From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id D83F51581F0 for ; Thu, 23 Jan 2025 06:28:11 +0000 (UTC) Received: from lists.gentoo.org (bobolink.gentoo.org [140.211.166.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) (Authenticated sender: relay-lists.gentoo.org@gentoo.org) by smtp.gentoo.org (Postfix) with ESMTPSA id C06253431DD for ; Thu, 23 Jan 2025 06:28:11 +0000 (UTC) Received: from bobolink.gentoo.org (localhost [127.0.0.1]) by bobolink.gentoo.org (Postfix) with ESMTP id 6715011044D; Thu, 23 Jan 2025 06:25:42 +0000 (UTC) Received: from smtp.gentoo.org (dev.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by bobolink.gentoo.org (Postfix) with ESMTPS id 7FB9711042D for ; Thu, 23 Jan 2025 06:25:25 +0000 (UTC) Received: from glsamakerdev.dev.gentoo.org (glsamakerdev.dev.gentoo.org [140.211.166.178]) by smtp.gentoo.org (Postfix) with ESMTP id 6573E34302E for ; Thu, 23 Jan 2025 06:25:25 +0000 (UTC) Received: from [172.18.0.3] (unknown [172.18.0.3]) by glsamakerdev.dev.gentoo.org (Postfix) with ESMTP id 5B973C772A for ; Thu, 23 Jan 2025 06:25:25 +0000 (UTC) Subject: [gentoo-announce] [ GLSA 202501-07 ] libgsf: Multiple Vulnerabilities Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-announce@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg="pgp-sha512"; boundary="===============7406019286096938837==" From: glsamaker@gentoo.org To: gentoo-announce@lists.gentoo.org Reply-To: security@gentoo.org Date: Thu, 23 Jan 2025 06:25:25 -0000 Message-ID: <173761352536.7.10586773755219134265@3f85d36892cf> X-Archives-Salt: dd7fbde1-d2f1-44d9-9c96-dd9376ac1aa7 X-Archives-Hash: ef56339719ad2ca9506057c9966e2a60 --===============7406019286096938837== Content-Type: text/plain; charset="utf-8" - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202501-07 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: libgsf: Multiple Vulnerabilities Date: January 23, 2025 Bugs: #940777 ID: 202501-07 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been discovered in libgsf, the worst of which can lead to arbitrary code execution. Background ========== The GNOME Structured File Library is an I/O library that can read and write common file types and handle structured formats that provide file- system-in-a-file semantics. Affected packages ================= Package Vulnerable Unaffected ------------------ ------------ ------------ gnome-extra/libgsf < 1.14.53 >= 1.14.53 Description =========== Multiple vulnerabilities have been discovered in libgsf. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All libgsf users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=gnome-extra/libgsf-1.14.53" References ========== [ 1 ] CVE-2024-36474 https://nvd.nist.gov/vuln/detail/CVE-2024-36474 [ 2 ] CVE-2024-42415 https://nvd.nist.gov/vuln/detail/CVE-2024-42415 [ 3 ] TALOS-2024-2068 [ 4 ] TALOS-2024-2069 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202501-07 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2025 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 --===============7406019286096938837== Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmeR4NUACgkQFMQkOaVy +9kKwRAAw+h7TxRdGPWd28S/A2NTsgHl8B9sAJ29VnE1STeVkz93TXUoDEMi7meA 3FWql51xoGNOR7+5AU3ooC7GNw6zOcLXbTWuXS+eDhdXch0XiS0S1n1F8WBiM30U vEAVTokHqNw9SYvhETZDuZrdhuhBs9mNN13fXVd/ADSLMB4web7QCLVHNyfIBzVf AHoAFKdyVDsh2fipSz4SJ1GW5jCNgWaDH+3kaWQDptNNAw3zOFJidw33QyuNogjG AlZdVMF1QAv+XDva/kggSoA5368j1eQgzJAFolwnaa4NNBWlfgWUNFuPafJGzPzr OuZASmH5lktVH0W0/C5fxFro+KCp6KS/xrGJV4DklGH5FGswB51wVJaFKa9HE5Xj jIrs4jO9hjcP/9YOcxT+PsxO2tv4GdWmMq/QzjzX7vsM9kh3zXe5SYM2tSJZk3CG yaDNJ2DoKRdZRyLNsWQcN9e89P4m1ZYhZNiHqPZ37/g9Blgks7EGlIHOtkxCrBVj nmDr5TOIn8OYMwevI2SCbevBDv5vv7NzXwx965G2P1PzZC2uh24os+HIGPeL6M22 fTawb1gwdHzQrY7K/0x6WW/tKpL43MneCEMZCFOHSfTAflx52vr02SJ2/V5Dvve8 SSl/L/O9kTbsOdCIctHrVqXgYbJvcKhAL+laDuXBku7JnF1TpKs= =5GYi -----END PGP SIGNATURE----- --===============7406019286096938837==--