diff options
Diffstat (limited to 'metadata/glsa')
| -rw-r--r-- | metadata/glsa/Manifest | 30 | ||||
| -rw-r--r-- | metadata/glsa/Manifest.files.gz | bin | 522243 -> 523040 bytes | |||
| -rw-r--r-- | metadata/glsa/glsa-202208-23.xml | 88 | ||||
| -rw-r--r-- | metadata/glsa/glsa-202208-24.xml | 50 | ||||
| -rw-r--r-- | metadata/glsa/glsa-202208-25.xml | 284 | ||||
| -rw-r--r-- | metadata/glsa/glsa-202208-26.xml | 47 | ||||
| -rw-r--r-- | metadata/glsa/glsa-202208-27.xml | 85 | ||||
| -rw-r--r-- | metadata/glsa/timestamp.chk | 2 | ||||
| -rw-r--r-- | metadata/glsa/timestamp.commit | 2 |
9 files changed, 571 insertions, 17 deletions
diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest index 790faaed20bf..ac449b44a1b4 100644 --- a/metadata/glsa/Manifest +++ b/metadata/glsa/Manifest @@ -1,23 +1,23 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 -MANIFEST Manifest.files.gz 522243 BLAKE2B 1596c3af61b1a6da95c3143b9968db11001d017b9506ddce59f4bcd1b944e1b13f15bff778700b29e74a0b2dac4d906c7d152fac426efbd2dfdda0744685bc62 SHA512 712773ae7f28857d3018f0041efb6721a75332941366f343b7761b3473756a12951420fbef4c2cb89129bd36c7629d17ca51c9b4c6624c65d15ffa2d22aff11b -TIMESTAMP 2022-08-14T12:39:36Z +MANIFEST Manifest.files.gz 523040 BLAKE2B 8eeb24c75cf6c7bec7ec9a65b185ac888b142fde39482fa0ab4d18aa2147cfea7cf47603b519b69b9e9df88cc3a13e0216b0971e88ac68d786f126de2f58bdd2 SHA512 b28ea2f32b332f318bbd2e9a86dbf229361057ef9680cb149f03a60da9f63ba11e29cdfd45708da3930fc5ef89493c7e8ede5bd19bdbf7e6c1d42278f539eb0e +TIMESTAMP 2022-08-14T18:39:38Z -----BEGIN PGP SIGNATURE----- -iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmL47QhfFIAAAAAALgAo +iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmL5QWtfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY -klDXmBAAsJ1Gj/t32p9MUE0bjqld6iBcjMfyNIft94jM8QYs33r2zelvQkZcRnLt -sm/b/N/ip5V+vrwThDUEoQCmlEvIt/t2jV7XW8cIgw0iS7uWO39EvbqhKeMt8Nfk -Q6mnzhC3ys6R0Kj4AdHZPi47oWkC21Hodvfj7gThCnrdw5LfOveZ4Tn8g+mZ6o4S -su5eEozzvOU1ne2X7IUCXEIn85jpFTpVEOgG6mDyK+E9bsHh4NXhhTgw80kiLKHx -2rNcaXp6dAIHTYY+uy/yJoC54WwqdEnyl5nQSoIbB+fggCPTeJ006UlrV1iZMCKG -PtHktaQ7t4nHWdlkvWUbgwCkyRqXQhaKRuuzdiPIBejgfNbZRmIDwQhpobZdnZmq -VGfGrcsiq3BnzEYgyaYzcdbM5+akfxVK0HMm1s7qpWiDxmp4gujSRDXgY8r7kunk -vKOvJkoAdWalyCyb70Y4p+BkeTaJX4UlELpAzs346BvzfhQi0sSfxiOEdIwe42AW -WnDSFB+WMxPg7EOWBCF0J47WENCDPXFhBjMyFiLFpBnYo/Fb2E1zGg7SR0rm/JXB -j0jWX8nnfGOeLJu9QU7Tpn9CFKiw2Nna+HPUz3XjdPd8E6HLehxwE4pU/71N51e+ -1ESE/AuhPR6AAuZFc4011tdZeEDV5BOadu/XhoZkEhsjvLgmt3c= -=I4Tp +klBnxxAAqoBrPHAkdqZnknnfSFFF4pFVw/ZtiKdtxpStw0JWYhjiMtIKEiT9CW6M +AkTNO0ZVV4nwxPhdO+sGpYWPzccra56qN4aRy3b/k3iuQxMVAwKmc74v11TX52uo +lIuxgIGDqkznnybKMrvq65BBHbwwWOKJdhjfDSdlKv/Lb5qF0pmxYbTFOaTRSZSJ +CRp8e6y4SL34x9yz6zeGQ6wMg5r4Nv+NXE8N5NNznbQVUx4Zg6EuwxoyXW8n/jtP +Em4gQkWlbqihnWHX4qbZVlLrzJou+N+B3MQRKKRKJBs5IzwUtL/ayTsKsWA2pmaW +XZ72nh586DNXHYpfqTZjxvqS1p05T6sKb/FMiM7v+LItlTouebg4dzy/q1nbOG9k +zRLGlu3or7dTl21VUyYpfbyI9TrJHNqKWVqbDiIbHulvlY1pN/XDoKP/1jRWWzFV +6DRlY0e3jPwf/9o5P/yYYw+bRPqPgvpVE1BdCckH4qP4tb3aJVIIY38JQNwky97q +5xcWsJn6aKjZow6jxaW8/vYlq764TjXLtHWRqMiE9bDTngTLTz86U96mVbEnEMCZ +oLzNazJlhaFB7AU5eZ/Ow9sXGGH9ogoZyh/w+gBGRDFWooXN1h0yI47e9/dJ64aL +M8Cnj3PP6QJlwkYM6O+Nr6zt8K5MR+KABzSUF2+sJt7Aw6mVJk8= +=cqTK -----END PGP SIGNATURE----- diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz Binary files differindex e7607780d7b3..90736676b75b 100644 --- a/metadata/glsa/Manifest.files.gz +++ b/metadata/glsa/Manifest.files.gz diff --git a/metadata/glsa/glsa-202208-23.xml b/metadata/glsa/glsa-202208-23.xml new file mode 100644 index 000000000000..dcdd7318172f --- /dev/null +++ b/metadata/glsa/glsa-202208-23.xml @@ -0,0 +1,88 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> +<glsa id="202208-23"> + <title>Xen: Multiple Vulnerabilities</title> + <synopsis>Multiple vulnerabilities have been discovered in Xen, the worst of which could result in remote code execution (guest sandbox escape).</synopsis> + <product type="ebuild">xen,xen-tools</product> + <announced>2022-08-14</announced> + <revised count="1">2022-08-14</revised> + <bug>810341</bug> + <bug>812485</bug> + <bug>816882</bug> + <bug>825354</bug> + <bug>832039</bug> + <bug>835401</bug> + <bug>850802</bug> + <access>remote</access> + <affected> + <package name="app-emulation/xen" auto="yes" arch="*"> + <unaffected range="ge">4.15.3</unaffected> + <vulnerable range="lt">4.15.3</vulnerable> + </package> + <package name="app-emulation/xen-tools" auto="yes" arch="*"> + <unaffected range="ge">4.15.3</unaffected> + <vulnerable range="lt">4.15.3</vulnerable> + </package> + </affected> + <background> + <p>Xen is a bare-metal hypervisor.</p> + </background> + <description> + <p>Multiple vulnerabilities have been discovered in Xen. Please review the CVE identifiers referenced below for details.</p> + </description> + <impact type="high"> + <p>Please review the referenced CVE identifiers for details.</p> + </impact> + <workaround> + <p>There is no known workaround at this time.</p> + </workaround> + <resolution> + <p>All Xen users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/xen-4.15.3" + </code> + + <p>All Xen tools users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/xen-tools-4.15.3" + </code> + </resolution> + <references> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-28694">CVE-2021-28694</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-28695">CVE-2021-28695</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-28696">CVE-2021-28696</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-28697">CVE-2021-28697</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-28698">CVE-2021-28698</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-28699">CVE-2021-28699</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-28700">CVE-2021-28700</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-28701">CVE-2021-28701</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-28702">CVE-2021-28702</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-28710">CVE-2021-28710</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-21123">CVE-2022-21123</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-21125">CVE-2022-21125</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-21166">CVE-2022-21166</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-23033">CVE-2022-23033</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-23034">CVE-2022-23034</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-23035">CVE-2022-23035</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-26362">CVE-2022-26362</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-26363">CVE-2022-26363</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-26364">CVE-2022-26364</uri> + <uri>XSA-378</uri> + <uri>XSA-379</uri> + <uri>XSA-380</uri> + <uri>XSA-382</uri> + <uri>XSA-383</uri> + <uri>XSA-384</uri> + <uri>XSA-386</uri> + <uri>XSA-390</uri> + <uri>XSA-401</uri> + <uri>XSA-402</uri> + <uri>XSA-404</uri> + </references> + <metadata tag="requester" timestamp="2022-08-14T14:28:39.018721Z">ajak</metadata> + <metadata tag="submitter" timestamp="2022-08-14T14:28:39.023416Z">sam</metadata> +</glsa>
\ No newline at end of file diff --git a/metadata/glsa/glsa-202208-24.xml b/metadata/glsa/glsa-202208-24.xml new file mode 100644 index 000000000000..68d2b4e5456e --- /dev/null +++ b/metadata/glsa/glsa-202208-24.xml @@ -0,0 +1,50 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> +<glsa id="202208-24"> + <title>GNU C Library: Multiple Vulnerabilities</title> + <synopsis>Multiple vulnerabilities have been discovered in the GNU C Library, the worst of which could result in denial of service.</synopsis> + <product type="ebuild">glibc</product> + <announced>2022-08-14</announced> + <revised count="1">2022-08-14</revised> + <bug>803437</bug> + <bug>807935</bug> + <bug>831096</bug> + <bug>831212</bug> + <access>remote</access> + <affected> + <package name="sys-libs/glibc" auto="yes" arch="*"> + <unaffected range="ge">2.34</unaffected> + <vulnerable range="lt">2.34</vulnerable> + </package> + </affected> + <background> + <p>The GNU C library is the standard C library used by Gentoo Linux systems. It provides programs with basic facilities and interfaces to system calls. ld.so is the dynamic linker which prepares dynamically linked programs for execution by resolving runtime dependencies and related functions.</p> + </background> + <description> + <p>Multiple vulnerabilities have been discovered in GNU C Library. Please review the CVE identifiers referenced below for details.</p> + </description> + <impact type="normal"> + <p>Please review the referenced CVE identifiers for details.</p> + </impact> + <workaround> + <p>There is no known workaround at this time.</p> + </workaround> + <resolution> + <p>All GNU C Library users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.34-r7" + </code> + </resolution> + <references> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3998">CVE-2021-3998</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3999">CVE-2021-3999</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-35942">CVE-2021-35942</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-38604">CVE-2021-38604</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-23218">CVE-2022-23218</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-23219">CVE-2022-23219</uri> + </references> + <metadata tag="requester" timestamp="2022-08-14T14:29:01.578271Z">ajak</metadata> + <metadata tag="submitter" timestamp="2022-08-14T14:29:01.583276Z">sam</metadata> +</glsa>
\ No newline at end of file diff --git a/metadata/glsa/glsa-202208-25.xml b/metadata/glsa/glsa-202208-25.xml new file mode 100644 index 000000000000..02c46c6d6195 --- /dev/null +++ b/metadata/glsa/glsa-202208-25.xml @@ -0,0 +1,284 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> +<glsa id="202208-25"> + <title>Chromium, Google Chrome, Microsoft Edge, QtWebEngine: Multiple Vulnerabilities</title> + <synopsis>Multiple vulnerabilities have been found in Chromium and its derivatives, the worst of which could result in remote code execution.</synopsis> + <product type="ebuild">chromium,google-chrome,microsoft-edge,qtwebengine</product> + <announced>2022-08-14</announced> + <revised count="1">2022-08-14</revised> + <bug>828519</bug> + <bug>834477</bug> + <bug>835397</bug> + <bug>836011</bug> + <bug>836381</bug> + <bug>836777</bug> + <bug>838049</bug> + <bug>838433</bug> + <bug>841371</bug> + <bug>843728</bug> + <bug>847370</bug> + <bug>851003</bug> + <bug>853643</bug> + <bug>773040</bug> + <bug>787950</bug> + <bug>800181</bug> + <bug>810781</bug> + <bug>815397</bug> + <bug>829161</bug> + <bug>835761</bug> + <bug>836830</bug> + <bug>847613</bug> + <bug>853229</bug> + <bug>837497</bug> + <bug>838682</bug> + <bug>843035</bug> + <bug>848864</bug> + <bug>851009</bug> + <bug>854372</bug> + <access>remote</access> + <affected> + <package name="dev-qt/qtwebengine" auto="yes" arch="*"> + <unaffected range="ge">5.15.5_p20220618</unaffected> + <vulnerable range="lt">5.15.5_p20220618</vulnerable> + </package> + <package name="www-client/chromium" auto="yes" arch="*"> + <unaffected range="ge">103.0.5060.53</unaffected> + <vulnerable range="lt">103.0.5060.53</vulnerable> + </package> + <package name="www-client/google-chrome" auto="yes" arch="*"> + <unaffected range="ge">103.0.5060.53</unaffected> + <vulnerable range="lt">103.0.5060.53</vulnerable> + </package> + <package name="www-client/microsoft-edge" auto="yes" arch="*"> + <unaffected range="ge">101.0.1210.47</unaffected> + <vulnerable range="lt">101.0.1210.47</vulnerable> + </package> + </affected> + <background> + <p>Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.
+
+Google Chrome is one fast, simple, and secure browser for all your devices.
+
+Microsoft Edge is a browser that combines a minimal design with sophisticated technology to make the web faster, safer, and easier.</p> + </background> + <description> + <p>Multiple vulnerabilities have been discovered in Chromium and its derivatives. Please review the CVE identifiers referenced below for details.</p> + </description> + <impact type="high"> + <p>Please review the referenced CVE identifiers for details.</p> + </impact> + <workaround> + <p>There is no known workaround at this time.</p> + </workaround> + <resolution> + <p>All Chromium users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/chromium-103.0.5060.53" + </code> + + <p>All Chromium binary users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/chromium-bin-103.0.5060.53" + </code> + + <p>All Google Chrome users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/google-chrome-103.0.5060.53" + </code> + + <p>All Microsoft Edge users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/chromium-103.0.5060.53" + </code> + + <p>All QtWebEngine users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-qt/qtwebengine-5.15.5_p20220618" + </code> + </resolution> + <references> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4052">CVE-2021-4052</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4053">CVE-2021-4053</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4054">CVE-2021-4054</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4055">CVE-2021-4055</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4056">CVE-2021-4056</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4057">CVE-2021-4057</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4058">CVE-2021-4058</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4059">CVE-2021-4059</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4061">CVE-2021-4061</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4062">CVE-2021-4062</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4063">CVE-2021-4063</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4064">CVE-2021-4064</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4065">CVE-2021-4065</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4066">CVE-2021-4066</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4067">CVE-2021-4067</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4068">CVE-2021-4068</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4078">CVE-2021-4078</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4079">CVE-2021-4079</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-30551">CVE-2021-30551</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0789">CVE-2022-0789</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0790">CVE-2022-0790</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0791">CVE-2022-0791</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0792">CVE-2022-0792</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0793">CVE-2022-0793</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0794">CVE-2022-0794</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0795">CVE-2022-0795</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0796">CVE-2022-0796</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0797">CVE-2022-0797</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0798">CVE-2022-0798</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0799">CVE-2022-0799</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0800">CVE-2022-0800</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0801">CVE-2022-0801</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0802">CVE-2022-0802</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0803">CVE-2022-0803</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0804">CVE-2022-0804</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0805">CVE-2022-0805</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0806">CVE-2022-0806</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0807">CVE-2022-0807</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0808">CVE-2022-0808</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0809">CVE-2022-0809</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0971">CVE-2022-0971</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0972">CVE-2022-0972</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0973">CVE-2022-0973</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0974">CVE-2022-0974</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0975">CVE-2022-0975</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0976">CVE-2022-0976</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0977">CVE-2022-0977</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0978">CVE-2022-0978</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0979">CVE-2022-0979</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0980">CVE-2022-0980</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1096">CVE-2022-1096</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1125">CVE-2022-1125</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1127">CVE-2022-1127</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1128">CVE-2022-1128</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1129">CVE-2022-1129</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1130">CVE-2022-1130</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1131">CVE-2022-1131</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1132">CVE-2022-1132</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1133">CVE-2022-1133</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1134">CVE-2022-1134</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1135">CVE-2022-1135</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1136">CVE-2022-1136</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1137">CVE-2022-1137</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1138">CVE-2022-1138</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1139">CVE-2022-1139</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1141">CVE-2022-1141</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1142">CVE-2022-1142</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1143">CVE-2022-1143</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1144">CVE-2022-1144</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1145">CVE-2022-1145</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1146">CVE-2022-1146</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1232">CVE-2022-1232</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1305">CVE-2022-1305</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1306">CVE-2022-1306</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1307">CVE-2022-1307</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1308">CVE-2022-1308</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1309">CVE-2022-1309</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1310">CVE-2022-1310</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1311">CVE-2022-1311</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1312">CVE-2022-1312</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1313">CVE-2022-1313</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1314">CVE-2022-1314</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1364">CVE-2022-1364</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1477">CVE-2022-1477</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1478">CVE-2022-1478</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1479">CVE-2022-1479</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1480">CVE-2022-1480</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1481">CVE-2022-1481</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1482">CVE-2022-1482</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1483">CVE-2022-1483</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1484">CVE-2022-1484</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1485">CVE-2022-1485</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1486">CVE-2022-1486</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1487">CVE-2022-1487</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1488">CVE-2022-1488</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1489">CVE-2022-1489</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1490">CVE-2022-1490</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1491">CVE-2022-1491</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1492">CVE-2022-1492</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1493">CVE-2022-1493</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1494">CVE-2022-1494</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1495">CVE-2022-1495</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1496">CVE-2022-1496</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1497">CVE-2022-1497</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1498">CVE-2022-1498</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1499">CVE-2022-1499</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1500">CVE-2022-1500</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1501">CVE-2022-1501</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1633">CVE-2022-1633</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1634">CVE-2022-1634</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1635">CVE-2022-1635</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1636">CVE-2022-1636</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1637">CVE-2022-1637</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1639">CVE-2022-1639</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1640">CVE-2022-1640</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1641">CVE-2022-1641</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1853">CVE-2022-1853</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1854">CVE-2022-1854</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1855">CVE-2022-1855</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1856">CVE-2022-1856</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1857">CVE-2022-1857</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1858">CVE-2022-1858</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1859">CVE-2022-1859</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1860">CVE-2022-1860</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1861">CVE-2022-1861</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1862">CVE-2022-1862</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1863">CVE-2022-1863</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1864">CVE-2022-1864</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1865">CVE-2022-1865</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1866">CVE-2022-1866</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1867">CVE-2022-1867</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1868">CVE-2022-1868</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1869">CVE-2022-1869</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1870">CVE-2022-1870</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1871">CVE-2022-1871</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1872">CVE-2022-1872</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1873">CVE-2022-1873</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1874">CVE-2022-1874</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1875">CVE-2022-1875</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-1876">CVE-2022-1876</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-2007">CVE-2022-2007</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-2010">CVE-2022-2010</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-2011">CVE-2022-2011</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-2156">CVE-2022-2156</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-2157">CVE-2022-2157</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-2158">CVE-2022-2158</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-2160">CVE-2022-2160</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-2161">CVE-2022-2161</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-2162">CVE-2022-2162</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-2163">CVE-2022-2163</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-2164">CVE-2022-2164</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-2165">CVE-2022-2165</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-22021">CVE-2022-22021</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-24475">CVE-2022-24475</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-24523">CVE-2022-24523</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-26891">CVE-2022-26891</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-26894">CVE-2022-26894</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-26895">CVE-2022-26895</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-26900">CVE-2022-26900</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-26905">CVE-2022-26905</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-26908">CVE-2022-26908</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-26909">CVE-2022-26909</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-26912">CVE-2022-26912</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-29144">CVE-2022-29144</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-29146">CVE-2022-29146</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-29147">CVE-2022-29147</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-30127">CVE-2022-30127</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-30128">CVE-2022-30128</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-30192">CVE-2022-30192</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-33638">CVE-2022-33638</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-33639">CVE-2022-33639</uri> + </references> + <metadata tag="requester" timestamp="2022-08-14T14:29:30.785120Z">ajak</metadata> + <metadata tag="submitter" timestamp="2022-08-14T14:29:30.789119Z">sam</metadata> +</glsa>
\ No newline at end of file diff --git a/metadata/glsa/glsa-202208-26.xml b/metadata/glsa/glsa-202208-26.xml new file mode 100644 index 000000000000..5d229495aa93 --- /dev/null +++ b/metadata/glsa/glsa-202208-26.xml @@ -0,0 +1,47 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> +<glsa id="202208-26"> + <title>libarchive: Multiple Vulnerabilities</title> + <synopsis>Multiple vulnerabilities have been discovered in libarchive, the worst of which could result in arbitrary code execution.</synopsis> + <product type="ebuild">libarchive</product> + <announced>2022-08-14</announced> + <revised count="1">2022-08-14</revised> + <bug>803128</bug> + <bug>836352</bug> + <bug>837266</bug> + <access>remote</access> + <affected> + <package name="app-arch/libarchive" auto="yes" arch="*"> + <unaffected range="ge">3.6.1</unaffected> + <vulnerable range="lt">3.6.1</vulnerable> + </package> + </affected> + <background> + <p>libarchive is a library for manipulating different streaming archive formats, including certain tar variants, several cpio formats, and both BSD and GNU ar variants.</p> + </background> + <description> + <p>Multiple vulnerabilities have been discovered in libarchive. Please review the CVE identifiers referenced below for details.</p> + </description> + <impact type="high"> + <p>Please review the referenced CVE identifiers for details.</p> + </impact> + <workaround> + <p>There is no known workaround at this time.</p> + </workaround> + <resolution> + <p>All libarchive users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-arch/libarchive-3.6.1" + </code> + </resolution> + <references> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-31566">CVE-2021-31566</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-36976">CVE-2021-36976</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-26280">CVE-2022-26280</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-28066">CVE-2022-28066</uri> + </references> + <metadata tag="requester" timestamp="2022-08-14T16:08:34.091685Z">ajak</metadata> + <metadata tag="submitter" timestamp="2022-08-14T16:08:34.098278Z">sam</metadata> +</glsa>
\ No newline at end of file diff --git a/metadata/glsa/glsa-202208-27.xml b/metadata/glsa/glsa-202208-27.xml new file mode 100644 index 000000000000..474faac8ae32 --- /dev/null +++ b/metadata/glsa/glsa-202208-27.xml @@ -0,0 +1,85 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> +<glsa id="202208-27"> + <title>QEMU: Multiple Vulnerabilities</title> + <synopsis>Multiple vulnerabilities have been discovered in QEMU, the worst of which could result in remote code execution (guest sandbox escape).</synopsis> + <product type="ebuild">qemu</product> + <announced>2022-08-14</announced> + <revised count="1">2022-08-14</revised> + <bug>733448</bug> + <bug>736605</bug> + <bug>773220</bug> + <bug>775713</bug> + <bug>780816</bug> + <bug>792624</bug> + <bug>807055</bug> + <bug>810544</bug> + <bug>820743</bug> + <bug>835607</bug> + <bug>839762</bug> + <access>remote</access> + <affected> + <package name="app-emulation/qemu" auto="yes" arch="*"> + <unaffected range="ge">7.0.0</unaffected> + <vulnerable range="lt">7.0.0</vulnerable> + </package> + </affected> + <background> + <p>QEMU is a generic and open source machine emulator and virtualizer.</p> + </background> + <description> + <p>Multiple vulnerabilities have been discovered in QEMU.Please review the CVE identifiers referenced below for details.</p> + </description> + <impact type="high"> + <p>Please review the referenced CVE identifiers for details.</p> + </impact> + <workaround> + <p>There is no known workaround at this time.</p> + </workaround> + <resolution> + <p>All QEMU users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/qemu-7.0.0" + </code> + </resolution> + <references> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-15859">CVE-2020-15859</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-15863">CVE-2020-15863</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-16092">CVE-2020-16092</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-35504">CVE-2020-35504</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-35505">CVE-2020-35505</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-35506">CVE-2020-35506</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-35517">CVE-2020-35517</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3409">CVE-2021-3409</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3416">CVE-2021-3416</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3527">CVE-2021-3527</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3544">CVE-2021-3544</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3545">CVE-2021-3545</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3546">CVE-2021-3546</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3582">CVE-2021-3582</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3607">CVE-2021-3607</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3608">CVE-2021-3608</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3611">CVE-2021-3611</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3682">CVE-2021-3682</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3713">CVE-2021-3713</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3748">CVE-2021-3748</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3750">CVE-2021-3750</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3929">CVE-2021-3929</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3930">CVE-2021-3930</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3947">CVE-2021-3947</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4145">CVE-2021-4145</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4158">CVE-2021-4158</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4206">CVE-2021-4206</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-4207">CVE-2021-4207</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-20203">CVE-2021-20203</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-20257">CVE-2021-20257</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-20263">CVE-2021-20263</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0358">CVE-2022-0358</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-26353">CVE-2022-26353</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-26354">CVE-2022-26354</uri> + </references> + <metadata tag="requester" timestamp="2022-08-14T16:09:07.836051Z">ajak</metadata> + <metadata tag="submitter" timestamp="2022-08-14T16:09:07.841731Z">sam</metadata> +</glsa>
\ No newline at end of file diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk index 504b46674db2..900df9b086f3 100644 --- a/metadata/glsa/timestamp.chk +++ b/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Sun, 14 Aug 2022 12:39:33 +0000 +Sun, 14 Aug 2022 18:39:35 +0000 diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit index fa30ed48ee4f..6242b2f75b2e 100644 --- a/metadata/glsa/timestamp.commit +++ b/metadata/glsa/timestamp.commit @@ -1 +1 @@ -60298a368732a5fdf5e926ec4c59811f482e73b5 1660435906 2022-08-14T00:11:46+00:00 +fd3b0a54cba850267bd5f7ed0ac9f66f91aa44ac 1660493383 2022-08-14T16:09:43+00:00 |