From d7ed2b01311f15ba54fe8ea872aab7d59ab2b193 Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Fri, 29 Jan 2021 18:03:51 +0000 Subject: gentoo resync : 29.01.2021 --- metadata/glsa/Manifest | 30 ++++---- metadata/glsa/Manifest.files.gz | Bin 496888 -> 500220 bytes metadata/glsa/glsa-202101-18.xml | 90 +++++++++++++++++++++++ metadata/glsa/glsa-202101-19.xml | 86 ++++++++++++++++++++++ metadata/glsa/glsa-202101-20.xml | 53 ++++++++++++++ metadata/glsa/glsa-202101-21.xml | 54 ++++++++++++++ metadata/glsa/glsa-202101-22.xml | 42 +++++++++++ metadata/glsa/glsa-202101-23.xml | 49 +++++++++++++ metadata/glsa/glsa-202101-24.xml | 49 +++++++++++++ metadata/glsa/glsa-202101-25.xml | 44 ++++++++++++ metadata/glsa/glsa-202101-26.xml | 50 +++++++++++++ metadata/glsa/glsa-202101-27.xml | 45 ++++++++++++ metadata/glsa/glsa-202101-28.xml | 47 ++++++++++++ metadata/glsa/glsa-202101-29.xml | 65 +++++++++++++++++ metadata/glsa/glsa-202101-30.xml | 151 +++++++++++++++++++++++++++++++++++++++ metadata/glsa/glsa-202101-31.xml | 46 ++++++++++++ metadata/glsa/glsa-202101-32.xml | 62 ++++++++++++++++ metadata/glsa/glsa-202101-33.xml | 61 ++++++++++++++++ metadata/glsa/glsa-202101-34.xml | 48 +++++++++++++ metadata/glsa/glsa-202101-35.xml | 47 ++++++++++++ metadata/glsa/glsa-202101-36.xml | 60 ++++++++++++++++ metadata/glsa/glsa-202101-37.xml | 47 ++++++++++++ metadata/glsa/glsa-202101-38.xml | 49 +++++++++++++ metadata/glsa/timestamp.chk | 2 +- metadata/glsa/timestamp.commit | 2 +- 25 files changed, 1262 insertions(+), 17 deletions(-) create mode 100644 metadata/glsa/glsa-202101-18.xml create mode 100644 metadata/glsa/glsa-202101-19.xml create mode 100644 metadata/glsa/glsa-202101-20.xml create mode 100644 metadata/glsa/glsa-202101-21.xml create mode 100644 metadata/glsa/glsa-202101-22.xml create mode 100644 metadata/glsa/glsa-202101-23.xml create mode 100644 metadata/glsa/glsa-202101-24.xml create mode 100644 metadata/glsa/glsa-202101-25.xml create mode 100644 metadata/glsa/glsa-202101-26.xml create mode 100644 metadata/glsa/glsa-202101-27.xml create mode 100644 metadata/glsa/glsa-202101-28.xml create mode 100644 metadata/glsa/glsa-202101-29.xml create mode 100644 metadata/glsa/glsa-202101-30.xml create mode 100644 metadata/glsa/glsa-202101-31.xml create mode 100644 metadata/glsa/glsa-202101-32.xml create mode 100644 metadata/glsa/glsa-202101-33.xml create mode 100644 metadata/glsa/glsa-202101-34.xml create mode 100644 metadata/glsa/glsa-202101-35.xml create mode 100644 metadata/glsa/glsa-202101-36.xml create mode 100644 metadata/glsa/glsa-202101-37.xml create mode 100644 metadata/glsa/glsa-202101-38.xml (limited to 'metadata/glsa') diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest index 807eb9d9b2ba..bdb466ec6711 100644 --- a/metadata/glsa/Manifest +++ b/metadata/glsa/Manifest @@ -1,23 +1,23 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 -MANIFEST Manifest.files.gz 496888 BLAKE2B 9a8e48e705b83d0db366e4888a292cde78b191857d846a370c8c9908479c42c700f1d323d98e4aa4d9b6c2e0d3a80723d6cf76b125a273f90c8452ccb8f52fcf SHA512 d3e9efddd34ec46cab11f602c4a7b71480efc08ed49372d92ba27d45fdaf8129db8b52a169483e512d968a24c9a22f50140b178eb538444bb6200ee4eec5ef81 -TIMESTAMP 2021-01-22T20:08:39Z +MANIFEST Manifest.files.gz 500220 BLAKE2B aabc50258bfbbe2cb5f971f25f26b6c05a6f14b711c2f736db373e7c0f145f0cf5c547efb6e1ec1d43ad7c393a98fedc6e4f0b6a62a75dea9d2737f89715f3bb SHA512 66b9eade9f3337a820d760fef65a13534a76b1b7a62212ccfc6cd15a592b34f013e749b09caeb49eab79948c7489c23ae10c93f2b39bc07cd930f362aace586e +TIMESTAMP 2021-01-29T17:38:24Z -----BEGIN PGP SIGNATURE----- -iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmALMMdfFIAAAAAALgAo +iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmAUSBBfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY -klC88Q//X2h0rP3NYa0rA8lySWj21hExpd6/llu7LS18xkxy3t7T9SG17c7CxY8z -TTWPoQm0Ck9li0rKVfo5/GJL5gtL4jqEKWBUcfGECIzymm7ouwxn9XF8HfziX5YB -TbuZYFjemEbmPBHclDtOxS10sxuN4GL9g/yef9kBwST1bGPZBfksNIBllaqz19VW -P5bdRYoglf2LoH9Hp7VbppJAmyJPCEbJfsN5xvL0giqlR5V44JjRnfsh0RE1ni5I -Om+WilXAuyDH55a3jTZzX2IrGic5q1N7JIrTI/3/wjf8GY/ecIgtJQMpijNrcHEb -sW4OsfnbgTICm5QBLjx8IR0cFE3DQ1PkcfEJyHuStoNq2q10dIpvRdIV2dv5JeJ6 -Jy85jnXeGfXkD6PG2VoHdgqGhYmtzUoCNmyRvtIKJFXUfUoZ1Qer8kogO5xctzo5 -ro6JOuM8/vUhyyOSs7Nn08uwZ7pLTifo5omDX/pVElTxT6NQ+51Rig9ty/OQrkdt -5n+gIRdj81ntikW4pGOPOjfqt95epN2znjxapGLiw+01wWvp4YBr3OLTDCoObTxT -l0heXWC3+RVZ6Cm1CCoDdEYopn5fAuVPWG7FZ48KdZ00n5zwnHNIBbvSYb8+ahp3 -9ZlXb0dbyw0uSEtPBb7CWgEKKnH33BMoleap1KUvQfeJPzp3lLA= -=2FTv +klCamA/+PkIaOt+yq+q+7+OFtHAAlHiYG+YXTxjt4S0/SL86nCk5a3cgidEelaiW +3YcydTbBCJj6DqPO50n0w9U/LnYp4rZUuZCGmopTbw6wePvJUg6jjr7wmMRzZr2T +hu/YRNE3+NcN1XPiHXXUfx5JcHFMV3uVe1sxjKC3NUWy6TPfPRPun3YqMzdVRsRr +/athvqya/wi0kbrmjZ8p3qAgbz7+jyuDmV5k/YfGjYnZSyY8W0d4LgRsHWqs36Lo +fvDzc9LVK1jgJMIxPOwpfrU1IvYoKN4E7oVZjby/jgjN4BFNtcxlKjoieEVbPXtC +Kp0pqT5wvzgjuX9L1gwtYExa93mT9G5skQDJTom0De1hSF+yV4/dGovUYYLQv2aF +h9MzCOGhP+MeW4+1R6Tmhoo9JeIJ9wdev/mLRnuF5oNt74OxtRwFfMdL6GEmAtsX +csR9kiTsGMlxtvwVqlCdJ2FKo3Vg7ztj2z644hCjzfM8hVCH5kewtF2cTj8ndQzX +hGd7+uX3ZR6pG58o8nZE/hrfueVU6yjcLjZ7+PppWGVyZqiGq3dLJmkJnp3I+CJy +oQyhvmEPIunsxAZ/MUctjydLVrGW5iynT6w8j28BGzqCufSG60XXrY9T2zRmOVEV +xE8aprokT9xx0mdBin2FMLspjProhrmYDfxvlBK3bL9o1riX4RE= +=JcYw -----END PGP SIGNATURE----- diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz index ab29e0fa0273..8e5c9db63e0a 100644 Binary files a/metadata/glsa/Manifest.files.gz and b/metadata/glsa/Manifest.files.gz differ diff --git a/metadata/glsa/glsa-202101-18.xml b/metadata/glsa/glsa-202101-18.xml new file mode 100644 index 000000000000..03d6e27b19ce --- /dev/null +++ b/metadata/glsa/glsa-202101-18.xml @@ -0,0 +1,90 @@ + + + + Python: Multiple vulnerabilities + Multiple vulnerabilities have been found in Python, the worst of + which could result in the arbitrary execution of code. + + python + 2021-01-24 + 2021-01-24 + 749339 + 759928 + 766189 + remote + + + 2.7.18-r6 + 3.6.12-r2 + 3.7.9-r2 + 3.8.7-r1 + 3.9.1-r1 + 2.7.18-r6 + 3.6.12-r2 + 3.7.9-r2 + 3.8.7-r1 + 3.9.1-r1 + + + +

Python is an interpreted, interactive, object-oriented programming + language. +

+ + +

Multiple vulnerabilities have been discovered in Python. Please review + the bugs referenced below for details. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process, or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Python 2.7 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.18-r5" + + +

All Python 3.6 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.6.12-r1" + + +

All Python 3.7 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.7.9-r1" + + +

All Python 3.8 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.8.6-r1" + + +

All Python 3.9 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.9.0-r1" + + + + + CVE-2020-26116 + CVE-2021-3177 + + sam_c + sam_c + diff --git a/metadata/glsa/glsa-202101-19.xml b/metadata/glsa/glsa-202101-19.xml new file mode 100644 index 000000000000..866c37dcdf8a --- /dev/null +++ b/metadata/glsa/glsa-202101-19.xml @@ -0,0 +1,86 @@ + + + + OpenJDK: Multiple vulnerabilities + Multiple vulnerabilities have been found in OpenJDK, the worst of + which could result in the arbitrary execution of code. + + openjdk + 2021-01-25 + 2021-01-25 + 705992 + 750833 + remote + + + 8.272_p10 + 8.272_p10 + + + 8.272_p10 + 8.272_p10 + + + 8.272_p10 + 8.272_p10 + + + +

OpenJDK is a free and open-source implementation of the Java Platform, + Standard Edition. +

+ + +

Multiple vulnerabilities have been discovered in OpenJDK. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All OpenJDK users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-java/openjdk-8.272_p10" + + +

All OpenJDK (binary) users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-java/openjdk-bin-8.272_p10" + + +

All OpenJDK JRE (binary) users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=dev-java/openjdk-jre-bin-8.272_p10" + + + + CVE-2020-14779 + CVE-2020-14781 + CVE-2020-14782 + CVE-2020-14792 + CVE-2020-14796 + CVE-2020-14797 + CVE-2020-14798 + CVE-2020-14803 + CVE-2020-2583 + CVE-2020-2590 + CVE-2020-2593 + CVE-2020-2601 + CVE-2020-2604 + CVE-2020-2654 + CVE-2020-2659 + + sam_c + b-man + diff --git a/metadata/glsa/glsa-202101-20.xml b/metadata/glsa/glsa-202101-20.xml new file mode 100644 index 000000000000..c4fc0f6dd37c --- /dev/null +++ b/metadata/glsa/glsa-202101-20.xml @@ -0,0 +1,53 @@ + + + + glibc: Multiple vulnerabilities + Multiple vulnerabilities have been found in glibc, the worst of + which could result in the arbitrary execution of code. + + glibc + 2021-01-25 + 2021-01-25 + 611344 + 717058 + 720730 + 758359 + local, remote + + + 2.32-r5 + 2.32-r5 + + + +

glibc is a package that contains the GNU C library.

+ + +

Multiple vulnerabilities have been discovered in glibc. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All glibc users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.32-r5" + + + + CVE-2016-10228 + CVE-2020-1752 + CVE-2020-29562 + CVE-2020-29573 + CVE-2020-6096 + + sam_c + b-man + diff --git a/metadata/glsa/glsa-202101-21.xml b/metadata/glsa/glsa-202101-21.xml new file mode 100644 index 000000000000..38c63fc9f4d1 --- /dev/null +++ b/metadata/glsa/glsa-202101-21.xml @@ -0,0 +1,54 @@ + + + + Flatpak: Sandbox escape + A vulnerability was discovered in Flatpak which could allow a + remote attacker to execute arbitrary code. + + flatpak + 2021-01-25 + 2021-01-25 + 765457 + remote + + + 1.10.0 + 1.10.0 + + + +

Flatpak is a Linux application sandboxing and distribution framework.

+ + +

A bug was discovered in the flatpak-portal service that can allow + sandboxed applications to execute arbitrary code on the host system (a + sandbox escape). +

+ + +

A remote attacker could entice a user to open a specially crafted + Flatpak app possibly resulting in execution of arbitrary code with the + privileges of the process or a Denial of Service condition. +

+ + +

As a workaround, this vulnerability can be mitigated by preventing the + flatpak-portal service from starting, but that mitigation will prevent + many Flatpak apps from working correctly. It is highly recommended to + upgrade. +

+ + +

All Flatpak users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/flatpak-1.10.0" + + + + CVE-2021-21261 + + sam_c + b-man + diff --git a/metadata/glsa/glsa-202101-22.xml b/metadata/glsa/glsa-202101-22.xml new file mode 100644 index 000000000000..36a94ff168ac --- /dev/null +++ b/metadata/glsa/glsa-202101-22.xml @@ -0,0 +1,42 @@ + + + + libvirt: Unintended access to /dev/mapper/control + A vulnerability in libvirt may allow root privilege escalation. + libvirt + 2021-01-26 + 2021-01-26 + 739948 + local + + + 6.7.0 + 6.7.0 + + + +

libvirt is a C toolkit for manipulating virtual machines.

+ + +

A file descriptor for /dev/mapper/control was insufficiently protected.

+ + +

A local attacker may be able to escalate to root privileges.

+ + +

There is no known workaround at this time.

+ + +

All libvirt users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-emulation/libvirt-6.7.0" + + + + CVE-2020-14339 + + sam_c + sam_c + diff --git a/metadata/glsa/glsa-202101-23.xml b/metadata/glsa/glsa-202101-23.xml new file mode 100644 index 000000000000..d3ba7f305498 --- /dev/null +++ b/metadata/glsa/glsa-202101-23.xml @@ -0,0 +1,49 @@ + + + + PEAR Archive_Tar: Directory traversal + Multiple vulnerabilities have been found in PEAR Archive_Tar, the + worst of which could result in the arbitrary execution of code. + + PEAR-Archive_Tar + 2021-01-26 + 2021-01-26 + 755653 + 766036 + remote + + + 1.4.12 + 1.4.12 + + + +

This class provides handling of tar files in PHP.

+ + +

Multiple vulnerabilities have been discovered in PEAR Archive_Tar. + Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All PEAR-Archive_Tar users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-php/PEAR-Archive_Tar-1.4.12" + + + + CVE-2020-28948 + CVE-2020-28949 + CVE-2020-36193 + + sam_c + sam_c + diff --git a/metadata/glsa/glsa-202101-24.xml b/metadata/glsa/glsa-202101-24.xml new file mode 100644 index 000000000000..3e9fb3f77765 --- /dev/null +++ b/metadata/glsa/glsa-202101-24.xml @@ -0,0 +1,49 @@ + + + + cfitsio: Multiple vulnerabilities + Multiple vulnerabilities have been found in cfitsio, the worst of + which could result in the arbitrary execution of code. + + cfitsio + 2021-01-26 + 2021-01-26 + 673944 + remote + + + 3.490 + 3.490 + + + +

A C and Fortran library for manipulating FITS files.

+ + +

Multiple vulnerabilities have been discovered in cfitsio. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All cfitsio users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sci-libs/cfitsio-3.490" + + + + CVE-2018-3846 + CVE-2018-3847 + CVE-2018-3848 + CVE-2018-3849 + + sam_c + sam_c + diff --git a/metadata/glsa/glsa-202101-25.xml b/metadata/glsa/glsa-202101-25.xml new file mode 100644 index 000000000000..6914662437b5 --- /dev/null +++ b/metadata/glsa/glsa-202101-25.xml @@ -0,0 +1,44 @@ + + + + Mutt: Denial of service + A vulnerability in Mutt could lead to a Denial of Service + condition. + + mutt + 2021-01-26 + 2021-01-26 + 765790 + remote + + + 2.0.4-r1 + 2.0.4-r1 + + + +

Mutt is a small but very powerful text-based mail client.

+ + +

A memory leak could occur when a crafted email message is received.

+ + +

An attacker could cause a possible Denial of Service condition.

+ + +

There is no known workaround at this time.

+ + +

All Mutt users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/mutt-2.0.4-r1" + + + + CVE-2021-3181 + + sam_c + sam_c + diff --git a/metadata/glsa/glsa-202101-26.xml b/metadata/glsa/glsa-202101-26.xml new file mode 100644 index 000000000000..64fbf2c1b631 --- /dev/null +++ b/metadata/glsa/glsa-202101-26.xml @@ -0,0 +1,50 @@ + + + + f2fs-tools: Multiple vulnerabilities + Multiple vulnerabilities have been found in f2fs-tools, the worst + of which could result in the arbitrary execution of code. + + f2fs-tools + 2021-01-26 + 2021-01-26 + 749318 + remote + + + 1.14.0 + 1.14.0 + + + +

Tools for Flash-Friendly File System (F2FS).

+ + +

Multiple vulnerabilities have been discovered in f2fs-tools. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All f2fs-tools users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-fs/f2fs-tools-1.14.0" + + + + CVE-2020-6104 + CVE-2020-6105 + CVE-2020-6106 + CVE-2020-6107 + CVE-2020-6108 + + sam_c + sam_c + diff --git a/metadata/glsa/glsa-202101-27.xml b/metadata/glsa/glsa-202101-27.xml new file mode 100644 index 000000000000..776a91822460 --- /dev/null +++ b/metadata/glsa/glsa-202101-27.xml @@ -0,0 +1,45 @@ + + + + FreeRADIUS: Root privilege escalation + Multiple vulnerabilities were discovered in Gentoo's systemd unit + for FreeRADIUS which could lead to root privilege escalation. + + freeradius + 2021-01-26 + 2021-01-26 + 630910 + local + + + 3.0.20-r1 + 3.0.20-r1 + + + +

FreeRADIUS is a modular, high performance free RADIUS suite.

+ + +

It was discovered that Gentoo’s FreeRADIUS systemd unit set + permissions on an unsafe directory on start. +

+ + +

A local attacker could escalate privileges.

+ + +

There is no known workaround at this time.

+ + +

All FreeRADIUS users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-dialup/freeradius-3.0.20-r1" + + + + + sam_c + sam_c + diff --git a/metadata/glsa/glsa-202101-28.xml b/metadata/glsa/glsa-202101-28.xml new file mode 100644 index 000000000000..8ba014862bfd --- /dev/null +++ b/metadata/glsa/glsa-202101-28.xml @@ -0,0 +1,47 @@ + + + + ncurses: Multiple vulnerabilities + Multiple vulnerabilities have been found in ncurses, the worst of + which could result in a Denial of Service condition. + + ncurses + 2021-01-26 + 2021-01-26 + 698210 + remote + + + 6.2 + 6.2 + + + +

A console display library.

+ + +

Multiple vulnerabilities have been discovered in ncurses. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All ncurses users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/ncurses-6.2" + + + + CVE-2019-17594 + CVE-2019-17595 + + sam_c + sam_c + diff --git a/metadata/glsa/glsa-202101-29.xml b/metadata/glsa/glsa-202101-29.xml new file mode 100644 index 000000000000..5f2c0b02b104 --- /dev/null +++ b/metadata/glsa/glsa-202101-29.xml @@ -0,0 +1,65 @@ + + + + OpenJPEG: Multiple vulnerabilities + Multiple vulnerabilities have been found in OpenJPEG, the worst of + which could result in the arbitrary execution of code. + + openjpeg + 2021-01-26 + 2021-01-26 + 711260 + 718918 + remote + + + 2.4.0 + 2.4.0 + 1.5.2-r1 + + + +

OpenJPEG is an open-source JPEG 2000 library.

+ + +

Multiple vulnerabilities have been discovered in OpenJPEG. Please review + the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All OpenJPEG 2 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-libs/openjpeg-2.4.0:2" + + +

Gentoo has discontinued support OpenJPEG 1.x and any dependent packages + should now be using OpenJPEG 2 or have dropped support for the library. + We recommend that users unmerge OpenJPEG 1.x: +

+ + + # emerge --unmerge "media-libs/openjpeg:1" + + + + CVE-2018-21010 + CVE-2019-12973 + CVE-2020-15389 + CVE-2020-27814 + CVE-2020-27841 + CVE-2020-27842 + CVE-2020-27843 + CVE-2020-27844 + CVE-2020-27845 + + sam_c + sam_c + diff --git a/metadata/glsa/glsa-202101-30.xml b/metadata/glsa/glsa-202101-30.xml new file mode 100644 index 000000000000..0c4e07eeaaa7 --- /dev/null +++ b/metadata/glsa/glsa-202101-30.xml @@ -0,0 +1,151 @@ + + + + Qt WebEngine: Multiple vulnerabilities + Multiple vulnerabilities have been found in Qt WebEngine, the worst + of which could result in the arbitrary execution of code. + + qtwebengine + 2021-01-26 + 2021-01-26 + 734600 + 754852 + remote + + + 5.15.2 + 5.15.2 + + + +

Library for rendering dynamic web content in Qt5 C++ and QML + applications. +

+ + +

Multiple vulnerabilities have been discovered in Qt WebEngine. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Qt WebEngine users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-qt/qtwebengine-5.15.2" + + + + CVE-2020-15959 + CVE-2020-15959 + CVE-2020-15960 + CVE-2020-15960 + CVE-2020-15961 + CVE-2020-15961 + CVE-2020-15962 + CVE-2020-15962 + CVE-2020-15963 + CVE-2020-15963 + CVE-2020-15964 + CVE-2020-15964 + CVE-2020-15965 + CVE-2020-15965 + CVE-2020-15966 + CVE-2020-15966 + CVE-2020-15968 + CVE-2020-15968 + CVE-2020-15969 + CVE-2020-15969 + CVE-2020-15972 + CVE-2020-15972 + CVE-2020-15974 + CVE-2020-15974 + CVE-2020-15976 + CVE-2020-15976 + CVE-2020-15977 + CVE-2020-15977 + CVE-2020-15978 + CVE-2020-15978 + CVE-2020-15979 + CVE-2020-15979 + CVE-2020-15985 + CVE-2020-15985 + CVE-2020-15987 + CVE-2020-15987 + CVE-2020-15989 + CVE-2020-15989 + CVE-2020-15992 + CVE-2020-15992 + CVE-2020-16001 + CVE-2020-16001 + CVE-2020-16002 + CVE-2020-16002 + CVE-2020-16003 + CVE-2020-16003 + CVE-2020-6467 + CVE-2020-6467 + CVE-2020-6470 + CVE-2020-6470 + CVE-2020-6471 + CVE-2020-6471 + CVE-2020-6472 + CVE-2020-6473 + CVE-2020-6474 + CVE-2020-6475 + CVE-2020-6476 + CVE-2020-6480 + CVE-2020-6481 + CVE-2020-6482 + CVE-2020-6483 + CVE-2020-6486 + CVE-2020-6487 + CVE-2020-6489 + CVE-2020-6490 + CVE-2020-6506 + CVE-2020-6510 + CVE-2020-6511 + CVE-2020-6512 + CVE-2020-6513 + CVE-2020-6514 + CVE-2020-6518 + CVE-2020-6523 + CVE-2020-6524 + CVE-2020-6526 + CVE-2020-6529 + CVE-2020-6530 + CVE-2020-6531 + CVE-2020-6532 + CVE-2020-6533 + CVE-2020-6534 + CVE-2020-6535 + CVE-2020-6540 + CVE-2020-6541 + CVE-2020-6542 + CVE-2020-6543 + CVE-2020-6544 + CVE-2020-6545 + CVE-2020-6548 + CVE-2020-6549 + CVE-2020-6550 + CVE-2020-6551 + CVE-2020-6555 + CVE-2020-6557 + CVE-2020-6559 + CVE-2020-6561 + CVE-2020-6562 + CVE-2020-6569 + CVE-2020-6570 + CVE-2020-6571 + CVE-2020-6573 + CVE-2020-6575 + CVE-2020-6576 + + sam_c + sam_c + diff --git a/metadata/glsa/glsa-202101-31.xml b/metadata/glsa/glsa-202101-31.xml new file mode 100644 index 000000000000..3d7dcd82f908 --- /dev/null +++ b/metadata/glsa/glsa-202101-31.xml @@ -0,0 +1,46 @@ + + + + Cacti: Remote code execution + A vulnerability in Cacti could lead to remote code execution. + cacti + 2021-01-26 + 2021-01-26 + 765019 + remote + + + 1.2.16-r1 + 1.2.16-r1 + + + +

Cacti is a complete frontend to rrdtool.

+ + +

The side_id parameter in data_debug.php does not properly verify input + allowing SQL injection. +

+ + +

A remote attacker could possibly execute arbitrary code with the + privileges of the process or cause a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All Cacti users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-1.2.16-r1" + + + + CVE-2020-35701 + + sam_c + sam_c + diff --git a/metadata/glsa/glsa-202101-32.xml b/metadata/glsa/glsa-202101-32.xml new file mode 100644 index 000000000000..2c1a6dd3ef52 --- /dev/null +++ b/metadata/glsa/glsa-202101-32.xml @@ -0,0 +1,62 @@ + + + + Mutt, NeoMutt: Information disclosure + A weakness was discovered in Mutt and NeoMutt's TLS handshake + handling + + NeoMutt + 2021-01-26 + 2021-01-26 + 755833 + 755866 + remote + + + 2.0.2 + 2.0.2 + + + 20201120 + 20201120 + + + +

Mutt is a small but very powerful text-based mail client.

+ +

NeoMutt is a command line mail reader (or MUA). It’s a fork of Mutt + with added features. +

+ + +

A weakness in TLS handshake handling was found which may allow + information disclosure. +

+ + +

A remote attacker may be able to cause information disclosure.

+ + +

There is no known workaround at this time.

+ + +

All Mutt users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/mutt-2.0.2" + + +

All NeoMutt users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=mail-client/neomutt-20201120" + + + + CVE-2020-28896 + + sam_c + sam_c + diff --git a/metadata/glsa/glsa-202101-33.xml b/metadata/glsa/glsa-202101-33.xml new file mode 100644 index 000000000000..a53bfabd5cd9 --- /dev/null +++ b/metadata/glsa/glsa-202101-33.xml @@ -0,0 +1,61 @@ + + + + sudo: Multiple vulnerabilities + Multiple vulnerabilities have been found in sudo, the worst of + which could result in privilege escalation. + + sudo + 2021-01-26 + 2021-01-26 + 764986 + 767364 + local + + + 1.9.5_p2 + 1.9.5_p2 + + + +

sudo (su “do”) allows a system administrator to delegate authority + to give certain users (or groups of users) the ability to run some (or + all) commands as root or another user while providing an audit trail of + the commands and their arguments. +

+ + +

Multiple vulnerabilities have been discovered in sudo. Please review the + CVE identifiers referenced below for details. +

+ + +

Local users are able to gain unauthorized privileges on the system or + determine the existence of files. +

+ + +

There is no known workaround at this time.

+ + +

All sudo users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=app-admin/sudo-1.9.5_p2" + + + + CVE-2021-23239 + CVE-2021-23240 + CVE-2021-3156 + Upstream + advisory (CVE-2020-23240) + + Upstream + advisory (CVE-2021-3156) + + + sam_c + sam_c + diff --git a/metadata/glsa/glsa-202101-34.xml b/metadata/glsa/glsa-202101-34.xml new file mode 100644 index 000000000000..bedeea759a1d --- /dev/null +++ b/metadata/glsa/glsa-202101-34.xml @@ -0,0 +1,48 @@ + + + + Telegram Desktop: Multiple vulnerabilities + Multiple vulnerabilities have been found in Telegram, the worst of + which could result in information disclosure. + + telegram + 2021-01-27 + 2021-01-27 + 736774 + 749288 + remote + + + 2.4.4 + 2.4.4 + + + +

Telegram is a messaging app with a focus on speed and security.

+ + +

Multiple vulnerabilities have been discovered in Telegram Desktop. + Please review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Telegram Desktop users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-im/telegram-desktop-2.4.4" + + + + CVE-2020-17448 + CVE-2020-25824 + + sam_c + sam_c + diff --git a/metadata/glsa/glsa-202101-35.xml b/metadata/glsa/glsa-202101-35.xml new file mode 100644 index 000000000000..974a6a240ef5 --- /dev/null +++ b/metadata/glsa/glsa-202101-35.xml @@ -0,0 +1,47 @@ + + + + phpMyAdmin: Multiple vulnerabilities + Multiple vulnerabilities have been found in phpMyAdmin, allowing + remote attackers to conduct XSS. + + phpmyadmin + 2021-01-27 + 2021-01-27 + 747805 + remote + + + 4.9.6 + 4.9.6 + + + +

phpMyAdmin is a web-based management tool for MySQL databases.

+ + +

Multiple vulnerabilities have been discovered in phpMyAdmin. Please + review the CVE identifiers referenced below for details. +

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All phpMyAdmin users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-db/phpmyadmin-4.9.6" + + + + CVE-2020-26934 + CVE-2020-26935 + + whissi + b-man + diff --git a/metadata/glsa/glsa-202101-36.xml b/metadata/glsa/glsa-202101-36.xml new file mode 100644 index 000000000000..7b5b52d6a17b --- /dev/null +++ b/metadata/glsa/glsa-202101-36.xml @@ -0,0 +1,60 @@ + + + + ImageMagick: Command injection + A vulnerability in ImageMagick's handling of PDF was discovered + possibly allowing code execution. + + imagemagick + 2021-01-29 + 2021-01-29 + 756829 + remote + + + 7.0.10.41-r1 + 6.9.11.41-r1 + 7.0.10.41-r1 + 6.9.11.41-r1 + + + +

A collection of tools and libraries for many image formats.

+ + +

A flaw in ImageMagick’s handling of password protected PDFs was + discovered. +

+ + +

A remote attacker could entice a user to open a specially crafted PDF + using ImageMagick possibly resulting in execution of arbitrary code with + the privileges of the process or a Denial of Service condition. +

+ + +

Do not open untrusted PDFs.

+ + +

All ImageMagick 7 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=media-gfx/imagemagick-7.0.10.41-r1" + + +

All ImageMagick 6 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=media-gfx/imagemagick-6.9.11.41-r1" + + + + CVE-2020-29599 + + sam_c + sam_c + diff --git a/metadata/glsa/glsa-202101-37.xml b/metadata/glsa/glsa-202101-37.xml new file mode 100644 index 000000000000..52b09f41e0a2 --- /dev/null +++ b/metadata/glsa/glsa-202101-37.xml @@ -0,0 +1,47 @@ + + + + VLC: Buffer overflow + A buffer overflow in VLC might allow remote attacker(s) to execute + arbitrary code. + + vlc + 2021-01-29 + 2021-01-29 + 765040 + remote + + + 3.0.12.1 + 3.0.12.1 + + + +

VLC is a cross-platform media player and streaming server.

+ + +

VLC was found to have a buffer overflow when handling crafted MKV files.

+ + +

A remote attacker could entice a user to open a specially crafted MKV + file using VLC possibly resulting in execution of arbitrary code with the + privileges of the process or a Denial of Service condition. +

+ + +

There is no known workaround at this time.

+ + +

All VLC users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-video/vlc-3.0.12.1" + + + + CVE-2020-26664 + + sam_c + sam_c + diff --git a/metadata/glsa/glsa-202101-38.xml b/metadata/glsa/glsa-202101-38.xml new file mode 100644 index 000000000000..11ca507fa1e1 --- /dev/null +++ b/metadata/glsa/glsa-202101-38.xml @@ -0,0 +1,49 @@ + + + + NSD: Symbolic link traversal + A vulnerability was discovered in NSD which could allow a local + attacker to cause a Denial of Service condition. + + nsd + 2021-01-29 + 2021-01-29 + 758977 + local + + + 4.3.4 + 4.3.4 + + + +

An authoritative only, high performance, open source name server

+ + +

A local vulnerability was discovered that would allow for a local + symlink attack due to how NSD handles PID files. +

+ + +

A local attacker could cause a Denial of Service condition.

+ + +

There is no known workaround at this time.

+ + +

All NSD users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-dns/nsd-4.3.4" + + + + CVE-2020-28935 + + Upstream advisory + + + whissi + b-man + diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk index a5dbbef5e51f..5a5c0130df7c 100644 --- a/metadata/glsa/timestamp.chk +++ b/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Fri, 22 Jan 2021 20:08:35 +0000 +Fri, 29 Jan 2021 17:38:21 +0000 diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit index 55000c1dfc6e..67da988a6843 100644 --- a/metadata/glsa/timestamp.commit +++ b/metadata/glsa/timestamp.commit @@ -1 +1 @@ -fc457c57148901f04674f1d427ad8bb280eb3c72 1611338159 2021-01-22T17:55:59+00:00 +efd0aa32fd2ca278747b075a2c8f414bb8aadead 1611878727 2021-01-29T00:05:27+00:00 -- cgit v1.2.3