Merge commit 'bf3b24f23db25fc2a1b67e819a3464f29121e98c'

13 files changed, 724 insertions, 0 deletions

diff --git a/metadata/glsa/glsa-201701-19.xml b/metadata/glsa/glsa-201701-19.xml
new file mode 100644
index 000000000000..d80778d0860f
--- /dev/null
+++ b/metadata/glsa/glsa-201701-19.xml
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201701-19">
+  <title>NTFS-3G: Privilege escalation</title>
+  <synopsis>A vulnerability in NTFS-3G allows local users to gain root
+    privileges.
+  </synopsis>
+  <product type="ebuild">ntfs3g</product>
+  <announced>January 11, 2017</announced>
+  <revised>January 11, 2017: 1</revised>
+  <bug>550970</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-fs/ntfs3g" auto="yes" arch="*">
+      <unaffected range="ge">2016.2.22</unaffected>
+      <vulnerable range="lt">2016.2.22</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>NTFS-3G is a stable, full-featured, read-write NTFS driver for various
+      operating systems.
+    </p>
+  </background>
+  <description>
+    <p>NTFS-3G is affected by the same vulnerability as reported in “GLSA
+      201603-04” when the bundled fuse-lite implementation is used.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A local user could gain root privileges.</p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time. However, on Gentoo when the
+      “external-fuse” USE flag is set or the “suid” USE flag is not set
+      then NTFS-3G is not affected. Both of these cases are the default
+      configuration.
+    </p>
+  </workaround>
+  <resolution>
+    <p>All NTFS-3G users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=sys-fs/ntfs3g-2016.2.22"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3202">CVE-2015-3202</uri>
+    <uri link="https://security.gentoo.org/glsa/201603-04">GLSA 201603-04</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 07 Sep 2016 01:46:01 +0000">
+    BlueKnight
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 11 Jan 2017 12:04:09 +0000">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201701-20.xml b/metadata/glsa/glsa-201701-20.xml
new file mode 100644
index 000000000000..a6f49ee828e4
--- /dev/null
+++ b/metadata/glsa/glsa-201701-20.xml
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201701-20">
+  <title>D-Bus: Format string vulnerability</title>
+  <synopsis>A vulnerability has been found in D-Bus possibly resulting in a
+    local Denial of Service. 
+  </synopsis>
+  <product type="ebuild">dbus</product>
+  <announced>January 11, 2017</announced>
+  <revised>January 11, 2017: 1</revised>
+  <bug>596772</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-apps/dbus" auto="yes" arch="*">
+      <unaffected range="ge">1.10.12</unaffected>
+      <vulnerable range="lt">1.10.12</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>D-Bus is a message bus system, a simple way for applications to talk to
+      one another.
+    </p>
+  </background>
+  <description>
+    <p>It was discovered that D-Bus incorrectly handles certain format strings.</p>
+    
+    <p>The impact of this new vulnerability is believed to not be exploitable
+      if D-Bus is patched against CVE-2015-0245. The previous vulnerability
+      (CVE-2015-0245) was addressed in GLSA-201503-02 referenced below.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A local attacker could cause a Denial of Service condition or possibly
+      execute arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>The vulnerable D-Bus interface is intended only for use by systemd
+      running as root.
+    </p>
+    
+    <p>The administrator can install a policy which denies sending from 
+      org.freedesktop.systemd1.Activator” to D-Bus. This will prevent
+      non-root attackers from reaching the interface in order to exercise this
+      flaw.
+    </p>
+  </workaround>
+  <resolution>
+    <p>All D-Bus users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=sys-apps/dbus-1.10.12"
+    </code>
+  </resolution>
+  <references>
+    <uri link="https://security.gentoo.org/glsa/201503-02">GLSA-201503-02</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 08 Jan 2017 23:47:24 +0000">whissi</metadata>
+  <metadata tag="submitter" timestamp="Wed, 11 Jan 2017 12:08:23 +0000">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201701-21.xml b/metadata/glsa/glsa-201701-21.xml
new file mode 100644
index 000000000000..e17ca4872d42
--- /dev/null
+++ b/metadata/glsa/glsa-201701-21.xml
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201701-21">
+  <title>Expat: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in Expat, the worst of
+    which may allow execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">expat</product>
+  <announced>January 11, 2017</announced>
+  <revised>January 11, 2017: 1</revised>
+  <bug>458742</bug>
+  <bug>555642</bug>
+  <bug>577928</bug>
+  <bug>583268</bug>
+  <bug>585510</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/expat" auto="yes" arch="*">
+      <unaffected range="ge">2.2.0-r1</unaffected>
+      <vulnerable range="lt">2.2.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>Expat is a set of XML parsing libraries.</p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in Expat. Please review
+      the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker, by enticing a user to process a specially crafted XML
+      file, could execute arbitrary code with the privileges of the process or
+      cause a Denial of Service condition.  This attack could also be used
+      against automated systems that arbitrarily process XML files.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All Expat users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=dev-libs/expat-2.2.0-r1"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6702">CVE-2012-6702</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0340">CVE-2013-0340</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1283">CVE-2015-1283</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0718">CVE-2016-0718</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4472">CVE-2016-4472</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5300">CVE-2016-5300</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 31 Dec 2015 03:24:00 +0000">
+    BlueKnight
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 11 Jan 2017 12:13:03 +0000">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201701-22.xml b/metadata/glsa/glsa-201701-22.xml
new file mode 100644
index 000000000000..8853a745812f
--- /dev/null
+++ b/metadata/glsa/glsa-201701-22.xml
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201701-22">
+  <title>NGINX: Privilege escalation</title>
+  <synopsis>Gentoo's NGINX ebuilds are vulnerable to privilege escalation due
+    to the way log files are handled.
+  </synopsis>
+  <product type="ebuild">nginx</product>
+  <announced>January 11, 2017</announced>
+  <revised>January 11, 2017: 1</revised>
+  <bug>605008</bug>
+  <access>local</access>
+  <affected>
+    <package name="www-servers/nginx" auto="yes" arch="*">
+      <unaffected range="ge">1.10.2-r3</unaffected>
+      <vulnerable range="lt">1.10.2-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>nginx is a robust, small, and high performance HTTP and reverse proxy
+      server.
+    </p>
+  </background>
+  <description>
+    <p>It was discovered that Gentoo’s default NGINX installation applied
+      similar problematic permissions on “/var/log/nginx” as Debian
+      (DSA-3701) and is therefore vulnerable to the same attack described in
+      CVE-2016-1247.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A local attacker, who either is already NGINX’s system user or belongs
+      to NGINX’s group, could potentially escalate privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>Ensure that no untrusted user can create files in directories which are
+      used by NGINX (or an NGINX vhost) to store log files.
+    </p>
+  </workaround>
+  <resolution>
+    <p>All NGINX users should upgrade to the latest ebuild revision:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=www-servers/nginx-1.10.2-r3"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1247">CVE-2016-1247</uri>
+    <uri link="https://www.debian.org/security/2016/dsa-3701">DSA-3701</uri>
+    <uri link="https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html">
+      Technical analysis
+    </uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 10 Jan 2017 15:37:19 +0000">whissi</metadata>
+  <metadata tag="submitter" timestamp="Wed, 11 Jan 2017 12:18:42 +0000">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201701-23.xml b/metadata/glsa/glsa-201701-23.xml
new file mode 100644
index 000000000000..255d0dca1576
--- /dev/null
+++ b/metadata/glsa/glsa-201701-23.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201701-23">
+  <title>Botan: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in Botan, the worst of
+    which might allow remote attackers to obtain ECDSA secret keys.
+  </synopsis>
+  <product type="ebuild">botan</product>
+  <announced>January 11, 2017</announced>
+  <revised>January 11, 2017: 1</revised>
+  <bug>581324</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/botan" auto="yes" arch="*">
+      <unaffected range="ge">1.10.13</unaffected>
+      <vulnerable range="lt">1.10.13</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>Botan (Japanese for peony) is a cryptography library written in C++11.</p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in Botan. Please review
+      the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker might obtain ECDSA secret keys via a timing
+      side-channel attack or could possibly bypass TLS policy.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All Botan users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=dev-libs/botan-1.10.13"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2849">CVE-2016-2849</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2850">CVE-2016-2850</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 09 Jan 2017 17:45:34 +0000">whissi</metadata>
+  <metadata tag="submitter" timestamp="Wed, 11 Jan 2017 12:23:40 +0000">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201701-24.xml b/metadata/glsa/glsa-201701-24.xml
new file mode 100644
index 000000000000..90a33c74028a
--- /dev/null
+++ b/metadata/glsa/glsa-201701-24.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201701-24">
+  <title>PgBouncer: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in PgBouncer, the worst of
+    which may allow an attacker to bypass authentication.
+  </synopsis>
+  <product type="ebuild">pgbouncer</product>
+  <announced>January 11, 2017</announced>
+  <revised>January 11, 2017: 1</revised>
+  <bug>550124</bug>
+  <bug>600184</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/pgbouncer" auto="yes" arch="*">
+      <unaffected range="ge">1.7.2</unaffected>
+      <vulnerable range="lt">1.7.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>PgBouncer is a lightweight connection pooler for PostgreSQL.</p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in PgBouncer. Please
+      review the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker might send a specially crafted package possibly
+      resulting in a Denial of Service condition. Furthermore, a remote
+      attacker might bypass authentication in configurations using the
+      “auth_user” feature.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All PgBouncer users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=dev-db/pgbouncer-1.7.2"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4054">CVE-2015-4054</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-6817">CVE-2015-6817</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 09 Jan 2017 13:32:34 +0000">whissi</metadata>
+  <metadata tag="submitter" timestamp="Wed, 11 Jan 2017 12:24:51 +0000">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201701-25.xml b/metadata/glsa/glsa-201701-25.xml
new file mode 100644
index 000000000000..d7af4d709170
--- /dev/null
+++ b/metadata/glsa/glsa-201701-25.xml
@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201701-25">
+  <title>phpBB: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in phpBB, the worst of
+    which may allow remote attackers to inject arbitrary web script or HTML.
+  </synopsis>
+  <product type="ebuild">phpBB</product>
+  <announced>January 11, 2017</announced>
+  <revised>January 11, 2017: 1</revised>
+  <bug>538360</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phpBB" auto="yes" arch="*">
+      <vulnerable range="lt">3.1.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>phpBB is an Open Source bulletin board package.</p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in phpBB. Please review
+      the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker may be able to change settings, inject arbitrary web
+      script or HTML, or conduct cross-site request forgery (CSRF) attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>Gentoo Security support has been discontinued due to phpBB being dropped
+      to unstable. As such, we recommend that users unmerge phpBB:
+    </p>
+    
+    <code>
+      # emerge --unmerge "www-apps/phpBB"
+    </code>
+    
+    <p>NOTE: Users could alternatively upgrade to
+      “&gt;=www-apps/phpBB-3.1.10”, however, these packages are not
+      currently marked stable.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1431">CVE-2015-1431</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1432">CVE-2015-1432</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 08 Jan 2017 20:58:16 +0000">whissi</metadata>
+  <metadata tag="submitter" timestamp="Wed, 11 Jan 2017 12:26:07 +0000">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201701-26.xml b/metadata/glsa/glsa-201701-26.xml
new file mode 100644
index 000000000000..bf8f1bd6415f
--- /dev/null
+++ b/metadata/glsa/glsa-201701-26.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201701-26">
+  <title>BIND: Denial of Service</title>
+  <synopsis>A vulnerability in BIND might allow remote attackers to cause a
+    Denial of Service condition.
+  </synopsis>
+  <product type="ebuild">bind</product>
+  <announced>January 11, 2017</announced>
+  <revised>January 11, 2017: 1</revised>
+  <bug>598750</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/bind" auto="yes" arch="*">
+      <unaffected range="ge">9.10.4_p4</unaffected>
+      <vulnerable range="lt">9.10.4_p4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>BIND (Berkeley Internet Name Domain) is a Name Server.</p>
+  </background>
+  <description>
+    <p>A defect in BIND’s handling of responses containing a DNAME answer can
+      cause a resolver to exit after encountering an assertion failure in db.c
+      or resolver.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker could send a specially crafted DNS request to the BIND
+      resolver possibly resulting in a Denial of Service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All BIND users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=net-dns/bind-9.10.4_p4"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8864">CVE-2016-8864</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 04 Jan 2017 02:59:06 +0000">b-man</metadata>
+  <metadata tag="submitter" timestamp="Wed, 11 Jan 2017 12:27:02 +0000">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201701-27.xml b/metadata/glsa/glsa-201701-27.xml
new file mode 100644
index 000000000000..604624ab6f4d
--- /dev/null
+++ b/metadata/glsa/glsa-201701-27.xml
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201701-27">
+  <title>7-Zip: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in 7-Zip, the worst of
+    which may allow execution of arbitrary code. 
+  </synopsis>
+  <product type="ebuild">7zip</product>
+  <announced>January 11, 2017</announced>
+  <revised>January 11, 2017: 1</revised>
+  <bug>582832</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/p7zip" auto="yes" arch="*">
+      <unaffected range="ge">16.02-r1</unaffected>
+      <vulnerable range="lt">16.02-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>7-Zip is an open-source file archiver, an application used primarily to
+      compress files. 7-Zip uses its own 7z archive format, but can read and
+      write several other archive formats.
+    </p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in 7-Zip. Please review
+      the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker could entice a user to open a specially crafted
+      archive file possibly resulting in execution of arbitrary code with the
+      privileges of the process or a Denial of Service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All 7-Zip users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=app-arch/p7zip-16.02-r1"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2334">CVE-2016-2334</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2335">CVE-2016-2335</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 09 Jan 2017 17:11:43 +0000">whissi</metadata>
+  <metadata tag="submitter" timestamp="Wed, 11 Jan 2017 12:28:26 +0000">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201701-28.xml b/metadata/glsa/glsa-201701-28.xml
new file mode 100644
index 000000000000..705cb7c7d6ee
--- /dev/null
+++ b/metadata/glsa/glsa-201701-28.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201701-28">
+  <title>c-ares: Heap-based buffer overflow</title>
+  <synopsis>A heap-based buffer overflow in c-ares might allow remote attackers
+    to cause a Denial of Service condition.
+  </synopsis>
+  <product type="ebuild">c-ares</product>
+  <announced>January 11, 2017</announced>
+  <revised>January 11, 2017: 1</revised>
+  <bug>595536</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/c-ares" auto="yes" arch="*">
+      <unaffected range="ge">1.12.0</unaffected>
+      <vulnerable range="lt">1.12.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>c-ares is a C library for asynchronous DNS requests (including name
+      resolves).
+    </p>
+  </background>
+  <description>
+    <p>A hostname with an escaped trailing dot (such as “hello\.”) would
+      have its size calculated incorrectly leading to a single byte written
+      beyond the end of a buffer on the heap.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker, able to provide a specially crafted hostname to an
+      application using c-ares, could potentially cause a Denial of Service
+      condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All c-ares users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=net-dns/c-ares-1.12.0"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5180">CVE-2016-5180</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 09 Jan 2017 14:14:23 +0000">whissi</metadata>
+  <metadata tag="submitter" timestamp="Wed, 11 Jan 2017 12:29:54 +0000">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201701-29.xml b/metadata/glsa/glsa-201701-29.xml
new file mode 100644
index 000000000000..fe208305857e
--- /dev/null
+++ b/metadata/glsa/glsa-201701-29.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201701-29">
+  <title>Vim, gVim: Remote execution of arbitrary code</title>
+  <synopsis>A vulnerability has been found in Vim and gVim concerning how
+    certain modeline options are treated.
+  </synopsis>
+  <product type="ebuild">vim, gvim</product>
+  <announced>January 11, 2017</announced>
+  <revised>January 11, 2017: 1</revised>
+  <bug>600650</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-editors/vim" auto="yes" arch="*">
+      <unaffected range="ge">8.0.0106</unaffected>
+      <vulnerable range="lt">8.0.0106</vulnerable>
+    </package>
+    <package name="app-editors/gvim" auto="yes" arch="*">
+      <unaffected range="ge">8.0.0106</unaffected>
+      <vulnerable range="lt">8.0.0106</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>Vim is an efficient, highly configurable improved version of the classic
+      ‘vi’ text editor. gVim is the GUI version of Vim.
+    </p>
+  </background>
+  <description>
+    <p>Vim and gVim do not properly validate values for the ‘filetype’,
+      ‘syntax’, and ‘keymap’ options.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>A remote attacker could entice a user to open a specially crafted file
+      using Vim/gVim with certain modeline options enabled possibly resulting
+      in execution of arbitrary code with the privileges of the process.
+    </p>
+  </impact>
+  <workaround>
+    <p>Disabling modeline support in .vimrc by adding “set nomodeline” will
+      prevent exploitation of this flaw. By default, modeline is enabled for
+      ordinary users but disabled for root.
+    </p>
+  </workaround>
+  <resolution>
+    <p>All Vim users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=app-editors/vim-8.0.0106"
+    </code>
+    
+    <p>All gVim users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=app-editors/gvim-8.0.0106"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1248">CVE-2016-1248</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 09 Jan 2017 17:07:43 +0000">whissi</metadata>
+  <metadata tag="submitter" timestamp="Wed, 11 Jan 2017 12:33:33 +0000">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201701-30.xml b/metadata/glsa/glsa-201701-30.xml
new file mode 100644
index 000000000000..f157c7d8a781
--- /dev/null
+++ b/metadata/glsa/glsa-201701-30.xml
@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201701-30">
+  <title>vzctl: Security bypass</title>
+  <synopsis>A vulnerability in vzctl might allow attackers to gain control over
+    ploop containers.
+  </synopsis>
+  <product type="ebuild">vzctl</product>
+  <announced>January 11, 2017</announced>
+  <revised>January 11, 2017: 1</revised>
+  <bug>560522</bug>
+  <access>local, remote</access>
+  <affected>
+    <package name="sys-cluster/vzctl" auto="yes" arch="*">
+      <unaffected range="ge">4.9.4</unaffected>
+      <vulnerable range="lt">4.9.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>vzctl is a set of control tools for the OpenVZ server virtualization
+      solution.
+    </p>
+  </background>
+  <description>
+    <p>It was discovered that vzctl determined the virtual environment (VE)
+      layout based on the presence of root.hdd/DiskDescriptor.xml in the VE
+      private directory.  This allows local simfs container (CT) root users to
+      change the root password for arbitrary ploop containers.  This is
+      demonstrated by a symlink attack on the ploop container root.hdd file
+      which can then be used to access a control panel.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>An attacker with root privileges, in a simfs-based container, could gain
+      control over ploop-based containers.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All vzctl users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=sys-cluster/vzctl-4.9.4"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-6927">CVE-2015-6927</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 10 Jan 2017 16:32:14 +0000">whissi</metadata>
+  <metadata tag="submitter" timestamp="Wed, 11 Jan 2017 12:39:20 +0000">whissi</metadata>
+</glsa>
diff --git a/metadata/glsa/glsa-201701-31.xml b/metadata/glsa/glsa-201701-31.xml
new file mode 100644
index 000000000000..542858851b37
--- /dev/null
+++ b/metadata/glsa/glsa-201701-31.xml
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201701-31">
+  <title>flex: Potential insecure code generation</title>
+  <synopsis>Flex might generate code with a buffer overflow making applications
+    using such scanners vulnerable to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">flex</product>
+  <announced>January 11, 2017</announced>
+  <revised>January 11, 2017: 1</revised>
+  <bug>589820</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-devel/flex" auto="yes" arch="*">
+      <unaffected range="ge">2.6.1</unaffected>
+      <vulnerable range="lt">2.6.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>flex is a programming tool used to generate scanners (programs which
+      recognize lexical patterns in text).
+    </p>
+  </background>
+  <description>
+    <p>A heap-based buffer overflow in the yy_get_next_buffer function in Flex
+      might allow context-dependent attackers to cause a denial of service or
+      possibly execute arbitrary code via vectors involving num_to_read.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>Context-dependent attackers could cause a Denial of Service condition or
+      possibly execute arbitrary code with the privileges of the process.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All flex users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=sys-devel/flex-2.6.1"
+    </code>
+    
+    <p>Packages which depend on flex may need to be recompiled. Tools such as
+      qdepends (included in app-portage/portage-utils) may assist in
+      identifying these packages:
+    </p>
+    
+    <code>
+      # emerge --oneshot --ask --verbose $(qdepends -CQ sys-devel/flex | sed
+      's/^/=/')
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6354">CVE-2016-6354</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 09 Jan 2017 14:07:40 +0000">whissi</metadata>
+  <metadata tag="submitter" timestamp="Wed, 11 Jan 2017 12:41:44 +0000">whissi</metadata>
+</glsa>