[ GLSA 202407-14 ] TigerVNC: Multiple Vulnerabilities
[ GLSA 202407-13 ] WebKitGTK+: Multiple Vulnerabilities
[ GLSA 202407-17 ] BusyBox: Multiple Vulnerabilities
[ GLSA 202407-16 ] GNU Coreutils: Buffer Overflow Vulnerability
[ GLSA 202407-15 ] GraphicsMagick: Multiple Vulnerabilities
[ GLSA 202407-12 ] podman: Multiple Vulnerabilities
[ GLSA 202407-11 ] PuTTY: Multiple Vulnerabilities
[ GLSA 202407-14 ] TigerVNC: Multiple Vulnerabilities
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 202407-14
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: TigerVNC: Multiple Vulnerabilities
Date: July 05, 2024
Bugs: #700464
ID: 202407-14
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been discovered in TigerVNC, the worst of
which could lead to remote code execution.
Background
==========
TigerVNC is a high-performance VNC server/client.
Affected packages
=================
Package Vulnerable Unaffected
----------------- ------------ ------------
net-misc/tigervnc < 1.12.0-r2 >= 1.12.0-r2
Description
===========
Multiple vulnerabilities have been discovered in TigerVNC. Please review
the CVE identifiers referenced below for details.
Impact
======
Please review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All TigerVNC users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/tigervnc-1.12.0-r2"
References
==========
[ 1 ] CVE-2019-15691
https://nvd.nist.gov/vuln/detail/CVE-2019-15691
[ 2 ] CVE-2019-15692
https://nvd.nist.gov/vuln/detail/CVE-2019-15692
[ 3 ] CVE-2019-15694
https://nvd.nist.gov/vuln/detail/CVE-2019-15694
[ 4 ] CVE-2019-15695
https://nvd.nist.gov/vuln/detail/CVE-2019-15695
[ 5 ] CVE-2020-26117
https://nvd.nist.gov/vuln/detail/CVE-2020-26117
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/202407-14
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
[ GLSA 202407-13 ] WebKitGTK+: Multiple Vulnerabilities
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 202407-13
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: WebKitGTK+: Multiple Vulnerabilities
Date: July 05, 2024
Bugs: #923851, #930116
ID: 202407-13
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been discovered in WebKitGTK+, the worst
of which could lead to arbitrary code execution
Background
==========
WebKitGTK+ is a full-featured port of the WebKit rendering engine,
suitable for projects requiring any kind of web integration, from hybrid
HTML/CSS applications to full-fledged web browsers.
Affected packages
=================
Package Vulnerable Unaffected
------------------- ------------ -------------
net-libs/webkit-gtk < 2.44.0:4 >= 2.44.0:4
< 2.44.0:4.1 >= 2.44.0:4.1
< 2.44.0:6 >= 2.44.0:6
Description
===========
Multiple vulnerabilities have been discovered in WebKitGTK+. Please
review the CVE identifiers referenced below for details.
Impact
======
Please review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All WebKitGTK+ users should upgrade to the latest version (depending on
the installed slots):
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.44.0:4"
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.44.0:4.1"
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.44.0:6"
References
==========
[ 1 ] CVE-2014-1745
https://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-1745
[ 2 ] CVE-2023-40414
https://nvd.nist.gov/vuln/detail/CVE-2023-40414
[ 3 ] CVE-2023-42833
https://nvd.nist.gov/vuln/detail/CVE-2023-42833
[ 4 ] CVE-2023-42843
https://nvd.nist.gov/vuln/detail/CVE-2023-42843
[ 5 ] CVE-2023-42950
https://nvd.nist.gov/vuln/detail/CVE-2023-42950
[ 6 ] CVE-2023-42956
https://nvd.nist.gov/vuln/detail/CVE-2023-42956
[ 7 ] CVE-2024-23206
https://nvd.nist.gov/vuln/detail/CVE-2024-23206
[ 8 ] CVE-2024-23213
https://nvd.nist.gov/vuln/detail/CVE-2024-23213
[ 9 ] CVE-2024-23222
https://nvd.nist.gov/vuln/detail/CVE-2024-23222
[ 10 ] CVE-2024-23252
https://nvd.nist.gov/vuln/detail/CVE-2024-23252
[ 11 ] CVE-2024-23254
https://nvd.nist.gov/vuln/detail/CVE-2024-23254
[ 12 ] CVE-2024-23263
https://nvd.nist.gov/vuln/detail/CVE-2024-23263
[ 13 ] CVE-2024-23280
https://nvd.nist.gov/vuln/detail/CVE-2024-23280
[ 14 ] CVE-2024-23284
https://nvd.nist.gov/vuln/detail/CVE-2024-23284
[ 15 ] WSA-2024-0001
https://webkitgtk.org/security/WSA-2024-0001.html
[ 16 ] WSA-2024-0002
https://webkitgtk.org/security/WSA-2024-0002.html
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/202407-13
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
[ GLSA 202407-17 ] BusyBox: Multiple Vulnerabilities
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 202407-17
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: BusyBox: Multiple Vulnerabilities
Date: July 05, 2024
Bugs: #824222
ID: 202407-17
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been discovered in BusyBox, the worst of
which could lead to arbitrary code execution.
Background
==========
BusyBox is set of tools for embedded systems and is a replacement for
GNU Coreutils.
Affected packages
=================
Package Vulnerable Unaffected
---------------- ------------ ------------
sys-apps/busybox < 1.34.0 >= 1.34.0
Description
===========
Multiple vulnerabilities have been discovered in BusyBox. Please review
the CVE identifiers referenced below for details.
Impact
======
Please review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All BusyBox users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-apps/busybox-1.34.0"
References
==========
[ 1 ] CVE-2021-42373
https://nvd.nist.gov/vuln/detail/CVE-2021-42373
[ 2 ] CVE-2021-42374
https://nvd.nist.gov/vuln/detail/CVE-2021-42374
[ 3 ] CVE-2021-42375
https://nvd.nist.gov/vuln/detail/CVE-2021-42375
[ 4 ] CVE-2021-42376
https://nvd.nist.gov/vuln/detail/CVE-2021-42376
[ 5 ] CVE-2021-42377
https://nvd.nist.gov/vuln/detail/CVE-2021-42377
[ 6 ] CVE-2021-42378
https://nvd.nist.gov/vuln/detail/CVE-2021-42378
[ 7 ] CVE-2021-42379
https://nvd.nist.gov/vuln/detail/CVE-2021-42379
[ 8 ] CVE-2021-42380
https://nvd.nist.gov/vuln/detail/CVE-2021-42380
[ 9 ] CVE-2021-42381
https://nvd.nist.gov/vuln/detail/CVE-2021-42381
[ 10 ] CVE-2021-42382
https://nvd.nist.gov/vuln/detail/CVE-2021-42382
[ 11 ] CVE-2021-42383
https://nvd.nist.gov/vuln/detail/CVE-2021-42383
[ 12 ] CVE-2021-42384
https://nvd.nist.gov/vuln/detail/CVE-2021-42384
[ 13 ] CVE-2021-42385
https://nvd.nist.gov/vuln/detail/CVE-2021-42385
[ 14 ] CVE-2021-42386
https://nvd.nist.gov/vuln/detail/CVE-2021-42386
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/202407-17
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
[ GLSA 202407-16 ] GNU Coreutils: Buffer Overflow Vulnerability
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 202407-16
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: GNU Coreutils: Buffer Overflow Vulnerability
Date: July 05, 2024
Bugs: #922474
ID: 202407-16
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
A vulnerability has been discovered in Coreutils, which can lead to a
heap buffer overflow and possibly aribitrary code execution.
Background
==========
The GNU Core Utilities are the basic file, shell and text manipulation
utilities of the GNU operating system.
Affected packages
=================
Package Vulnerable Unaffected
------------------ ------------ ------------
sys-apps/coreutils < 9.4-r1 >= 9.4-r1
Description
===========
A vulnerability has been discovered in the Coreutils "split" program
that can lead to a heap buffer overflow and possibly arbitrary code
execution.
Impact
======
Please review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Coreutils users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-apps/coreutils-9.4-r1"
References
==========
[ 1 ] CVE-2024-0684
https://nvd.nist.gov/vuln/detail/CVE-2024-0684
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/202407-16
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
[ GLSA 202407-15 ] GraphicsMagick: Multiple Vulnerabilities
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 202407-15
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: GraphicsMagick: Multiple Vulnerabilities
Date: July 05, 2024
Bugs: #888545, #890851
ID: 202407-15
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been discovered in GraphicsMagick, the
worst of which could lead to arbitrary code execution.
Background
==========
GraphicsMagick is a collection of tools and libraries which support
reading, writing, and manipulating images in many major formats.
Affected packages
=================
Package Vulnerable Unaffected
------------------------ ------------ ------------
media-gfx/graphicsmagick < 1.3.40 >= 1.3.40
Description
===========
Multiple vulnerabilities have been discovered in GraphicsMagick. Please
review the CVE identifiers referenced below for details.
Impact
======
Please review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All GraphicsMagick users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-gfx/graphicsmagick-1.3.40"
References
==========
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/202407-15
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
[ GLSA 202407-12 ] podman: Multiple Vulnerabilities
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 202407-12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: podman: Multiple Vulnerabilities
Date: July 05, 2024
Bugs: #829896, #870931, #896372, #921290, #923751, #927500, #927501
ID: 202407-12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been discovered in Podman, the worst of
which could lead to privilege escalation.
Background
==========
Podman is a tool for managing OCI containers and pods with a Docker-
compatible CLI.
Affected packages
=================
Package Vulnerable Unaffected
--------------------- ------------ ------------
app-containers/podman < 4.9.4 >= 4.9.4
Description
===========
Please review the referenced CVE identifiers for details.
Impact
======
Please review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Podman users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-containers/podman-4.9.4"
References
==========
[ 1 ] CVE-2021-4024
https://nvd.nist.gov/vuln/detail/CVE-2021-4024
[ 2 ] CVE-2022-2989
https://nvd.nist.gov/vuln/detail/CVE-2022-2989
[ 3 ] CVE-2023-0778
https://nvd.nist.gov/vuln/detail/CVE-2023-0778
[ 4 ] CVE-2023-48795
https://nvd.nist.gov/vuln/detail/CVE-2023-48795
[ 5 ] CVE-2024-1753
https://nvd.nist.gov/vuln/detail/CVE-2024-1753
[ 6 ] CVE-2024-23651
https://nvd.nist.gov/vuln/detail/CVE-2024-23651
[ 7 ] CVE-2024-23652
https://nvd.nist.gov/vuln/detail/CVE-2024-23652
[ 8 ] CVE-2024-23653
https://nvd.nist.gov/vuln/detail/CVE-2024-23653
[ 9 ] CVE-2024-24786
https://nvd.nist.gov/vuln/detail/CVE-2024-24786
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/202407-12
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
[ GLSA 202407-11 ] PuTTY: Multiple Vulnerabilities
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 202407-11
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: PuTTY: Multiple Vulnerabilities
Date: July 05, 2024
Bugs: #920304, #930082
ID: 202407-11
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been discovered in PuTTY, the worst of
which could lead to compromised keys.
Background
==========
PuTTY is a free implementation of Telnet and SSH for Windows and Unix
platforms, along with an xterm terminal emulator.
Affected packages
=================
Package Vulnerable Unaffected
-------------- ------------ ------------
net-misc/putty < 0.81 >= 0.81
Description
===========
Multiple vulnerabilities have been discovered in PuTTY. Please review
the CVE identifiers referenced below for details.
Impact
======
Please review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All PuTTY users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/putty-0.81"
In addition, any keys generated with PuTTY versions 0.68 to 0.80 should
be considered breached and should be regenerated.
References
==========
[ 1 ] CVE-2023-48795
https://nvd.nist.gov/vuln/detail/CVE-2023-48795
[ 2 ] CVE-2024-31497
https://nvd.nist.gov/vuln/detail/CVE-2024-31497
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/202407-11
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
