From a87d0d6b8bfa400637c56d3194b22fca5cbd6f9e Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Thu, 4 Aug 2022 20:05:57 +0100 Subject: gentoo auto-resync : 04:08:2022 - 20:05:57 --- metadata/glsa/Manifest | 30 ++++++------ metadata/glsa/Manifest.files.gz | Bin 518764 -> 519553 bytes metadata/glsa/glsa-202208-01.xml | 42 ++++++++++++++++ metadata/glsa/glsa-202208-02.xml | 101 +++++++++++++++++++++++++++++++++++++++ metadata/glsa/glsa-202208-03.xml | 42 ++++++++++++++++ metadata/glsa/glsa-202208-04.xml | 42 ++++++++++++++++ metadata/glsa/glsa-202208-05.xml | 46 ++++++++++++++++++ metadata/glsa/timestamp.chk | 2 +- metadata/glsa/timestamp.commit | 2 +- 9 files changed, 290 insertions(+), 17 deletions(-) create mode 100644 metadata/glsa/glsa-202208-01.xml create mode 100644 metadata/glsa/glsa-202208-02.xml create mode 100644 metadata/glsa/glsa-202208-03.xml create mode 100644 metadata/glsa/glsa-202208-04.xml create mode 100644 metadata/glsa/glsa-202208-05.xml (limited to 'metadata/glsa') diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest index fafc6b894c8f..3b8852c82805 100644 --- a/metadata/glsa/Manifest +++ b/metadata/glsa/Manifest @@ -1,23 +1,23 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 -MANIFEST Manifest.files.gz 518764 BLAKE2B 800d8c605261a8d2ca31eca4bde7d3bb3f684de4f3181019daf03f289f18680c6d96f494d58f96fe4ad07cdd9e1d88375337c122e7b8e08a991332389d887299 SHA512 aedc41e29d7be49299b1cb0ff40f391a2deff64b9b55c25130ff0d38269f249b737b1d372d346ecfc163d0044fae33a0e164e57a26c205b60f17269607a8117b -TIMESTAMP 2022-08-04T12:09:55Z +MANIFEST Manifest.files.gz 519553 BLAKE2B 95b916bb9f20b609241e18817604d9aedbd9b94266162c0ae72c4075b346239f9bd4fbc73135a0dac0faa2a62330ae77a5fadd98fff5b4147580808a7c200ffe SHA512 4eb7457d78ec74e73c36af46d3c675bcb9bc9cf33d2f1fde05df8e517560b480fc8f920df111c03877fd301aeb0d0d260bbfc22b80cd0d7497e107fd5ded7e3c +TIMESTAMP 2022-08-04T18:09:48Z -----BEGIN PGP SIGNATURE----- -iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmLrtxNfFIAAAAAALgAo +iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmLsC2xfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY -klCaEw/+KIdI9/zP7WSa4yasw8sfLEybpWWo2hiS0SoASnhIWZ2TBG5XkBkWV8JE -ab+rtBcJPXXq28NUBso6Vy7nSwtPuvJxl7zRfb9XXboDj4pCpAlo82yVXd+oL0lI -kHPmdHMLJPipcOkvS8iBOKDckrOBC+/FyJ4IhK5Qm+YCZEs5/Aiu4JL0CDpna6AG -amQm/f3XlQBDUS6+JCBtbHLG5f23XNW6VmON08vTjj9apxedqG2vy3tnVyBqLguv -7KRKTS9gSaU+kzpp0Gg5n+uVdQR9J/BnHE6W2JBC7bp8LT0LOKWsBvwp6HjzvolB -ST98s9XVe92MbU3QpiDaQEwQ2CmeeO+L1YtxUrRhCQiG9ySXNbNLI5eIMhxDGFTn -2izhdIAwxhEKW3NWyzajRwDlKQJ6a/b8GlRRu0CEdzpzrqG6dr2qIH/WHFSprYVI -9RPvI5CUeBkuSfbZzOqgfG1wEqeCuQylL/RJvRYFr/aCUgBE8zywinX7fpTc3e6Q -o4Ick/nqaK9MEZ5gPlRnU7rnFuSOoEME5Dkl+dIm2ZB/N3ujaJA04mevjPovkD9/ -vADAv2hylVTdy3pkNIJVj46HYfeCSeYiK9RpPvLim+/eYP9QJzaNQ+x4106klOgI -JtJH/2DmLlSWBph+Su1h3MFAMR5eCMTEoAWuySCoUhiHpi6TlS8= -=ZxjK +klCKbQ//bntJ95joz38QqRnmXbL+NwnSI+uSHeUInVQFp1b2JpPzbXp0tM7vCnqI +MGLfrFhwYU2Vk/EolMxNBq9qB9SCg904ymbeBu3z1OED97YtzrZONkl1ISuxICjY +SZitZI7lUMifAGzAaDNTBu4ZxVcXIujonjq/jTdCrut9LCkHJwuHZVdnIfutzvnp +15iLlHa+aq1tO2OMPkyKDCHbXF5qSu/4LsGl3TA7oJEVu3Iuv7VjNdArcV4CYHc+ +q3kzxu8B1mGv4bAhK2v9cVXqn+IdszHqxBKp7AqM6kqOWjft+0zR60slWhEWyknK +/4CFRfhhCVeWzvhzcYc+dHo3WAy5qAPh7Jmq/gElo6Tmf6LcHjqEU2fXGpF5f6Bv +ncinwnEubMFUrtoNtWpeukY8rlkwBFj0AatbIlsqHNoUEZbOyJsxwRGie6Co4dry +g8WUOr8s4ldHIX/E+hRmbGYUr/VXh9v4sFBtGa3WIDfO/bKkVItlXs924vlaQXTx +cMglcCB7d7NCLm36K6PobfpYjknHSXD/Lh0TIk2i1Yxow3yVOPyjD+bV5qcznwI8 +WJFOMGDmwp03zUqH8+uBz4AgrZ3AcuBMHlAF5q9IDfi+kFSs8a3gbZcWNR5CqJAS +EMet+c3iNt5X69ARcpSTTZxivYEtERuyfKJiJqDDpTn/Kr0ZcK8= +=TLF9 -----END PGP SIGNATURE----- diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz index 1f73abc83f0a..5b6ba51e4671 100644 Binary files a/metadata/glsa/Manifest.files.gz and b/metadata/glsa/Manifest.files.gz differ diff --git a/metadata/glsa/glsa-202208-01.xml b/metadata/glsa/glsa-202208-01.xml new file mode 100644 index 000000000000..ed2d5810df34 --- /dev/null +++ b/metadata/glsa/glsa-202208-01.xml @@ -0,0 +1,42 @@ + + + + 3MF Consortium lib3mf: Remote code execution + A vulnerability in lib3mf could lead to remote code execution. + lib3mf + 2022-08-04 + 2022-08-04 + 775362 + remote + + + 2.1.1 + 2.1.1 + + + +

lib3mf is an implementation of the 3D Manufacturing Format file standard.

+
+ +

Incorrect memory handling within lib3mf could result in a use-after-free.

+
+ +

An attacker that can provide malicious input to an application using 3MF Consortium's lib3mf could achieve remote code execution.

+
+ +

There is no known workaround at this time.

+
+ +

All 3MF Consortium lib3mf users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/lib3mf-2.1.1" + +
+ + CVE-2021-21772 + + ajak + ajak +
\ No newline at end of file diff --git a/metadata/glsa/glsa-202208-02.xml b/metadata/glsa/glsa-202208-02.xml new file mode 100644 index 000000000000..f8dd813ed94a --- /dev/null +++ b/metadata/glsa/glsa-202208-02.xml @@ -0,0 +1,101 @@ + + + + Go: Multiple Vulnerabilities + Multiple vulnerabilities have been found in Go, the worst of which could result in remote code execution. + go + 2022-08-04 + 2022-08-04 + 754210 + 766216 + 775326 + 788640 + 794784 + 802054 + 806659 + 807049 + 816912 + 821859 + 828655 + 833156 + 834635 + 838130 + 843644 + 849290 + 857822 + 862822 + remote + + + 1.18.5 + 1.18.5 + + + +

Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.

+
+ +

Multiple vulnerabilities have been discovered in Go. Please review the CVE identifiers referenced below for details.

+
+ +

Please review the referenced CVE identifiers for details.

+
+ +

There is no known workaround at this time.

+
+ +

All Go users shoud upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/go-1.18.5" + + +

In addition, users using Portage 3.0.9 or later should ensure that packages with Go binaries have no vulnerable code statically linked into their binaries by rebuilding the @golang-rebuild set:

+ + + # emerge --ask --oneshot --verbose @golang-rebuild + +
+ + CVE-2020-28366 + CVE-2020-28367 + CVE-2021-27918 + CVE-2021-27919 + CVE-2021-29923 + CVE-2021-3114 + CVE-2021-3115 + CVE-2021-31525 + CVE-2021-33195 + CVE-2021-33196 + CVE-2021-33197 + CVE-2021-33198 + CVE-2021-34558 + CVE-2021-36221 + CVE-2021-38297 + CVE-2021-41771 + CVE-2021-41772 + CVE-2021-44716 + CVE-2021-44717 + CVE-2022-1705 + CVE-2022-23772 + CVE-2022-23773 + CVE-2022-23806 + CVE-2022-24675 + CVE-2022-24921 + CVE-2022-27536 + CVE-2022-28131 + CVE-2022-28327 + CVE-2022-29526 + CVE-2022-30629 + CVE-2022-30630 + CVE-2022-30631 + CVE-2022-30632 + CVE-2022-30633 + CVE-2022-30635 + CVE-2022-32148 + CVE-2022-32189 + + ajak + ajak +
\ No newline at end of file diff --git a/metadata/glsa/glsa-202208-03.xml b/metadata/glsa/glsa-202208-03.xml new file mode 100644 index 000000000000..942101cddcc7 --- /dev/null +++ b/metadata/glsa/glsa-202208-03.xml @@ -0,0 +1,42 @@ + + + + Babel: Remote code execution + A vulnerability in Babel could result in remote code execution. + Babel + 2022-08-04 + 2022-08-04 + 786954 + remote + + + 2.9.1 + 2.9.1 + + + +

Babel is a collection of tools for internationalizing Python applications.

+
+ +

Babel does not properly restrict which sources a locale can be loaded from. If Babel loads an attacker-controlled .dat file, arbitrary code execution can be achieved via unsafe Pickle deserialization.

+
+ +

An attacker with filesystem access and control over the locales Babel loads can achieve code execution.

+
+ +

There is no known workaround at this time.

+
+ +

All Babel users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-python/Babel-2.9.1" + +
+ + CVE-2021-20095 + + ajak + ajak +
\ No newline at end of file diff --git a/metadata/glsa/glsa-202208-04.xml b/metadata/glsa/glsa-202208-04.xml new file mode 100644 index 000000000000..59a03c63d718 --- /dev/null +++ b/metadata/glsa/glsa-202208-04.xml @@ -0,0 +1,42 @@ + + + + libmcpp: Denial of service + Multiple vulnerabilities in libmcpp could result in a denial of service condition. + libmcpp + 2022-08-04 + 2022-08-04 + 718808 + remote + + + 2.7.2_p5 + 2.7.2_p5 + + + +

libmcpp is a portable C/C++ preprocessor.

+
+ +

A buffer overflow and an out-of-bounds read vulnerability have been discovered in libmcpp, which could be exploited for denial of service.

+
+ +

An attacker that can provide crafted input to libmcpp could achieve denial of service.

+
+ +

There is no known workaround at this time.

+
+ +

All libmcpp users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-cpp/libmcpp-2.7.2_p5" + +
+ + CVE-2019-14274 + + ajak + ajak +
\ No newline at end of file diff --git a/metadata/glsa/glsa-202208-05.xml b/metadata/glsa/glsa-202208-05.xml new file mode 100644 index 000000000000..088ef70191b0 --- /dev/null +++ b/metadata/glsa/glsa-202208-05.xml @@ -0,0 +1,46 @@ + + + + Icinga Web 2: Multiple Vulnerabilities + Multiple vulnerabilities have been found in Icinga Web 2, the worst of which could result in remote code execution. + icingaweb2 + 2022-08-04 + 2022-08-04 + 738024 + 834802 + remote + + + 2.9.6 + 2.9.6 + + + +

Icinga Web 2 is a frontend for icinga2.

+
+ +

Multiple vulnerabilities have been discovered in Icinga Web 2. Please review the CVE identifiers referenced below for details.

+
+ +

Please review the referenced CVE identifiers for details.

+
+ +

There is no known workaround at this time.

+
+ +

All Icinga Web 2 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-apps/icingaweb2-2.9.6" + +
+ + CVE-2020-24368 + CVE-2022-24714 + CVE-2022-24715 + CVE-2022-24716 + + ajak + ajak +
\ No newline at end of file diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk index 8faa17d133fc..73af047d975d 100644 --- a/metadata/glsa/timestamp.chk +++ b/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Thu, 04 Aug 2022 12:09:52 +0000 +Thu, 04 Aug 2022 18:09:45 +0000 diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit index 349124ae11e5..3c24c45fc243 100644 --- a/metadata/glsa/timestamp.commit +++ b/metadata/glsa/timestamp.commit @@ -1 +1 @@ -254c716d0dd35a6846f281fd4a3eaf970dc0bede 1659377108 2022-08-01T18:05:08+00:00 +911ba97fd465c36414fa2eb8a1fea31d4152990a 1659621622 2022-08-04T14:00:22+00:00 -- cgit v1.2.3