summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRepository mirror & CI <repomirrorci@gentoo.org>2021-07-15 05:36:22 +0000
committerRepository mirror & CI <repomirrorci@gentoo.org>2021-07-15 05:36:22 +0000
commit894f12e3dc316e19f2eb04f59d77eb9e8ddd2f23 (patch)
tree67ccfea878690fec49a173c6853ff8a4805fcb65 /metadata/glsa
parentMerge updates from master (diff)
parent[ GLSA 202107-36 ] urllib3: Multiple vulnerabilities (diff)
downloadgentoo-894f12e3dc316e19f2eb04f59d77eb9e8ddd2f23.tar.gz
gentoo-894f12e3dc316e19f2eb04f59d77eb9e8ddd2f23.tar.bz2
gentoo-894f12e3dc316e19f2eb04f59d77eb9e8ddd2f23.zip
Merge commit 'a5596fc0c11d9078b1b8e5dd3cd094cd1fabdc62'
Diffstat (limited to 'metadata/glsa')
-rw-r--r--metadata/glsa/glsa-202107-34.xml52
-rw-r--r--metadata/glsa/glsa-202107-35.xml47
-rw-r--r--metadata/glsa/glsa-202107-36.xml50
3 files changed, 149 insertions, 0 deletions
diff --git a/metadata/glsa/glsa-202107-34.xml b/metadata/glsa/glsa-202107-34.xml
new file mode 100644
index 000000000000..45507b800ec2
--- /dev/null
+++ b/metadata/glsa/glsa-202107-34.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202107-34">
+ <title>FluidSynth: Remote code execution</title>
+ <synopsis>A vulnerability was found in FluidSynth that could result in remote
+ code execution.
+ </synopsis>
+ <product type="ebuild">fluidsynth</product>
+ <announced>2021-07-15</announced>
+ <revised count="1">2021-07-15</revised>
+ <bug>782700</bug>
+ <access>remote</access>
+ <affected>
+ <package name="media-sound/fluidsynth" auto="yes" arch="*">
+ <unaffected range="ge">2.2.0</unaffected>
+ <vulnerable range="lt">2.2.0</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>FluidSynth is a real-time synthesizer based on the Soundfont 2
+ specifications.
+ </p>
+ </background>
+ <description>
+ <p>FluidSynth contains a use-after-free in sfloader/fluid_sffile.c which
+ occurs when parsing Soundfile 2 files.
+ </p>
+ </description>
+ <impact type="normal">
+ <p>A remote attacker could entice a user to open a specially crafted
+ Soundfont 2 file using FluidSynth, possibly resulting in execution of
+ arbitrary code with the privileges of the process or a Denial of Service
+ condition.
+ </p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All FluidSynth users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose "&gt;=media-sound/fluidsynth-2.2.0"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-28421">CVE-2021-28421</uri>
+ </references>
+ <metadata tag="requester" timestamp="2021-07-14T23:27:29Z">ajak</metadata>
+ <metadata tag="submitter" timestamp="2021-07-15T05:12:31Z">ajak</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-202107-35.xml b/metadata/glsa/glsa-202107-35.xml
new file mode 100644
index 000000000000..392ebaa6e18e
--- /dev/null
+++ b/metadata/glsa/glsa-202107-35.xml
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202107-35">
+ <title>OpenSCAD: Buffer overflow</title>
+ <synopsis>A buffer overflow in OpenSCAD might allow remote attacker(s) to
+ execute arbitrary code.
+ </synopsis>
+ <product type="ebuild">openscad</product>
+ <announced>2021-07-15</announced>
+ <revised count="1">2021-07-15</revised>
+ <bug>773217</bug>
+ <access>remote</access>
+ <affected>
+ <package name="media-gfx/openscad" auto="yes" arch="*">
+ <unaffected range="ge">2021.01</unaffected>
+ <vulnerable range="lt">2021.01</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>OpenSCAD is the programmer’s solid 3D CAD modeller.</p>
+ </background>
+ <description>
+ <p>A buffer overflow exists in OpenSCAD when parsing STL files.</p>
+ </description>
+ <impact type="normal">
+ <p>A remote attacker could entice a user to open a specially crafted STL
+ file using OpenSCAD, possibly resulting in execution of arbitrary code
+ with the privileges of the process or a Denial of Service condition.
+ </p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All OpenSCAD users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose "&gt;=media-gfx/openscad-2021.01"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-28599">CVE-2020-28599</uri>
+ </references>
+ <metadata tag="requester" timestamp="2021-07-14T23:34:45Z">ajak</metadata>
+ <metadata tag="submitter" timestamp="2021-07-15T05:18:07Z">ajak</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-202107-36.xml b/metadata/glsa/glsa-202107-36.xml
new file mode 100644
index 000000000000..f5fc80d84489
--- /dev/null
+++ b/metadata/glsa/glsa-202107-36.xml
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202107-36">
+ <title>urllib3: Multiple vulnerabilities</title>
+ <synopsis>Multiple vulnerabilities have been found in urllib3, the worst of
+ which could result in a Denial of Service condition.
+ </synopsis>
+ <product type="ebuild">urllib3</product>
+ <announced>2021-07-15</announced>
+ <revised count="1">2021-07-15</revised>
+ <bug>776421</bug>
+ <bug>799413</bug>
+ <access>remote</access>
+ <affected>
+ <package name="dev-python/urllib3" auto="yes" arch="*">
+ <unaffected range="ge">1.26.5</unaffected>
+ <vulnerable range="lt">1.26.5</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>The urllib3 library is an HTTP library with thread-safe connection
+ pooling, file post, and more.
+ </p>
+ </background>
+ <description>
+ <p>Multiple vulnerabilities have been discovered in urllib3. Please review
+ the CVE identifiers referenced below for details.
+ </p>
+ </description>
+ <impact type="normal">
+ <p>An attacker could cause a possible Denial of Service condition.</p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>All urllib3 users should upgrade to the latest version:</p>
+
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose "&gt;=dev-python/urllib3-1.26.5"
+ </code>
+ </resolution>
+ <references>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-28363">CVE-2021-28363</uri>
+ <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-33503">CVE-2021-33503</uri>
+ </references>
+ <metadata tag="requester" timestamp="2021-07-13T14:50:16Z">ajak</metadata>
+ <metadata tag="submitter" timestamp="2021-07-15T05:20:38Z">ajak</metadata>
+</glsa>