From 43793fab84041cfc5c60c0151d1591b8a69fb24a Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Sat, 25 Aug 2018 07:36:27 +0100 Subject: gentoo resync : 25.08.2018 --- metadata/glsa/Manifest | 30 +++++------ metadata/glsa/Manifest.files.gz | Bin 427414 -> 428048 bytes metadata/glsa/glsa-201808-01.xml | 105 ++++++++++++++++++++++++++++++++++++ metadata/glsa/glsa-201808-02.xml | 51 ++++++++++++++++++ metadata/glsa/glsa-201808-03.xml | 61 +++++++++++++++++++++ metadata/glsa/glsa-201808-04.xml | 111 +++++++++++++++++++++++++++++++++++++++ metadata/glsa/timestamp.chk | 2 +- metadata/glsa/timestamp.commit | 2 +- 8 files changed, 345 insertions(+), 17 deletions(-) create mode 100644 metadata/glsa/glsa-201808-01.xml create mode 100644 metadata/glsa/glsa-201808-02.xml create mode 100644 metadata/glsa/glsa-201808-03.xml create mode 100644 metadata/glsa/glsa-201808-04.xml (limited to 'metadata/glsa') diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest index 315b78bc356e..10acbec232fc 100644 --- a/metadata/glsa/Manifest +++ b/metadata/glsa/Manifest @@ -1,23 +1,23 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 -MANIFEST Manifest.files.gz 427414 BLAKE2B 03f31e82901c67c54c9e2a393ac3d0d1d25bb342aa53f12ef4cda3b8ecae5db556d030b733bc4f3fdba54171e0a9a96a6e0e3c4ab9239061ea537618ba745ce1 SHA512 01f241123b41771420b69c122806bf7c9c1b4f6f77886ed4e9a9737364198dc0d9cc296f967c056f28a2af511a8d2680a7991527b5ca7723fbd12dcffe525a32 -TIMESTAMP 2018-08-12T04:08:43Z +MANIFEST Manifest.files.gz 428048 BLAKE2B 5834bbfc1927ee7e2cae3faeae917bb164749c31d96c4c2668b07723f350b9742d5ef21ebbf7f78fbff1cc985eb00ece32e39d04e065bfb0d6824a4107935d0a SHA512 038811f6891b17d7f2be8dde22716fa2af520867cd5808ca4a095d817a75e7d94ee52dc46317f62740ddbc4cd55248f9f02d26404d1805e220ae95187a8b3764 +TIMESTAMP 2018-08-25T05:38:46Z -----BEGIN PGP SIGNATURE----- -iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAltvsstfFIAAAAAALgAo +iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAluA62ZfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY -klBCUBAAsXjhLT5fxLhP/zixh6RmoOe3UE32mg17K5+YMUSiGzkuqcSmKE/AcL8X -LTKxn+DWSuTtZfAFN6YTpb/lf8EZ2D6owPQGy2hE1FS8e2MEAfIesKjMFBtawfQS -HxtBuYG7EhWWnu20Aq5N61sFulqv71SibOZ7AIbbIRg+GPLG92tp1uGe33u82jTZ -GK8KPwVQuJfSWZs70Za4XJgTojI4bNY09sN3PmFr+qZefosFnryEZJ52MUAfaerW -EAzUi3rEYKkAcZ1XVqAbrbz/3RcEWSKFfyjz8c+E7N/lKyLTrArm6gR/i/s5lkCu -55dvx8hwLv7yLmpuLsg70j4woMEdT8meNlW5rCMxaX9+1vo4URUiEC85e162ROr2 -sB82M1KumPYjrOdB8RnCnH5lwdWK60JDRm7mqMbF0nucNt/kA+FVBFZqM4n7+/04 -Z3dhv3+TZdF5tauDy9fkn6fZfWY3PNJs0YL3zyRKX6CncswoSjzMZmbi8jQpwWi7 -gi9gyXiF1qmzl6GbFeSzY/pYf2li3lHegQQzrr/p2oAUcYDiHX5Wuh832AgCzoXK -sasG0l2YRzfaMcvyWyecZb+yTepnHKCZeX9B+5g5kEdK+OGB4qpZ5nswp+LcbSGY -IK0PDbKAP0VP2RMpjdE2VVkXqXtZL8I0/GW5j4/jETcAVReAZpE= -=WXfr +klBA7g//dYb3WypgUyWARdyGL0tHPvQcok2a40YtJ3SH2v2itHvsPjJmrEcQK5A8 +2aA+V+y5AWubdo81XyFWKIrQZz2bLVckxPljbS65vUbEV/G5mqNF+djwTOxEV+Xn +xPfervQf2TY/Xh24GXLUs1rHy0IDCwr7TPevxUF9aPtqNqXaksAfpAhyTSX764M3 +uVReSbj0GKMdl+1ptQuDt3A6LDJnzs1jWU2g1sobrSx6MKudBvZN80U3Wu7Vajaa +2KuElXzDg8WNhiLdKUrBbaPt7q5yFkHkH+aQRwTNDI0ITa4RG6qUDhZNqTblqB12 +qi85MnA4WLOED4YOFxVacLb+6SLOgQVXutoFNRX1upuYMmPAYdymvwk5KHqYLKls +mCZC28Ng3p/9dTohOQOFGuTs+HKoJx4bfdTS78DI8fNgWidd63yzNkTqeOM1MHhw +vyeg2NEIv6dRhKxeCZoOfOMvaMQMUTTUS63t366lR+E1qoa0DXKajDbAEUrF03WP +5zhZX6WRvHPwnVAydVedhzcyItMUMnk6frx5HtIHVkSoSlnK+sPiwC0GGKvedvWv +TLCQvenVeFQDyXyH3tZrgtMapfuKR2xy68agCv7Mso9XtYrxquO2ZUAdYAeRGPTy +WqIrNtyd7AyQghW9aJXYMHz/MILAYZ2vEiwZU0a/yt9dak0tFq8= +=LiK4 -----END PGP SIGNATURE----- diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz index 2c573718af44..efd7310b81fc 100644 Binary files a/metadata/glsa/Manifest.files.gz and b/metadata/glsa/Manifest.files.gz differ diff --git a/metadata/glsa/glsa-201808-01.xml b/metadata/glsa/glsa-201808-01.xml new file mode 100644 index 000000000000..6e5632d69a0a --- /dev/null +++ b/metadata/glsa/glsa-201808-01.xml @@ -0,0 +1,105 @@ + + + + Chromium, Google Chrome: Multiple vulnerabilities + Multiple vulnerabilities have been found in Chromium and Google + Chrome, the worst of which allows remote attackers to escalate privileges. + + chromium + 2018-08-22 + 2018-08-22 + 657376 + 662436 + remote + + + 68.0.3440.75 + 68.0.3440.75 + + + 68.0.3440.75 + 68.0.3440.75 + + + +

Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +

+ +

Google Chrome is one fast, simple, and secure browser for all your + devices. +

+ + +

Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the referenced CVE identifiers and Google Chrome + Releases for details. +

+ + +

A remote attacker could escalate privileges, cause a heap buffer + overflow, obtain sensitive information or spoof a URL. +

+ + +

There is no known workaround at this time.

+ + +

All Chromium users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/chromium-68.0.3440.75" + + +

All Google Chrome users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-client/google-chrome-68.0.3440.75" + + + + + CVE-2018-4117 + CVE-2018-6044 + CVE-2018-6150 + CVE-2018-6151 + CVE-2018-6152 + CVE-2018-6153 + CVE-2018-6154 + CVE-2018-6155 + CVE-2018-6156 + CVE-2018-6157 + CVE-2018-6158 + CVE-2018-6159 + CVE-2018-6160 + CVE-2018-6161 + CVE-2018-6162 + CVE-2018-6163 + CVE-2018-6164 + CVE-2018-6165 + CVE-2018-6166 + CVE-2018-6167 + CVE-2018-6168 + CVE-2018-6169 + CVE-2018-6170 + CVE-2018-6171 + CVE-2018-6172 + CVE-2018-6173 + CVE-2018-6174 + CVE-2018-6175 + CVE-2018-6176 + CVE-2018-6177 + CVE-2018-6178 + CVE-2018-6179 + CVE-2108-6150 + + Google Chrome 68.0.3440.75 release announcement + + + irishluck83 + Zlogene + diff --git a/metadata/glsa/glsa-201808-02.xml b/metadata/glsa/glsa-201808-02.xml new file mode 100644 index 000000000000..efe6722f6acb --- /dev/null +++ b/metadata/glsa/glsa-201808-02.xml @@ -0,0 +1,51 @@ + + + + LinuX Containers user space utilities: Arbitrary file read + A vulnerability has been found in LXC which may allow for arbitrary + file access (read-only). + + lxc + 2018-08-22 + 2018-08-22 + 662780 + local + + + 3.0.1-r1 + 3.0.1-r1 + + + +

LinuX Containers user space utilities.

+ + +

lxc-user-nic when asked to delete a network interface will + unconditionally open a user provided path. This code path may be used by + an unprivileged user to check for the existence of a path which they + wouldn’t otherwise be able to reach. +

+ + +

A local unprivileged user could use this flaw to access arbitrary files, + including special device files. +

+ + +

There is no known workaround at this time.

+ + +

All LXC users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/lxc-3.0.1-r1" + + + + + CVE-2018-6556 + + irishluck83 + Zlogene + diff --git a/metadata/glsa/glsa-201808-03.xml b/metadata/glsa/glsa-201808-03.xml new file mode 100644 index 000000000000..fbb8ec698cb6 --- /dev/null +++ b/metadata/glsa/glsa-201808-03.xml @@ -0,0 +1,61 @@ + + + + NetworkManager VPNC plugin: Privilege escalation + A vulnerability in NetworkManager VPNC plugin allows local users to + escalate privileges. + + networkmanager-vpnc + 2018-08-22 + 2018-08-22 + 661712 + local + + + 1.2.6 + 1.2.6 + + + +

NetworkManager is an universal network configuration daemon for laptops, + desktops, servers and virtualization hosts. +

+ +

The VPNC plugin provides easy access Cisco Concentrator based VPN’s + utilizing NetworkManager. +

+ + +

When initiating a VPNC connection, NetworkManager spawns a new vpnc + process and passes the configuration via STDIN. By injecting a special + character into a configuration parameter, an attacker can coerce + NetworkManager to set the Password helper option to an attacker + controlled executable file. +

+ + +

A local attacker is able to escalate privileges via a specially crafted + configuration file. +

+ + +

There is no known workaround at this time.

+ + +

All NetworkManager VPNC plugin users should upgrade to the latest + version: +

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=net-misc/networkmanager-vpnc-1.2.6" + + + + + CVE-2018-10900 + + irishluck83 + irishluck83 + diff --git a/metadata/glsa/glsa-201808-04.xml b/metadata/glsa/glsa-201808-04.xml new file mode 100644 index 000000000000..842738778130 --- /dev/null +++ b/metadata/glsa/glsa-201808-04.xml @@ -0,0 +1,111 @@ + + + + WebkitGTK+: Multiple vulnerabilities + Multiple vulnerabilities have been found in WebKitGTK+, the worst + of which may lead to arbitrary code execution. + + webkit-gtk + 2018-08-22 + 2018-08-22 + 652820 + 658168 + 662974 + remote + + + 2.20.4 + 2.20.4 + + + +

WebKitGTK+ is a full-featured port of the WebKit rendering engine, + suitable for projects requiring any kind of web integration, from hybrid + HTML/CSS applications to full-fledged web browsers. +

+ + +

Multiple vulnerabilities have been discovered in WebKitGTK+. Please + review the referenced CVE identifiers for details. +

+ + +

A remote attacker could execute arbitrary commands or cause a denial of + service condition via a maliciously crafted web content. +

+ + +

There is no known workaround at this time.

+ + +

All WebkitGTK+ users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.20.4" + + + + + CVE-2018-11646 + CVE-2018-11712 + CVE-2018-11713 + CVE-2018-12293 + CVE-2018-12294 + CVE-2018-4101 + CVE-2018-4113 + CVE-2018-4114 + CVE-2018-4117 + CVE-2018-4118 + CVE-2018-4119 + CVE-2018-4120 + CVE-2018-4121 + CVE-2018-4122 + CVE-2018-4125 + CVE-2018-4127 + CVE-2018-4128 + CVE-2018-4129 + CVE-2018-4133 + CVE-2018-4146 + CVE-2018-4162 + CVE-2018-4163 + CVE-2018-4165 + CVE-2018-4190 + CVE-2018-4192 + CVE-2018-4199 + CVE-2018-4200 + CVE-2018-4201 + CVE-2018-4204 + CVE-2018-4214 + CVE-2018-4218 + CVE-2018-4222 + CVE-2018-4232 + CVE-2018-4233 + CVE-2018-4261 + CVE-2018-4262 + CVE-2018-4263 + CVE-2018-4264 + CVE-2018-4265 + CVE-2018-4266 + CVE-2018-4267 + CVE-2018-4270 + CVE-2018-4272 + CVE-2018-4273 + CVE-2018-4278 + CVE-2018-4284 + WebKitGTK+ + Security Advisory WSA-2018-0003 + + WebKitGTK+ + Security Advisory WSA-2018-0004 + + WebKitGTK+ + Security Advisory WSA-2018-0005 + + WebKitGTK+ + Security Advisory WSA-2018-0006 + + + whissi + irishluck83 + diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk index f9f6aa4e06e6..e992598d86de 100644 --- a/metadata/glsa/timestamp.chk +++ b/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Sun, 12 Aug 2018 04:08:40 +0000 +Sat, 25 Aug 2018 05:38:42 +0000 diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit index 39d5ceab637c..48b67b89a28e 100644 --- a/metadata/glsa/timestamp.commit +++ b/metadata/glsa/timestamp.commit @@ -1 +1 @@ -bc003b9516bfd3c1d933c8cd919b86b13f8c5548 1532902339 2018-07-29T22:12:19+00:00 +369717e703607f113d1aa3954217fedba2e18a69 1534973538 2018-08-22T21:32:18+00:00 -- cgit v1.2.3