{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/20814","repository_url":"https://api.github.com/repos/NixOS/nixpkgs","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/20814/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/20814/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/20814/events","html_url":"https://github.com/NixOS/nixpkgs/issues/20814","id":192559711,"number":20814,"title":"Vulnerability Roundup 11","user":{"login":"grahamc","id":76716,"avatar_url":"https://avatars.githubusercontent.com/u/76716?v=3","gravatar_id":"","url":"https://api.github.com/users/grahamc","html_url":"https://github.com/grahamc","followers_url":"https://api.github.com/users/grahamc/followers","following_url":"https://api.github.com/users/grahamc/following{/other_user}","gists_url":"https://api.github.com/users/grahamc/gists{/gist_id}","starred_url":"https://api.github.com/users/grahamc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/grahamc/subscriptions","organizations_url":"https://api.github.com/users/grahamc/orgs","repos_url":"https://api.github.com/users/grahamc/repos","events_url":"https://api.github.com/users/grahamc/events{/privacy}","received_events_url":"https://api.github.com/users/grahamc/received_events","type":"User","site_admin":false},"labels":[{"id":126506420,"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/1.severity:%20security","name":"1.severity: security","color":"e11d21","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-11-30T13:00:52Z","updated_at":"2016-11-30T13:17:44Z","closed_at":null,"body":"Here are all the vulnerabilities from https://lwn.net/Vulnerabilities\r\nsince our [last roundup](https://github.com/NixOS/nixpkgs/issues/20647)\r\n\r\ncc: @fpletz, @phanimahesh, @NeQuissimus, @vcunat.\r\n\r\n_Note:_ The list of people CC'd on this issue participated in the last\r\nroundup. If you participate on this roundup, I'll cc you on the next\r\none. If you don't participate in the next one, you won't be CC'd on\r\nthe one after that. If you would like to be CC'd on the next roundup.\r\nIf you would like to be CC'd on the next roundup, add a comment to the\r\nmost recent vulnerability roundup. If you would like to be CC'd on\r\n_all_ roundups, leave a comment and tell @grahamc so.\r\n\r\nPermanent CC's: @joepie91, @NixOS/security-notifications\r\n(if you no longer want to be CC'd, ask to be removed from this list)\r\n\r\n## Notes on the list\r\n1. The reports have been roughly grouped by the package name. This\r\n   isn't perfect, but is intended to help identify if a whole group\r\n   of reports is resolved already.\r\n2. Some issues will be duplicated, because it affects multiple packages.\r\n   For example, there are sometimes problems that impact thunderbird,\r\n   and firefox. LWN might report in one vulnerability \"thunderbird\r\n   firefox\". These names have been split to make sure both packages get\r\n   addressed.\r\n3. By each issue is a link to code search for the package name, and\r\n   a Github search by filename. These are to help, but may not return\r\n   results when we do in fact package the software. If a search\r\n   doesn't turn up, please try altering the search criteria or\r\n   looking in nixpkgs manually before asserting we don't have it.\r\n4. This issue is created by https://github.com/NixOS/security\r\n\r\n# Instructions:\r\n\r\n1. Triage a report: If we don't have the software or our version isn't\r\n   vulnerable, tick the box or add a comment with the report number,\r\n   stating it isn't vulnerable.\r\n2. Fix the issue: If we do have the software and it is vulnerable,\r\n   either leave a comment on this issue saying so, even open a pull\r\n   request with the fix. If you open a PR, make sure to tag this\r\n   issue so we can coordinate.\r\n3. When an entire section is completed, move the section to the\r\n   \"Triaged and Resolved Issues\" `details` block below.\r\n\r\n\r\n\r\n## Upon Completion ...\r\n\r\n - [ ] Run the issue through `reformat` one last time\r\n - [ ] Review commits since last roundup for backport candidates\r\n - [ ] Update https://github.com/NixOS/nixpkgs/issues/13515 with a\r\n summary.\r\n - [ ] Update the database at https://github.com/NixOS/security\r\n\r\nWithout further ado...\r\n### Assorted (21 issues)\r\n - [ ] [`#707496`](https://lwn.net/Vulnerabilities/707496/) ([search](http://search.nix.gsc.io/?q=bzip2&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=bzip2+in%3Apath&type=Code))  bzip2: denial of service\r\n - [ ] [`#707215`](https://lwn.net/Vulnerabilities/707215/) ([search](http://search.nix.gsc.io/?q=dovecot22&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=dovecot22+in%3Apath&type=Code))  dovecot22: information disclosure\r\n - [x] [`#707218`](https://lwn.net/Vulnerabilities/707218/) ([search](http://search.nix.gsc.io/?q=gst-plugins-good0.10&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=gst-plugins-good0.10+in%3Apath&type=Code))  gst-plugins-good: code execution\r\n - [x] [`#707218`](https://lwn.net/Vulnerabilities/707218/) ([search](http://search.nix.gsc.io/?q=gst-plugins-good1.0&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=gst-plugins-good1.0+in%3Apath&type=Code))  gst-plugins-good: code execution\r\n - [x] [`#707497`](https://lwn.net/Vulnerabilities/707497/) ([search](http://search.nix.gsc.io/?q=kernel&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=kernel+in%3Apath&type=Code))  kernel: code execution\r\n - [ ] [`#707363`](https://lwn.net/Vulnerabilities/707363/) ([search](http://search.nix.gsc.io/?q=kvm&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=kvm+in%3Apath&type=Code))  kvm: denial of service\r\n - [x] [`#658823`](https://lwn.net/Vulnerabilities/658823/) ([search](http://search.nix.gsc.io/?q=libemail-address-perl&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=libemail-address-perl+in%3Apath&type=Code))  libemail-address-perl: denial of service\r\n - [ ] [`#707357`](https://lwn.net/Vulnerabilities/707357/) ([search](http://search.nix.gsc.io/?q=libgc&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=libgc+in%3Apath&type=Code))  libgc: code execution\r\n - [ ] [`#707491`](https://lwn.net/Vulnerabilities/707491/) ([search](http://search.nix.gsc.io/?q=libsoap-lite-perl&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=libsoap-lite-perl+in%3Apath&type=Code))  libsoap-lite-perl: XML expansion\r\n - [ ] [`#707364`](https://lwn.net/Vulnerabilities/707364/) ([search](http://search.nix.gsc.io/?q=lxc&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=lxc+in%3Apath&type=Code))  lxc: directory traversal\r\n - [ ] [`#707493`](https://lwn.net/Vulnerabilities/707493/) ([search](http://search.nix.gsc.io/?q=mcabber&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=mcabber+in%3Apath&type=Code))  mcabber: roster push attack\r\n - [ ] [`#707361`](https://lwn.net/Vulnerabilities/707361/) ([search](http://search.nix.gsc.io/?q=mujs&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=mujs+in%3Apath&type=Code))  mujs: multiple vulnerabilities\r\n - [ ] [`#707217`](https://lwn.net/Vulnerabilities/707217/) ([search](http://search.nix.gsc.io/?q=ntp&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=ntp+in%3Apath&type=Code))  ntp: multiple vulnerabilities\r\n - [ ] [`#707362`](https://lwn.net/Vulnerabilities/707362/) ([search](http://search.nix.gsc.io/?q=perl-DBD-MySQL&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=perl-DBD-MySQL+in%3Apath&type=Code))  perl-DBD-MySQL: out of bounds read\r\n - [ ] [`#707494`](https://lwn.net/Vulnerabilities/707494/) ([search](http://search.nix.gsc.io/?q=python-tornado&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=python-tornado+in%3Apath&type=Code))  python-tornado: XSRF protection bypass\r\n - [ ] [`#657992`](https://lwn.net/Vulnerabilities/657992/) ([search](http://search.nix.gsc.io/?q=rpcbind&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=rpcbind+in%3Apath&type=Code))  rpcbind: denial of service\r\n - [ ] [`#707214`](https://lwn.net/Vulnerabilities/707214/) ([search](http://search.nix.gsc.io/?q=testdisk&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=testdisk+in%3Apath&type=Code))  testdisk: code execution\r\n - [ ] [`#707356`](https://lwn.net/Vulnerabilities/707356/) ([search](http://search.nix.gsc.io/?q=tomcat6&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=tomcat6+in%3Apath&type=Code))  tomcat: two vulnerabilities\r\n - [ ] [`#707211`](https://lwn.net/Vulnerabilities/707211/) ([search](http://search.nix.gsc.io/?q=vim&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=vim+in%3Apath&type=Code))  vim: code execution\r\n - [ ] [`#707499`](https://lwn.net/Vulnerabilities/707499/) ([search](http://search.nix.gsc.io/?q=wireshark&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=wireshark+in%3Apath&type=Code))  wireshark: denial of service\r\n - [ ] [`#707359`](https://lwn.net/Vulnerabilities/707359/) ([search](http://search.nix.gsc.io/?q=xen&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=xen+in%3Apath&type=Code))  xen: multiple vulnerabilities\r\n\r\n### icu (2 issues)\r\n - [ ] [`#707489`](https://lwn.net/Vulnerabilities/707489/) ([search](http://search.nix.gsc.io/?q=icu&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=icu+in%3Apath&type=Code))  icu: code execution\r\n - [ ] [`#707360`](https://lwn.net/Vulnerabilities/707360/) ([search](http://search.nix.gsc.io/?q=icu&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=icu+in%3Apath&type=Code))  icu: code execution\r\n\r\n### libtiff (2 issues)\r\n - [x] [`#707488`](https://lwn.net/Vulnerabilities/707488/) ([search](http://search.nix.gsc.io/?q=libtiff&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=libtiff+in%3Apath&type=Code))  libtiff: multiple vulnerabilities\r\n - [x] [`#707212`](https://lwn.net/Vulnerabilities/707212/) ([search](http://search.nix.gsc.io/?q=libtiff&i=fosho&repos=nixos-nixpkgs), [files](https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=libtiff+in%3Apath&type=Code))  tiff: buffer overflow\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/comments/263870929","html_url":"https://github.com/NixOS/nixpkgs/issues/20814#issuecomment-263870929","issue_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/20814","id":263870929,"user":{"login":"grahamc","id":76716,"avatar_url":"https://avatars.githubusercontent.com/u/76716?v=3","gravatar_id":"","url":"https://api.github.com/users/grahamc","html_url":"https://github.com/grahamc","followers_url":"https://api.github.com/users/grahamc/followers","following_url":"https://api.github.com/users/grahamc/following{/other_user}","gists_url":"https://api.github.com/users/grahamc/gists{/gist_id}","starred_url":"https://api.github.com/users/grahamc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/grahamc/subscriptions","organizations_url":"https://api.github.com/users/grahamc/orgs","repos_url":"https://api.github.com/users/grahamc/repos","events_url":"https://api.github.com/users/grahamc/events{/privacy}","received_events_url":"https://api.github.com/users/grahamc/received_events","type":"User","site_admin":false},"created_at":"2016-11-30T13:17:44Z","updated_at":"2016-11-30T13:17:44Z","body":"libgc is this: https://github.com/NixOS/nixpkgs/blob/release-16.09/pkgs/development/libraries/boehm-gc/default.nix"}}
{"actor":{"display_login":"grahamc"}}