{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/21289","repository_url":"https://api.github.com/repos/NixOS/nixpkgs","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/21289/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/21289/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/21289/events","html_url":"https://github.com/NixOS/nixpkgs/issues/21289","id":196532606,"number":21289,"title":"Vulnerability Roundup 14","user":{"login":"grahamc","id":76716,"avatar_url":"https://avatars.githubusercontent.com/u/76716?v=3","gravatar_id":"","url":"https://api.github.com/users/grahamc","html_url":"https://github.com/grahamc","followers_url":"https://api.github.com/users/grahamc/followers","following_url":"https://api.github.com/users/grahamc/following{/other_user}","gists_url":"https://api.github.com/users/grahamc/gists{/gist_id}","starred_url":"https://api.github.com/users/grahamc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/grahamc/subscriptions","organizations_url":"https://api.github.com/users/grahamc/orgs","repos_url":"https://api.github.com/users/grahamc/repos","events_url":"https://api.github.com/users/grahamc/events{/privacy}","received_events_url":"https://api.github.com/users/grahamc/received_events","type":"User","site_admin":false},"labels":[{"id":126506420,"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/1.severity:%20security","name":"1.severity: security","color":"e11d21","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-12-19T22:05:31Z","updated_at":"2016-12-20T13:30:32Z","closed_at":null,"body":"Here are all the vulnerabilities from https://lwn.net/Vulnerabilities\r\nsince our [last roundup](https://github.com/NixOS/nixpkgs/issues/21142)\r\n\r\nThis roundup is different from previous' due to Christmas: http://lists.science.uu.nl/pipermail/nix-dev/2016-December/022367.html\r\n\r\nI will update this issue tomorrow and Wednesday with new issues.\r\n\r\ncc: @NeQuissimus @bachp @domenkozar @makefu.\r\n\r\n_Note:_ The list of people CC'd on this issue participated in the last\r\nroundup. If you participate on this roundup, I'll cc you on the next\r\none. If you don't participate in the next one, you won't be CC'd on\r\nthe one after that. If you would like to be CC'd on the next roundup,\r\nadd a comment to the most recent vulnerability roundup.\r\nIf you would like to be CC'd on _all_ roundups, leave a comment and\r\ntell @grahamc so.\r\n\r\nPermanent CC's: @joepie91, @phanimahesh, @NixOS/security-notifications\r\n(if you no longer want to be CC'd, ask to be removed from this list)\r\n\r\n## Notes on the list\r\n1. The reports have been roughly grouped by the package name. This\r\n   isn't perfect, but is intended to help identify if a whole group\r\n   of reports is resolved already.\r\n2. Some issues will be duplicated, because it affects multiple\r\n   packages. For example, there are sometimes problems that impact\r\n   thunderbird, and firefox. LWN might report in one vulnerability\r\n   \"thunderbird firefox\". These names have been split to make sure\r\n   both packages get addressed.\r\n3. By each issue is a link to code search for the package name, and\r\n   a Github search by filename. These are to help, but may not return\r\n   results when we do in fact package the software. If a search\r\n   doesn't turn up, please try altering the search criteria or\r\n   looking in nixpkgs manually before asserting we don't have it.\r\n4. This issue is created by https://github.com/NixOS/security\r\n\r\n# Instructions:\r\n\r\n1. Triage a report: If we don't have the software or our version isn't\r\n   vulnerable, tick the box or add a comment with the report number,\r\n   stating it isn't vulnerable.\r\n2. Fix the issue: If we do have the software and it is vulnerable,\r\n   either leave a comment on this issue saying so, even open a pull\r\n   request with the fix. If you open a PR, make sure to tag this\r\n   issue so we can coordinate.\r\n3. When an entire section is completed, move the section to the\r\n   \"Triaged and Resolved Issues\" `details` block below.\r\n\r\n\r\n\r\n## Upon Completion ...\r\n\r\n - [ ] Run the issue through `reformat` one last time\r\n - [ ] Review commits since last roundup for backport candidates\r\n - [ ] Send an update e-mail to nix-security-announce@googlegroups.com\r\n - [ ] Update the database at https://github.com/NixOS/security\r\n\r\nWithout further ado...\r\n### Assorted (10 issues)\r\n - [x] [`#709363`](https://lwn.net/Vulnerabilities/709363/) ([search](http://search.nix.gsc.io/?q=apport&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=apport+in%3Apath&type=Code))  apport: three vulnerabilities\r\n - [x] [`#709149`](https://lwn.net/Vulnerabilities/709149/) ([search](http://search.nix.gsc.io/?q=apt&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=apt+in%3Apath&type=Code))  apt: code execution\r\n - [x] [`#709669`](https://lwn.net/Vulnerabilities/709669/) ([search](http://search.nix.gsc.io/?q=kernel&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=kernel+in%3Apath&type=Code))  kernel: out of bounds stack read\r\n - [ ] [`#709466`](https://lwn.net/Vulnerabilities/709466/) ([search](http://search.nix.gsc.io/?q=libupnp&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=libupnp+in%3Apath&type=Code))  libupnp: code execution\r\n - [ ] [`#709664`](https://lwn.net/Vulnerabilities/709664/) ([search](http://search.nix.gsc.io/?q=most&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=most+in%3Apath&type=Code))  most: command execution\r\n - [ ] [`#709666`](https://lwn.net/Vulnerabilities/709666/) ([search](http://search.nix.gsc.io/?q=nagios&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=nagios+in%3Apath&type=Code))  nagios: two vulnerabilities\r\n - [ ] [`#709146`](https://lwn.net/Vulnerabilities/709146/) ([search](http://search.nix.gsc.io/?q=python-html5lib&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=python-html5lib+in%3Apath&type=Code))  python-html5lib: cross-site scripting\r\n - [ ] [`#709661`](https://lwn.net/Vulnerabilities/709661/) ([search](http://search.nix.gsc.io/?q=samba&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=samba+in%3Apath&type=Code))  samba: three vulnerabilities\r\n - [x] [`#709162`](https://lwn.net/Vulnerabilities/709162/) ([search](http://search.nix.gsc.io/?q=w3m&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=w3m+in%3Apath&type=Code))  w3m: multiple vulnerabilities\r\n - [ ] [`#709670`](https://lwn.net/Vulnerabilities/709670/) ([search](http://search.nix.gsc.io/?q=xen&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=xen+in%3Apath&type=Code))  xen: multiple vulnerabilities\r\n\r\n### firefox (3 issues)\r\n - [x] [`#709468`](https://lwn.net/Vulnerabilities/709468/) ([search](http://search.nix.gsc.io/?q=firefox&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=firefox+in%3Apath&type=Code))  firefox: denial of service\r\n - [x] [`#709140`](https://lwn.net/Vulnerabilities/709140/) ([search](http://search.nix.gsc.io/?q=firefox&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=firefox+in%3Apath&type=Code))  mozilla: multiple vulnerabilities\r\n - [x] [`#709141`](https://lwn.net/Vulnerabilities/709141/) ([search](http://search.nix.gsc.io/?q=firefox&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=firefox+in%3Apath&type=Code))  mozilla: multiple vulnerabilities\r\n\r\n### game-music-emu (2 issues)\r\n - [x] [`#709663`](https://lwn.net/Vulnerabilities/709663/) ([search](http://search.nix.gsc.io/?q=game-music-emu&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=game-music-emu+in%3Apath&type=Code))  game-music-emu: multiple vulnerabilities\r\n - [x] [`#709341`](https://lwn.net/Vulnerabilities/709341/) ([search](http://search.nix.gsc.io/?q=game-music-emu&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=game-music-emu+in%3Apath&type=Code))  game-music-emu: code execution\r\n\r\n### tomcat (2 issues)\r\n - [x] [`#709662`](https://lwn.net/Vulnerabilities/709662/) ([search](http://search.nix.gsc.io/?q=tomcat&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=tomcat+in%3Apath&type=Code))  tomcat: two vulnerabilities\r\n - [x] [`#709342`](https://lwn.net/Vulnerabilities/709342/) ([search](http://search.nix.gsc.io/?q=tomcat&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=tomcat+in%3Apath&type=Code))  tomcat: denial of service\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/comments/268243233","html_url":"https://github.com/NixOS/nixpkgs/issues/21289#issuecomment-268243233","issue_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/21289","id":268243233,"user":{"login":"michalpalka","id":5004087,"avatar_url":"https://avatars.githubusercontent.com/u/5004087?v=3","gravatar_id":"","url":"https://api.github.com/users/michalpalka","html_url":"https://github.com/michalpalka","followers_url":"https://api.github.com/users/michalpalka/followers","following_url":"https://api.github.com/users/michalpalka/following{/other_user}","gists_url":"https://api.github.com/users/michalpalka/gists{/gist_id}","starred_url":"https://api.github.com/users/michalpalka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michalpalka/subscriptions","organizations_url":"https://api.github.com/users/michalpalka/orgs","repos_url":"https://api.github.com/users/michalpalka/repos","events_url":"https://api.github.com/users/michalpalka/events{/privacy}","received_events_url":"https://api.github.com/users/michalpalka/received_events","type":"User","site_admin":false},"created_at":"2016-12-20T13:30:32Z","updated_at":"2016-12-20T13:30:32Z","body":"@grahamc My schedule is full for the next 2 days, but will look at it on Friday"}}
{"actor":{"display_login":"michalpalka"}}