From ca2977e80c0b29d0e6ce6ff178b6e0043442262b Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Fri, 29 Sep 2023 17:37:53 +0100 Subject: gentoo auto-resync : 29:09:2023 - 17:37:53 --- metadata/glsa/Manifest | 30 +++++++++++++------------- metadata/glsa/Manifest.files.gz | Bin 547709 -> 548500 bytes metadata/glsa/glsa-202309-10.xml | 42 ++++++++++++++++++++++++++++++++++++ metadata/glsa/glsa-202309-11.xml | 43 +++++++++++++++++++++++++++++++++++++ metadata/glsa/glsa-202309-12.xml | 45 +++++++++++++++++++++++++++++++++++++++ metadata/glsa/glsa-202309-13.xml | 42 ++++++++++++++++++++++++++++++++++++ metadata/glsa/glsa-202309-14.xml | 43 +++++++++++++++++++++++++++++++++++++ metadata/glsa/timestamp.chk | 2 +- metadata/glsa/timestamp.commit | 2 +- 9 files changed, 232 insertions(+), 17 deletions(-) create mode 100644 metadata/glsa/glsa-202309-10.xml create mode 100644 metadata/glsa/glsa-202309-11.xml create mode 100644 metadata/glsa/glsa-202309-12.xml create mode 100644 metadata/glsa/glsa-202309-13.xml create mode 100644 metadata/glsa/glsa-202309-14.xml (limited to 'metadata/glsa') diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest index dece5d71dadc..c5e18223a0cf 100644 --- a/metadata/glsa/Manifest +++ b/metadata/glsa/Manifest @@ -1,23 +1,23 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 -MANIFEST Manifest.files.gz 547709 BLAKE2B d36b5eab46802d38f5dc159e9f03149513662c9854aa62da883429961b68edb038ebef040f517863c136ecc51899290cd74c9087529037a37efe40ec65601123 SHA512 76b4b80b9d0d4cbbcdde748628052fa922c089cce8eb0edfc47cfa2875923af79393a7f6b07917b9aa64c2c7d7d6fbdc509c10b177b9df02314011f74f4f5b95 -TIMESTAMP 2023-09-29T10:10:03Z +MANIFEST Manifest.files.gz 548500 BLAKE2B d69c37d2e4e1895a076d1d7359c4b2e9ee1bb29bb132e37c5ebbfec54a414dbebe9f37903f835edd21f36c623a99ace2c24c3147d42057a99fd505bd8a1bc7a6 SHA512 5962e8d7b50c6e11e00b4f0217a7e22066dddd2df564ff9e7effe3a4f06f99abd73934a610fab81ed6e3d4849a4e2fc942054d55562e1f299eb9fce8ded836cf +TIMESTAMP 2023-09-29T16:10:11Z -----BEGIN PGP SIGNATURE----- -iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmUWontfFIAAAAAALgAo +iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmUW9uNfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY -klBOtxAAodmGTvzvmwCcm0LNOQWN8cgyk2rUSf6knyeoReDJlAH8IhHqwFLIeJzN -2zFitFhWQ0Y5jLkQ2rkvt5O9XAPe27HMJIE55x4roa9+iyUSTFZHkQQcIQusU4aP -1Y9D1TPJY18kPJ1+QnsiQYK9xm/CTS4h54e4mKow4rcMQbXtZqmtmrWOfG0rE7sW -HrrpM5fAnFhinnCFUCIEXEYqCrm+F3rfOJIZwWkeFbFisR9OVOy2Xdm56r69S0Qt -e+HBSxBQfKoptS0fNkHuFTQ5nwNGwqQQcGC93Gbl6y1KwYaB7UFWbC13Fg8pS3tI -POdtsVb2LdsIb6UZ1A2LUKXP6CMYlOo2Q2D5IHTPgcqX1/oYGNDUgdNNMc7cwVU1 -rhYX7ybt4Y/Auf6hrolLPB9x4eyVDpg9ZDWyAjRdl1dBEtFvexQ79M+vkBElqZum -RdBPxYCSTi6956OKGLLGJMG3ZMyOXjBBq3JMivF+7O/opFqhnmqJoKjc6p1DULqu -ZZjPNvCkcdMeCd4TPLX5FR3yY2Y6JgvBCj0/kBmxr5IVoTFerOrWWTV5GxOaKMYM -UDhW8RfaeAaaAA0wbp9yznZoPoBxdbtTqgF4clWNAmpNFjYCufn83udgsWkBEXjh -ZeShPJ/nLVRAlb9EJS9in8JPmMgdB++8Jw3x8xSKcYYZVNuLcSY= -=+V0X +klABqBAAo9rvtMiIhmVMNeJLYFWyaM/QDAskYST0zgmyGAoKMlcgv2bpuNIfi/3q +xZeuOYqUgBmtS7yo0rAFNZEjqS3SoKesmwGz0OEMovS3OnODgvk/Yw9NT25datVY +j6tQ5bjBMB6ueZcVtt/mVjYiTa3nx8Ekf4yduI6LKQFKwpIbDD8SszvPL5ECkEZs +d/5HgxBxCblEYamkkofydVwxHHM3DB4miYkOFc1vbNHrRg8EvH/ZcIip0eyh45mV +lFXSkFsn3601PZe4TYxEBdb6XHyfympJ8XLdO9nlFon8Q53HRqvGwJYvMPccBUVn +RBIRRNK9TI9XjR/rC9Q4L/XOO7py2FCun3yQVTU8Wmy4u/C5cGtc/fiF5SN0CQrQ +pLwXR7C9zZRKDJsPmAm6MsUzXxFZxQyK1NHTAdLIeJbdg82SnSJJunvgT1U6NIZN +72JKs8PC92axIC39w4rHCg8u5pszP3sFWxJNERR21U14GvOZLxAJblw5dFvQ7X/K +xkxBwQcGtbvcP5/soSZBGlaPb9tQGR9rxYGOC9OLZmSEUjtGlnBT5wSNk8N2kmHJ +Di34bU4xrJezO4oxOrqp3Iy+G7t44k7CHFKdetjV/iG8H+qGOHypnx4J40QMrBw+ +c8QecGR21Xgna8hbhkF+3gxDpPzkDFNVdq5KC6Or2J9aO8LQyUQ= +=dx9B -----END PGP SIGNATURE----- diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz index b0d4956e2ece..98277cf32d3a 100644 Binary files a/metadata/glsa/Manifest.files.gz and b/metadata/glsa/Manifest.files.gz differ diff --git a/metadata/glsa/glsa-202309-10.xml b/metadata/glsa/glsa-202309-10.xml new file mode 100644 index 000000000000..ab90f225c850 --- /dev/null +++ b/metadata/glsa/glsa-202309-10.xml @@ -0,0 +1,42 @@ + + + + Fish: User-assisted execution of arbitrary code + A vulnerability was discovered in Fish when handling git repository configuration that may lead to execution of arbitrary code + fish + 2023-09-29 + 2023-09-29 + 835337 + local + + + 3.4.0 + 3.4.0 + + + +

Smart and user-friendly command line shell for macOS, Linux, and the rest of the family. It includes features like syntax highlighting, autosuggest-as-you-type, and fancy tab completions that just work, with no configuration required.

+ + +

A vulnerability have been discovered in Fish. Please review the CVE identifiers referenced below for details.

+ + +

A user may be enticed to cd into a git repository under control by an attacker (e.g. on a shared filesystem or by unpacking an archive) and execute arbitrary commands.

+ + +

There is no known workaround at this time.

+ + +

All fish users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-shells/fish-3.4.0" + + + + CVE-2022-20001 + + graaff + graaff + \ No newline at end of file diff --git a/metadata/glsa/glsa-202309-11.xml b/metadata/glsa/glsa-202309-11.xml new file mode 100644 index 000000000000..91f9f39a8d3f --- /dev/null +++ b/metadata/glsa/glsa-202309-11.xml @@ -0,0 +1,43 @@ + + + + libsndfile: Multiple Vulnerabilities + Multiple vulnerabilities have been found in libsndfile, the worst of which could result in arbitrary code execution. + libsndfile + 2023-09-29 + 2023-09-29 + 803065 + remote + + + 1.1.0 + 1.1.0 + + + +

libsndfile is a C library for reading and writing files containing sampled sound.

+ + +

Multiple vulnerabilities have been discovered in libsndfile. Please review the CVE identifiers referenced below for details.

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All libsndfile users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/libsndfile-1.1.0" + + + + CVE-2021-3246 + CVE-2021-4156 + + ajak + graaff + \ No newline at end of file diff --git a/metadata/glsa/glsa-202309-12.xml b/metadata/glsa/glsa-202309-12.xml new file mode 100644 index 000000000000..95404c8496d5 --- /dev/null +++ b/metadata/glsa/glsa-202309-12.xml @@ -0,0 +1,45 @@ + + + + sudo: Multiple Vulnerabilities + Multiple vulnerabilities have been found in sudo, the worst of which can result in root privilege escalation. + sudo + 2023-09-29 + 2023-09-29 + 898510 + 905322 + remote + + + 1.9.13_p2 + 1.9.13_p2 + + + +

sudo allows a system administrator to give users the ability to run commands as other users.

+ + +

Multiple vulnerabilities have been discovered in sudo. Please review the CVE identifiers referenced below for details.

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All sudo users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-admin/sudo-1.9.13_p2" + + + + CVE-2023-27320 + CVE-2023-28486 + CVE-2023-28487 + + ajak + graaff + \ No newline at end of file diff --git a/metadata/glsa/glsa-202309-13.xml b/metadata/glsa/glsa-202309-13.xml new file mode 100644 index 000000000000..c9a01015913d --- /dev/null +++ b/metadata/glsa/glsa-202309-13.xml @@ -0,0 +1,42 @@ + + + + GMP: Buffer Overflow Vulnerability + A buffer overflow vulnerability has been found in GMP which could result in denial of service. + gmp + 2023-09-29 + 2023-09-29 + 823804 + remote + + + 6.2.1-r2 + 6.2.1-r2 + + + +

The GNU Multiple Precision Arithmetic Library is a library forarbitrary-precision arithmetic on different types of numbers.

+ + +

There is an integer overflow leading to a buffer overflow when processing untrusted input via GMP's mpz_inp_raw function.

+ + +

Untrusted input can cause a denial of service via segmentation fault.

+ + +

Users can ensure no untrusted input is passed into GMP's mpz_inp_raw function.

+ + +

All GMP users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/gmp-6.2.1-r2" + + + + CVE-2021-43618 + + ajak + graaff + \ No newline at end of file diff --git a/metadata/glsa/glsa-202309-14.xml b/metadata/glsa/glsa-202309-14.xml new file mode 100644 index 000000000000..c9c519077013 --- /dev/null +++ b/metadata/glsa/glsa-202309-14.xml @@ -0,0 +1,43 @@ + + + + libarchive: Multiple Vulnerabilities + Multiple vulnerabilities have been found in libarchive, the worst of which could result in denial of service. + libarchive + 2023-09-29 + 2023-09-29 + 882521 + 911486 + remote + + + 3.7.1 + 3.7.1 + + + +

libarchive is a library for manipulating different streaming archive formats, including certain tar variants, several cpio formats, and both BSD and GNU ar variants.

+ + +

Multiple vulnerabilities have been discovered in libarchive. Please review the CVE identifiers referenced below for details.

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All libarchive users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-arch/libarchive-3.7.1" + + + + CVE-2022-36227 + + ajak + graaff + \ No newline at end of file diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk index b30c199fa4e1..564b12c6c439 100644 --- a/metadata/glsa/timestamp.chk +++ b/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Fri, 29 Sep 2023 10:10:00 +0000 +Fri, 29 Sep 2023 16:10:06 +0000 diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit index 69c6e9226e17..dd18748ab966 100644 --- a/metadata/glsa/timestamp.commit +++ b/metadata/glsa/timestamp.commit @@ -1 +1 @@ -1879b11c680b5a942bb283d62aff5b3aa0b78304 1695976656 2023-09-29T08:37:36+00:00 +e05346e205e470b799ae6c0dafb506d6aa1cdae8 1695994770 2023-09-29T13:39:30+00:00 -- cgit v1.2.3