Skip to content

Commit

Permalink
portage-stable/metadata: Monthly GLSA metadata updates
Browse files Browse the repository at this point in the history
  • Loading branch information
Flatcar Buildbot authored and github-actions[bot] committed Jan 1, 2025
1 parent f8bf613 commit 9d552ed
Show file tree
Hide file tree
Showing 24 changed files with 1,324 additions and 17 deletions.
30 changes: 15 additions & 15 deletions sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest
Original file line number Diff line number Diff line change
@@ -1,23 +1,23 @@
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

MANIFEST Manifest.files.gz 591718 BLAKE2B cd53ee1575b57b03315f3e2b15f89a06fbc6711259ee7a82e1ca6f8970d8fdd183ea1f95f313b15f9f7f905c2c8641fa9ae9f0d8a12e8fedc6851ee3f7c15bbd SHA512 1cf337d112115a521c08a9fa208a2c60a1ef9651426b5a20b7ff05709eda7e21b384c627f1dedd2abb84476daf5fadea280b479585390abd903daec89814b24f
TIMESTAMP 2024-12-01T06:40:23Z
MANIFEST Manifest.files.gz 594915 BLAKE2B 220d9175cb1796cb5045abb4a1dd895efa478aa604a6eb3dde800553a73ce6b12ecf630b6574e1fc834659bac119417be17231464d8355e60ed5ed18f51b8044 SHA512 db425e75cb49a2ea05358c8e7f4e366d86628930a1e26279cb8287fe250565842ac004358a56986eb2aa4342ed7217cf30c8f78d97a02ed24483cca80fd1b2eb
TIMESTAMP 2025-01-01T06:40:41Z
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmdMBNdfFIAAAAAALgAo
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmd042lfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
klANZw/+KSWqV2sDOVWslomj90wmI4kWrUE4ZC46YZtvjGz4Faf9D8i9RzkuV9nB
Lt6HhwNbrTFYYyFv0wAYLBUbNzQUDKl0KwOXs7SjRD+hV2lNRakA/dM1FbHsN0wF
qUd+S3Slmis3NGaIQ5UstxqdG5wjZ04q6BnjdrA5Yaqxj+S8bS04D3HUr5jhKU8A
vR9e7h6fkiABZW52mXVcBvqkSTmqrZcxGss3LpTiWU1VDcbFoVXcjsNQKYUEj9dt
IgWaVX/LwVj3yPSI2TPF2PO8lenyiroADclFwXPHHyuDm6qxXb0v0nie3h4PuG5O
yFVWmpLPkgdO2oCnJhh1W2sh+vu5iV4xnfoxT5U0BMp24s2wt2oKzPieJUhslk4s
lINvCPAVF8VFwgvop3rdwvwQWE7yZCAZuKxD0Y6m8WORExR/MB33Qmc0gm7b6ksC
yFG7AjN6y0qUd2yL1vpl9lvy4Rv0izZnVmuhd0+Jsq/8lgzY8+oiiZMzTxEc8Y/e
8BcxWkB64/Sta0U+GYEYypxS2nPtPAb7BvPu1f2dyBEqO+vDRN5M+0LuhfucKDTo
fuNw7Ri6zyv4thIvUJI7f54AHcGvAGmxQ+ObXHoHrBHtKacSXG6VF/P48rAwX165
WblhbkW1T4kqLrUiFl/pt9BHP2zCXFkphVMrw4GJyp6KquSqfFA=
=l52K
klBoyg//VQm7GsyyuffSjKJO3H/YJF558ygX0IxnZPwgQweC9ERRd3NlONm2mlph
TzmZhAC+PnRGN+QTZh3M/kNuxPytaf6bg9vSNs2v221CHcSqErbzbMAiDO8ZRPoj
ToTfCC1jH2AoEAAmCWd120MK7nA1dzKx0DSvWhuTv02ssdS9Plj+SJ0SY6stjE3w
vfyYTvVjsz90UppvVl9zdKPQa5st2ojC9/tJxCFEjTxV1ubGJDI/7TdArgyTTSDg
rx4Bbc5su4ANjXbYHofhar2X0/YYF6l/bglDMhCJIn8OwOyzWqXufgrmhmnCrCgt
V6FLxXqWimOmIiIL1YUwUgc3p0JYNuYAwGt5I6Tf/gX2h/4aHOxUvgDdvRf+hoUl
9USr4sw5qovn+pFdDNwYrZ2+Uat83IYET85Mnlc8sqf3wH8I17lPKOzLtcgtkRND
i062wD9kU6gCen6fM80vuW4k40UphiAkrLhy8nMaWjBBVbRdXpGddGdOuPk0yX+b
g+qjOXnkY/rZPek+u0lpS1MPU661IFJgXQs9wFaV9++VXpcpVCyFoyUNhhaIxEH9
KEQwa8bz2DkoBCeJMYjH3xigcXMavQ9KTrRqkl2lUk1tLf/dBwY3d7Ao8rpCkirO
AF2w3sJ5hbD7PXm4OEDG3EYt1uQftsnV/UcNB26SVu8UT1tfmR0=
=IQdp
-----END PGP SIGNATURE-----
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="202412-01">
<title>R: Arbitrary Code Execution</title>
<synopsis>A vulnerability has been discovered in R, which can lead to arbitrary code execution.</synopsis>
<product type="ebuild">R</product>
<announced>2024-12-07</announced>
<revised count="1">2024-12-07</revised>
<bug>930936</bug>
<access>local</access>
<affected>
<package name="dev-lang/R" auto="yes" arch="*">
<unaffected range="ge">4.4.1</unaffected>
<vulnerable range="lt">4.4.1</vulnerable>
</package>
</affected>
<background>
<p>R is a language and environment for statistical computing and graphics.</p>
</background>
<description>
<p>Deserialization of untrusted data can occur in the R statistical programming language, enabling a maliciously crafted RDS (R Data Serialization) formatted file or R package to run arbitrary code on an end user’s system when interacted with.</p>
</description>
<impact type="high">
<p>Arbitrary code may be run when deserializing untrusted data.</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All R users should upgrade to the latest version:</p>

<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/R-4.4.1"
</code>
</resolution>
<references>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-27322">CVE-2024-27322</uri>
</references>
<metadata tag="requester" timestamp="2024-12-07T08:53:34.596478Z">graaff</metadata>
<metadata tag="submitter" timestamp="2024-12-07T08:53:34.602412Z">graaff</metadata>
</glsa>
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="202412-02">
<title>Cacti: Multiple Vulnerabilities</title>
<synopsis>Multiple vulnerabilities have been discovered in Cacti, the worst of which can lead to privilege escalation.</synopsis>
<product type="ebuild">cacti</product>
<announced>2024-12-07</announced>
<revised count="1">2024-12-07</revised>
<bug>823788</bug>
<bug>834597</bug>
<bug>884799</bug>
<access>remote</access>
<affected>
<package name="net-analyzer/cacti" auto="yes" arch="*">
<unaffected range="ge">1.2.26</unaffected>
<vulnerable range="lt">1.2.26</vulnerable>
</package>
</affected>
<background>
<p>Cacti is a web-based network graphing and reporting tool.</p>
</background>
<description>
<p>Multiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details.</p>
</description>
<impact type="high">
<p>Please review the referenced CVE identifiers for details.</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All Cacti users should upgrade to the latest version:</p>

<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-analyzer/cacti-1.2.26"
</code>
</resolution>
<references>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-14424">CVE-2020-14424</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0730">CVE-2022-0730</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-46169">CVE-2022-46169</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-48547">CVE-2022-48547</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-30534">CVE-2023-30534</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-31132">CVE-2023-31132</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-39357">CVE-2023-39357</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-39358">CVE-2023-39358</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-39359">CVE-2023-39359</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-39360">CVE-2023-39360</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-39361">CVE-2023-39361</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-39362">CVE-2023-39362</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-39365">CVE-2023-39365</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-39510">CVE-2023-39510</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-39511">CVE-2023-39511</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-39512">CVE-2023-39512</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-39513">CVE-2023-39513</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-39514">CVE-2023-39514</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-39515">CVE-2023-39515</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-39516">CVE-2023-39516</uri>
</references>
<metadata tag="requester" timestamp="2024-12-07T08:56:20.459772Z">graaff</metadata>
<metadata tag="submitter" timestamp="2024-12-07T08:56:20.462893Z">graaff</metadata>
</glsa>
Original file line number Diff line number Diff line change
@@ -0,0 +1,64 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="202412-03">
<title>Asterisk: Multiple Vulnerabilities</title>
<synopsis>Multiple vulnerabilities have been discovered in Asterisk, the worst of which can lead to privilege escalation.</synopsis>
<product type="ebuild">asterisk</product>
<announced>2024-12-07</announced>
<revised count="1">2024-12-07</revised>
<bug>771318</bug>
<bug>803440</bug>
<bug>838391</bug>
<bug>884797</bug>
<bug>920026</bug>
<bug>937844</bug>
<bug>939159</bug>
<access>remote</access>
<affected>
<package name="net-misc/asterisk" auto="yes" arch="*">
<unaffected range="ge">18.24.3</unaffected>
<vulnerable range="lt">18.24.3</vulnerable>
</package>
</affected>
<background>
<p>Asterisk is an open source telephony engine and toolkit.</p>
</background>
<description>
<p>Multiple vulnerabilities have been discovered in Asterisk. Please review the CVE identifiers referenced below for details.</p>
</description>
<impact type="high">
<p>Please review the referenced CVE identifiers for details.</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All Asterisk users should upgrade to the latest version:</p>

<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/asterisk-18.24.3"
</code>
</resolution>
<references>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-35776">CVE-2020-35776</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-26712">CVE-2021-26712</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-26713">CVE-2021-26713</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-26714">CVE-2021-26714</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-26717">CVE-2021-26717</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-26906">CVE-2021-26906</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-31878">CVE-2021-31878</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-32558">CVE-2021-32558</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-26498">CVE-2022-26498</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-26499">CVE-2022-26499</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-26651">CVE-2022-26651</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-37325">CVE-2022-37325</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-42705">CVE-2022-42705</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-42706">CVE-2022-42706</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-37457">CVE-2023-37457</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-49294">CVE-2023-49294</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-49786">CVE-2023-49786</uri>
</references>
<metadata tag="requester" timestamp="2024-12-07T08:58:41.628301Z">graaff</metadata>
<metadata tag="submitter" timestamp="2024-12-07T08:58:41.632180Z">graaff</metadata>
</glsa>
Original file line number Diff line number Diff line change
@@ -0,0 +1,129 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="202412-04">
<title>Mozilla Firefox: Multiple Vulnerabilities</title>
<synopsis>Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which arbitrary code execution.</synopsis>
<product type="ebuild">firefox,firefox-bin</product>
<announced>2024-12-07</announced>
<revised count="1">2024-12-07</revised>
<bug>936215</bug>
<bug>937467</bug>
<bug>941169</bug>
<bug>941174</bug>
<bug>941224</bug>
<access>remote</access>
<affected>
<package name="www-client/firefox" auto="yes" arch="*">
<unaffected range="ge" slot="rapid">131.0.2</unaffected>
<unaffected range="ge" slot="esr">123.3.1</unaffected>
<vulnerable range="lt" slot="rapid">131.0.2</vulnerable>
<vulnerable range="lt" slot="esr">128.3.1</vulnerable>
</package>
<package name="www-client/firefox-bin" auto="yes" arch="*">
<unaffected range="ge" slot="rapid">131.0.2</unaffected>
<unaffected range="ge" slot="esr">128.3.1</unaffected>
<vulnerable range="lt" slot="rapid">131.0.2</vulnerable>
<vulnerable range="lt" slot="esr">128.3.1</vulnerable>
</package>
</affected>
<background>
<p>Mozilla Firefox is a popular open-source web browser from the Mozilla project.</p>
</background>
<description>
<p>Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers referenced below for details.</p>
</description>
<impact type="high">
<p>Please review the referenced CVE identifiers for details.</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All Mozilla Firefox users should upgrade to the latest version in their release channel:</p>

<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-client/firefox-bin-131.0.2:rapid"
# emerge --ask --oneshot --verbose ">=www-client/firefox-bin-128.3.1:esr"
</code>

<p>All Mozilla Firefox users should upgrade to the latest version:</p>

<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-client/firefox-131.0.2:rapid"
# emerge --ask --oneshot --verbose ">=www-client/firefox-128.3.1:esr"
</code>
</resolution>
<references>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-6601">CVE-2024-6601</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-6602">CVE-2024-6602</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-6603">CVE-2024-6603</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-6604">CVE-2024-6604</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-6606">CVE-2024-6606</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-6607">CVE-2024-6607</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-6608">CVE-2024-6608</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-6609">CVE-2024-6609</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-6610">CVE-2024-6610</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-6611">CVE-2024-6611</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-6612">CVE-2024-6612</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-6613">CVE-2024-6613</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-6614">CVE-2024-6614</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-6615">CVE-2024-6615</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-7518">CVE-2024-7518</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-7519">CVE-2024-7519</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-7520">CVE-2024-7520</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-7521">CVE-2024-7521</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-7522">CVE-2024-7522</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-7523">CVE-2024-7523</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-7524">CVE-2024-7524</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-7525">CVE-2024-7525</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-7526">CVE-2024-7526</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-7527">CVE-2024-7527</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-7528">CVE-2024-7528</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-7529">CVE-2024-7529</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-7530">CVE-2024-7530</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-7531">CVE-2024-7531</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-8381">CVE-2024-8381</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-8382">CVE-2024-8382</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-8383">CVE-2024-8383</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-8384">CVE-2024-8384</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-8385">CVE-2024-8385</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-8386">CVE-2024-8386</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-8387">CVE-2024-8387</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-8389">CVE-2024-8389</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-8394">CVE-2024-8394</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-8900">CVE-2024-8900</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-9391">CVE-2024-9391</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-9392">CVE-2024-9392</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-9395">CVE-2024-9395</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-9396">CVE-2024-9396</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-9397">CVE-2024-9397</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-9399">CVE-2024-9399</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-9400">CVE-2024-9400</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-9401">CVE-2024-9401</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-9402">CVE-2024-9402</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-9403">CVE-2024-9403</uri>
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-9680">CVE-2024-9680</uri>
<uri>MFSA2024-29</uri>
<uri>MFSA2024-30</uri>
<uri>MFSA2024-31</uri>
<uri>MFSA2024-33</uri>
<uri>MFSA2024-34</uri>
<uri>MFSA2024-35</uri>
<uri>MFSA2024-38</uri>
<uri>MFSA2024-39</uri>
<uri>MFSA2024-40</uri>
<uri>MFSA2024-41</uri>
<uri>MFSA2024-43</uri>
<uri>MFSA2024-44</uri>
<uri>MFSA2024-46</uri>
<uri>MFSA2024-47</uri>
<uri>MFSA2024-48</uri>
<uri>MFSA2024-49</uri>
<uri>MFSA2024-50</uri>
<uri>MFSA2024-51</uri>
</references>
<metadata tag="requester" timestamp="2024-12-07T10:09:25.027501Z">graaff</metadata>
<metadata tag="submitter" timestamp="2024-12-07T10:09:25.030768Z">graaff</metadata>
</glsa>
Loading

0 comments on commit 9d552ed

Please sign in to comment.