Skip to content

Commit f10188c

Browse files
Flatcar Buildbotgithub-actions[bot]
Flatcar Buildbot
authored and
github-actions[bot]
committed
portage-stable/metadata: Monthly GLSA metadata updates
1 parent 751ce39 commit f10188c

15 files changed

+683
-17
lines changed

‎sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
11
-----BEGIN PGP SIGNED MESSAGE-----
22
Hash: SHA512
33

4-
MANIFEST Manifest.files.gz 596980 BLAKE2B eddb25532154bba44bb35623eb68543626c56c08b4a9b70673d678e12e2e9d223dee9cf4d0203ab7966bfde59e62bbac75b407365fffaffd689f74499226bdef SHA512 63607f6c6d89e0de89c2ed0d49a183cf3ebf144547b6b6c3a675072d222d42a76895e60d6f7b099c2762d742420925f50f5f0705f64f212c92b5228a8c6aac91
5-
TIMESTAMP 2025-05-01T06:40:34Z
4+
MANIFEST Manifest.files.gz 598731 BLAKE2B a123a1f501b9be6c59feffa8b43671d5335b382f4b84aa603f3d15893b45a6086a5a70f86be61d8ea32bb8de2a67e35e334f33fcf58bab7db4e23c13e979ce4d SHA512 cbd4d498b4c86dcefe73be854ac45a943cd3c6f816dc6fbe600e09012c372bed7bc821a0065f103f69d153506ed854c91b2f733b93bdc5d36f8322f3e1dddfab
5+
TIMESTAMP 2025-06-01T06:40:37Z
66
-----BEGIN PGP SIGNATURE-----
77

8-
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmgTF2JfFIAAAAAALgAo
8+
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmg79eVfFIAAAAAALgAo
99
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
1010
RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
11-
klDRMQ/+PAi2qYoR0sip4LFgbYOupfpmsR8tU5KJ1/74lCyKWzBeJXLv6ZpzzUfQ
12-
/zdiT7LTQTI/S+rLzGZ9iuru+SDj+TmSaqqe3/V47EMXrIUMQmi2/wpv4Xdz6SZv
13-
vaIEnBvxy7AcER2kd3SjuP7oqh49lY3M8lSxGzDcyLuKLMtA0GruuXoOHK8Kc32p
14-
e4MTmHiysNkwQ48mxpogteDz6UzMDz69H+RidhBJLcXj+VNi69jmLFUUWJ0WlINK
15-
BScxduFU4NdYew2iDUFohVSAvLshHnpWUg/S6WlJo1Kf7XSjROBnuNxbrHrRfBRh
16-
m4mx1fdXE73jM7QOpyx+BflrOEBmvrsGC2WJpI+YU5HmhRldkq9I1+amcPJEx/WD
17-
8lTul44UWczfeDxOjVSwQ4Ez0a3YzGxtvo/6aT/P/8u6lxZwXC73F4vPe9B/qQDn
18-
tCVkS4kDfMQf3zUlypFo3ny6eF54AcWzaT6XDIYVYJD1aSMXXqHhoffznAFB9Tjd
19-
gmYAjCPk/6Oi7WPKEg+TryBnQLv9GEL7TRpQDAAMf0vc8OXwsJbEfS1HO8msMjA7
20-
+q4SVTPh7y9uKR62hu9MLuEXBxm3w4fS+U8e+62SVPIqwFsa5Q92Sh98AOPjK9yY
21-
ViFNSQ0SCOaoWbmk9YFaC7JywXnlIXpD7si1W5a4hQ9aIF+qLqs=
22-
=4GyX
11+
klAGUQ/9Fv/2zVWg3XQg3WRE6NXq4ZOx6laMZFPX+JnhrfyPURTBZNFgFxLhZmq9
12+
7i2nZ48Q4oX2pHM0BQJ9Kkmpb/+JxOmm6ndRrX9TIqI+dQiB87SRcz7N+uCtC57j
13+
yFyEN6szKGSERuuCRI/NDQurxN9gWpGzraukfGmJ/Z8KifFMKSRhntjy2EdT7txb
14+
L9nBGrpziJCuLbamA1BZaHW8LXtKoo+YQbFMul1DKN603JfL8cWBM1xWfkwlDK0Z
15+
Bj55FFy7lIMZqfS7toUqKY1wGophf3wAtHAp+O8J8kUNmrqTAHFgz5qU7Db8DZf3
16+
62AcphUqFo0YQRU+Q0oMZywxIslXbzjseLlGf2BinMATLVgSqlE4InlrUewkHIFg
17+
UBNqSipEhCq36Do99ku7aX3YpoS/UwS9L3YqSsIu3B0aNzd6ehbTdWVIgqlRhLip
18+
rWQPOSJLIn7CbSNVWST/TYOOOU4KSWXamsGH4tA5vFxjB9dwPpf6P9y8SOtjm7LZ
19+
gdxt1WrYto1pS/ugQevFMPFLj3CFkVxDVfATdQvTkV1JIAABw3VucGocTg94RUV6
20+
aj+0R5M2/nGRsPI9ByU8er/b9dV6qJh5U6MIUyxSWXgtMqBcvMSvYqyuZO/bOjHr
21+
NsotXbeYfj/gTvK5vQ0ZY8u5C5LDt5du5XdKK+B7csCZOVofBxA=
22+
=UP7i
2323
-----END PGP SIGNATURE-----

‎sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz

1.71 KB
Binary file not shown.

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202505-01.xml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202505-01">
4+
<title>PAM: Multiple Vulnerabilities</title>
5+
<synopsis>Multiple vulnerabilities have been discovered in PAM, the worst of which could lead to password leakage.</synopsis>
6+
<product type="ebuild">pam</product>
7+
<announced>2025-05-12</announced>
8+
<revised count="1">2025-05-12</revised>
9+
<bug>922397</bug>
10+
<bug>942075</bug>
11+
<access>remote</access>
12+
<affected>
13+
<package name="sys-libs/pam" auto="yes" arch="*">
14+
<unaffected range="ge">1.7.0_p20241230</unaffected>
15+
<vulnerable range="lt">1.7.0_p20241230</vulnerable>
16+
</package>
17+
</affected>
18+
<background>
19+
<p>PAM (Pluggable Authentication Modules) is an architecture allowing the separation of the development of privilege granting software from the development of secure and appropriate authentication schemes.</p>
20+
</background>
21+
<description>
22+
<p>Multiple vulnerabilities have been discovered in PAM. Please review the CVE identifiers referenced below for details.</p>
23+
</description>
24+
<impact type="high">
25+
<p>Please review the referenced CVE identifiers for details.</p>
26+
</impact>
27+
<workaround>
28+
<p>There is no known workaround at this time.</p>
29+
</workaround>
30+
<resolution>
31+
<p>All PAM users should upgrade to the latest version:</p>
32+
33+
<code>
34+
# emerge --sync
35+
# emerge --ask --oneshot --verbose ">=sys-libs/pam-1.7.0_p20241230"
36+
</code>
37+
</resolution>
38+
<references>
39+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-10041">CVE-2024-10041</uri>
40+
</references>
41+
<metadata tag="requester" timestamp="2025-05-12T06:55:41.605140Z">graaff</metadata>
42+
<metadata tag="submitter" timestamp="2025-05-12T06:55:41.608795Z">graaff</metadata>
43+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202505-02.xml

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202505-02">
4+
<title>Mozilla Firefox: Multiple Vulnerabilities</title>
5+
<synopsis>Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution.</synopsis>
6+
<product type="ebuild">firefox,firefox-bin</product>
7+
<announced>2025-05-12</announced>
8+
<revised count="1">2025-05-12</revised>
9+
<bug>951563</bug>
10+
<bug>953021</bug>
11+
<access>remote</access>
12+
<affected>
13+
<package name="www-client/firefox" auto="yes" arch="*">
14+
<unaffected range="ge" slot="stable">137.0.1</unaffected>
15+
<unaffected range="ge" slot="esr">128.9.0</unaffected>
16+
<vulnerable range="lt" slot="stable">137.0.1</vulnerable>
17+
<vulnerable range="lt" slot="esr">128.9.0</vulnerable>
18+
</package>
19+
<package name="www-client/firefox-bin" auto="yes" arch="*">
20+
<unaffected range="ge" slot="stable">137.0.1</unaffected>
21+
<unaffected range="ge" slot="esr">128.9.0</unaffected>
22+
<vulnerable range="lt" slot="stable">137.0.1</vulnerable>
23+
<vulnerable range="lt" slot="esr">128.9.0</vulnerable>
24+
</package>
25+
</affected>
26+
<background>
27+
<p>Mozilla Firefox is a popular open-source web browser from the Mozilla project.</p>
28+
</background>
29+
<description>
30+
<p>Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers referenced below for details.</p>
31+
</description>
32+
<impact type="high">
33+
<p>Please review the referenced CVE identifiers for details.</p>
34+
</impact>
35+
<workaround>
36+
<p>There is no known workaround at this time.</p>
37+
</workaround>
38+
<resolution>
39+
<p>All Mozilla Firefox users should upgrade to the latest version in their release channel:</p>
40+
41+
<code>
42+
# emerge --sync
43+
# emerge --ask --oneshot --verbose ">=www-client/firefox-bin-137.0.1:rapid"
44+
# emerge --ask --oneshot --verbose ">=www-client/firefox-bin-128.9.0:esr"
45+
</code>
46+
47+
<p>All Mozilla Firefox users should upgrade to the latest version:</p>
48+
49+
<code>
50+
# emerge --sync
51+
# emerge --ask --oneshot --verbose ">=www-client/firefox-137.0.1:rapid"
52+
# emerge --ask --oneshot --verbose ">=www-client/firefox-128.9.0:esr"
53+
</code>
54+
</resolution>
55+
<references>
56+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-43097">CVE-2024-43097</uri>
57+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1931">CVE-2025-1931</uri>
58+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1932">CVE-2025-1932</uri>
59+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1933">CVE-2025-1933</uri>
60+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1934">CVE-2025-1934</uri>
61+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1935">CVE-2025-1935</uri>
62+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1936">CVE-2025-1936</uri>
63+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1937">CVE-2025-1937</uri>
64+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1938">CVE-2025-1938</uri>
65+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1941">CVE-2025-1941</uri>
66+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1942">CVE-2025-1942</uri>
67+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1943">CVE-2025-1943</uri>
68+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-3028">CVE-2025-3028</uri>
69+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-3029">CVE-2025-3029</uri>
70+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-3030">CVE-2025-3030</uri>
71+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-3031">CVE-2025-3031</uri>
72+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-3032">CVE-2025-3032</uri>
73+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-3034">CVE-2025-3034</uri>
74+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-3035">CVE-2025-3035</uri>
75+
<uri>MFSA2025-14</uri>
76+
<uri>MFSA2025-16</uri>
77+
<uri>MFSA2025-18</uri>
78+
<uri>MFSA2025-20</uri>
79+
<uri>MFSA2025-22</uri>
80+
<uri>MFSA2025-23</uri>
81+
<uri>MFSA2025-24</uri>
82+
</references>
83+
<metadata tag="requester" timestamp="2025-05-12T08:06:29.059257Z">graaff</metadata>
84+
<metadata tag="submitter" timestamp="2025-05-12T08:06:29.061692Z">graaff</metadata>
85+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202505-03.xml

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202505-03">
4+
<title>Mozilla Thunderbird: Multiple Vulnerabilities</title>
5+
<synopsis>Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution.</synopsis>
6+
<product type="ebuild">thunderbird,thunderbird-bin</product>
7+
<announced>2025-05-12</announced>
8+
<revised count="1">2025-05-12</revised>
9+
<bug>945051</bug>
10+
<bug>948114</bug>
11+
<bug>951564</bug>
12+
<bug>953022</bug>
13+
<access>remote</access>
14+
<affected>
15+
<package name="mail-client/thunderbird" auto="yes" arch="*">
16+
<unaffected range="ge">128.9.0</unaffected>
17+
<vulnerable range="lt">128.9.0</vulnerable>
18+
</package>
19+
<package name="mail-client/thunderbird-bin" auto="yes" arch="*">
20+
<unaffected range="ge">128.9.0</unaffected>
21+
<vulnerable range="lt">128.9.0</vulnerable>
22+
</package>
23+
</affected>
24+
<background>
25+
<p>Mozilla Thunderbird is a popular open-source email client from the Mozilla project.</p>
26+
</background>
27+
<description>
28+
<p>Multiple vulnerabilities have been discovered in Mozilla Thunderbird. Please review the CVE identifiers referenced below for details.</p>
29+
</description>
30+
<impact type="high">
31+
<p>Please review the referenced CVE identifiers for details.</p>
32+
</impact>
33+
<workaround>
34+
<p>There is no known workaround at this time.</p>
35+
</workaround>
36+
<resolution>
37+
<p>All Mozilla Thunderbird users should upgrade to the latest version:</p>
38+
39+
<code>
40+
# emerge --sync
41+
# emerge --ask --oneshot --verbose ">=mail-client/thunderbird-bin-128.9.0"
42+
</code>
43+
44+
<p>All Mozilla Thunderbird users should upgrade to the latest version:</p>
45+
46+
<code>
47+
# emerge --sync
48+
# emerge --ask --oneshot --verbose ">=mail-client/thunderbird-128.9.0"
49+
</code>
50+
</resolution>
51+
<references>
52+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-11692">CVE-2024-11692</uri>
53+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-11694">CVE-2024-11694</uri>
54+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-11695">CVE-2024-11695</uri>
55+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-11696">CVE-2024-11696</uri>
56+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-11697">CVE-2024-11697</uri>
57+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-11699">CVE-2024-11699</uri>
58+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-11700">CVE-2024-11700</uri>
59+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-11701">CVE-2024-11701</uri>
60+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-11704">CVE-2024-11704</uri>
61+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-11705">CVE-2024-11705</uri>
62+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-11706">CVE-2024-11706</uri>
63+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-11708">CVE-2024-11708</uri>
64+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-43097">CVE-2024-43097</uri>
65+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-50336">CVE-2024-50336</uri>
66+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-0237">CVE-2025-0237</uri>
67+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-0238">CVE-2025-0238</uri>
68+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-0239">CVE-2025-0239</uri>
69+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-0240">CVE-2025-0240</uri>
70+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-0241">CVE-2025-0241</uri>
71+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-0242">CVE-2025-0242</uri>
72+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-0243">CVE-2025-0243</uri>
73+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1931">CVE-2025-1931</uri>
74+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1932">CVE-2025-1932</uri>
75+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1933">CVE-2025-1933</uri>
76+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1934">CVE-2025-1934</uri>
77+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1935">CVE-2025-1935</uri>
78+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1936">CVE-2025-1936</uri>
79+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1937">CVE-2025-1937</uri>
80+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-1938">CVE-2025-1938</uri>
81+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-3028">CVE-2025-3028</uri>
82+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-3029">CVE-2025-3029</uri>
83+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-3030">CVE-2025-3030</uri>
84+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-3031">CVE-2025-3031</uri>
85+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-3032">CVE-2025-3032</uri>
86+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-3034">CVE-2025-3034</uri>
87+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-26695">CVE-2025-26695</uri>
88+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-26696">CVE-2025-26696</uri>
89+
<uri>MFSA2024-63</uri>
90+
<uri>MFSA2024-64</uri>
91+
<uri>MFSA2024-65</uri>
92+
<uri>MFSA2024-67</uri>
93+
<uri>MFSA2024-68</uri>
94+
<uri>MFSA2025-01</uri>
95+
<uri>MFSA2025-02</uri>
96+
<uri>MFSA2025-05</uri>
97+
<uri>MFSA2025-14</uri>
98+
<uri>MFSA2025-16</uri>
99+
<uri>MFSA2025-18</uri>
100+
<uri>MFSA2025-20</uri>
101+
<uri>MFSA2025-22</uri>
102+
<uri>MFSA2025-23</uri>
103+
<uri>MFSA2025-24</uri>
104+
</references>
105+
<metadata tag="requester" timestamp="2025-05-12T09:13:59.331961Z">graaff</metadata>
106+
<metadata tag="submitter" timestamp="2025-05-12T09:13:59.334292Z">graaff</metadata>
107+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202505-04.xml

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202505-04">
4+
<title>NVIDIA Drivers: Multiple Vulnerabilities</title>
5+
<synopsis>Multiple vulnerabilities have been discovered in NVIDIA Drivers, the worst of which could result in arbitrary code execution.</synopsis>
6+
<product type="ebuild">nvidia-drivers</product>
7+
<announced>2025-05-12</announced>
8+
<revised count="1">2025-05-12</revised>
9+
<bug>954339</bug>
10+
<access>local</access>
11+
<affected>
12+
<package name="x11-drivers/nvidia-drivers" auto="yes" arch="*">
13+
<unaffected range="ge">535.247.01</unaffected>
14+
<unaffected range="ge">550.163.01</unaffected>
15+
<unaffected range="ge">570.133.07</unaffected>
16+
<vulnerable range="lt">535.247.01</vulnerable>
17+
<vulnerable range="lt">550.163.01</vulnerable>
18+
<vulnerable range="lt">570.133.07</vulnerable>
19+
</package>
20+
</affected>
21+
<background>
22+
<p>NVIDIA Drivers are NVIDIA&#39;s accelerated graphics driver.</p>
23+
</background>
24+
<description>
25+
<p>A vulnerability has been discovered in NVIDIA Drivers. Please review the CVE identifiers referenced below for details.</p>
26+
</description>
27+
<impact type="high">
28+
<p>Please review the referenced CVE identifier for details.</p>
29+
</impact>
30+
<workaround>
31+
<p>There is no known workaround at this time.</p>
32+
</workaround>
33+
<resolution>
34+
<p>All NVIDIA Drivers 535 users should upgrade to the latest version:</p>
35+
36+
<code>
37+
# emerge --sync
38+
# emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-535.247.01:0/535"
39+
</code>
40+
41+
<p>All NVIDIA Drivers 550 users should upgrade to the latest version:</p>
42+
43+
<code>
44+
# emerge --sync
45+
# emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-550.163.01:0/550"
46+
</code>
47+
48+
<p>All NVIDIA Drivers 570 users should upgrade to the latest version:</p>
49+
50+
<code>
51+
# emerge --sync
52+
# emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-570.133.07:0/570"
53+
</code>
54+
</resolution>
55+
<references>
56+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-23244">CVE-2025-23244</uri>
57+
</references>
58+
<metadata tag="requester" timestamp="2025-05-12T10:30:38.991890Z">graaff</metadata>
59+
<metadata tag="submitter" timestamp="2025-05-12T10:30:38.996472Z">graaff</metadata>
60+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202505-05.xml

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202505-05">
4+
<title>Orc: Arbitrary Code Execution</title>
5+
<synopsis>A vulnerability has been discovered in Orc, which can lead to arbitrary code execution</synopsis>
6+
<product type="ebuild">orc</product>
7+
<announced>2025-05-12</announced>
8+
<revised count="1">2025-05-12</revised>
9+
<bug>937127</bug>
10+
<access>local</access>
11+
<affected>
12+
<package name="dev-lang/orc" auto="yes" arch="*">
13+
<unaffected range="ge">0.4.40</unaffected>
14+
<vulnerable range="lt">0.4.40</vulnerable>
15+
</package>
16+
</affected>
17+
<background>
18+
<p>Orc is a library and set of tools for compiling and executing
19+
very simple programs that operate on arrays of data. The &#34;language&#34;
20+
is a generic assembly language that represents many of the features
21+
available in SIMD architectures, including saturated addition and
22+
subtraction, and many arithmetic operations.</p>
23+
</background>
24+
<description>
25+
<p>Please review the CVE identifier referenced below for details.</p>
26+
</description>
27+
<impact type="high">
28+
<p>It is possible for a malicious third party to trigger a buffer overflow and effect code execution with the same privileges as the orc compiler is called with by feeding it with malformed orc source files.
29+
30+
This only affects developers and CI environments using orcc, not users of liborc.</p>
31+
</impact>
32+
<workaround>
33+
<p>There is no known workaround at this time.</p>
34+
</workaround>
35+
<resolution>
36+
<p>All Orc users should upgrade to the latest version:</p>
37+
38+
<code>
39+
# emerge --sync
40+
# emerge --ask --oneshot --verbose ">=dev-lang/orc-0.4.40"
41+
</code>
42+
</resolution>
43+
<references>
44+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-40897">CVE-2024-40897</uri>
45+
</references>
46+
<metadata tag="requester" timestamp="2025-05-12T12:39:16.601801Z">graaff</metadata>
47+
<metadata tag="submitter" timestamp="2025-05-12T12:39:16.605879Z">graaff</metadata>
48+
</glsa>

0 commit comments

Comments
 (0)