Merge commit '897a88bc971653dc30260f5432ee7d29adee1c07'

4 files changed, 254 insertions, 0 deletions

diff --git a/metadata/glsa/glsa-201705-01.xml b/metadata/glsa/glsa-201705-01.xml
new file mode 100644
index 000000000000..a0e2962bee69
--- /dev/null
+++ b/metadata/glsa/glsa-201705-01.xml
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201705-01">
+  <title>libevent: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in libevent, the worst of
+    which allows remote attackers to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">libevent</product>
+  <announced>2017-05-07</announced>
+  <revised>2017-05-07: 1</revised>
+  <bug>608042</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/libevent" auto="yes" arch="*">
+      <unaffected range="ge">2.1.7_rc</unaffected>
+      <vulnerable range="lt">2.1.7_rc</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>libevent is a library to execute a function when a specific event occurs
+      on a file descriptor.
+    </p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in libevent. Please review
+      the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker could possibly execute arbitrary code with the
+      privileges of the process, or cause a Denial of Service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All libevent users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=dev-libs/libevent-2.1.7_rc"
+    </code>
+    
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10195">
+      CVE-2016-10195
+    </uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10196">
+      CVE-2016-10196
+    </uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10197">
+      CVE-2016-10197
+    </uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-04-27T05:45:34Z">BlueKnight</metadata>
+  <metadata tag="submitter" timestamp="2017-05-07T20:14:35Z">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201705-02.xml b/metadata/glsa/glsa-201705-02.xml
new file mode 100644
index 000000000000..2816380e4391
--- /dev/null
+++ b/metadata/glsa/glsa-201705-02.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201705-02">
+  <title>Chromium: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in the Chromium web
+    browser, the worst of which allows remote attackers to execute arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">chromium</product>
+  <announced>2017-05-07</announced>
+  <revised>2017-05-07: 1</revised>
+  <bug>616048</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/chromium" auto="yes" arch="*">
+      <unaffected range="ge">58.0.3029.81</unaffected>
+      <vulnerable range="lt">58.0.3029.81</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>Chromium is an open-source browser project that aims to build a safer,
+      faster, and more stable way for all users to experience the web.
+    </p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in the Chromium web
+      browser. Please review the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker could possibly execute arbitrary code with the
+      privileges of the process, cause a Denial of Service condition, obtain
+      sensitive information, bypass security restrictions or spoof content.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All Chromium users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose
+      "&gt;=www-client/chromium-58.0.3029.81"
+    </code>
+    
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5057">CVE-2017-5057</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5058">CVE-2017-5058</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5059">CVE-2017-5059</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5060">CVE-2017-5060</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5061">CVE-2017-5061</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5062">CVE-2017-5062</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5063">CVE-2017-5063</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5064">CVE-2017-5064</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5065">CVE-2017-5065</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5066">CVE-2017-5066</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5067">CVE-2017-5067</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5069">CVE-2017-5069</uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-04-28T01:40:34Z">BlueKnight</metadata>
+  <metadata tag="submitter" timestamp="2017-05-07T20:15:34Z">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201705-03.xml b/metadata/glsa/glsa-201705-03.xml
new file mode 100644
index 000000000000..34124fe984bc
--- /dev/null
+++ b/metadata/glsa/glsa-201705-03.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201705-03">
+  <title>Oracle JDK/JRE: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in Oracle's JRE and JDK
+    software suites, the worst of which may allow execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">jre,jdk,oracle</product>
+  <announced>2017-05-07</announced>
+  <revised>2017-05-07: 1</revised>
+  <bug>616050</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/oracle-jre-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.8.0.131</unaffected>
+      <vulnerable range="lt">1.8.0.131</vulnerable>
+    </package>
+    <package name="dev-java/oracle-jdk-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.8.0.131</unaffected>
+      <vulnerable range="lt">1.8.0.131</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>Java Platform, Standard Edition (Java SE) lets you develop and deploy
+      Java applications on desktops and servers, as well as in today’s
+      demanding embedded environments. Java offers the rich user interface,
+      performance, versatility, portability, and security that today’s
+      applications require.
+    </p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in in Oracle’s JRE and
+      JDK. Please review the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker could possibly execute arbitrary code with the
+      privileges of the process, gain access to information, or cause a Denial
+      of Service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All Oracle JRE users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose
+      "&gt;=dev-java/oracle-jre-bin-1.8.0.131"
+    </code>
+    
+    <p>All Oracle JDK users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose
+      "&gt;=dev-java/oracle-jdk-bin-1.8.0.131"
+    </code>
+    
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3509">CVE-2017-3509</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3511">CVE-2017-3511</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3512">CVE-2017-3512</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3514">CVE-2017-3514</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3526">CVE-2017-3526</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3533">CVE-2017-3533</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3539">CVE-2017-3539</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3544">CVE-2017-3544</uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-04-28T06:54:02Z">BlueKnight</metadata>
+  <metadata tag="submitter" timestamp="2017-05-07T20:16:21Z">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201705-04.xml b/metadata/glsa/glsa-201705-04.xml
new file mode 100644
index 000000000000..d924eb640b6f
--- /dev/null
+++ b/metadata/glsa/glsa-201705-04.xml
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201705-04">
+  <title>Mozilla Network Security Service (NSS): Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in NSS, the worst of which
+    may allow execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">nss</product>
+  <announced>2017-05-07</announced>
+  <revised>2017-05-07: 1</revised>
+  <bug>616032</bug>
+  <bug>616036</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/nss" auto="yes" arch="*">
+      <unaffected range="ge">3.29.5</unaffected>
+      <vulnerable range="lt">3.29.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>The Mozilla Network Security Service (NSS) is a library implementing
+      security features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS
+      #12, S/MIME and X.509 certificates.
+    </p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in NSS. Please review the
+      CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker could possibly execute arbitrary code with the
+      privileges of the process, cause a Denial of Service condition, or view
+      sensitive information.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All NSS users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=dev-libs/nss-3.29.5"
+    </code>
+    
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5461">CVE-2017-5461</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5462">CVE-2017-5462</uri>
+  </references>
+  <metadata tag="requester" timestamp="2017-04-30T13:52:41Z">BlueKnight</metadata>
+  <metadata tag="submitter" timestamp="2017-05-07T20:17:08Z">whissi</metadata>
+</glsa>