Merge commit '539e8917835f7c7401a65a5c82b96ffed9c18e4e'

8 files changed, 471 insertions, 0 deletions

diff --git a/metadata/glsa/glsa-201707-02.xml b/metadata/glsa/glsa-201707-02.xml
new file mode 100644
index 000000000000..d8ddccf41da0
--- /dev/null
+++ b/metadata/glsa/glsa-201707-02.xml
@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201707-02">
+  <title>Game Music Emu: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in Game Music Emu, the
+    worst of which could lead to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">game-music-emu</product>
+  <announced>2017-07-08</announced>
+  <revised>2017-07-08: 1</revised>
+  <bug>603092</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/game-music-emu" auto="yes" arch="*">
+      <unaffected range="ge" slot="">0.6.1</unaffected>
+      <vulnerable range="lt" slot="">0.6.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>Game Music Emu is a multi-purpose console music emulator and player
+      library.
+    </p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in Game Music Emu. Please
+      review the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker could entice a user to open a specially crafted SPC
+      music file, using Game Music Emu or an application linked against the
+      Game Music Emu library, possibly resulting in execution of arbitrary code
+      with the privileges of the process or a Denial of Service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All Game Music Emu users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=media-libs/game-music-emu-0.6.1"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9957">CVE-2016-9957</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9958">CVE-2016-9958</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9959">CVE-2016-9959</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9960">CVE-2016-9960</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9961">CVE-2016-9961</uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-03-24T05:27:52Z">BlueKnight</metadata>
+  <metadata tag="submitter" timestamp="2017-07-08T12:04:39Z">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201707-03.xml b/metadata/glsa/glsa-201707-03.xml
new file mode 100644
index 000000000000..22c2e86e5fd0
--- /dev/null
+++ b/metadata/glsa/glsa-201707-03.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201707-03">
+  <title>phpMyAdmin: Security bypass</title>
+  <synopsis>A vulnerability in phpMyAdmin might allow remote attackers to
+    bypass authentication.
+  </synopsis>
+  <product type="ebuild">phpmyadmin</product>
+  <announced>2017-07-08</announced>
+  <revised>2017-07-08: 1</revised>
+  <bug>614522</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/phpmyadmin" auto="yes" arch="*">
+      <unaffected range="ge" slot="">4.0.10.20</unaffected>
+      <unaffected range="ge" slot="">4.7.0</unaffected>
+      <vulnerable range="lt" slot="">4.0.10.20</vulnerable>
+      <vulnerable range="lt" slot="">4.7.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>phpMyAdmin is a web-based management tool for MySQL databases.</p>
+  </background>
+  <description>
+    <p>A vulnerability was discovered where the restrictions caused by
+      “$cfg[‘Servers’][$i][‘AllowNoPassword’] = false” are bypassed
+      under certain PHP versions. This can lead compromised user accounts, who
+      have no passwords set, even if the administrator has set
+      “$cfg[‘Servers’][$i][‘AllowNoPassword’]” to false (which is
+      the default).
+    </p>
+    
+    <p>This behavior depends on the PHP version used (it seems PHP 5 is
+      affected, while PHP 7.0 is not).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker, who only needs to know the username, could bypass
+      security restrictions and access phpMyAdmin.
+    </p>
+  </impact>
+  <workaround>
+    <p>Set a password for all users.</p>
+  </workaround>
+  <resolution>
+    <p>All phpMyAdmin 4.0.x users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose
+      "&gt;=dev-db/phpmyadmin-4.0.10.20:4.0.10.20"
+    </code>
+    
+    <p>All other phpMyAdmin users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=dev-db/phpmyadmin-4.7.0:4.7.0"
+    </code>
+  </resolution>
+  <references>
+    <uri link="https://www.phpmyadmin.net/security/PMASA-2017-8/">PMASA-2017-8</uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-04-28T01:10:27Z">BlueKnight</metadata>
+  <metadata tag="submitter" timestamp="2017-07-08T12:04:56Z">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201707-04.xml b/metadata/glsa/glsa-201707-04.xml
new file mode 100644
index 000000000000..f89c27b13d69
--- /dev/null
+++ b/metadata/glsa/glsa-201707-04.xml
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201707-04">
+  <title>libsndfile: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in libsndfile, the worst
+    of which might allow remote attackers to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">libsndfile</product>
+  <announced>2017-07-08</announced>
+  <revised>2017-07-08: 1</revised>
+  <bug>618010</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libsndfile" auto="yes" arch="*">
+      <unaffected range="ge" slot="">1.0.28</unaffected>
+      <vulnerable range="lt" slot="">1.0.28</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>libsndfile is a C library for reading and writing files containing
+      sampled sound.
+    </p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in libsndfile. Please
+      review the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker could entice a user to open a specially crafted file,
+      possibly resulting in the execution of arbitrary code with the privileges
+      of the process, or cause a Denial of Service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All libsndfile users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=media-libs/libsndfile-1.0.28"
+    </code>
+    
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7585">CVE-2017-7585</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7586">CVE-2017-7586</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7741">CVE-2017-7741</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7742">CVE-2017-7742</uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-05-21T07:41:05Z">BlueKnight</metadata>
+  <metadata tag="submitter" timestamp="2017-07-08T12:05:10Z">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201707-05.xml b/metadata/glsa/glsa-201707-05.xml
new file mode 100644
index 000000000000..dfaad4135cb4
--- /dev/null
+++ b/metadata/glsa/glsa-201707-05.xml
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201707-05">
+  <title>OpenSLP: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in OpenSLP, the worst of
+    which allows remote attackers to cause a Denial of Service condition or
+    other unspecified impacts.
+  </synopsis>
+  <product type="ebuild">OpenSLP</product>
+  <announced>2017-07-08</announced>
+  <revised>2017-07-08: 1</revised>
+  <bug>360061</bug>
+  <bug>434918</bug>
+  <bug>583396</bug>
+  <bug>595542</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-libs/openslp" auto="yes" arch="*">
+      <unaffected range="ge" slot="">2.0.0-r4</unaffected>
+      <vulnerable range="lt" slot="">2.0.0-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>OpenSLP is an open-source implementation of Service Location Protocol
+      (SLP).
+    </p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in OpenSLP. Please review
+      the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker could possibly cause a Denial of Service condition or
+      have other unspecified impacts.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All OpenSLP users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=net-libs/openslp-2.0.0-r4"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3609">CVE-2010-3609</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4428">CVE-2012-4428</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4912">CVE-2016-4912</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7567">CVE-2016-7567</uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-05-21T02:50:48Z">BlueKnight</metadata>
+  <metadata tag="submitter" timestamp="2017-07-08T12:05:22Z">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201707-06.xml b/metadata/glsa/glsa-201707-06.xml
new file mode 100644
index 000000000000..7b201894bf60
--- /dev/null
+++ b/metadata/glsa/glsa-201707-06.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201707-06">
+  <title>virglrenderer: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in virglrenderer, the
+    worst of which could allow local guest OS users to cause a Denial of
+    Service condition.
+  </synopsis>
+  <product type="ebuild">virglrenderer</product>
+  <announced>2017-07-08</announced>
+  <revised>2017-07-08: 1</revised>
+  <bug>606996</bug>
+  <bug>607022</bug>
+  <bug>608734</bug>
+  <bug>609400</bug>
+  <bug>609402</bug>
+  <bug>609492</bug>
+  <bug>609494</bug>
+  <bug>610678</bug>
+  <bug>610680</bug>
+  <bug>611378</bug>
+  <bug>611380</bug>
+  <bug>611382</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-libs/virglrenderer" auto="yes" arch="*">
+      <unaffected range="ge" slot="">0.6.0</unaffected>
+      <vulnerable range="lt" slot="">0.6.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>A virtual 3D GPU library, that allows the guest operating system to use
+      the host GPU to accelerate 3D rendering.
+    </p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in virglrenderer. Please
+      review the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A local attacker could cause a Denial of Service condition.</p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All virglrenderer users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=media-libs/virglrenderer-0.6.0"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10163">
+      CVE-2016-10163
+    </uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10214">
+      CVE-2016-10214
+    </uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5580">CVE-2017-5580</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5956">CVE-2017-5956</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5957">CVE-2017-5957</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5993">CVE-2017-5993</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5994">CVE-2017-5994</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6209">CVE-2017-6209</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6210">CVE-2017-6210</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6317">CVE-2017-6317</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6355">CVE-2017-6355</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6386">CVE-2017-6386</uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-05-05T00:14:09Z">BlueKnight</metadata>
+  <metadata tag="submitter" timestamp="2017-07-08T12:06:05Z">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201707-07.xml b/metadata/glsa/glsa-201707-07.xml
new file mode 100644
index 000000000000..153c637eb8c4
--- /dev/null
+++ b/metadata/glsa/glsa-201707-07.xml
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201707-07">
+  <title>JasPer: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in JasPer, the worst of
+    which could could allow an attacker to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">JasPer</product>
+  <announced>2017-07-08</announced>
+  <revised>2017-07-08: 1</revised>
+  <bug>559164</bug>
+  <bug>559168</bug>
+  <bug>571256</bug>
+  <bug>599430</bug>
+  <bug>602848</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/jasper" auto="yes" arch="*">
+      <unaffected range="ge" slot="">2.0.12</unaffected>
+      <vulnerable range="lt" slot="">2.0.12</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>JasPer is a software-based implementation of the codec specified in the
+      JPEG-2000 Part-1 standard.
+    </p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in JasPer. Please review
+      the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker could entice a user to open a specially crafted image
+      file using JasPer possibly resulting in execution of arbitrary code with
+      the privileges of the process or a Denial of Service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All JasPer users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=media-libs/jasper-2.0.12"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5203">CVE-2015-5203</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8751">CVE-2015-8751</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9262">CVE-2016-9262</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9591">CVE-2016-9591</uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-04-30T19:55:35Z">BlueKnight</metadata>
+  <metadata tag="submitter" timestamp="2017-07-08T12:06:24Z">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201707-08.xml b/metadata/glsa/glsa-201707-08.xml
new file mode 100644
index 000000000000..ebfc4a64b955
--- /dev/null
+++ b/metadata/glsa/glsa-201707-08.xml
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201707-08">
+  <title>feh: Arbitrary remote code execution</title>
+  <synopsis>A vulnerability in feh might allow remote attackers to execute
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">feh</product>
+  <announced>2017-07-08</announced>
+  <revised>2017-07-08: 1</revised>
+  <bug>616470</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/feh" auto="yes" arch="*">
+      <unaffected range="ge" slot="">2.18.3</unaffected>
+      <vulnerable range="lt" slot="">2.18.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>feh is an X11 image viewer aimed mostly at console users.</p>
+  </background>
+  <description>
+    <p>Tobias Stoeckmann discovered it was possible to trigger an
+      out-of-boundary heap write with the image viewer feh while receiving an
+      IPC message.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker, pretending to be the E17 window manager, could
+      possibly trigger an out-of-boundary heap write in feh while receiving an
+      IPC message.  This could result in execution of arbitrary code with the
+      privileges of the process or a Denial of Service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All feh users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=media-gfx/feh-2.18.3"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7875">CVE-2017-7875</uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-05-05T00:04:28Z">BlueKnight</metadata>
+  <metadata tag="submitter" timestamp="2017-07-08T12:06:41Z">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201707-09.xml b/metadata/glsa/glsa-201707-09.xml
new file mode 100644
index 000000000000..d8ac9db00f28
--- /dev/null
+++ b/metadata/glsa/glsa-201707-09.xml
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201707-09">
+  <title>GNOME applet for NetworkManager: Arbitrary file read/write</title>
+  <synopsis>A vulnerability has been found in GNOME applet for NetworkManager
+    allowing local attackers to access the local filesystem.
+  </synopsis>
+  <product type="ebuild">nm-applet</product>
+  <announced>2017-07-08</announced>
+  <revised>2017-07-08: 1</revised>
+  <bug>613768</bug>
+  <access>local</access>
+  <affected>
+    <package name="gnome-extra/nm-applet" auto="yes" arch="*">
+      <unaffected range="ge" slot="">1.4.6-r1</unaffected>
+      <vulnerable range="lt" slot="">1.4.6-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>GNOME applet for NetworkManager is a GTK+ 3 front-end which works under
+      Xorg environments with a systray.
+    </p>
+  </background>
+  <description>
+    <p>Frederic Bardy and Quentin Biguenet discovered that GNOME applet for
+      NetworkManager incorrectly checked permissions when connecting to certain
+      wireless networks.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A local attacker could bypass security restrictions at the login screen
+      to access local files.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All GNOME applet for NetworkManager users should upgrade to the latest
+      version:
+    </p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=gnome-extra/nm-applet-1.4.6-r1"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6590">CVE-2017-6590</uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-04-02T12:44:50Z">BlueKnight</metadata>
+  <metadata tag="submitter" timestamp="2017-07-08T12:07:02Z">whissi</metadata>
+</glsa>