From 796cae72cf9ed18ba01256ac1f83a686a2a76036 Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Mon, 20 Nov 2017 18:45:28 +0000 Subject: gentoo resync : 20.11.2017 --- metadata/glsa/glsa-201711-13.xml | 70 ++++++++++++++++++++++++++++++ metadata/glsa/glsa-201711-14.xml | 93 ++++++++++++++++++++++++++++++++++++++++ metadata/glsa/glsa-201711-15.xml | 63 +++++++++++++++++++++++++++ metadata/glsa/glsa-201711-16.xml | 55 ++++++++++++++++++++++++ metadata/glsa/timestamp.chk | 2 +- metadata/glsa/timestamp.commit | 2 +- 6 files changed, 283 insertions(+), 2 deletions(-) create mode 100644 metadata/glsa/glsa-201711-13.xml create mode 100644 metadata/glsa/glsa-201711-14.xml create mode 100644 metadata/glsa/glsa-201711-15.xml create mode 100644 metadata/glsa/glsa-201711-16.xml (limited to 'metadata/glsa') diff --git a/metadata/glsa/glsa-201711-13.xml b/metadata/glsa/glsa-201711-13.xml new file mode 100644 index 000000000000..a1d554d6d45a --- /dev/null +++ b/metadata/glsa/glsa-201711-13.xml @@ -0,0 +1,70 @@ + + + + Adobe Flash Player: Multiple vulnerabilities + Multiple vulnerabilities have been found in Adobe Flash Player, the + worst of which allows remote attackers to execute arbitrary code. + + adobe-flash + 2017-11-19 + 2017-11-19: 1 + 637630 + remote + + + 27.0.0.187 + 27.0.0.187 + + + +

The Adobe Flash Player is a renderer for the SWF file format, which is + commonly used to provide interactive websites. +

+ + + +

Multiple vulnerabilities have been discovered in Adobe Flash Player. + Please review the referenced CVE identifiers and Adobe Security Bulletin + for details. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process. +

+ + +

There is no known workaround at this time.

+ + +

All Adobe Flash Player users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=www-plugins/adobe-flash-27.0.0.187" + + + + + Adobe Security Bulletin + + + CVE-2017-11213 + + + CVE-2017-11215 + + + CVE-2017-11225 + + + CVE-2017-3112 + + + CVE-2017-3114 + + + chrisadr + chrisadr + diff --git a/metadata/glsa/glsa-201711-14.xml b/metadata/glsa/glsa-201711-14.xml new file mode 100644 index 000000000000..f84b84306c48 --- /dev/null +++ b/metadata/glsa/glsa-201711-14.xml @@ -0,0 +1,93 @@ + + + + IcedTea: Multiple vulnerabilities + Multiple vulnerabilities have been found in IcedTea, the worst of + which may allow execution of arbitrary code. + + icedtea + 2017-11-19 + 2017-11-19: 1 + 636522 + remote + + + 3.6.0 + 3.6.0 + + + +

IcedTea’s aim is to provide OpenJDK in a form suitable for easy + configuration, compilation and distribution with the primary goal of + allowing inclusion in GNU/Linux distributions. +

+ + +

Multiple vulnerabilities have been discovered in IcedTea. Please review + the referenced CVE identifiers for details. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, cause a Denial of Service condition, or gain + access to information. +

+ + +

There is no known workaround at this time.

+ + +

All IcedTea binary users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-java/icedtea-bin-3.6.0" + + + + + CVE-2017-10274 + + + CVE-2017-10281 + + + CVE-2017-10285 + + + CVE-2017-10295 + + + CVE-2017-10345 + + + CVE-2017-10346 + + + CVE-2017-10347 + + + CVE-2017-10348 + + + CVE-2017-10349 + + + CVE-2017-10350 + + + CVE-2017-10355 + + + CVE-2017-10356 + + + CVE-2017-10357 + + + CVE-2017-10388 + + + chrisadr + chrisadr + diff --git a/metadata/glsa/glsa-201711-15.xml b/metadata/glsa/glsa-201711-15.xml new file mode 100644 index 000000000000..eb77bec4c008 --- /dev/null +++ b/metadata/glsa/glsa-201711-15.xml @@ -0,0 +1,63 @@ + + + + PHPUnit: Remote code execution + A vulnerability was discovered in PHPUnit which may allow an + unauthenticated remote attacker to execute arbitrary PHP code. + + PHPUnit + 2017-11-19 + 2017-11-19: 1 + 635356 + remote + + + 5.7.15-r1 + 5.7.15-r1 + + + +

PHPUnit is a programmer-oriented testing framework for PHP. It is an + instance of the xUnit architecture for unit testing frameworks. +

+ + +

When PHPUnit is installed in a production environment via composer and + these modules are in a web accessible directory, the eval-stdin.php file + in PHPUnit contains vulnerable statements that trigger the vulnerability. +

+ + +

A remote attacker could possibly execute arbitrary PHP code or cause a + Denial of Service condition. +

+ + +

There are several ways to fix or mitigate this vulnerability:

+ +

Remove PHPUnit from the production environment.

+ +

Update PHPUnit.

+ +

Manually apply the patch.

+ +

Disable direct access to the composer packages by placing .htaccess file + to /vendor folder. +

+ + +

All PHPUnit users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-php/phpunit-5.7.15-r1" + + + + + CVE-2017-9841 + + + jmbailey + jmbailey + diff --git a/metadata/glsa/glsa-201711-16.xml b/metadata/glsa/glsa-201711-16.xml new file mode 100644 index 000000000000..69401136336a --- /dev/null +++ b/metadata/glsa/glsa-201711-16.xml @@ -0,0 +1,55 @@ + + + + CouchDB: Multiple vulnerabilities + Multiple vulnerabilities have been found in CouchDB, the worst of + which could lead to the remote execution of arbitrary shell commands. + + couchdb + 2017-11-19 + 2017-11-19: 1 + 637516 + remote + + + 1.7.1 + 1.7.1 + + + +

Apache CouchDB is a distributed, fault-tolerant and schema-free + document-oriented database. +

+ + +

Multiple vulnerabilities have been discovered in CouchDB. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could execute arbitrary shell commands or escalate + privileges. +

+ + +

There is no known workaround at this time.

+ + +

All CouchDB users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/couchdb-1.7.1" + + + + + CVE-2017-12635 + + + CVE-2017-12636 + + + jmbailey + jmbailey + diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk index e90d5fd80d3a..71e50cf595ca 100644 --- a/metadata/glsa/timestamp.chk +++ b/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Sun, 19 Nov 2017 09:39:33 +0000 +Mon, 20 Nov 2017 17:39:39 +0000 diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit index b1a5dd2500e1..7505100ea6ad 100644 --- a/metadata/glsa/timestamp.commit +++ b/metadata/glsa/timestamp.commit @@ -1 +1 @@ -5734ba55387c6cf49565c6c096a4be4ee2b65de5 1510540061 2017-11-13T02:27:41+00:00 +31cda2f2740c70cb2f5f8b622594f6884aec1c21 1511124610 2017-11-19T20:50:10+00:00 -- cgit v1.2.3