From 6b933047f46efec1aa747570f945344254227457 Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Fri, 15 Dec 2017 17:25:28 +0000 Subject: gentoo resync : 15.12.2017 --- metadata/glsa/Manifest | 30 ++++++------- metadata/glsa/Manifest.files.gz | Bin 412220 -> 412859 bytes metadata/glsa/glsa-201712-01.xml | 90 ++++++++++++++++++++++++++++++++++++++ metadata/glsa/glsa-201712-02.xml | 92 +++++++++++++++++++++++++++++++++++++++ metadata/glsa/glsa-201712-03.xml | 65 +++++++++++++++++++++++++++ metadata/glsa/glsa-201712-04.xml | 65 +++++++++++++++++++++++++++ metadata/glsa/timestamp.chk | 2 +- metadata/glsa/timestamp.commit | 2 +- 8 files changed, 329 insertions(+), 17 deletions(-) create mode 100644 metadata/glsa/glsa-201712-01.xml create mode 100644 metadata/glsa/glsa-201712-02.xml create mode 100644 metadata/glsa/glsa-201712-03.xml create mode 100644 metadata/glsa/glsa-201712-04.xml (limited to 'metadata/glsa') diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest index 0dd53be795f1..525448a5eee4 100644 --- a/metadata/glsa/Manifest +++ b/metadata/glsa/Manifest @@ -1,23 +1,23 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 -MANIFEST Manifest.files.gz 412220 BLAKE2B 617f98a11422c1ee21088130d37b0366715c394e1b07542c78cc30517f3787d1a7caef3c41d798a3b476df30c0c66c05c78794ebc80ff83c5b528cbc6cfe4b21 SHA512 cd79d1d0f667c0328946b3f39635013f95ead0bdc9d55e949bdeff00c6846b73b692fe2e0db699410d94aec83dcc49b2344f458738ab9321428be107da1bc56a -TIMESTAMP 2017-12-10T08:09:33Z +MANIFEST Manifest.files.gz 412859 BLAKE2B 29f22611257846c43da3f994e05684673fa1caa957a4b148f39ff19bc84f3682e8490d97c111e7eccbdb376d70136a0d0906ef152ce3abf044f4fb391eb520c4 SHA512 49d32fc5be9c59d40fa5555276aaf748a6274c5421c12e450644629355174f7bb6f7e77103a5571ae8f5e28bcd53505531ac68ed8f7957c3debfc9196bd152cd +TIMESTAMP 2017-12-15T16:38:51Z -----BEGIN PGP SIGNATURE----- -iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlos671fFIAAAAAALgAo +iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAloz+ptfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY -klCdIQ//UElZHAGeG5LBVrYKnyEO2yOhkl9OkUzQgyYiVT5L2ow0SjMQLqMGeUxi -xm4irO9/PkEC8LE6lthAWanQQC0hRrBvNEHObViaUWdVvvDMdRFbpreUqT1FjTnC -EFf3oX4EFYNc3f3K43vVnkaERdHiPZyijIOWLpn9D7eX5f/6bAHHhTWmFDgfxiIP -QNdlZLqwGWzDvhhxDvIUumBsa5XZfzKS5Ocb61+iUw4x4mnhnw0LfKpWImpYn+sT -E94oc+vVvSRO3bp33kgV8s616uVZU2EXv9eiGHKEJiMJRXEO/WD15UnP8SshK0vQ -smj7MK48uEwM6s3DuZuUr5foid/XYOq3Usubvlo7a3QUJfUkXgwpTv/O2XlIUcN9 -LgbZB1uMEXTJGcKAtNi/u5KabWdXVVqL9FfUMOSfNMUR1HhZmVb+ooHw8nHh+RRc -R4Su62S1wvazW228nw7ujj5inm5/EC8+964HCMgnVgXQHk9+LmWVKNnTyB0Rlale -u9xG67kW3pEx58HOydtYyHXiw/9sKXBWHgBXTfzO0BTrFkmfK+XW2mwT+FmUH+Y4 -HE/HBdyvck6ReTCoV9nQZY7Ra30gQxL9JOTu/DGoAgP0gPUDKNFRKuGq+E3Awnyb -reqtKB25Xe+UVTUBG1uZQXgQkPnaLwRRyw9a4sV8YYuE9085Plc= -=tv0T +klCycQ//UINb5dEsy1qRPuBO/wDfi4Gh2U3hC9W5ZZqNkCtYTeRzhdNGtyRtgqKX +h1tEe93LGxIclmshFtzmMupZZD8DwNIrI1WYk/7lvVEi9hYMiDX3IklHHXwk0D52 +j6K+bhEpWnRg6pUlO81gbyYIx25nWQKCf6exrocCrkUW5XIY2AhYxUvuTu0RXOMl +0DyUIpSgh+JZtkP0f3QzJW/BUZ5T+9cT0OM5JspOEvrDuToAIrT7PlW1Rrwkkf4I +q1KP1Mt12e52uKTvbRnufSd7Fb1GNq15Y0hufP0hIf2JWMEX5lXHhM1JSf3fmiqv +EDMQnVbVSETcpZFdp2M4P7Z9+jmgeLzLR3PJX9E198SSEhPj0y59q5QHGW15rJZD +HSIXXOiYx0uXbCjy9IHS78qDMBQCP3rFMpz+if+IqWsGBEjknZGuCYNZKc92OBtM +aiBPeM/rN2NHMlMpaqV3JgMYm+pIK9K8CgQ0+HBsPmrY4lNj0CpJcEf7dJdaT9TW +4ByJnHYtT0zlZ2ET+GPu/NmjE0QR2DcuvYV7FfcFNUCWK8R6Jr5FCyEqlIjvQZcB +OR2ioPRXNGebde1f2V2j9iqC7uE9PB1AVtE6TAVoSUBgusTOpTsIQqQ6XRqB3zIu +NsdxI+aM1suWje+GRwF9jchcTJCqwciPQ2FrrOW6EucwmBZq8M8= +=BZJE -----END PGP SIGNATURE----- diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz index 962ae75495cc..6fc5b55366c7 100644 Binary files a/metadata/glsa/Manifest.files.gz and b/metadata/glsa/Manifest.files.gz differ diff --git a/metadata/glsa/glsa-201712-01.xml b/metadata/glsa/glsa-201712-01.xml new file mode 100644 index 000000000000..31391d02a59e --- /dev/null +++ b/metadata/glsa/glsa-201712-01.xml @@ -0,0 +1,90 @@ + + + + WebKitGTK+: Multiple vulnerabilities + Multiple vulnerabilities have been discovered in WebKitGTK+, the + worst of which may lead to arbitrary code execution. + + WebkitGTK + 2017-12-14 + 2017-12-14: 1 + 637076 + remote + + + 2.18.3 + 2.18.3 + + + +

WebKitGTK+ is a full-featured port of the WebKit rendering engine, + suitable for projects requiring any kind of web integration, from hybrid + HTML/CSS applications to full-fledged web browsers. +

+ + +

Multiple vulnerabilities have been discovered in WebKitGTK+. Please + review the referenced CVE identifiers for details. +

+ + +

By enticing a victim to visit maliciously crafted web content, a remote + attacker could execute arbitrary code or cause a denial of service + condition. +

+ + +

There are no known workarounds at this time.

+ + +

All WebKitGTK+ users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.18.3" + + + + + CVE-2017-13783 + + + CVE-2017-13784 + + + CVE-2017-13785 + + + CVE-2017-13788 + + + CVE-2017-13791 + + + CVE-2017-13792 + + + CVE-2017-13793 + + + CVE-2017-13794 + + + CVE-2017-13795 + + + CVE-2017-13796 + + + CVE-2017-13798 + + + CVE-2017-13802 + + + CVE-2017-13803 + + + jmbailey + jmbailey + diff --git a/metadata/glsa/glsa-201712-02.xml b/metadata/glsa/glsa-201712-02.xml new file mode 100644 index 000000000000..f0f2f8bc37f9 --- /dev/null +++ b/metadata/glsa/glsa-201712-02.xml @@ -0,0 +1,92 @@ + + + + OpenCV: Multiple vulnerabilities + Multiple vulnerabilities have been discovered in OpenCV, the worst + of which may result in a denial of service condition. + + OpenCV + 2017-12-14 + 2017-12-14: 1 + 627230 + 627958 + remote + + + 2.4.13-r3 + 2.4.13-r3 + + + +

OpenCV (Open Source Computer Vision Library) is an open source computer + vision and machine learning software library. +

+ + +

Multiple vulnerabilities have been discovered in OpenCV. Please review + the referenced CVE identifiers for details. +

+ + +

An attacker can cause a denial of service condition or conduct other + memory corruption attacks. +

+ + +

There are no known workarounds at this time.

+ + +

All OpenCV users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/opencv-2.4.13-r3" + + + + + CVE-2017-12597 + + + CVE-2017-12598 + + + CVE-2017-12599 + + + CVE-2017-12600 + + + CVE-2017-12601 + + + CVE-2017-12602 + + + CVE-2017-12603 + + + CVE-2017-12604 + + + CVE-2017-12605 + + + CVE-2017-12606 + + + CVE-2017-12862 + + + CVE-2017-12863 + + + CVE-2017-12864 + + + CVE-2017-14136 + + + jmbailey + jmbailey + diff --git a/metadata/glsa/glsa-201712-03.xml b/metadata/glsa/glsa-201712-03.xml new file mode 100644 index 000000000000..2f08599410ad --- /dev/null +++ b/metadata/glsa/glsa-201712-03.xml @@ -0,0 +1,65 @@ + + + + OpenSSL: Multiple vulnerabilities + Multiple vulnerabilities have been found in OpenSSL, the worst of + which may lead to a Denial of Service condition. + + openssl + 2017-12-14 + 2017-12-14: 1 + 629290 + 636264 + 640172 + remote + + + 1.0.2n + 1.0.2n + + + +

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the + Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. +

+ + +

Multiple vulnerabilities have been discovered in OpenSSL. Please review + the referenced CVE identifiers for details. +

+ + +

A remote attacker could cause a Denial of Service condition, recover a + private key in unlikely circumstances, circumvent security restrictions + to perform unauthorized actions, or gain access to sensitive information. +

+ + +

There are no known workarounds at this time.

+ + +

All OpenSSL users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.2n" + + + + + + CVE-2017-3735 + + + CVE-2017-3736 + + + CVE-2017-3737 + + + CVE-2017-3738 + + + jmbailey + jmbailey + diff --git a/metadata/glsa/glsa-201712-04.xml b/metadata/glsa/glsa-201712-04.xml new file mode 100644 index 000000000000..ba252c674eb0 --- /dev/null +++ b/metadata/glsa/glsa-201712-04.xml @@ -0,0 +1,65 @@ + + + + cURL: Multiple vulnerabilities + Multiple vulnerabilities have been found in cURL, the worst of + which may allow execution of arbitrary code. + + curl + 2017-12-14 + 2017-12-14: 1 + 633430 + 635140 + 638734 + remote + + + 7.57.0 + 7.57.0 + + + +

A command line tool and library for transferring data with URLs.

+ + +

Multiple vulnerabilities have been discovered in cURL. Please review the + CVE identifiers referenced below for details. +

+ + +

Remote attackers could cause a Denial of Service condition, disclose + sensitive information or other unspecified impacts. +

+ + +

There is no known workaround at this time.

+ + +

All cURL users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/curl-7.57.0" + + + + + + CVE-2017-1000254 + + + CVE-2017-1000257 + + + CVE-2017-8816 + + + CVE-2017-8817 + + + CVE-2017-8818 + + + jmbailey + jmbailey + diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk index ff3017bc94cc..edad6f7e0fe4 100644 --- a/metadata/glsa/timestamp.chk +++ b/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Sun, 10 Dec 2017 08:09:30 +0000 +Fri, 15 Dec 2017 16:38:48 +0000 diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit index 7505100ea6ad..632542b5e138 100644 --- a/metadata/glsa/timestamp.commit +++ b/metadata/glsa/timestamp.commit @@ -1 +1 @@ -31cda2f2740c70cb2f5f8b622594f6884aec1c21 1511124610 2017-11-19T20:50:10+00:00 +30b0a682c74fee092dcec1e6356f4afc7fa14625 1513277071 2017-12-14T18:44:31+00:00 -- cgit v1.2.3