From ed8299fef4175104e66b734cfc0482770614f398 Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Sat, 23 Dec 2023 13:50:55 +0000 Subject: gentoo auto-resync : 23:12:2023 - 13:50:55 --- metadata/glsa/Manifest | 30 ++++++++++---------- metadata/glsa/Manifest.files.gz | Bin 556922 -> 557720 bytes metadata/glsa/glsa-202312-10.xml | 42 +++++++++++++++++++++++++++ metadata/glsa/glsa-202312-11.xml | 42 +++++++++++++++++++++++++++ metadata/glsa/glsa-202312-12.xml | 52 +++++++++++++++++++++++++++++++++ metadata/glsa/glsa-202312-13.xml | 45 +++++++++++++++++++++++++++++ metadata/glsa/glsa-202312-14.xml | 60 +++++++++++++++++++++++++++++++++++++++ metadata/glsa/timestamp.chk | 2 +- metadata/glsa/timestamp.commit | 2 +- 9 files changed, 258 insertions(+), 17 deletions(-) create mode 100644 metadata/glsa/glsa-202312-10.xml create mode 100644 metadata/glsa/glsa-202312-11.xml create mode 100644 metadata/glsa/glsa-202312-12.xml create mode 100644 metadata/glsa/glsa-202312-13.xml create mode 100644 metadata/glsa/glsa-202312-14.xml (limited to 'metadata/glsa') diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest index 84e4a3860c11..799148902b5c 100644 --- a/metadata/glsa/Manifest +++ b/metadata/glsa/Manifest @@ -1,23 +1,23 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 -MANIFEST Manifest.files.gz 556922 BLAKE2B 4af97573db7aa951e408380dafaf4564604dab984a92046d73d1682616bf5972d8277f1ff5a139ca402707c848cbc37c64071d88cba8e2a217aa0fa1c81922f9 SHA512 ff2c1ae85d7fd96100abd1ac489ec14ce252228d4d7f01d4cc15ce1d273416a97c18a8c2879acb4b68cc91a2cec9f67808cb86557333ea7c653ae804465d62e0 -TIMESTAMP 2023-12-23T07:10:06Z +MANIFEST Manifest.files.gz 557720 BLAKE2B 1bc79beb7b22c2ce6b80e7677302891c872d6ac116096c06d9dbba6d7683aec51bbbcefe97cf8126dd25818fe0c936a6b25df9e1c8c1be9da6a5c9580fff46e2 SHA512 273602eb349fcbbef4c2202ec5c33b66d702f53716aad3f0abfbf14db5c7ba667dd6fefa620e348109b82427555dd8d45ab0b261320d92f551c7162d8f78de5f +TIMESTAMP 2023-12-23T13:10:02Z -----BEGIN PGP SIGNATURE----- -iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmWGh85fFIAAAAAALgAo +iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmWG3CpfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY -klCN8g/+OyfRUJNtzl7mbM0UMuwHEWEqN8Y55+bG6Z+gvLI4buLIwG46AtQC5Dmw -PiMXq1GTXXeRQLqueB/QYsroFcfP+RLYcFbpRSWuV7tYYsJSHONyFHPWczU9nujy -PpVl6GIfZYYEMfwh88kQJmsxr3GGxNPvJriMx40R6Sa5GFguxgdsMSJtCa5WROIh -UqcMJ+8g+Yir51JptSxcpOAnf/kh3H+5MNcw+2RK25UcNSJJWgXKSDXFBrCt9hcz -hYYtwg1hJ1sGuGa1ygajG7Ib45SAS9iDmtd3P4BP2quOeDxoSzZ0rv8P24L8mYJV -FzaEM/3dmatzQuaCEz2OEz6Xdt/QJ7XK25DxVGIkrPvEF6KCgRPfGucwYM1HuMwf -oUBbpD4BL6oo8nfBVavjV+416qSWXmT0WpFN5Z/D3WaWsB1YrxvZd2kzYlS+k7CD -phhw5rIMo7GTpaZ5yrSCTZze/hil5Sfmd/4+5v0KXguQ8sEA6gCx+aACQpek7kXT -/60ufkGTvJDyBG3PP++1V5LwC2L30Petqv1yBGFKvDSXHGJAiU6o4urxwEgOVavh -JicbrswpZ17krdmwb3ieTUd76KZcM9uXLEyM4AUnYus7AVXehqAit9rv8Z1hRR71 -xrqy7z5YLCsqL+Ve4Y032rRflx4CHZvHgYjsv14fnWDgb7m5HyI= -=Msrs +klBBZg//dt3NUAfgxUmvVwtx5dKdGNB/MHXCXwSlq5+ban+nAt1BE7ft2CNIFFB5 +3CC1bGF6bVHipcxcI7S9jlfUv39YG2NE/TLLwTSeJNjbQEPKOqtdaEx9uf5MU1kP +eQDWEQwVpU2J2ptfjmMYntOWaJ3wdxpJBrWw8nk8BnxorNlKpupwPZTNH2NS2Jqg +TBydI0/Jbg3KbZEPYwncGOj/becWs34H9UG1aTkqldF7ZEj9F6B6TBeD4e/MHZhg +4rPN3KH8O58vCyMlwSVf/qYY2eQr47SUxB8MqZ3fLIU0ql5cknXCpJkpPqkBPwJV +GibXbB2jpqkXoIM+iPX2VUIY1jvkbBV1Z5JjHiUfeBjxJ2BLy3In3AlGWPaJJ/PQ +UewNSiQUaumyBpVHZ/NgHBwkXkcb2hEsE0BLrUYaXlbOu9P9Zxoog80SIHHg2mhP +6PkjROISCVqTirP3zm3gPn+1F3xZxAas+M1sC0b910vXLfutbBDAFEvj2/3FtnWw +FbnWIvpYSv1GnxU+l/aaNeif1hHpMR4B+AtmgxnolV5CNXqJOLTwBRZhww8ZZnZr +gXpJpJJga+Vs2Ok5BG3X6mn3t2fBtMFlazvZHhbxY81BckWJImoAGSAl9fwH1Zp7 +Y3DxpGu2HWF+ckjQBeQCCfjg4PWKfaHKLV06D37lkVhgjcR6EMk= +=INQ4 -----END PGP SIGNATURE----- diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz index fbe6d36a44bb..0bbb2a52458b 100644 Binary files a/metadata/glsa/Manifest.files.gz and b/metadata/glsa/Manifest.files.gz differ diff --git a/metadata/glsa/glsa-202312-10.xml b/metadata/glsa/glsa-202312-10.xml new file mode 100644 index 000000000000..2f3185e353ba --- /dev/null +++ b/metadata/glsa/glsa-202312-10.xml @@ -0,0 +1,42 @@ + + + + Ceph: Root Privilege Escalation + A vulnerability has been found in Ceph which can lead to root privilege escalation. + ceph + 2023-12-23 + 2023-12-23 + 878277 + local + + + 17.2.6 + 17.2.6 + + + +

Ceph is a distributed network file system designed to provide excellent performance, reliability, and scalability.

+ + +

A vulnerability has been discovered in Ceph. Please review the CVE identifier referenced below for details.

+ + +

The ceph-crash.service runs the ceph-crash Python script as root. The script is operating in the directory /var/lib/ceph/crash which is controlled by the unprivileged ceph user (ceph:ceph mode 0750). The script periodically scans for new crash directories and forwards the content via `ceph crash post`.

+ + +

There is no known workaround at this time.

+ + +

All Ceph users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-cluster/ceph-17.2.6" + + + + CVE-2022-3650 + + graaff + graaff + \ No newline at end of file diff --git a/metadata/glsa/glsa-202312-11.xml b/metadata/glsa/glsa-202312-11.xml new file mode 100644 index 000000000000..8a76344d531c --- /dev/null +++ b/metadata/glsa/glsa-202312-11.xml @@ -0,0 +1,42 @@ + + + + SABnzbd: Remote Code Execution + A vulnerability has been found in SABnzbd which allows for remote code execution. + sabnzbd + 2023-12-23 + 2023-12-23 + 908032 + remote + + + 4.0.2 + 4.0.2 + + + +

Free and easy binary newsreader with web interface.

+ + +

A vulnerability has been discovered in SABnzbd. Please review the CVE identifier referenced below for details.

+ + +

A design flaw was discovered in SABnzbd that could allow remote code execution. Manipulating the Parameters setting in the Notification Script functionality allows code execution with the privileges of the SABnzbd process. Exploiting the vulnerabilities requires access to the web interface. Remote exploitation is possible if users exposed their setup to the internet or other untrusted networks without setting a username/password. By default SABnzbd is only accessible from `localhost`, with no authentication required for the web interface.

+ + +

There is no known workaround at this time.

+ + +

All SABnzbd users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-nntp/sabnzbd-4.0.2" + + + + CVE-2023-34237 + + graaff + graaff + \ No newline at end of file diff --git a/metadata/glsa/glsa-202312-12.xml b/metadata/glsa/glsa-202312-12.xml new file mode 100644 index 000000000000..2cf088a78322 --- /dev/null +++ b/metadata/glsa/glsa-202312-12.xml @@ -0,0 +1,52 @@ + + + + Flatpak: Multiple Vulnerabilities + Several vulnerabilities have been found in Flatpack, the worst of which lead to privilege escalation and sandbox escape. + flatpak + 2023-12-23 + 2023-12-23 + 775365 + 816951 + 831087 + 901507 + remote + + + 1.14.4 + 1.14.4 + + + +

Flatpak is a Linux application sandboxing and distribution framework.

+ + +

Multiple vulnerabilities have been discovered in Flatpak. Please review the CVE identifiers referenced below for details.

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Flatpak users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=sys-apps/flatpak-1.14.4" + + + + CVE-2021-21381 + CVE-2021-41133 + CVE-2021-43860 + CVE-2022-21682 + CVE-2023-28100 + CVE-2023-28101 + GHSA-67h7-w3jq-vh4q + GHSA-xgh4-387p-hqpp + + graaff + graaff + \ No newline at end of file diff --git a/metadata/glsa/glsa-202312-13.xml b/metadata/glsa/glsa-202312-13.xml new file mode 100644 index 000000000000..b7e051ae5fe3 --- /dev/null +++ b/metadata/glsa/glsa-202312-13.xml @@ -0,0 +1,45 @@ + + + + Gitea: Multiple Vulnerabilities + Multiple vulnerabilities have been discovered in Gitea, the worst of which could result in information leakage. + gitea + 2023-12-23 + 2023-12-23 + 887825 + 891983 + 905886 + 918674 + remote + + + 1.20.6 + 1.20.6 + + + +

Gitea is a painless self-hosted Git service.

+ + +

Multiple vulnerabilities have been discovered in Gitea. Please review the CVE identifiers referenced below for details.

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All Gitea users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-apps/gitea-1.20.6" + + + + CVE-2023-3515 + + ajak + graaff + \ No newline at end of file diff --git a/metadata/glsa/glsa-202312-14.xml b/metadata/glsa/glsa-202312-14.xml new file mode 100644 index 000000000000..d3f9f79b9353 --- /dev/null +++ b/metadata/glsa/glsa-202312-14.xml @@ -0,0 +1,60 @@ + + + + FFmpeg: Multiple Vulnerabilities + Multiple vulnerabilitiies have been discovered in FFmpeg, the worst of which could lead to code execution + ffmpeg + 2023-12-23 + 2023-12-23 + 795696 + 842267 + 881523 + 903805 + local and remote + + + 6.0 + 4.4.3 + 6.0 + 4.4.3 + + + +

FFmpeg is a complete solution to record, convert and stream audio and video.

+ + +

Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers referenced below for details.

+ + +

Please review the referenced CVE identifiers for details.

+ + +

There is no known workaround at this time.

+ + +

All FFmpeg 4 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-video/ffmpeg-4.4.3" + + +

All FFmpeg 6 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-video/ffmpeg-6.0" + + + + CVE-2021-33815 + CVE-2021-38171 + CVE-2021-38291 + CVE-2022-1475 + CVE-2022-3964 + CVE-2022-3965 + CVE-2022-48434 + + graaff + graaff + \ No newline at end of file diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk index 633b4fc98ac2..a057d352b9a2 100644 --- a/metadata/glsa/timestamp.chk +++ b/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Sat, 23 Dec 2023 07:10:02 +0000 +Sat, 23 Dec 2023 13:09:58 +0000 diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit index 920ff58ffd43..f144ab9f3de3 100644 --- a/metadata/glsa/timestamp.commit +++ b/metadata/glsa/timestamp.commit @@ -1 +1 @@ -9f9ee310bf6c4ebf26d43ff75e027e27f23beb80 1703247114 2023-12-22T12:11:54+00:00 +054115a94fa38350f4468052ec239cbacb5b8e26 1703329649 2023-12-23T11:07:29+00:00 -- cgit v1.2.3