summaryrefslogtreecommitdiff
path: root/metadata/glsa
diff options
context:
space:
mode:
Diffstat (limited to 'metadata/glsa')
-rw-r--r--metadata/glsa/Manifest30
-rw-r--r--metadata/glsa/Manifest.files.gzbin574731 -> 575523 bytes
-rw-r--r--metadata/glsa/glsa-202406-01.xml42
-rw-r--r--metadata/glsa/glsa-202406-02.xml42
-rw-r--r--metadata/glsa/glsa-202406-03.xml44
-rw-r--r--metadata/glsa/glsa-202406-04.xml42
-rw-r--r--metadata/glsa/glsa-202406-05.xml48
-rw-r--r--metadata/glsa/timestamp.chk2
-rw-r--r--metadata/glsa/timestamp.commit2
9 files changed, 235 insertions, 17 deletions
diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest
index 42e56ef326dc..7235d7a12d62 100644
--- a/metadata/glsa/Manifest
+++ b/metadata/glsa/Manifest
@@ -1,23 +1,23 @@
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
-MANIFEST Manifest.files.gz 574731 BLAKE2B 89caa0807b8cb3bb8f1cc5679dbe23ca4398827dd3b841269212eea4c56cfd057c2066dfc5853236e4134ffbd1bf10272359df656c88cc2dda1c7d6317ab1970 SHA512 68081b023a298180abb3d5c6ce33bd36fece32d1d6fe7d38f87edd236b3e70d2dc5c11f8a42561ff66103806af4278e08e0282649c4d9fe95a44f29ea0bc82b8
-TIMESTAMP 2024-06-21T22:40:39Z
+MANIFEST Manifest.files.gz 575523 BLAKE2B de41364df787e2652a1f6dda37e1513a8953f61c0ade9d1ba90db51415db460a2dd55ec567c2c851c28aaf7ffaa4763a80e748ea9a9d8f30ff1696ea4f17f233 SHA512 717db93df5303c6328fa1610a5166072155b52c981dab3121e3399b951cd8877d22fba9534692b8b7da38c227d9e195296abdf7536518c7808a22fe65a776a5f
+TIMESTAMP 2024-06-22T22:40:41Z
-----BEGIN PGP SIGNATURE-----
-iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmZ2AWdfFIAAAAAALgAo
+iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmZ3UulfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
-klAd6Q//a+mnKuS0s3RNqG7vx0usFL2C7LrBrvu+7HTDdbD+0yYp6atS6qnFalMX
-QNL2vpwz0DMQYB1syeYlOgl7pyHK0Gl3T/ABfE7VGc6jo8CteFk9AUFfhLnaesTr
-+KnSVfidhbZXdV9bdTNSBuODk7trLyB7fZWW8Y1jo2w9FGRLt6E3Au9Ahqra5ySt
-mkRM1BZBnOS1j5gWycBAhBcpevou3uvV3rIvlpcM5zWsWHmS3RznDZFqTV7wnMLX
-amQ5jMskbpPVI5lRX7j8XaONRR1iAdxh+/V+6q+nq41w/EuoXyg3VpTaX09NkTot
-tsvEE1zyf4Qnzh0leASGecIweGc4IYU4pQ9iwg1Pkn/siLJSnEzSnPQl1QSGLv0K
-22JBnYSvK5ZLj7VV5iBcK69ZkPONDf4GOTEIJv3YG4obolZfug8M9UavPQCe8+IE
-0l1qm9aoUakSFqncK2Ss+Fa28ZTrX0pyjN5xEqwKKkEjEVdRkKHDDnYg37JAhpaB
-GM64FYL6tzgbw8vFeJSVDFFxyO6l5LRrULptL1gZ/s34azF5GcaLIODXDCV/oFZN
-GhFWuQZX0C9F9bx3yAuniTxkhXf4V32/j4FSBrmQoc/ML8VO37nvObe7x75PIfnE
-klB3hWsuxn7ORz43QUDCJCNpxe8LeH1soH9NzEv/lbk+hdaoNfg=
-=H7fn
+klBMjBAAtRo76cRpIbOl22uyRKvXwJ+b4MNVEfx34HtIBPPO7dcKCmY9XEsX0uVs
+aVZAqmPV/R+Hyr9GTnub6WG1j6aMx01plBe9pmo9BDjKy2uw2S0lS94OFGbv78o6
+QdV2IMLY4KCF19+fd5tkAmmFTx429XQNsWvb6f6G62rfRlMOmJm58+R3W9Jk/O9g
+xJNWvAT7Q88PA0Fnd54pNuxcXxU5Q6aziFjCmpYh5/0vJIjgEzu5L07d75vPCbK3
+o5rkYjqcbmLNMNxk2/S3AOQ7RnQ4kBcT/v17E42YFgtKTtmGYq/FPQgQLTd46vpW
+OCrzKmJ31cAG9I9zFWE6oZaAGfcPmPsepKP+XpupT0gGeU6jaRIj25R5G2bCchd5
+lknSDU8O3pK9cJ5zEs0AROK6WAdgtYN8fTf0xo6DBdhRO+n57l3VZnbbuMP4cxjC
+87nJwD4G0rNVnhYRQwBc7xufwfzuqCiCfMxEcRLyFzr9Zf4X26njSbDq53lXmjbn
+QHjTw0BXQd5qdXLufXU98MsiAcoiMddLMroHgf5eEiwQz7UdYRI3/NNx2Uh3zuot
+0zA+o39qlteS3KA0Ri36JMSQnBpzn50qqj77TsvNFWMiYxKJD0LwI7CaPdR8FQk7
+5HDM6bOAe3PzrsuUM+o8aYwwcCCbyiB1NgQOvAGWSLupjNIy6n8=
+=IdQI
-----END PGP SIGNATURE-----
diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz
index 539c52a99f3d..df7e9aa6f896 100644
--- a/metadata/glsa/Manifest.files.gz
+++ b/metadata/glsa/Manifest.files.gz
Binary files differ
diff --git a/metadata/glsa/glsa-202406-01.xml b/metadata/glsa/glsa-202406-01.xml
new file mode 100644
index 000000000000..b751481f5580
--- /dev/null
+++ b/metadata/glsa/glsa-202406-01.xml
@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202406-01">
+ <title>GLib: Privilege Escalation</title>
+ <synopsis>A vulnerability has been discovered in GLib, which can lead to privilege escalation.</synopsis>
+ <product type="ebuild">glib</product>
+ <announced>2024-06-22</announced>
+ <revised count="1">2024-06-22</revised>
+ <bug>931507</bug>
+ <access>local</access>
+ <affected>
+ <package name="dev-libs/glib" auto="yes" arch="*">
+ <unaffected range="ge">2.78.6</unaffected>
+ <vulnerable range="lt">2.78.6</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>GLib is a library providing a number of GNOME&#39;s core objects and functions.</p>
+ </background>
+ <description>
+ <p>A vulnerability has been discovered in GLib. Please review the CVE identifier referenced below for details.</p>
+ </description>
+ <impact type="high">
+ <p>When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager or logind on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact.</p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All GLib users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=dev-libs/glib-2.78.6"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-34397">CVE-2024-34397</uri>
+ </references>
+ <metadata tag="requester" timestamp="2024-06-22T06:44:35.106379Z">graaff</metadata>
+ <metadata tag="submitter" timestamp="2024-06-22T06:44:35.109355Z">graaff</metadata>
+</glsa> \ No newline at end of file
diff --git a/metadata/glsa/glsa-202406-02.xml b/metadata/glsa/glsa-202406-02.xml
new file mode 100644
index 000000000000..e71b4a225fe0
--- /dev/null
+++ b/metadata/glsa/glsa-202406-02.xml
@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202406-02">
+ <title>Flatpak: Sandbox Escape</title>
+ <synopsis>A vulnerability has been discovered in Flatpak, which can lead to a sandbox escape.</synopsis>
+ <product type="ebuild">flatpak</product>
+ <announced>2024-06-22</announced>
+ <revised count="1">2024-06-22</revised>
+ <bug>930202</bug>
+ <access>local</access>
+ <affected>
+ <package name="sys-apps/flatpak" auto="yes" arch="*">
+ <unaffected range="ge">1.14.6</unaffected>
+ <vulnerable range="lt">1.14.6</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>Flatpak is a Linux application sandboxing and distribution framework.</p>
+ </background>
+ <description>
+ <p>A vulnerability has been discovered in Flatpak. Please review the CVE identifier referenced below for details.</p>
+ </description>
+ <impact type="high">
+ <p>A malicious or compromised Flatpak app could execute arbitrary code outside its sandbox in conjunction with xdg-desktop-portal.</p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All Flatpak users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=sys-apps/flatpak-1.14.6"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-32462">CVE-2024-32462</uri>
+ </references>
+ <metadata tag="requester" timestamp="2024-06-22T07:02:59.833368Z">graaff</metadata>
+ <metadata tag="submitter" timestamp="2024-06-22T07:02:59.837565Z">graaff</metadata>
+</glsa> \ No newline at end of file
diff --git a/metadata/glsa/glsa-202406-03.xml b/metadata/glsa/glsa-202406-03.xml
new file mode 100644
index 000000000000..ea0ecac3e1bf
--- /dev/null
+++ b/metadata/glsa/glsa-202406-03.xml
@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202406-03">
+ <title>RDoc: Remote Code Execution</title>
+ <synopsis>A vulnerability has been discovered in RDoc, which can lead to execution of arbitrary code.</synopsis>
+ <product type="ebuild">rdoc</product>
+ <announced>2024-06-22</announced>
+ <revised count="2">2024-06-22</revised>
+ <bug>927565</bug>
+ <access>local and remote</access>
+ <affected>
+ <package name="dev-ruby/rdoc" auto="yes" arch="*">
+ <unaffected range="ge">6.6.3.1</unaffected>
+ <vulnerable range="lt">6.6.3.1</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>RDoc produces HTML and command-line documentation for Ruby projects.</p>
+ </background>
+ <description>
+ <p>A vulnerability has been discovered in RDoc. Please review the CVE identifier referenced below for details.</p>
+ </description>
+ <impact type="high">
+ <p>When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored.
+
+When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.</p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All RDoc users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=dev-ruby/rdoc-6.6.3.1"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-27281">CVE-2024-27281</uri>
+ </references>
+ <metadata tag="requester" timestamp="2024-06-22T07:30:29.289298Z">graaff</metadata>
+ <metadata tag="submitter" timestamp="2024-06-22T07:30:29.293762Z">graaff</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-202406-04.xml b/metadata/glsa/glsa-202406-04.xml
new file mode 100644
index 000000000000..cea7d0f601d5
--- /dev/null
+++ b/metadata/glsa/glsa-202406-04.xml
@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202406-04">
+ <title>LZ4: Memory Corruption</title>
+ <synopsis>A vulnerability has been discovered in LZ4, which can lead to memory corruption.</synopsis>
+ <product type="ebuild">lz4</product>
+ <announced>2024-06-22</announced>
+ <revised count="1">2024-06-22</revised>
+ <bug>791952</bug>
+ <access>local</access>
+ <affected>
+ <package name="app-arch/lz4" auto="yes" arch="*">
+ <unaffected range="ge">1.9.3-r1</unaffected>
+ <vulnerable range="lt">1.9.3-r1</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>LZ4 is a lossless compression algorithm, providing compression speed &gt; 500 MB/s per core, scalable with multi-cores CPU. It features an extremely fast decoder, with speed in multiple GB/s per core, typically reaching RAM speed limits on multi-core systems.</p>
+ </background>
+ <description>
+ <p>An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash.</p>
+ </description>
+ <impact type="normal">
+ <p>The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.</p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All LZ4 users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=app-arch/lz4-1.9.3-r1"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3520">CVE-2021-3520</uri>
+ </references>
+ <metadata tag="requester" timestamp="2024-06-22T08:02:03.295621Z">graaff</metadata>
+ <metadata tag="submitter" timestamp="2024-06-22T08:02:03.298226Z">graaff</metadata>
+</glsa> \ No newline at end of file
diff --git a/metadata/glsa/glsa-202406-05.xml b/metadata/glsa/glsa-202406-05.xml
new file mode 100644
index 000000000000..622d3fc82eaf
--- /dev/null
+++ b/metadata/glsa/glsa-202406-05.xml
@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202406-05">
+ <title>JHead: Multiple Vulnerabilities</title>
+ <synopsis>Multiple vulnerabilities have been discovered in JHead, the worst of which may lead to arbitrary code execution.</synopsis>
+ <product type="ebuild">jhead</product>
+ <announced>2024-06-22</announced>
+ <revised count="1">2024-06-22</revised>
+ <bug>876247</bug>
+ <bug>879801</bug>
+ <bug>908519</bug>
+ <access>local</access>
+ <affected>
+ <package name="media-gfx/jhead" auto="yes" arch="*">
+ <unaffected range="ge">3.08</unaffected>
+ <vulnerable range="lt">3.08</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>JHead is an EXIF JPEG header manipulation tool.</p>
+ </background>
+ <description>
+ <p>Multiple vulnerabilities have been discovered in JHead. Please review the CVE identifiers referenced below for details.</p>
+ </description>
+ <impact type="normal">
+ <p>Please review the referenced CVE identifiers for details.</p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All JHead users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=media-gfx/jhead-3.08"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6624">CVE-2020-6624</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-6625">CVE-2020-6625</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-34055">CVE-2021-34055</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-28550">CVE-2022-28550</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-41751">CVE-2022-41751</uri>
+ </references>
+ <metadata tag="requester" timestamp="2024-06-22T08:28:39.822960Z">graaff</metadata>
+ <metadata tag="submitter" timestamp="2024-06-22T08:28:39.825887Z">graaff</metadata>
+</glsa> \ No newline at end of file
diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk
index da7f46a38817..34d83b1ed55f 100644
--- a/metadata/glsa/timestamp.chk
+++ b/metadata/glsa/timestamp.chk
@@ -1 +1 @@
-Fri, 21 Jun 2024 22:40:33 +0000
+Sat, 22 Jun 2024 22:40:37 +0000
diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit
index 4a7b6a9c71b0..63866c4fbb8e 100644
--- a/metadata/glsa/timestamp.commit
+++ b/metadata/glsa/timestamp.commit
@@ -1 +1 @@
-23f9961964e4ef86fe4fed4e36f8f2cbe2b47dfe 1717006097 2024-05-29T18:08:17Z
+70a36362e8053f3760826b4ccce860e94299c700 1719044953 2024-06-22T08:29:13Z
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-19 15:46:03 +0000