>
+  <bug>650272</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/evince" auto="yes" arch="*">
+      <unaffected range="ge">3.24.2-r1</unaffected>
+      <vulnerable range="lt">3.24.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>Evince is a document viewer for multiple document formats, including
+      PostScript.
+    </p>
+  </background>
+  <description>
+    <p>A vulnerability was discovered in Evince’s handling of filenames while
+      printing PDF files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker, by enticing the user to process a specially crafted
+      file, could execute arbitrary commands.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All Evince users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=app-text/evince-3.24.2-r1"
+    </code>
+  </resolution>
+  <references>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2017-1000159">
+      CVE-2017-1000159
+    </uri>
+  </references>
+  <metadata tag="requester" timestamp="2018-04-17T17:27:38Z">b-man</metadata>
+  <metadata tag="submitter" timestamp="2018-04-17T18:22:39Z">b-man</metadata>
+</glsa>
diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk
index 1686faf69c07..167e54886334 100644
--- a/metadata/glsa/timestamp.chk
+++ b/metadata/glsa/timestamp.chk
@@ -1 +1 @@
-Mon, 16 Apr 2018 15:08:31 +0000
+Thu, 19 Apr 2018 12:08:15 +0000
diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit
index 3c4f54fe8d44..3dfa107fe0cf 100644
--- a/metadata/glsa/timestamp.commit
+++ b/metadata/glsa/timestamp.commit
@@ -1 +1 @@
-aa26a212e36fbca3a9091a00250a459fd6576eae 1523834733 2018-04-15T23:25:33+00:00
+1739962616fabf5c85c9b2444576cd88c68aafeb 1523989376 2018-04-17T18:22:56+00:00