From bd4aeefe33e63f613512604e47bfca7b2187697d Mon Sep 17 00:00:00 2001
From: V3n3RiX <venerix@redcorelinux.org>
Date: Sun, 3 Nov 2019 16:06:58 +0000
Subject: gentoo resync : 03.11.2019

---
 metadata/glsa/Manifest           |  30 ++++++++--------
 metadata/glsa/Manifest.files.gz  | Bin 448845 -> 449006 bytes
 metadata/glsa/glsa-201910-01.xml |  72 +++++++++++++++++++++++++++++++++++++++
 metadata/glsa/timestamp.chk      |   2 +-
 metadata/glsa/timestamp.commit   |   2 +-
 5 files changed, 89 insertions(+), 17 deletions(-)
 create mode 100644 metadata/glsa/glsa-201910-01.xml

(limited to 'metadata/glsa')

diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest
index fb2dbba86227..78865332cded 100644
--- a/metadata/glsa/Manifest
+++ b/metadata/glsa/Manifest
@@ -1,23 +1,23 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA512
 
-MANIFEST Manifest.files.gz 448845 BLAKE2B 24feded351e2c02762000f35c6c58ac935b2383bf6acdd7450f974e16e15fe0935d3f657233d5cd4ab87639ad5f410b8ea36fd5c019b93bfbfc47983ef01dbdc SHA512 569d13495f7e4953afefd29435d7953d3afa1815ae86459c1f4f84726efaaedc5598835f415738d792d2d1060be50cf8ad9140b7fcf124dd7f9ea681a55957ab
-TIMESTAMP 2019-10-13T20:38:57Z
+MANIFEST Manifest.files.gz 449006 BLAKE2B ab32207f84ac7631fd8d236fe1aa63e88587b06e44eb1809cd72818ffb95ebb8390c250d5ab1ac5b1ac80968c4cef20897786383d93e0f140f7f1be52e7cb314 SHA512 d97241a68516a4c88a2d1afe7dac7dc36b0124cf3186aca88c595b3e66875bc4c66530c9b1c5221bf584a799c385182af538ea678c6f87418d9749030c73d619
+TIMESTAMP 2019-11-03T15:08:53Z
 -----BEGIN PGP SIGNATURE-----
 
-iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAl2ji2FfFIAAAAAALgAo
+iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAl2+7YVfFIAAAAAALgAo
 aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
 RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
-klCxTw//cB1DOqxzrCdkBOpaT53PhrXYDKu36Nj/AjvQm4kHB4dQjvbqtLdXC2aa
-pvlyZbEa2le54+b/95TMBPugHN0SzQ/NpbVBWo2tSE9ILnCggUU58hxrlERQ4vnO
-FfZHrrNx8M4MDhEkF9Hpe8GqhqFLRhi5RM0czQ+x5xoMb+CKZo46oOt40skukZy0
-JftY5klDkwT+oG4plt1xSAE1ZHuOewDRjB3ak0wfFQtvEC9d/EsBHog0QJvt1huU
-rL8MheUv6GJRyybWofq7I9V7QVoZqf/8PIBhablFAbquEoWOc9kfXQ89EB+tPdax
-89h4x+fgMibxplwBqzCWv3+B6Yk9NnT/xY6YdcN+9b0dfKBZV8mR1Df37Q8hoAn7
-j8MJawd7jdhGmvuVB2jhyb9daxk7WodpLQcygNuuF5kTBq7XGXq3Xiyy+Gj6pa3O
-SCriF+O/n88bAVFqmaW0ILLD3YP37WTffI0RdVwyz6t5Kt3I+NXooOIhaeb5EwWB
-iBMR93QsBxNv8n2e9yKC7qUJrcHDrMFcq87D7KoYBbcs8YTe4X80H1RtQL7dtCcy
-2YXu3yd74BJ2bdcvnjrBYarrASvOqxUxqTi/tvE5IieAK8N/gfJ+fXwDlnVoqDx3
-Yyt1IsHx5i/Z5Kg6L7y8IxRh+KBaQZFEXY95GP1YUxklA50jJto=
-=PZ9t
+klA/hQ//Q90V3h1hPpFXA3KueeVXekIVjVAOoiEaYpjsn0KP8JVZGAsMjyF2KOfV
+Q2zX1Pfb2KSPI/RR1z92BMd+CBtLcQvx6I0vhk0ZCGk/6cyr95q4a4ekeA+V3xOU
+HqYK4ary3q5RD2ns79nCpMtOYH6k4g6W9DGX0RRdMKW44c110o3XjDHgtQcc4SKx
+83Y/oAk8nmQ3J1TiBIuF2Rz5dOQPgqxI3ojcIteIHYnC4vRZX7HKCN9dGd3JFzv8
+jDxHWeTv5gCEfz2qSsU6oMA3cEfhOQv/8wPut9BtkOIQxgVcDp/ofIVRH6ijul9n
+UNgtF/+4ERwsADw+VABy+B1AlU+ivz4xclnjeaYEWivt2kc+17KFgTR5eM7rooj9
+6xmm6OzI/ZSiblWfo7lquiqUQErZpjLxJOFck8JJnXmHpYdQfkrAm2+d1/Us/Dl7
+XcQpC/dSz8rDnRgjhBVjn8q6tJs1o/4nI4EvX4au5KLOYZueRE5wTNuSGRHrS/sM
+481wDpIecIRa/lIocojNSfxVL8wNSp17KcjMfiev2yDj9/cb6N5d9Ae/QzGLiXPc
+fM6/FyEbkUq7Lk4kOIiD5+5COdCQ32uyUaqP1zu5NPI9XzDaQte8TyB6OeUu59UX
+yjHGtaYKKqs4SiIlbbRKkHUDUis7+Xh8AyQgFYaTh4ZlpNWJ2a0=
+=VLza
 -----END PGP SIGNATURE-----
diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz
index e80a943da59d..676b6a27efd7 100644
Binary files a/metadata/glsa/Manifest.files.gz and b/metadata/glsa/Manifest.files.gz differ
diff --git a/metadata/glsa/glsa-201910-01.xml b/metadata/glsa/glsa-201910-01.xml
new file mode 100644
index 000000000000..9210bb5e03dd
--- /dev/null
+++ b/metadata/glsa/glsa-201910-01.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201910-01">
+  <title>PHP: Arbitrary code execution</title>
+  <synopsis>A vulnerability in PHP might allow an attacker to execute arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">php</product>
+  <announced>2019-10-25</announced>
+  <revised count="1">2019-10-25</revised>
+  <bug>698452</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/php" auto="yes" arch="*">
+      <unaffected range="ge">7.1.33</unaffected>
+      <unaffected range="ge">7.2.24</unaffected>
+      <unaffected range="ge">7.3.11</unaffected>
+      <vulnerable range="lt">7.1.33</vulnerable>
+      <vulnerable range="lt">7.2.24</vulnerable>
+      <vulnerable range="lt">7.3.11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>PHP is an open source general-purpose scripting language that is
+      especially suited for web development.
+    </p>
+  </background>
+  <description>
+    <p>A underflow in env_path_info in PHP-FPM under certain configurations can
+      be exploited to gain remote code execution.
+    </p>
+  </description>
+  <impact type="high">
+    <p>A remote attacker, by sending special crafted HTTP requests, could
+      possibly execute arbitrary code with the privileges of the process, or
+      cause a Denial of Service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>If patching is not feasible, the suggested workaround is to include
+      checks to verify whether or not a file exists before passing to PHP.
+    </p>
+  </workaround>
+  <resolution>
+    <p>All PHP 7.1 users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=dev-lang/php-7.1.33"
+    </code>
+    
+    <p>All PHP 7.2 users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=dev-lang/php-7.2.24"
+    </code>
+    
+    <p>All PHP 7.3 users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=dev-lang/php-7.3.11"
+    </code>
+    
+  </resolution>
+  <references>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-11043">CVE-2019-11043</uri>
+  </references>
+  <metadata tag="requester" timestamp="2019-10-24T23:39:18Z">whissi</metadata>
+  <metadata tag="submitter" timestamp="2019-10-25T11:01:56Z">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk
index df15733aa00e..0228db373743 100644
--- a/metadata/glsa/timestamp.chk
+++ b/metadata/glsa/timestamp.chk
@@ -1 +1 @@
-Sun, 13 Oct 2019 20:38:54 +0000
+Sun, 03 Nov 2019 15:08:50 +0000
diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit
index 933a7041a478..c9b577a39721 100644
--- a/metadata/glsa/timestamp.commit
+++ b/metadata/glsa/timestamp.commit
@@ -1 +1 @@
-0d8b041795d355b2f8da9b84725a62150a91dc13 1567964538 2019-09-08T17:42:18+00:00
+4c2e30a50e776e9ec1833c4419ce239e6d9cc178 1572001702 2019-10-25T11:08:22+00:00
-- 
cgit v1.2.3