diff options
author | Repository mirror & CI <repomirrorci@gentoo.org> | 2021-07-15 05:36:22 +0000 |
---|---|---|
committer | Repository mirror & CI <repomirrorci@gentoo.org> | 2021-07-15 05:36:22 +0000 |
commit | 894f12e3dc316e19f2eb04f59d77eb9e8ddd2f23 (patch) | |
tree | 67ccfea878690fec49a173c6853ff8a4805fcb65 /metadata/glsa | |
parent | Merge updates from master (diff) | |
parent | [ GLSA 202107-36 ] urllib3: Multiple vulnerabilities (diff) | |
download | gentoo-894f12e3dc316e19f2eb04f59d77eb9e8ddd2f23.tar.gz gentoo-894f12e3dc316e19f2eb04f59d77eb9e8ddd2f23.tar.bz2 gentoo-894f12e3dc316e19f2eb04f59d77eb9e8ddd2f23.zip |
Merge commit 'a5596fc0c11d9078b1b8e5dd3cd094cd1fabdc62'
Diffstat (limited to 'metadata/glsa')
-rw-r--r-- | metadata/glsa/glsa-202107-34.xml | 52 | ||||
-rw-r--r-- | metadata/glsa/glsa-202107-35.xml | 47 | ||||
-rw-r--r-- | metadata/glsa/glsa-202107-36.xml | 50 |
3 files changed, 149 insertions, 0 deletions
diff --git a/metadata/glsa/glsa-202107-34.xml b/metadata/glsa/glsa-202107-34.xml new file mode 100644 index 000000000000..45507b800ec2 --- /dev/null +++ b/metadata/glsa/glsa-202107-34.xml @@ -0,0 +1,52 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> +<glsa id="202107-34"> + <title>FluidSynth: Remote code execution</title> + <synopsis>A vulnerability was found in FluidSynth that could result in remote + code execution. + </synopsis> + <product type="ebuild">fluidsynth</product> + <announced>2021-07-15</announced> + <revised count="1">2021-07-15</revised> + <bug>782700</bug> + <access>remote</access> + <affected> + <package name="media-sound/fluidsynth" auto="yes" arch="*"> + <unaffected range="ge">2.2.0</unaffected> + <vulnerable range="lt">2.2.0</vulnerable> + </package> + </affected> + <background> + <p>FluidSynth is a real-time synthesizer based on the Soundfont 2 + specifications. + </p> + </background> + <description> + <p>FluidSynth contains a use-after-free in sfloader/fluid_sffile.c which + occurs when parsing Soundfile 2 files. + </p> + </description> + <impact type="normal"> + <p>A remote attacker could entice a user to open a specially crafted + Soundfont 2 file using FluidSynth, possibly resulting in execution of + arbitrary code with the privileges of the process or a Denial of Service + condition. + </p> + </impact> + <workaround> + <p>There is no known workaround at this time.</p> + </workaround> + <resolution> + <p>All FluidSynth users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-sound/fluidsynth-2.2.0" + </code> + </resolution> + <references> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-28421">CVE-2021-28421</uri> + </references> + <metadata tag="requester" timestamp="2021-07-14T23:27:29Z">ajak</metadata> + <metadata tag="submitter" timestamp="2021-07-15T05:12:31Z">ajak</metadata> +</glsa> diff --git a/metadata/glsa/glsa-202107-35.xml b/metadata/glsa/glsa-202107-35.xml new file mode 100644 index 000000000000..392ebaa6e18e --- /dev/null +++ b/metadata/glsa/glsa-202107-35.xml @@ -0,0 +1,47 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> +<glsa id="202107-35"> + <title>OpenSCAD: Buffer overflow</title> + <synopsis>A buffer overflow in OpenSCAD might allow remote attacker(s) to + execute arbitrary code. + </synopsis> + <product type="ebuild">openscad</product> + <announced>2021-07-15</announced> + <revised count="1">2021-07-15</revised> + <bug>773217</bug> + <access>remote</access> + <affected> + <package name="media-gfx/openscad" auto="yes" arch="*"> + <unaffected range="ge">2021.01</unaffected> + <vulnerable range="lt">2021.01</vulnerable> + </package> + </affected> + <background> + <p>OpenSCAD is the programmer’s solid 3D CAD modeller.</p> + </background> + <description> + <p>A buffer overflow exists in OpenSCAD when parsing STL files.</p> + </description> + <impact type="normal"> + <p>A remote attacker could entice a user to open a specially crafted STL + file using OpenSCAD, possibly resulting in execution of arbitrary code + with the privileges of the process or a Denial of Service condition. + </p> + </impact> + <workaround> + <p>There is no known workaround at this time.</p> + </workaround> + <resolution> + <p>All OpenSCAD users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-gfx/openscad-2021.01" + </code> + </resolution> + <references> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-28599">CVE-2020-28599</uri> + </references> + <metadata tag="requester" timestamp="2021-07-14T23:34:45Z">ajak</metadata> + <metadata tag="submitter" timestamp="2021-07-15T05:18:07Z">ajak</metadata> +</glsa> diff --git a/metadata/glsa/glsa-202107-36.xml b/metadata/glsa/glsa-202107-36.xml new file mode 100644 index 000000000000..f5fc80d84489 --- /dev/null +++ b/metadata/glsa/glsa-202107-36.xml @@ -0,0 +1,50 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> +<glsa id="202107-36"> + <title>urllib3: Multiple vulnerabilities</title> + <synopsis>Multiple vulnerabilities have been found in urllib3, the worst of + which could result in a Denial of Service condition. + </synopsis> + <product type="ebuild">urllib3</product> + <announced>2021-07-15</announced> + <revised count="1">2021-07-15</revised> + <bug>776421</bug> + <bug>799413</bug> + <access>remote</access> + <affected> + <package name="dev-python/urllib3" auto="yes" arch="*"> + <unaffected range="ge">1.26.5</unaffected> + <vulnerable range="lt">1.26.5</vulnerable> + </package> + </affected> + <background> + <p>The urllib3 library is an HTTP library with thread-safe connection + pooling, file post, and more. + </p> + </background> + <description> + <p>Multiple vulnerabilities have been discovered in urllib3. Please review + the CVE identifiers referenced below for details. + </p> + </description> + <impact type="normal"> + <p>An attacker could cause a possible Denial of Service condition.</p> + </impact> + <workaround> + <p>There is no known workaround at this time.</p> + </workaround> + <resolution> + <p>All urllib3 users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-python/urllib3-1.26.5" + </code> + </resolution> + <references> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-28363">CVE-2021-28363</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-33503">CVE-2021-33503</uri> + </references> + <metadata tag="requester" timestamp="2021-07-13T14:50:16Z">ajak</metadata> + <metadata tag="submitter" timestamp="2021-07-15T05:20:38Z">ajak</metadata> +</glsa> |