From 13ec12ad28bc2ce6e2902be1d571befcca2b3f60 Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Tue, 22 Nov 2022 07:05:54 +0000 Subject: gentoo auto-resync : 22:11:2022 - 07:05:54 --- metadata/glsa/Manifest | 30 ++++++------- metadata/glsa/Manifest.files.gz | Bin 536244 -> 537675 bytes metadata/glsa/glsa-202211-03.xml | 65 ++++++++++++++++++++++++++++ metadata/glsa/glsa-202211-04.xml | 87 ++++++++++++++++++++++++++++++++++++++ metadata/glsa/glsa-202211-05.xml | 65 ++++++++++++++++++++++++++++ metadata/glsa/glsa-202211-06.xml | 89 +++++++++++++++++++++++++++++++++++++++ metadata/glsa/glsa-202211-07.xml | 42 ++++++++++++++++++ metadata/glsa/glsa-202211-08.xml | 42 ++++++++++++++++++ metadata/glsa/glsa-202211-09.xml | 44 +++++++++++++++++++ metadata/glsa/glsa-202211-10.xml | 54 ++++++++++++++++++++++++ metadata/glsa/glsa-202211-11.xml | 44 +++++++++++++++++++ metadata/glsa/timestamp.chk | 2 +- metadata/glsa/timestamp.commit | 2 +- 13 files changed, 549 insertions(+), 17 deletions(-) create mode 100644 metadata/glsa/glsa-202211-03.xml create mode 100644 metadata/glsa/glsa-202211-04.xml create mode 100644 metadata/glsa/glsa-202211-05.xml create mode 100644 metadata/glsa/glsa-202211-06.xml create mode 100644 metadata/glsa/glsa-202211-07.xml create mode 100644 metadata/glsa/glsa-202211-08.xml create mode 100644 metadata/glsa/glsa-202211-09.xml create mode 100644 metadata/glsa/glsa-202211-10.xml create mode 100644 metadata/glsa/glsa-202211-11.xml (limited to 'metadata/glsa') diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest index 5621c490ca51..cc7196e78e48 100644 --- a/metadata/glsa/Manifest +++ b/metadata/glsa/Manifest @@ -1,23 +1,23 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 -MANIFEST Manifest.files.gz 536244 BLAKE2B 47908e9e54099299278f14e5112b789aac78178d7406b6880e3986163e8e2aeec411757dbe131202da7291c508ea72a7d158f7fe08facf6e36a23a28a992a7d8 SHA512 ef16d73b0d889ec01efae4d55e398ba1b384a7b46066c129d82b336f46e8804d0dd1765c65c49d93842dc829696efc67759ac790655f316a70359fb8847d9e4e -TIMESTAMP 2022-11-22T00:10:05Z +MANIFEST Manifest.files.gz 537675 BLAKE2B 920e8afd5076bd0b0cdc4b21f592f49b91bbfc5cd35a94863cffbeddf95c33b8cfa3b57b92eb6cb354a0f6b5d3d95712be50f4206d5d745982929e0523ffcf57 SHA512 b57f0c4473d079d8ddd01c5c21f2196c3359382e6f03dacfc2f8f7484775994807c2f998f659cdcb495b95326de503b7834f47ee0f334256cc0077fc813618d3 +TIMESTAMP 2022-11-22T06:10:05Z -----BEGIN PGP SIGNATURE----- -iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmN8E11fFIAAAAAALgAo +iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmN8Z71fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY -klDo4RAAhTWVZvS2pKSLahHtV+/w6AgkuwJlaxLNzEbAQnG9piOGk/TASCOtWJ2R -ayJ5VoScFaKUTUmh2BrtyBwOc08Rmf6hqYd5CxqNR8YgpULBKBRF4jQdzH5TYUOT -5w8P2Jgu/0hDvyUaMQ0hvkWCws2iSPK7M0BNUTMHGIZgHs1UoBIERvjBV8tfT+9K -WxHY3XWHAlq9cWAt/IRhrVsyXO+zB961GK5kC2yJ76ysljzSpUxaHXqaWJpX1ELR -5wPqEY8IAXKQEwe98gmAzZC10Q49hjvM8rZ9spP07unhWxcM7Nc6rVMlZsbcmyC4 -1EN5eIMJVHzHKVMet5gn+dY79fhII4VZYAqx8exnXNZggOwK/miR3qyc5kLdb3Uw -TT0e5DPpK3nj8GZgg5M3y5diMD7y8gRZ3MmgqIgm4fBMTWOHnyuQJm9Bw8xsFul8 -D4yjDaZFz+6jeW1vFCCoIOBxZt6TXQVrfKz80GfjASo8otRCd3TrJjxfbxI2/RMg -KgtwMnzqy7pUMr61Uiw3lkSuyzdZkuJpsIhMAexCej98RmWANTcyPjfR7onWRQ3i -eRlj4X6pSq5L+5X7o6tdhi494MuMmW7eH93sXl+26t0skJdJp0FXkHvsdct2pMjj -DP0pwd42B0L33+z7KH76WXwByBm2T9nxAwgVwwpgNGEufUxITu8= -=o1wz +klAenA//Q22kP00Uh6U12C3C++4rP/u88dbO1az9KRsbhT4y3dSjR2KVwVzq1pm4 +LFObdEYCqyqabfSKhwdcQZAceGYYIwY/VNTZzXWBzLfCb24in/znXeS3DHOul/Xr +fl6SexpOCJ+1J/xoytnIB+DB7KV7Z3K3W0s/Nx9dTcRLKaBuzBgg2vEOff3BPjQZ +bqqFtHBNCWxY9jLAucxvnISMlcPsAQYLu/HHOFywK+bx2bwmCpz0TMbKuukI/U+v +D5RgAv5Bb2/FWgkg8mMKfANIZIpHHX1OASeabsaeoM8t6FGa6xVO2Bu2HySy6jLI +MNqkGkgjU0VuWw4/+cSW1XCzchF3hweyUH2meYexU0l7c07siTtZYKnSiAXms/sH +gdMMRbfZumTsY4YGMS6q+6VPeOH0kecvIECAwFzH6CWFYpol6FhNUd2v7OlD6mmq +nLmJIV5N9bvy8p+XaB8c1erlPqk13gkDCqRs3Iw+MPPlac0J81xlzKlNVS5eWEXD +u/VHsrenMl1RiZlvJbM4wSMHE8AVwbVDD19foie9dLf02chHWwbqG5vcucelYzRt +NEaBj+XuaZROgqhxKNCgyLjXwXKftLEciWGwibxY51amF28mocqTQtyU1og7j2Xk +WswOebW6N66lwv+sc7d5tST1O/83Pbx9q9UocsAD8KMAGNmbpUM= +=n04N -----END PGP SIGNATURE----- diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz index 1a4f9ff8d224..157dfac057ab 100644 Binary files a/metadata/glsa/Manifest.files.gz and b/metadata/glsa/Manifest.files.gz differ diff --git a/metadata/glsa/glsa-202211-03.xml b/metadata/glsa/glsa-202211-03.xml new file mode 100644 index 000000000000..237aa0d806c8 --- /dev/null +++ b/metadata/glsa/glsa-202211-03.xml @@ -0,0 +1,65 @@ + + + + PHP: Multiple Vulnerabilities + Multiple vulnerabilities have been found in PHP, the worst of which could result in arbitrary code execution. + php + 2022-11-19 + 2022-11-19 + 867913 + 873376 + 877853 + remote + + + 8.1.12 + 8.0.25 + 7.4.33 + 8.1.12 + 8.0.25 + 7.4.33 + + + +

PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.

+ + +

Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details.

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All PHP 7.4 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/php-7.4.33" + + +

All PHP 8.0 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/php-8.0.25" + + +

All PHP 8.1 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/php-8.1.12" + + + + CVE-2022-31628 + CVE-2022-31629 + CVE-2022-31630 + CVE-2022-37454 + + ajak + sam + \ No newline at end of file diff --git a/metadata/glsa/glsa-202211-04.xml b/metadata/glsa/glsa-202211-04.xml new file mode 100644 index 000000000000..ba61adcd9ec4 --- /dev/null +++ b/metadata/glsa/glsa-202211-04.xml @@ -0,0 +1,87 @@ + + + + PostgreSQL: Multiple Vulnerabilities + Multiple vulnerabilities have been found in PostgreSQL, the worst of which could result in remote code execution. + postgresql + 2022-11-19 + 2022-11-19 + 793734 + 808984 + 823125 + 865255 + remote + + + 14.5 + 13.8 + 12.12 + 11.17 + 10.22 + 14.5 + 13.8 + 12.12 + 11.17 + 10.22 + + + +

PostgreSQL is an open source object-relational database management system.

+ + +

Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details.

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All PostgreSQL 10.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-10.22:10" + + +

All PostgreSQL 11.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-11.17:11" + + +

All PostgreSQL 12.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-12.12:12" + + +

All PostgreSQL 13.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-13.8:13" + + +

All PostgreSQL 14.x users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/postgresql-14.5:14" + + + + CVE-2021-3677 + CVE-2021-23214 + CVE-2021-23222 + CVE-2021-32027 + CVE-2021-32028 + CVE-2022-1552 + CVE-2022-2625 + + ajak + sam + \ No newline at end of file diff --git a/metadata/glsa/glsa-202211-05.xml b/metadata/glsa/glsa-202211-05.xml new file mode 100644 index 000000000000..b1b775bd9e81 --- /dev/null +++ b/metadata/glsa/glsa-202211-05.xml @@ -0,0 +1,65 @@ + + + + Mozilla Thunderbird: Multiple Vulnerabilities + Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. + thunderbird,thunderbird-bin + 2022-11-22 + 2022-11-22 + 881407 + remote + + + 102.5.0 + 102.5.0 + + + 102.5.0 + 102.5.0 + + + +

Mozilla Thunderbird is a popular open-source email client from the Mozilla project.

+ + +

Multiple vulnerabilities have been discovered in Mozilla Thunderbird. Please review the CVE identifiers referenced below for details.

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Thunderbird binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-bin-102.5.0" + + +

All Mozilla Thunderbird users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-102.5.0" + + + + CVE-2022-45403 + CVE-2022-45404 + CVE-2022-45405 + CVE-2022-45406 + CVE-2022-45408 + CVE-2022-45409 + CVE-2022-45410 + CVE-2022-45411 + CVE-2022-45412 + CVE-2022-45416 + CVE-2022-45418 + CVE-2022-45420 + CVE-2022-45421 + + ajak + ajak + \ No newline at end of file diff --git a/metadata/glsa/glsa-202211-06.xml b/metadata/glsa/glsa-202211-06.xml new file mode 100644 index 000000000000..1fbd73ac2901 --- /dev/null +++ b/metadata/glsa/glsa-202211-06.xml @@ -0,0 +1,89 @@ + + + + Mozilla Firefox: Multiple Vulnerabilities + Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. + firefox,firefox-bin + 2022-11-22 + 2022-11-22 + 881403 + remote + + + 107.0 + 102.5.0 + 107.0 + 102.5.0 + + + 107.0 + 102.5.0 + 107.0 + 102.5.0 + + + +

Mozilla Firefox is a popular open-source web browser from the Mozilla project.

+ + +

Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers referenced below for details.

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Mozilla Firefox ESR binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-102.5.0" + + +

All Mozilla Firefox ESR users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-102.5.0" + + +

All Mozilla Firefox binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-107.0" + + +

All Mozilla Firefox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-107.0" + + + + CVE-2022-40674 + CVE-2022-45403 + CVE-2022-45404 + CVE-2022-45405 + CVE-2022-45406 + CVE-2022-45407 + CVE-2022-45408 + CVE-2022-45409 + CVE-2022-45410 + CVE-2022-45411 + CVE-2022-45412 + CVE-2022-45413 + CVE-2022-45415 + CVE-2022-45416 + CVE-2022-45417 + CVE-2022-45418 + CVE-2022-45419 + CVE-2022-45420 + CVE-2022-45421 + + ajak + ajak + \ No newline at end of file diff --git a/metadata/glsa/glsa-202211-07.xml b/metadata/glsa/glsa-202211-07.xml new file mode 100644 index 000000000000..045ffe019c9a --- /dev/null +++ b/metadata/glsa/glsa-202211-07.xml @@ -0,0 +1,42 @@ + + + + sysstat: Arbitrary Code Execution + An integer overflow vulnerability has been found in sysstat which could result in arbitrary code execution. + sysstat + 2022-11-22 + 2022-11-22 + 880543 + local + + + 12.7.1 + 12.7.1 + + + +

sysstat is a package containing a number of performance monitoring utilities for Linux, including sar, mpstat, iostat and sa tools.

+ + +

On 32 bit systems, an integer overflow can be triggered when displaying activity data files.

+ + +

Arbitrary code execution can be achieved via sufficiently crafted malicious input.

+ + +

There is no known workaround at this time.

+ + +

All sysstat users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-admin/sysstat-12.7.1" + + + + CVE-2022-39377 + + ajak + ajak + \ No newline at end of file diff --git a/metadata/glsa/glsa-202211-08.xml b/metadata/glsa/glsa-202211-08.xml new file mode 100644 index 000000000000..ef6062360272 --- /dev/null +++ b/metadata/glsa/glsa-202211-08.xml @@ -0,0 +1,42 @@ + + + + sudo: Heap-Based Buffer Overread + A vulnerability has been discovered in sudo which could result in denial of service. + sudo + 2022-11-22 + 2022-11-22 + 879209 + remote + + + 1.9.12-r1 + 1.9.12-r1 + + + +

sudo allows a system administrator to give users the ability to run commands as other users.

+ + +

In certain password input handling, sudo incorrectly assumes the password input is at least nine bytes in size, leading to a heap buffer overread.

+ + +

In the worst case, the heap buffer overread can result in the denial of service of the sudo process.

+ + +

There is no known workaround at this time.

+ + +

All sudo users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-admin/sudo-1.9.12-r1" + + + + CVE-2022-43995 + + ajak + ajak + \ No newline at end of file diff --git a/metadata/glsa/glsa-202211-09.xml b/metadata/glsa/glsa-202211-09.xml new file mode 100644 index 000000000000..d17ced80428d --- /dev/null +++ b/metadata/glsa/glsa-202211-09.xml @@ -0,0 +1,44 @@ + + + + xterm: Arbitrary Code Execution + A vulnerability has been found in xterm which could allow for arbitrary code execution. + xterm + 2022-11-22 + 2022-11-22 + 880747 + remote + + + 375 + 375 + + + +

xterm is a terminal emulator for the X Window system.

+ + +

xterm does not correctly handle control characters related to OSC 50 font ops sequence handling.

+ + +

The vulnerability allows text written to the terminal to write text to the terminal's command line. If the terminal's shell is zsh running with vi line editing mode, text written to the terminal can also trigger the execution of arbitrary commands via writing ^G to the terminal.

+ + +

As a workaround, users can disable xterm's usage of OSC 50 sequences by adding the following to the XResources configuration: + +XTerm*allowFontOps: false

+ + +

All xterm users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-terms/xterm-375" + + + + CVE-2022-45063 + + ajak + ajak + \ No newline at end of file diff --git a/metadata/glsa/glsa-202211-10.xml b/metadata/glsa/glsa-202211-10.xml new file mode 100644 index 000000000000..2f53a15436f9 --- /dev/null +++ b/metadata/glsa/glsa-202211-10.xml @@ -0,0 +1,54 @@ + + + + Pillow: Multiple Vulnerabilities + Multiple vulnerabilities have been found in Pillow, the worst of which could result in arbitrary code execution. + pillow + 2022-11-22 + 2022-11-22 + 855683 + 878769 + 832598 + 830934 + 811450 + 802090 + remote + + + 9.3.0 + 9.3.0 + + + +

The friendly PIL fork.

+ + +

Multiple vulnerabilities have been discovered in Pillow. Please review the CVE identifiers referenced below for details.

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Pillow users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-python/pillow-9.3.0" + + + + CVE-2021-23437 + CVE-2021-34552 + CVE-2022-22815 + CVE-2022-22816 + CVE-2022-22817 + CVE-2022-24303 + CVE-2022-45198 + CVE-2022-45199 + + ajak + ajak + \ No newline at end of file diff --git a/metadata/glsa/glsa-202211-11.xml b/metadata/glsa/glsa-202211-11.xml new file mode 100644 index 000000000000..4c3adcd09665 --- /dev/null +++ b/metadata/glsa/glsa-202211-11.xml @@ -0,0 +1,44 @@ + + + + GPL Ghostscript: Multiple Vulnerabilities + Multiple vulnerabilities have been found in GPL Ghostscript, the worst of which could result in arbitrary code execution. + ghostscript-gpl + 2022-11-22 + 2022-11-22 + 852944 + 812509 + remote + + + 9.56.1 + 9.56.1 + + + +

Ghostscript is an interpreter for the PostScript language and for PDF.

+ + +

Multiple vulnerabilities have been discovered in GPL Ghostscript. Please review the CVE identifiers referenced below for details.

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All GPL Ghostscript users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-text/ghostscript-gpl-9.56.1" + + + + CVE-2021-3781 + CVE-2022-2085 + + ajak + ajak + \ No newline at end of file diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk index f5298ba72e3b..069229801596 100644 --- a/metadata/glsa/timestamp.chk +++ b/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Tue, 22 Nov 2022 00:10:02 +0000 +Tue, 22 Nov 2022 06:10:02 +0000 diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit index 856b1311a2d5..0a79ca2c1dba 100644 --- a/metadata/glsa/timestamp.commit +++ b/metadata/glsa/timestamp.commit @@ -1 +1 @@ -d2caa7d73160aa5b9c9cda07665068a8b25fa730 1668098162 2022-11-10T16:36:02+00:00 +ae2df9a36eb30967fc9dd392f63bc7af60249272 1669089580 2022-11-22T03:59:40+00:00 -- cgit v1.2.3