From b7b97785ebbb2f11d24d14dab8b81ed274f4ce6a Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Tue, 19 Mar 2019 11:37:34 +0000 Subject: gentoo resync : 19.03.2019 --- metadata/glsa/Manifest | 30 +++++++------- metadata/glsa/Manifest.files.gz | Bin 435197 -> 437590 bytes metadata/glsa/glsa-201903-01.xml | 55 ++++++++++++++++++++++++++ metadata/glsa/glsa-201903-02.xml | 62 +++++++++++++++++++++++++++++ metadata/glsa/glsa-201903-03.xml | 53 +++++++++++++++++++++++++ metadata/glsa/glsa-201903-04.xml | 73 ++++++++++++++++++++++++++++++++++ metadata/glsa/glsa-201903-05.xml | 50 ++++++++++++++++++++++++ metadata/glsa/glsa-201903-06.xml | 66 +++++++++++++++++++++++++++++++ metadata/glsa/glsa-201903-07.xml | 52 +++++++++++++++++++++++++ metadata/glsa/glsa-201903-08.xml | 48 +++++++++++++++++++++++ metadata/glsa/glsa-201903-09.xml | 50 ++++++++++++++++++++++++ metadata/glsa/glsa-201903-10.xml | 59 ++++++++++++++++++++++++++++ metadata/glsa/glsa-201903-11.xml | 49 +++++++++++++++++++++++ metadata/glsa/glsa-201903-12.xml | 61 +++++++++++++++++++++++++++++ metadata/glsa/glsa-201903-13.xml | 52 +++++++++++++++++++++++++ metadata/glsa/glsa-201903-14.xml | 82 +++++++++++++++++++++++++++++++++++++++ metadata/glsa/glsa-201903-15.xml | 50 ++++++++++++++++++++++++ metadata/glsa/timestamp.chk | 2 +- metadata/glsa/timestamp.commit | 2 +- 19 files changed, 879 insertions(+), 17 deletions(-) create mode 100644 metadata/glsa/glsa-201903-01.xml create mode 100644 metadata/glsa/glsa-201903-02.xml create mode 100644 metadata/glsa/glsa-201903-03.xml create mode 100644 metadata/glsa/glsa-201903-04.xml create mode 100644 metadata/glsa/glsa-201903-05.xml create mode 100644 metadata/glsa/glsa-201903-06.xml create mode 100644 metadata/glsa/glsa-201903-07.xml create mode 100644 metadata/glsa/glsa-201903-08.xml create mode 100644 metadata/glsa/glsa-201903-09.xml create mode 100644 metadata/glsa/glsa-201903-10.xml create mode 100644 metadata/glsa/glsa-201903-11.xml create mode 100644 metadata/glsa/glsa-201903-12.xml create mode 100644 metadata/glsa/glsa-201903-13.xml create mode 100644 metadata/glsa/glsa-201903-14.xml create mode 100644 metadata/glsa/glsa-201903-15.xml (limited to 'metadata/glsa') diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest index 8c83558cb00b..549df1977bb3 100644 --- a/metadata/glsa/Manifest +++ b/metadata/glsa/Manifest @@ -1,23 +1,23 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 -MANIFEST Manifest.files.gz 435197 BLAKE2B 5ef1f755677fba588afa252a22622c045d099b3f39fb6b356786170399bb20e8c58212856a5ddc6f59dc6076e3f84a95376a4dc3b4d5154c7d540151a154c88a SHA512 fb541e904c3c6b5ec17c08e76f9ce1dcd0d8f0b31dee092dd3542b9a34a04890e9a1b1e6b0d78d3523fb451deb84b3316ae6b588a29aec6f4741dfb52941ecc9 -TIMESTAMP 2019-03-03T12:38:43Z +MANIFEST Manifest.files.gz 437590 BLAKE2B 89b5299a2ae5909a2f126e7d079e486a46a84b314ae3fd8e955c116ff1469671110300e3034ae816a3f8d7760ff951864b0f6a2ea8e63f69093f03e040aaa3f5 SHA512 af2b9c5421b1ff957533cc161bb0347cbaa2e3e90c9069b5b7e6141ce2a943b1cc971aacd34224e34915a04db19e7b1d06ff5519de5e8c67f4753e7fc7157bf3 +TIMESTAMP 2019-03-19T10:38:40Z -----BEGIN PGP SIGNATURE----- -iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlx7ytNfFIAAAAAALgAo +iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlyQxrBfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY -klCtBBAAgh3tJOs+G5xDpl2QuCYf2giFlkDyaDPs6ThTfp/NddodbmAWHI8FYfbI -NmGHgMVOO399JI++u+C+aHQN9iYgO6wn7I7WTulUi4YrmG7DyfcErqpd7vchKFiX -RZq1U6B51aFEMOMdTjifHwXCY/TAnFWXf9X3LBQTgAwFloiBfp/rDLavCV/aQuV1 -KjQtGvisX91dWSp6JTsj/tdzgf5VLIilBOwa786iXZdJ4O9pgZUUWDdRCF3rqLDi -ThDBtQTa7frrnXWwWhlByLf2CR8XJqqz69OHML7UcBrvnMuIA1AUy/R+fT0/vFZ2 -Yd6MGgnVu2rdbhjZkpzJfbqpVa3BPgL7BBxDppR3Hsp9z0qTPRHO9DG0iwCx1i78 -oaqTdYhj/LnZSma8clsy6iM4AyjztM5+EB41IBCBSo3wQ/EltjZGBmCTI/y8yjvZ -k4yK3OwPmzpZUNanav4orzO1ZJj21c/l62G434F5oi1tPvvBeodeLwOjX5MukjpG -EOnWC1TvnWLn0/2AbVdJoNbvSOj/HJLxLZ7b7JatBt/1AcyTmw+sIc611cLbDuGu -i45ORvI9kn7ZWvfB3W1gS/Uhr7cNBC9MzmeMCZhlBJJbTbqikvb6wUlwVdvot7gw -LRuIowIz8Cs+WLlPx/GNxzFck7hORv+ulpeb43LXR3t2OOQTfkI= -=c5aV +klDrDg//YyE6JU2ZaXcEyszFO1/7+5m21MFqI0yNLvg6NpEYpKPXydaplPlZWePP +KwpwB/UCravezXqOive8GyGbClBKOrXI2PzX7gn+PgyNW5BQQgVgg1JKev4FCcr1 +IwrdKhLI7hi9VnGspot1SSROQfYoCq/Y367bv6t87fZ+0FLq3+Q2wJvSo0tbAWCM +CzxtPT6j9wZll3TFTLHqccw9cOCSJkgJ1U9lhTVfn47ACO4O3AmwZA08vANyJPGA +WBw1k9mdh6OPBXf72NauBPeEFDB9L39HHYifdCRlBhw1e/Go3ptjBcsKjqG5ZJO7 +JcVz4jtLrFpHDRlKQjtxeUZstkUTmnk3hXtKnHH9pCNUnAWWa09gFpz6iRIomEEQ +7f4CKWJI69WtZlfj0U3FdUkO7L2TXdikJWp/rLTyQDsM4JNrBEgUqr1DnReVhijW +A93TJ+0GrFh9717ym8XNsIJPgQlS0p5kMY+41d3e2IE+GRTDz2IOWHfnqmmOaS+/ +7pz9Gs1yjim+GnWgCPPVp3zVE/lUTq4n2w6TQZg6q6Q5AI+8z4OKwu8S5QbgsgVH +56Jh1U7gh7y1z/3TtiFJ4fsi6LX91KtsYc8D7+J1Kq9lHkXUMRLaqnDd5zPgGG8I +4QZ2SeDBsAb2Zu96B4fqWf8PkO9Vw97rWhWRJxux9jXzeeFpH4k= +=Xxnn -----END PGP SIGNATURE----- diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz index b87f67ec613a..01756e23b684 100644 Binary files a/metadata/glsa/Manifest.files.gz and b/metadata/glsa/Manifest.files.gz differ diff --git a/metadata/glsa/glsa-201903-01.xml b/metadata/glsa/glsa-201903-01.xml new file mode 100644 index 000000000000..beacb00e0bc4 --- /dev/null +++ b/metadata/glsa/glsa-201903-01.xml @@ -0,0 +1,55 @@ + + + + Keepalived: Multiple vulnerabilities + Multiple vulnerabilities have been found in Keepalived, the worst + of which could allow an attacker to cause Denial of Service condition. + + keepalived + 2019-03-10 + 2019-03-10 + 670856 + local, remote + + + 2.0.10 + 2.0.10 + + + +

Keepalived is a strong & robust keepalive facility to the Linux + Virtual Server project. +

+ + +

Multiple vulnerabilities have been discovered in keepalived. Please + review the CVE identifiers referenced below for details. +

+ + +

A remote attacker could send a specially crafted request possibly + resulting in a Denial of Service condition. A local attacker could + perform symlink attacks to overwrite arbitrary files with the privileges + of the user running the application. +

+ + +

There is no known workaround at this time.

+ + +

All Keepalived users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-cluster/keepalived-2.0.10" + + + + CVE-2018-19044 + CVE-2018-19045 + CVE-2018-19046 + CVE-2018-19115 + + whissi + pinkbyte + diff --git a/metadata/glsa/glsa-201903-02.xml b/metadata/glsa/glsa-201903-02.xml new file mode 100644 index 000000000000..11ae0246fe90 --- /dev/null +++ b/metadata/glsa/glsa-201903-02.xml @@ -0,0 +1,62 @@ + + + + Zsh: User-assisted execution of arbitrary code + Input validation errors in Zsh could result in arbitrary code + execution. + + zsh + 2019-03-10 + 2019-03-10 + 665278 + local, remote + + + 5.6 + 5.6 + + + +

A shell designed for interactive use, although it is also a powerful + scripting language. +

+ + +

Two input validation errors have been discovered in how Zsh parses + scripts: +

+ +
    +
  • Parsing a malformed shebang line could cause Zsh to call a program + listed in the second line (CVE-2018-0502) +
    • +
  • Shebang lines longer than 64 characters are truncated + (CVE-2018-13259) +
    • +
+ + +

An attacker could entice a user to execute a specially crafted script + using Zsh, possibly resulting in execution of arbitrary code with the + privileges of the process. +

+ + +

There is no known workaround at this time.

+ + +

All Zsh users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-shells/zsh-5.6" + + + + + CVE-2018-0502 + CVE-2018-13259 + + Zlogene + ackle + diff --git a/metadata/glsa/glsa-201903-03.xml b/metadata/glsa/glsa-201903-03.xml new file mode 100644 index 000000000000..eb2941f015e4 --- /dev/null +++ b/metadata/glsa/glsa-201903-03.xml @@ -0,0 +1,53 @@ + + + + cURL: Multiple vulnerabilities + Multiple vulnerabilities have been found in cURL, the worst of + which could result in a Denial of Service condition. + + curl + 2019-03-10 + 2019-03-10 + 665292 + 670026 + 677346 + remote + + + 7.64.0 + 7.64.0 + + + +

A command line tool and library for transferring data with URLs.

+ + +

Multiple vulnerabilities have been discovered in cURL. Please review the + CVE identifiers referenced below for details. +

+ + +

Remote attackers could cause a Denial of Service condition.

+ + +

There is no known workaround at this time.

+ + +

All cURL users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/curl-7.64.0" + + + + CVE-2018-14618 + CVE-2018-16839 + CVE-2018-16840 + CVE-2018-16842 + CVE-2019-3822 + CVE-2019-3823 + + b-man + b-man + diff --git a/metadata/glsa/glsa-201903-04.xml b/metadata/glsa/glsa-201903-04.xml new file mode 100644 index 000000000000..14dee74c7b65 --- /dev/null +++ b/metadata/glsa/glsa-201903-04.xml @@ -0,0 +1,73 @@ + + + + Mozilla Firefox: Multiple vulnerabilities + Multiple vulnerabilities have been found in Mozilla Firefox, the + worst of which may allow execution of arbitrary code. + + firefox + 2019-03-10 + 2019-03-10 + 672956 + 676892 + 677856 + remote + + + 60.5.1 + 60.5.1 + + + 60.5.1 + 60.5.1 + + + +

Mozilla Firefox is a popular open-source web browser from the Mozilla + Project. +

+ + +

Multiple vulnerabilities have been discovered in Mozilla Firefox. Please + review the CVE identifiers referenced below for details. +

+ + +

A remote attacker could entice a user to view a specially crafted web + page possibly resulting in the execution of arbitrary code with the + privileges of the process or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Mozilla FireFox users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-60.5.1" + + +

All Mozilla FireFox bin users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-60.5.1" + + + + CVE-2018-12405 + CVE-2018-18356 + CVE-2018-18492 + CVE-2018-18493 + CVE-2018-18494 + CVE-2018-18498 + CVE-2018-18500 + CVE-2018-18501 + CVE-2018-18505 + CVE-2019-5785 + + whissi + b-man + diff --git a/metadata/glsa/glsa-201903-05.xml b/metadata/glsa/glsa-201903-05.xml new file mode 100644 index 000000000000..106046f3f707 --- /dev/null +++ b/metadata/glsa/glsa-201903-05.xml @@ -0,0 +1,50 @@ + + + + Tar: Denial of Service + A vulnerability in Tar could led to a Denial of Service condition. + tar + 2019-03-10 + 2019-03-10 + 674210 + local + + + 1.30-r1 + 1.30-r1 + + + +

The Tar program provides the ability to create and manipulate tar + archives. +

+ + +

The sparse_dump_region function in sparse.c file in Tar allows an + infinite loop using the --sparse option. +

+ + +

A local attacker could cause a Denial of Service condition by modifying + a file that is supposed to be archived by a different user’s process + (e.g., a system backup running as root). +

+ + +

There is no known workaround at this time.

+ + +

All Tar users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-arch/tar-1.30-r1" + + + + + CVE-2018-20482 + + Zlogene + Zlogene + diff --git a/metadata/glsa/glsa-201903-06.xml b/metadata/glsa/glsa-201903-06.xml new file mode 100644 index 000000000000..456d05712031 --- /dev/null +++ b/metadata/glsa/glsa-201903-06.xml @@ -0,0 +1,66 @@ + + + + rdesktop: Multiple vulnerabilities + Multiple vulnerabilities have been discovered in rdesktop, the + worst of which could result in the remote execution of arbitrary code. + + rdesktop + 2019-03-10 + 2019-03-10 + 674558 + remote + + + 1.8.4 + 1.8.4 + + + +

rdesktop is a Remote Desktop Protocol (RDP) Client.

+ + +

Multiple vulnerabilities have been discovered in rdesktop. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker could cause a Denial of Service condition, obtain + sensitive information, or execute arbitrary code. +

+ + +

There is no known workaround at this time.

+ + +

All rdesktop users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/rdesktop-1.8.4" + + + + CVE-2018-20174 + CVE-2018-20175 + CVE-2018-20176 + CVE-2018-20177 + CVE-2018-20178 + CVE-2018-20179 + CVE-2018-20180 + CVE-2018-20181 + CVE-2018-20182 + CVE-2018-8791 + CVE-2018-8792 + CVE-2018-8793 + CVE-2018-8794 + CVE-2018-8795 + CVE-2018-8796 + CVE-2018-8797 + CVE-2018-8798 + CVE-2018-8799 + CVE-2018-8800 + + b-man + b-man + diff --git a/metadata/glsa/glsa-201903-07.xml b/metadata/glsa/glsa-201903-07.xml new file mode 100644 index 000000000000..5ef41e69dd92 --- /dev/null +++ b/metadata/glsa/glsa-201903-07.xml @@ -0,0 +1,52 @@ + + + + systemd: Multiple vulnerabilities + Multiple vulnerabilities have been found in systemd, the worst of + which may allow execution of arbitrary code. + + systemd + 2019-03-10 + 2019-03-10 + 674144 + 677944 + remote + + + 239-r4 + 239-r4 + + + +

A system and service manager.

+ + +

Multiple vulnerabilities have been discovered in systemd. Please review + the CVE identifiers referenced below for details. +

+ + +

An attacker could cause a Denial of Service condition or possibly + execute arbitrary code. +

+ + +

There is no known workaround at this time.

+ + +

All systemd users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/systemd-239-r4" + + + + CVE-2018-16864 + CVE-2018-16865 + CVE-2018-16866 + CVE-2019-6454 + + b-man + b-man + diff --git a/metadata/glsa/glsa-201903-08.xml b/metadata/glsa/glsa-201903-08.xml new file mode 100644 index 000000000000..3793a2326d8f --- /dev/null +++ b/metadata/glsa/glsa-201903-08.xml @@ -0,0 +1,48 @@ + + + + GNU Wget: Password and metadata leak + A vulnerability in GNU Wget which could allow an attacker to obtain + sensitive information. + + wget + 2019-03-10 + 2019-03-10 + 674170 + local + + + 1.20.1 + 1.20.1 + + + +

GNU Wget is a free software package for retrieving files using HTTP, + HTTPS and FTP, the most widely-used Internet protocols. +

+ + +

A vulnerability was discovered in GNU Wget’s file_metadata in xattr.c.

+ + +

A local attacker could obtain sensitive information to include + credentials. +

+ + +

There is no known workaround at this time.

+ + +

All GNU Wget users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/wget-1.20.1" + + + + CVE-2018-20483 + + BlueKnight + b-man + diff --git a/metadata/glsa/glsa-201903-09.xml b/metadata/glsa/glsa-201903-09.xml new file mode 100644 index 000000000000..036d610ff7a3 --- /dev/null +++ b/metadata/glsa/glsa-201903-09.xml @@ -0,0 +1,50 @@ + + + + GNU C Library: Arbitrary descriptor allocation + A vulnerability in the GNU C Library could result in a Denial of + Service condition. + + glibc + 2019-03-14 + 2019-03-14 + 617938 + remote + + + 2.26.0 + 2.26.0 + + + +

The GNU C library is the standard C library used by Gentoo Linux + systems. +

+ + +

A vulnerability was discovered in the GNU C Library functions xdr_bytes + and xdr_string. +

+ + +

A remote attacker, by sending a crafted UDP packet, could cause a Denial + of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All GNU C Library users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.26.0" + + + + CVE-2018-19591 + + Zlogene + Zlogene + diff --git a/metadata/glsa/glsa-201903-10.xml b/metadata/glsa/glsa-201903-10.xml new file mode 100644 index 000000000000..afb36ae60d5c --- /dev/null +++ b/metadata/glsa/glsa-201903-10.xml @@ -0,0 +1,59 @@ + + + + OpenSSL: Multiple vulnerabilities + Multiple Information Disclosure vulnerabilities in OpenSSL allow + attackers to obtain sensitive information. + + openssl + 2019-03-14 + 2019-03-14 + 673056 + 678564 + local, remote + + + 1.0.2r + 1.0.2r + + + +

OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer + (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general + purpose cryptography library. +

+ + +

Multiple vulnerabilities have been discovered in OpenSSL. Please review + the CVE identifiers referenced below for details. +

+ + +

A remote attacker to obtain sensitive information, caused by the failure + to immediately close the TCP connection after the hosts encounter a + zero-length record with valid padding. +

+ +

A local attacker could run a malicious process next to legitimate + processes using the architecture’s parallel thread running capabilities + to leak encrypted data from the CPU’s internal processes. +

+ + +

There is no known workaround at this time.

+ + +

All OpenSSL users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.2r" + + + + CVE-2018-5407 + CVE-2019-1559 + + whissi + Zlogene + diff --git a/metadata/glsa/glsa-201903-11.xml b/metadata/glsa/glsa-201903-11.xml new file mode 100644 index 000000000000..7eea14bf14fa --- /dev/null +++ b/metadata/glsa/glsa-201903-11.xml @@ -0,0 +1,49 @@ + + + + XRootD: Remote code execution + A vulnerability was discovered in XRootD which could lead to the + remote execution of code. + + xrootd + 2019-03-14 + 2019-03-14 + 638420 + remote + + + 4.8.3 + 4.8.3 + + + +

A project that aims at giving high performance, scalable, and fault + tolerant access to data repositories of many kinds. +

+ + +

A shell command injection was discovered in XRootD.

+ + + +

A remote attacker could execute arbitrary code.

+ + +

There is no known workaround at this time.

+ + +

All XRootD users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/xrootd-4.8.3" + + + + + CVE-2017-1000215 + + + BlueKnight + b-man + diff --git a/metadata/glsa/glsa-201903-12.xml b/metadata/glsa/glsa-201903-12.xml new file mode 100644 index 000000000000..ddbe0d19b08a --- /dev/null +++ b/metadata/glsa/glsa-201903-12.xml @@ -0,0 +1,61 @@ + + + + WebkitGTK+: Multiple vulnerabilities + Multiple vulnerabilities have been found in WebkitGTK+, the worst + of which could result in the arbitrary execution of code. + + webkit-gtk + 2019-03-14 + 2019-03-14 + 672108 + 674702 + 678334 + remote + + + 2.22.6 + 2.22.6 + + + +

WebKitGTK+ is a full-featured port of the WebKit rendering engine, + suitable for projects requiring any kind of web integration, from hybrid + HTML/CSS applications to full-fledged web browsers. +

+ + +

Multiple vulnerabilities have been discovered in WebKitGTK+. Please + review the referenced CVE identifiers for details. +

+ + +

An attacker could execute arbitrary code or conduct cross-site + scripting. +

+ + +

There is no known workaround at this time.

+ + +

All WebkitGTK+ users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.22.6" + + + + CVE-2019-6212 + CVE-2019-6215 + CVE-2019-6216 + CVE-2019-6217 + CVE-2019-6226 + CVE-2019-6227 + CVE-2019-6229 + CVE-2019-6233 + CVE-2019-6234 + + BlueKnight + b-man + diff --git a/metadata/glsa/glsa-201903-13.xml b/metadata/glsa/glsa-201903-13.xml new file mode 100644 index 000000000000..11e3fcfdcde5 --- /dev/null +++ b/metadata/glsa/glsa-201903-13.xml @@ -0,0 +1,52 @@ + + + + BIND: Multiple vulnerabilities + Multiple vulnerabilities have been found in BIND, the worst of + which could result in a Denial of Service condition. + + bind + 2019-03-14 + 2019-03-14 + 657654 + 666946 + remote + + + 9.12.1_p2-r1 + 9.12.1_p2-r1 + + + +

BIND (Berkeley Internet Name Domain) is a Name Server.

+ + +

Multiple vulnerabilities have been discovered in BIND. Please review the + CVE identifiers referenced below for details. +

+ + +

BIND can improperly permit recursive query service to unauthorized + clients possibly resulting in a Denial of Service condition or to be used + in DNS reflection attacks. +

+ + +

There is no known workaround at this time.

+ + +

All bind users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-dns/bind-9.12.1_p2-r1" + + + + CVE-2018-5738 + CVE-2018-5740 + CVE-2018-5741 + + BlueKnight + BlueKnight + diff --git a/metadata/glsa/glsa-201903-14.xml b/metadata/glsa/glsa-201903-14.xml new file mode 100644 index 000000000000..88f56cdca5e3 --- /dev/null +++ b/metadata/glsa/glsa-201903-14.xml @@ -0,0 +1,82 @@ + + + + Oracle JDK/JRE: Multiple vulnerabilities + Multiple vulnerabilities have been found in Oracle’s JDK and JRE + software suites. + + oracle-jdk-bin,oracle-jre-bin + 2019-03-14 + 2019-03-14 + 653560 + 661456 + 676134 + remote + + + 1.8.0.202 + 1.8.0.202 + + + 1.8.0.202 + 1.8.0.202 + + + +

Java Platform, Standard Edition (Java SE) lets you develop and deploy + Java applications on desktops and servers, as well as in today’s + demanding embedded environments. Java offers the rich user interface, + performance, versatility, portability, and security that today’s + applications require. +

+ + +

Multiple vulnerabilities have been discovered in Oracle’s JDK and JRE + software suites. Please review the CVE identifiers referenced below for + details. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, gain access to information, or cause a Denial + of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Oracle JDK bin users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=dev-java/oracle-jdk-bin-1.8.0.202" + + +

All Oracle JRE bin users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=dev-java/oracle-jre-bin-1.8.0.202" + + + + CVE-2018-2790 + CVE-2018-2794 + CVE-2018-2795 + CVE-2018-2796 + CVE-2018-2797 + CVE-2018-2798 + CVE-2018-2799 + CVE-2018-2800 + CVE-2018-2811 + CVE-2018-2814 + CVE-2018-2815 + CVE-2019-2422 + CVE-2019-2426 + + BlueKnight + BlueKnight + diff --git a/metadata/glsa/glsa-201903-15.xml b/metadata/glsa/glsa-201903-15.xml new file mode 100644 index 000000000000..7683138d59b5 --- /dev/null +++ b/metadata/glsa/glsa-201903-15.xml @@ -0,0 +1,50 @@ + + + + NTP: Multiple vulnerabilities + Multiple vulnerabilities have been found in NTP, the worst of which + could result in the remote execution of arbitrary code. + + ntp + 2019-03-19 + 2019-03-19 + 658576 + 679742 + remote + + + 4.2.8_p13 + 4.2.8_p13 + + + +

NTP contains software for the Network Time Protocol.

+ + +

Multiple vulnerabilities have been discovered in NTP. Please review the + CVE identifiers referenced below for details. +

+ + +

An attacker could cause a Denial of Service condition, escalate + privileges, or remotely execute arbitrary code. +

+ + +

There is no known workaround at this time.

+ + +

All NTP users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/ntp-4.2.8_p13" + + + + CVE-2018-12327 + CVE-2019-8936 + + BlueKnight + b-man + diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk index ff7250c080ed..e93b41aac52e 100644 --- a/metadata/glsa/timestamp.chk +++ b/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Sun, 03 Mar 2019 12:38:39 +0000 +Tue, 19 Mar 2019 10:38:37 +0000 diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit index 991ee1687290..98bcf26d91f9 100644 --- a/metadata/glsa/timestamp.commit +++ b/metadata/glsa/timestamp.commit @@ -1 +1 @@ -baa5a86124960e22df1f11ab63da9f282dd4cdd3 1546204642 2018-12-30T21:17:22+00:00 +0a72c299702ffceee8f32f22b9d7b2c33e5140a0 1552965642 2019-03-19T03:20:42+00:00 -- cgit v1.2.3