Add main/ proj/ rdf/ security/

Purge commited CVS dirs in images.
Don't add more CVS dirs

1522 files changed, 115777 insertions, 0 deletions

diff --git a/xml/htdocs/security/en/glsa/glsa-200310-03.xml b/xml/htdocs/security/en/glsa/glsa-200310-03.xml
new file mode 100644
index 00000000..11916d6c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200310-03.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+
+<glsa id="200310-03">
+  <title>Apache: multiple buffer overflows</title>
+  <synopsis>
+    Multiple stack-based buffer overflows in mod_alias and mod_rewrite can allow
+    execution of arbitrary code and cause a denial of service.
+  </synopsis>
+  <product type="ebuild">Apache</product>
+  <announced>2003-10-28</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>32194</bug>
+  <access>local</access>
+  <affected>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="ge">1.3.29</unaffected>
+      <vulnerable range="lt">1.3.29</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP Server is one of the most popular web servers on the
+    Internet.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple stack-based buffer overflows in mod_alias and mod_rewrite allow
+    attackers who can create or edit configuration files including .htaccess
+    files, to cause a denial of service and execute arbitrary code via a regular
+    expression containing more than 9 captures.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker may cause a denial of service or execute arbitrary code with the
+    privileges of the user that is running apache.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time, other than to disable both
+    mod_alias and mod_rewrite.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    It is recommended that all Gentoo Linux users who are running
+    net-misc/apache 1.x upgrade:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv apache
+    # emerge '&gt;=www-servers/apache-1.3.29'
+    # emerge clean
+    # /etc/init.d/apache restart</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0542">CAN-2003-0542 (under review at time of GLSA)</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200310-04.xml b/xml/htdocs/security/en/glsa/glsa-200310-04.xml
new file mode 100644
index 00000000..68787c56
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200310-04.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+
+<glsa id="200310-04">
+  <title>Apache: buffer overflows and a possible information disclosure</title>
+  <synopsis>
+    Multiple stack-based buffer overflows in mod_alias and mod_rewrite can allow
+    execution of arbitrary code and cause a denial of service, and a bug in the
+    way mod_cgid handles CGI redirect paths could result in CGI output going to
+    the wrong client.
+  </synopsis>
+  <product type="ebuild">Apache</product>
+  <announced>2003-10-31</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>32271</bug>
+  <access>local</access>
+  <affected>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="ge">2.0.48</unaffected>
+      <unaffected range="lt">2.0</unaffected>
+      <vulnerable range="lt">2.0.48</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP Server is one of the most popular web servers on the
+    Internet.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple stack-based buffer overflows in mod_alias and mod_rewrite allow
+    attackers who can create or edit configuration files including .htaccess
+    files, to cause a denial of service and execute arbitrary code via a regular
+    expression containing more than 9 captures, and a bug in the way mod_cgid
+    handles CGI redirect paths could result in CGI output going to the wrong
+    client when a threaded MPM is used, resulting in an information disclosure.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker may cause a denial of service or execute arbitrary code with the
+    privileges of the user that is running apache.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    It is recommended that all Gentoo Linux users who are running
+    net-misc/apache 2.x upgrade:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv '&gt;=www-servers/apache-2.0.48'
+    # emerge '&gt;=www-servers/apache-2.0.48'
+    # emerge clean
+    # /etc/init.d/apache2 restart</code>
+    <p>
+    Please remember to update your config files in /etc/apache2 as --datadir has
+    been changed to /var/www/localhost.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0789">CAN-2003-0789</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0542">CAN-2003-0542</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200311-01.xml b/xml/htdocs/security/en/glsa/glsa-200311-01.xml
new file mode 100644
index 00000000..d45ccbed
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200311-01.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+
+<glsa id="200311-01">
+  <title>kdebase: KDM vulnerabilities</title>
+  <synopsis>
+    A bug in KDM can allow privilege escalation with certain configurations of
+    PAM modules.
+  </synopsis>
+  <product type="ebuild">kdebase</product>
+  <announced>2003-11-15</announced>
+  <revised>2003-11-15: 01</revised>
+  <bug>29406</bug>
+  <access>local / remote</access>
+  <affected>
+    <package name="kde-base/kdebase" auto="yes" arch="*">
+      <unaffected range="ge">3.1.4</unaffected>
+      <vulnerable range="le">3.1.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDM is the desktop manager included with the K Desktop Environment.
+    </p>
+  </background>
+  <description>
+    <p>
+    Firstly, versions of KDM &lt;=3.1.3 are vulnerable to a privilege escalation
+    bug with a specific configuration of PAM modules.  Users who do not use PAM
+    with KDM and users who use PAM with regular Unix crypt/MD5 based
+    authentication methods are not affected.
+    </p>
+    <p>
+    Secondly, KDM uses a weak cookie generation algorithm.  Users are advised to
+    upgrade to KDE 3.1.4, which uses /dev/urandom as a non-predictable source of
+    entropy to improve security.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote or local attacker could gain root privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    It is recommended that all Gentoo Linux users who are running
+    kde-base/kdebase &lt;=3.1.3 upgrade:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv '&gt;=kde-base/kde-3.1.4'
+    # emerge '&gt;=kde-base/kde-3.1.4'
+    # emerge clean</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0690">CAN-2003-0690</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0692">CAN-2003-0692</uri>
+    <uri link="http://www.kde.org/info/security/advisory-20030916-1.txt">KDE Security Advisory</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200311-02.xml b/xml/htdocs/security/en/glsa/glsa-200311-02.xml
new file mode 100644
index 00000000..2844958a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200311-02.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+
+<glsa id="200311-02">
+  <title>Opera: buffer overflows in 7.11 and 7.20</title>
+  <synopsis>
+    Buffer overflows exist in Opera 7.11 and 7.20 that can cause Opera to crash,
+    and can potentially overwrite arbitrary bytes on the heap leading to a
+    system compromise.
+  </synopsis>
+  <product type="ebuild">Opera</product>
+  <announced>2003-11-19</announced>
+  <revised>2003-11-19: 01</revised>
+  <bug>31775</bug>
+  <access>local / remote</access>
+  <affected>
+    <package name="www-client/opera" auto="yes" arch="*">
+      <unaffected range="ge">7.21</unaffected>
+      <vulnerable range="eq">7.20</vulnerable>
+      <vulnerable range="eq">7.11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Opera is a multi-platform web browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Opera browser can cause a buffer allocated on the heap to overflow under
+    certain HREFs when rendering HTML.  The mail system is also deemed
+    vulnerable and an attacker can send an email containing a malformed HREF, or
+    plant the malicious HREF on a web site.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Certain HREFs can cause a buffer allocated on the heap to overflow when
+    rendering HTML which can allow arbitrary bytes on the heap to be overwritten
+    which can result in a system compromise.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Users are encouraged to perform an 'emerge sync' and upgrade the package
+    to the latest available version.  Opera 7.22 is recommended as Opera 7.21 is
+    vulnerable to other security flaws. Specific steps to upgrade:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv '&gt;=www-client/opera-7.22'
+    # emerge '&gt;=www-client/opera-7.22'
+    # emerge clean</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0870">CAN-2003-0870</uri>
+    <uri link="http://www.atstake.com/research/advisories/2003/a102003-1.txt">@stake Security Advisory</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200311-03.xml b/xml/htdocs/security/en/glsa/glsa-200311-03.xml
new file mode 100644
index 00000000..8afc2751
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200311-03.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+
+<glsa id="200311-03">
+  <title>HylaFAX: Remote code exploit in hylafax</title>
+  <synopsis>
+    A format bug condition allows a remote attacjer to execute arbitrary code as
+    the root user.
+  </synopsis>
+  <product type="ebuild">HylaFAX</product>
+  <announced>2003-11-10</announced>
+  <revised>2003-11-10: 01</revised>
+  <bug>33368</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/hylafax" auto="yes" arch="*">
+      <unaffected range="ge">4.1.8</unaffected>
+      <vulnerable range="le">4.1.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    HylaFAX is a popular client-server fax package.
+    </p>
+  </background>
+  <description>
+    <p>
+    During a code review of the hfaxd server, the SuSE Security Team discovered
+    a format bug condition that allows a remote attacker to execute arbitrary
+    code as the root user.  However, the bug cannot be triggered in the default
+    hylafax configuration.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could execute arbitrary code with root privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Users are encouraged to perform an 'emerge sync' and upgrade the package to
+    the latest available version.  Vulnerable versions of hylafax have been
+    removed from portage.  Specific steps to upgrade:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv '&gt;=net-misc/hylafax-4.1.8'
+    # emerge '&gt;=net-misc/hylafax-4.1.8'
+    # emerge clean</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0886">CAN-2003-0886</uri>
+    <uri link="http://www.novell.com/linux/security/advisories/2003_045_hylafax.html">SuSE Security Announcment</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200311-04.xml b/xml/htdocs/security/en/glsa/glsa-200311-04.xml
new file mode 100644
index 00000000..e126b59b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200311-04.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+
+<glsa id="200311-04">
+  <title>FreeRADIUS: heap exploit and NULL pointer dereference vulnerability</title>
+  <synopsis>
+    FreeRADIUS is vulnerable to a heap exploit and a NULL pointer dereference
+    vulnerability.
+  </synopsis>
+  <product type="ebuild">FreeRADIUS</product>
+  <announced>2003-11-23</announced>
+  <revised>2003-11-23: 01</revised>
+  <bug>33989</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dialup/freeradius" auto="yes" arch="*">
+      <unaffected range="ge">0.9.3</unaffected>
+      <vulnerable range="le">0.9.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    FreeRADIUS is a popular open source RADIUS server.
+    </p>
+  </background>
+  <description>
+    <p>
+    FreeRADIUS versions below 0.9.3 are vulnerable to a heap exploit, however,
+    the attack code must be in the form of a valid RADIUS packet which limits
+    the possible exploits.
+    </p>
+    <p>
+    Also corrected in the 0.9.3 release is another vulnerability which causes
+    the RADIUS server to de-reference a NULL pointer and crash when an
+    Access-Request packet with a Tunnel-Password is received.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft a RADIUS packet which would cause the RADIUS
+    server to crash, or could possibly overflow the heap resulting in a system
+    compromise.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Users are encouraged to perform an 'emerge sync' and upgrade the package to
+    the latest available version - 0.9.3 is available in portage and is marked
+    as stable.
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv '&gt;=net-dialup/freeradius-0.9.3'
+    # emerge '&gt;=net-dialup/freeradius-0.9.3'
+    # emerge clean</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securitytracker.com/alerts/2003/Nov/1008263.html">SecurityTracker.com Security Alert</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200311-05.xml b/xml/htdocs/security/en/glsa/glsa-200311-05.xml
new file mode 100644
index 00000000..57ec9ae4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200311-05.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+
+<glsa id="200311-05">
+  <title>Ethereal: security problems in ethereal 0.9.15</title>
+  <synopsis>
+    Ethereal is vulnerable to heap and buffer overflows in the GTP, ISAKMP,
+    MEGACO, and SOCKS protocol dissectors.
+  </synopsis>
+  <product type="ebuild">Ethereal</product>
+  <announced>2003-11-22</announced>
+  <revised>2003-11-22: 01</revised>
+  <bug>32691</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/ethereal" auto="yes" arch="*">
+      <unaffected range="ge">0.9.16</unaffected>
+      <vulnerable range="lt">0.9.16</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ethereal is a popular network protocol analyzer.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ethereal contains buffer overflow vulnerabilities in the GTP, ISAKMP, and
+    MEGACO protocol dissectors, and a heap overflow vulnerability in the SOCKS
+    protocol dissector, which could cause Ethereal to crash or to execute
+    arbitrary code.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft a malformed packet which would cause Ethereal
+    to crash or run arbitrary code with the permissions of the user running
+    Ethereal.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time, other than to disable the GTP,
+    ISAKMP, MEGACO, and SOCKS protocol dissectors.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    It is recommended that all Gentoo Linux users who are running
+    net-analyzer/ethereal 0.9.x upgrade:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv '&gt;=net-analyzer/ethereal-0.9.16'
+    # emerge '&gt;=net-analyzer/ethereal-0.9.16'
+    # emerge clean</code>
+  </resolution>
+  <references>
+    <uri link="http://www.ethereal.com/appnotes/enpa-sa-00011.html">Ethereal Security Advisory</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200311-06.xml b/xml/htdocs/security/en/glsa/glsa-200311-06.xml
new file mode 100644
index 00000000..a766ed16
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200311-06.xml
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+
+<glsa id="200311-06">
+  <title>glibc: getgrouplist buffer overflow vulnerability</title>
+  <synopsis>
+    glibc contains a buffer overflow in the getgrouplist function.
+  </synopsis>
+  <product type="ebuild">glibc</product>
+  <announced>2003-11-22</announced>
+  <revised>2003-11-22: 01</revised>
+  <bug>33383</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-libs/glibc" auto="yes" arch="*">
+      <unaffected range="ge">2.2.5</unaffected>
+      <vulnerable range="le">2.2.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    glibc is the GNU C library.
+    </p>
+  </background>
+  <description>
+    <p>
+    A bug in the getgrouplist function can cause a buffer overflow if the size
+    of the group list is too small to hold all the user's groups.  This overflow
+    can cause segmentation faults in user applications.  This vulnerability
+    exists only when an administrator has placed a user in a number of groups
+    larger than that expected by an application.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Applications that use getgrouplist can crash.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    It is recommended that all Gentoo Linux users update their systems as
+    follows:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv '&gt;=sys-libs/glibc-2.2.5'
+    # emerge '&gt;=sys-libs/glibc-2.2.5'
+    # emerge clean</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0689">CAN-2003-0689</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200311-07.xml b/xml/htdocs/security/en/glsa/glsa-200311-07.xml
new file mode 100644
index 00000000..969005f1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200311-07.xml
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+
+<glsa id="200311-07">
+  <title>phpSysInfo: arbitrary code execution and directory traversal</title>
+  <synopsis>
+    phpSysInfo contains two vulnerabilities that can allow arbitrary code
+    execution and local directory traversal.
+  </synopsis>
+  <product type="ebuild">phpSysInfo</product>
+  <announced>2003-11-22</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>26782</bug>
+  <access>local</access>
+  <affected>
+    <package name="www-apps/phpsysinfo" auto="yes" arch="*">
+      <unaffected range="ge">2.1-r1</unaffected>
+      <vulnerable range="le">2.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpSysInfo is a PHP system information tool.
+    </p>
+  </background>
+  <description>
+    <p>
+    phpSysInfo contains two vulnerabilities which could allow local files to be
+    read or arbitrary PHP code to be executed, under the privileges of the web
+    server process.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could read local files or execute arbitrary code with the
+    permissions of the user running the host web server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    It is recommended that all Gentoo Linux users who are running
+    www-apps/phpsysinfo upgrade to the fixed version:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv '&gt;=www-apps/phpsysinfo-2.1-r1'
+    # emerge '&gt;=www-apps/phpsysinfo-2.1-r1'
+    # emerge clean</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0536">CAN-2003-0536</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200311-08.xml b/xml/htdocs/security/en/glsa/glsa-200311-08.xml
new file mode 100644
index 00000000..28315f90
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200311-08.xml
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+
+<glsa id="200311-08">
+  <title>Libnids: remote code execution vulnerability</title>
+  <synopsis>
+    Libnids contains a bug which could allow remote code execution.
+  </synopsis>
+  <product type="ebuild">Libnids</product>
+  <announced>2003-11-22</announced>
+  <revised>2003-11-22: 01</revised>
+  <bug>32724</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-libs/libnids" auto="yes" arch="*">
+      <unaffected range="ge">1.18</unaffected>
+      <vulnerable range="le">1.17</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Libnids is a component of a network intrusion detection system.
+    </p>
+  </background>
+  <description>
+    <p>
+    There is a bug in the part of libnids code responsible for TCP reassembly.
+    The flaw probably allows remote code execution.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could possibly execute arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    It is recommended that all Gentoo Linux users who are running
+    net-libs/libnids update their systems as follows:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv '&gt;=net-libs/libnids-1.18'
+    # emerge '&gt;=net-libs/libnids-1.18'
+    # emerge clean</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0850">CAN-2003-0850</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200312-01.xml b/xml/htdocs/security/en/glsa/glsa-200312-01.xml
new file mode 100644
index 00000000..81d8ddc8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200312-01.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+
+<glsa id="200312-01">
+  <title>rsync.gentoo.org: rotation server compromised</title>
+  <synopsis>
+    A server in the rsync.gentoo.org rotation was compromised.
+  </synopsis>
+  <product type="infrastructure">rsync mirror</product>
+  <announced>2003-12-02</announced>
+  <revised>2003-12-02: 01</revised>
+  <affected>
+    <service type="rsync" fixed="yes"/>
+  </affected>
+  <background>
+    <p>
+    The rsync.gentoo.org rotation of servers provides an up to date Portage
+    tree using the rsync file transfer protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    On December 2nd at approximately 03:45 UTC, one of the servers that makes up
+    the rsync.gentoo.org rotation was compromised via a remote exploit.  At this
+    point, we are still performing forensic analysis.  However, the compromised
+    system had both an IDS and a file integrity checker installed and we have a
+    very detailed forensic trail of what happened once the box was breached, so
+    we are reasonably confident that the portage tree stored on that box was
+    unaffected.
+    </p>
+    <p>
+    The attacker appears to have installed a rootkit and modified/deleted some
+    files to cover their tracks, but left the server otherwise untouched.  The
+    box was in a compromised state for approximately one hour before it was
+    discovered and shut down.  During this time, approximately 20 users
+    synchronized against the portage mirror stored on this box.  The method used
+    to gain access to the box remotely is still under investigation.  We will
+    release more details once we have ascertained the cause of the remote
+    exploit.
+    </p>
+    <p>
+    This box is not an official Gentoo infrastructure box and is instead donated
+    by a sponsor.  The box provides other services as well and the sponsor has
+    requested that we not publicly identify the box at this time.  Because the
+    Gentoo part of this box appears to be unaffected by this exploit, we are
+    currently honoring the sponsor's request.  That said, if at any point, we
+    determine that any file in the portage tree was modified in any way, we will
+    release full details about the compromised server.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    There is no known impact at this time.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Again, based on the forensic analysis done so far, we are reasonably
+    confident that no files within the Portage tree on the box were affected.
+    However, the server has been removed from all rsync.*.gentoo.org rotations
+    and will remain so until the forensic analysis has been completed and the
+    box has been wiped and rebuilt.  Thus, users preferring an extra level of
+    security may ensure that they have a correct and accurate portage tree by
+    running:
+    </p>
+    <code>
+    # emerge sync</code>
+    <p>
+    Which will perform a sync against another server and ensure that all files
+    are up to date.
+    </p>
+  </resolution>
+  <references/>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200312-03.xml b/xml/htdocs/security/en/glsa/glsa-200312-03.xml
new file mode 100644
index 00000000..8f1d6714
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200312-03.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+
+<glsa id="200312-03">
+  <title>rsync: exploitable heap overflow</title>
+  <synopsis>
+    rsync contains a heap overflow vulnerability that can be used to execute
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">rsync</product>
+  <announced>2003-12-04</announced>
+  <revised>2003-12-04: 01</revised>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/rsync" auto="yes" arch="*">
+      <unaffected range="ge">2.5.7</unaffected>
+      <vulnerable range="lt">2.5.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    rsync is a popular file transfer package used to synchronize the Portage
+    tree.
+    </p>
+  </background>
+  <description>
+    <p>
+    Rsync version 2.5.6 contains a vulnerability that can be used to run
+    arbitrary code.  The Gentoo infrastructure team has some reasonably good
+    forensic evidence that this exploit may have been used in combination with
+    the Linux kernel do_brk() vulnerability (see GLSA 200312-02) to exploit a
+    rsync.gentoo.org rotation server (see GLSA-200312-01.)
+    </p>
+    <p>
+    Please see http://lwn.net/Articles/61541/ for the security advisory released
+    by the rsync development team.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could execute arbitrary code with the permissions of the
+    root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    To address this vulnerability, all Gentoo users should read GLSA-200312-02
+    and ensure that all systems are upgraded to a version of the Linux kernel
+    without the do_brk() vulnerability, and upgrade to version 2.5.7 of rsync:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv '&gt;=net-misc/rsync-2.5.7'
+    # emerge '&gt;=net-misc/rsync-2.5.7'
+    # emerge clean</code>
+    <p>
+    Review your /etc/rsync/rsyncd.conf configuration file; ensure that the use
+    chroot="no" command is commented out or removed, or change use chroot="no"
+    to use chroot="yes".  Then, if necessary, restart rsyncd:
+    </p>
+    <code>
+    # /etc/init.d/rsyncd restart</code>
+  </resolution>
+  <references>
+    <uri link="http://rsync.samba.org/#security_dec03">Rsync Security Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0962">CAN-2003-0962</uri>
+    <uri link="http://security.gentoo.org/glsa/glsa-200312-02.xml">GLSA-200312-02</uri>
+    <uri link="http://security.gentoo.org/glsa/glsa-200312-01.xml">GLSA-200312-01</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200312-04.xml b/xml/htdocs/security/en/glsa/glsa-200312-04.xml
new file mode 100644
index 00000000..29953115
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200312-04.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+
+<glsa id="200312-04">
+  <title>CVS: malformed module request vulnerability</title>
+  <synopsis>
+    A bug in cvs could allow attempts to create files and directories outside a
+    repository.
+  </synopsis>
+  <product type="ebuild">CVS</product>
+  <announced>2003-12-08</announced>
+  <revised>2003-12-08: 01</revised>
+  <bug>35371</bug>
+  <access>unknown</access>
+  <affected>
+    <package name="dev-util/cvs" auto="yes" arch="*">
+      <unaffected range="ge">1.11.10</unaffected>
+      <vulnerable range="le">1.11.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CVS, which stands for Concurrent Versions System, is a client/server
+    application which tracks changes to sets of files.  It allows multiple users
+    to work concurrently on files, and then merge their changes back into the
+    main tree (which can be on a remote system).  It also allows branching, or
+    maintaining separate versions for files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Quote from ccvs.cvshome.org/servlets/NewsItemView?newsID=84:
+    "Stable CVS 1.11.10 has been released. Stable releases contain only bug
+    fixes from previous versions of CVS. This release fixes a security issue
+    with no known exploits that could cause previous versions of CVS to attempt
+    to create files and directories in the filesystem root. This release also
+    fixes several issues relevant to case insensitive filesystems and some other
+    bugs. We recommend this upgrade for all CVS clients and servers!"
+    </p>
+  </description>
+  <impact type="minimal">
+    <p>
+    Attempts to create files and directories outside the repository may be
+    possible.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gentoo Linux machines with cvs installed should be updated to use
+    dev-util/cvs-1.11.10 or higher:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv '&gt;=dev-util/cvs-1.11.10'
+    # emerge '&gt;=dev-util/cvs-1.11.10'
+    # emerge clean</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0977">CAN-2003-0977</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200312-05.xml b/xml/htdocs/security/en/glsa/glsa-200312-05.xml
new file mode 100644
index 00000000..bb254c01
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200312-05.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+
+<glsa id="200312-05">
+  <title>GnuPG: ElGamal signing keys compromised and format string vulnerability</title>
+  <synopsis>
+    A bug in GnuPG allows ElGamal signing keys to be compromised, and a format
+    string bug in the gpgkeys_hkp utility may allow arbitrary code execution.
+  </synopsis>
+  <product type="ebuild">GnuPG</product>
+  <announced>2003-12-12</announced>
+  <revised>2003-12-12: 01</revised>
+  <bug>34504</bug>
+  <access>unknown</access>
+  <affected>
+    <package name="app-crypt/gnupg" auto="yes" arch="*">
+      <unaffected range="ge">1.2.3-r5</unaffected>
+      <vulnerable range="le">1.2.3-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GnuPG is a popular open source signing and encryption tool.
+    </p>
+  </background>
+  <description>
+    <p>
+    Two flaws have been found in GnuPG 1.2.3.
+    </p>
+    <p>
+    First, ElGamal signing keys can be compromised.  These keys are not commonly
+    used, but this is "a significant security failure which can lead to a
+    compromise of almost all ElGamal keys used for signing.  Note that this is a
+    real world vulnerability which will reveal your private key within a few
+    seconds".
+    </p>
+    <p>
+    Second, there is a format string flaw in the 'gpgkeys_hkp' utility which
+    "would allow a malicious keyserver in the worst case to execute an arbitrary
+    code on the user's machine."
+    </p>
+  </description>
+  <impact type="minimal">
+    <p>
+    If you have used ElGamal keys for signing your private key can be
+    compromised, and a malicious keyserver could remotely execute arbitrary code
+    with the permissions of the user running gpgkeys_hkp.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users who have created ElGamal signing keys should immediately revoke
+    them.  In addition, all Gentoo Linux machines with gnupg installed should be
+    updated to use gnupg-1.2.3-r5 or higher:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv '&gt;=app-crypt/gnupg-1.2.3-r5'
+    # emerge '&gt;=app-crypt/gnupg-1.2.3-r5'
+    # emerge clean</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0971">CAN-2003-0971</uri>
+    <uri link="http://marc.theaimsgroup.com/?l=gnupg-announce&amp;m=106992378510843&amp;q=raw">GnuPG Announcement</uri>
+    <uri link="http://www.s-quadra.com/advisories/Adv-20031203.txt">S-Quadra Advisory</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200312-06.xml b/xml/htdocs/security/en/glsa/glsa-200312-06.xml
new file mode 100644
index 00000000..1d0ba5e2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200312-06.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+
+<glsa id="200312-06">
+  <title>XChat: malformed dcc send request denial of service</title>
+  <synopsis>
+    A bug in XChat could allow malformed dcc send requests to cause a denial of
+    service.
+  </synopsis>
+  <product type="ebuild">xchat</product>
+  <announced>2003-12-14</announced>
+  <revised>2003-12-14: 01</revised>
+  <bug>35623</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-irc/xchat" auto="yes" arch="*">
+      <unaffected range="ge">2.0.6-r1</unaffected>
+      <vulnerable range="eq">2.0.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    XChat is a multiplatform IRC client.
+    </p>
+  </background>
+  <description>
+    <p>
+    There is a remotely exploitable bug in XChat 2.0.6 that could lead to a
+    denial of service attack.  Gentoo wishes to thank lloydbates for discovering
+    this bug, as well as jcdutton and rac for submitting patches to fix the bug.
+    </p>
+  </description>
+  <impact type="medium">
+    <p>
+    A malformed DCC packet sent by a remote attacker can cause XChat to crash.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    For Gentoo users, xchat-2.0.6 was marked ~arch (unstable) for most
+    architectures.  Since it was never marked as stable in the portage tree,
+    only xchat users who have explictly added the unstable keyword to
+    ACCEPT_KEYWORDS are affected.  Users may updated affected machines to the
+    patched version of xchat using the following commands:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv '&gt;=net-irc/xchat-2.0.6-r1'
+    # emerge '&gt;=net-irc/xchat-2.0.6-r1'
+    # emerge clean</code>
+    <p>
+    This assumes that users are running with ACCEPT_KEYWORDS enabled for their
+    architecture.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://mail.nl.linux.org/xchat-announce/2003-12/msg00000.html">XChat Announcement</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200312-07.xml b/xml/htdocs/security/en/glsa/glsa-200312-07.xml
new file mode 100644
index 00000000..1f6b5efc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200312-07.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200312-07">
+  <title>Two buffer overflows in lftp</title>
+  <synopsis>
+    Two buffer overflow problems are found in lftp that, in case the user visits
+    a malicious ftp server, could lead to malicious code being executed.
+  </synopsis>
+  <product type="ebuild">lftp</product>
+  <announced>December 13, 2003</announced>
+  <revised>200312-07: 2</revised>
+  <bug>35866</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-ftp/lftp" auto="yes" arch="*">
+      <vulnerable range="lt">2.6.10</vulnerable>
+      <unaffected range="ge">2.6.10</unaffected>
+    </package>
+  </affected>
+  <background>
+    <p>
+    lftp is a multithreaded command-line based FTP client. It allows you to
+    execute multiple commands simultaneously or in the background. If features
+    mirroring capabilities, resuming downloads, etc.
+    </p>
+  </background>
+  <description>
+    <p>
+    Two buffer overflows exist in lftp. Both can occur when the user connects to
+    a malicious web server using the HTTP or HTTPS protocol and issues lftp's
+    "ls" or "rels" commands.
+    </p>
+    <p>
+    Ulf Harnhammar explains:
+    </p>
+    <p>
+    Technically, the problem lies in the file src/HttpDir.cc and the
+    functions try_netscape_proxy() and try_squid_eplf(), which both
+    have sscanf() calls that take data of an arbitrary length and
+    store it in a char array with 32 elements. (Back in version 2.3.0,
+    the problematic code was located in some other function, but the
+    problem existed back then too.) Depending on the HTML document in the 
+    specially prepared directory, buffers will be overflown in either one 
+    function or the other.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    When a user issues "ls" or "rels" on a malicious server, the tftp
+    application can be tricked into running arbitrary code on the user his
+    machine.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no workaround available.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gentoo users who have net-ftp/lftp installed should update to use
+    version 2.6.0 or higher using these commands:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv '>=net-ftp/lftp-2.6.10'
+    # emerge '>=net-ftp/lftp-2.6.10'
+    # emerge clean</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/347587/2003-12-13/2003-12-19/0">Initial report by Ulf Harnhammar</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200312-08.xml b/xml/htdocs/security/en/glsa/glsa-200312-08.xml
new file mode 100644
index 00000000..57872052
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200312-08.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+
+<glsa id="200312-08">
+  <title>CVS: possible root compromise when using CVS pserver</title>
+  <synopsis>
+    A possible root compromise exists for CVS pservers.
+  </synopsis>
+  <product type="ebuild">cvs</product>
+  <announced>2003-12-28</announced>
+  <revised>2003-12-28: 01</revised>
+  <bug>36142</bug>
+  <access>unknown</access>
+  <affected>
+    <package name="dev-util/cvs" auto="yes" arch="*">
+      <unaffected range="ge">1.11.11</unaffected>
+      <vulnerable range="le">1.11.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CVS, which stands for Concurrent Versions System, is a client/server
+    application which tracks changes to sets of files.  It allows multiple users
+    to work concurrently on files, and then merge their changes back into the
+    main tree (which can be on a remote system).  It also allows branching, or
+    maintaining separate versions for files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Quote from ccvs.cvshome.org/servlets/NewsItemView?newsID=88:
+    "Stable CVS 1.11.11 has been released. Stable releases contain only bug
+    fixes from previous versions of CVS. This release adds code to the CVS
+    server to prevent it from continuing as root after a user login, as an extra
+    failsafe against a compromise of the CVSROOT/passwd file. Previously, any
+    user with the ability to write the CVSROOT/passwd file could execute
+    arbitrary code as the root user on systems with CVS pserver access enabled.
+    We recommend this upgrade for all CVS servers!"
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote user could execute arbitrary code with the permissions of the root
+    user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gentoo Linux machines with cvs installed should be updated to use
+    cvs-1.11.11 or higher.
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv '&gt;=dev-util/cvs-1.11.11'
+    # emerge '&gt;=dev-util/cvs-1.11.11'
+    # emerge clean</code>
+  </resolution>
+  <references/>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200401-01.xml b/xml/htdocs/security/en/glsa/glsa-200401-01.xml
new file mode 100644
index 00000000..0716288f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200401-01.xml
@@ -0,0 +1,230 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200401-01">
+  <title>Linux kernel do_mremap() local privilege escalation vulnerability</title>
+  <synopsis>
+    A critical security vulnerability has been found in recent Linux kernels
+    which allows for local privelege escalation.
+  </synopsis>
+  <product type="ebuild">Kernel</product>
+  <announced>January 08, 2004</announced>
+  <revised>January 08, 2004: 01</revised>
+  <bug>37292</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-kernel/aa-sources" auto="no" arch="*">
+      <unaffected range="ge">2.4.23-r1</unaffected>
+      <vulnerable range="lt">2.4.23-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/alpha-sources" auto="no" arch="*">
+      <unaffected range="ge">2.4.21-r2</unaffected>
+      <vulnerable range="lt">2.4.21-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/arm-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.19-r2</unaffected>
+      <vulnerable range="lt">2.4.19-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/ck-sources" auto="no" arch="*">
+      <unaffected range="ge">2.4.23-r1</unaffected>
+      <vulnerable range="lt">2.4.23-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/compaq-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.9.32.7-r1</unaffected>
+      <vulnerable range="lt">2.4.9.32.7-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/development-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.1_rc3</unaffected>
+      <vulnerable range="lt">2.6.1_rc3</vulnerable>
+    </package>
+    <package name="sys-kernel/gaming-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.20-r7</unaffected>
+      <vulnerable range="lt">2.4.20-r7</vulnerable>
+    </package>
+    <package name="sys-kernel/gentoo-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.1_rc3</unaffected>
+      <vulnerable range="lt">2.6.1_rc3</vulnerable>
+    </package>
+    <package name="sys-kernel/gentoo-sources" auto="yes" arch="*">
+      <unaffected range="gt">2.4.22-r3</unaffected>
+      <vulnerable range="lt">2.4.22-r3</vulnerable>
+    </package>
+    <package name="sys-kernel/grsec-sources" auto="yes" arch="*">
+      <unaffected range="gt">2.4.23.2.0_rc4-r1</unaffected>
+      <vulnerable range="lt">2.4.23.2.0_rc4-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/gs-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.23_pre8-r2</unaffected>
+      <vulnerable range="lt">2.4.23_pre8-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/hardened-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.22-r2</unaffected>
+      <vulnerable range="lt">2.4.22-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/hppa-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.23_p4-r2</unaffected>
+      <vulnerable range="lt">2.4.23_p4-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/ia64-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.22-r2</unaffected>
+      <vulnerable range="lt">2.4.22-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/mips-prepatch-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.24_pre2-r1</unaffected>
+      <vulnerable range="lt">2.4.24_pre2-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/mips-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.23-r2</unaffected>
+      <vulnerable range="lt">2.4.23-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/mm-sources" auto="no" arch="*">
+      <unaffected range="ge">2.6.1_rc1-r2</unaffected>
+      <vulnerable range="lt">2.6.1_rc1-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/openmosix-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.22-r3</unaffected>
+      <vulnerable range="lt">2.4.22-r3</vulnerable>
+    </package>
+    <package name="sys-kernel/pac-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.23-r1</unaffected>
+      <vulnerable range="lt">2.4.23-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/pfeifer-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.21.1_pre4-r1</unaffected>
+      <vulnerable range="lt">2.4.21.1_pre4-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/planet-ccrma-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.21-r4</unaffected>
+      <vulnerable range="lt">2.4.21-r4</vulnerable>
+    </package>
+    <package name="sys-kernel/ppc-development-sources" auto="no" arch="*">
+      <unaffected range="ge">2.6.1_rc1-r1</unaffected>
+      <vulnerable range="lt">2.6.1_rc1-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/ppc-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.23-r1</unaffected>
+      <vulnerable range="lt">2.4.23-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/ppc-sources-benh" auto="yes" arch="*">
+      <unaffected range="ge">2.4.22-r4</unaffected>
+      <vulnerable range="lt">2.4.22-r4</vulnerable>
+    </package>
+    <package name="sys-kernel/ppc-sources-crypto" auto="yes" arch="*">
+      <unaffected range="ge">2.4.20-r2</unaffected>
+      <vulnerable range="lt">2.4.20-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/selinux-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.24</unaffected>
+      <vulnerable range="lt">2.4.24</vulnerable>
+    </package>
+    <package name="sys-kernel/sparc-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.1_rc2</unaffected>
+      <vulnerable range="lt">2.6.1_rc2</vulnerable>
+    </package>
+    <package name="sys-kernel/sparc-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.24</unaffected>
+      <vulnerable range="lt">2.4.24</vulnerable>
+    </package>
+    <package name="sys-kernel/usermode-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.23-r1</unaffected>
+      <vulnerable range="lt">2.4.23-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/vanilla-prepatch-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.25_pre4</unaffected>
+      <vulnerable range="lt">2.4.25_pre4</vulnerable>
+    </package>
+    <package name="sys-kernel/vanilla-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.24</unaffected>
+      <vulnerable range="lt">2.4.24</vulnerable>
+    </package>
+    <package name="sys-kernel/win4lin-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.0-r1</unaffected>
+      <vulnerable range="lt">2.6.0-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/wolk-sources" auto="yes" arch="*">
+      <unaffected range="ge">4.10_pre7-r2</unaffected>
+      <vulnerable range="lt">4.10_pre7-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/xfs-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.23-r1</unaffected>
+      <vulnerable range="lt">2.4.23-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Linux kernel is responsible for memory management in a working
+    system - to allow this, processes are allowed to allocate and unallocate
+    memory.
+    </p>
+  </background>
+  <description>
+    <p>
+    The memory subsystem allows for shrinking, growing, and moving of
+    chunks of memory along any of the allocated memory areas which the kernel
+    posesses. 
+    </p>
+    <p>
+    A typical virtual memory area covers at least one memory page. An incorrect
+    bound check discovered inside the do_mremap() kernel code performing
+    remapping of a virtual memory area may lead to creation of a virtual memory
+    area of 0 bytes length.
+    </p>
+    <p>
+    The problem is based on the general mremap flaw that remapping 2 pages from
+    inside a VMA creates a memory hole of only one page in length but an
+    additional VMA of two pages. In the case of a zero sized remapping request
+    no VMA hole is created but an additional VMA descriptor of 0
+    bytes in length is created.
+    </p>
+    <p>
+    This advisory also addresses an information leak in the Linux RTC system.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Arbitrary code may be able to exploit this vulnerability and may
+    disrupt the operation of other
+    parts of the kernel memory management subroutines finally leading to
+    unexpected behavior.
+    </p>
+    <p>
+    Since no special privileges are required to use the mremap(2) system call
+    any process may misuse its unexpected behavior to disrupt the kernel memory
+    management subsystem. Proper exploitation of this vulnerability may lead to
+    local privilege escalation including execution of arbitrary code
+    with kernel level access.
+    </p>
+    <p>
+    Proof-of-concept exploit code has been created and successfully tested,
+    permitting root escalation on vulnerable systems. As a result, all users
+    should upgrade their kernels to new or patched versions.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no temporary workaround - a kernel upgrade is required. A list
+    of unaffected kernels is provided along with this announcement.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Users are encouraged to upgrade to the latest available sources for
+    their system:
+    </p>
+    <code>
+    $> emerge sync
+    $> emerge -pv your-favourite-sources
+    $> emerge your-favourite-sources
+    $> # Follow usual procedure for compiling and installing a kernel.
+    $> # If you use genkernel, run genkernel as you would do normally.
+
+    $> # IF YOUR KERNEL IS MARKED as "remerge required!" THEN
+    $> # YOU SHOULD UPDATE YOUR KERNEL EVEN IF PORTAGE
+    $> # REPORTS THAT THE SAME VERSION IS INSTALLED.</code>
+  </resolution>
+  <references>
+    <uri link="http://isec.pl/vulnerabilities/isec-0012-mremap.txt">Vulnerability</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200401-02.xml b/xml/htdocs/security/en/glsa/glsa-200401-02.xml
new file mode 100644
index 00000000..5cd9b2be
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200401-02.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200401-02">
+  <title>Honeyd remote detection vulnerability via a probe packet</title>
+  <synopsis>
+    Identification of Honeyd installations allows an adversary to launch
+    attacks specifically against Honeyd.  No remote root exploit is currently
+    known.
+  </synopsis>
+  <product type="ebuild">honeyd</product>
+  <announced>January 21, 2004</announced>
+  <revised>January 21, 2004: 01</revised>
+  <bug>38934</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/honeyd" auto="yes" arch="*">
+      <unaffected range="ge">0.8</unaffected>
+      <vulnerable range="lt">0.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Honeyd is a virtual honeypot daemon that can simulate virtual hosts on
+    unallocated IP addresses.
+    </p>
+  </background>
+  <description>
+    <p>
+    A bug in handling NMAP fingerprints caused Honeyd to reply to TCP
+    packets with both the SYN and RST flags set.  Watching for replies, it is
+    possible to detect IP addresses simulated by Honeyd.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    Although there are no public exploits known for Honeyd, the detection
+    of Honeyd IP addresses may in some cases be undesirable.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Honeyd 0.8 has been released along with an advisory to address this 
+    issue. In addition, Honeyd 0.8 drops privileges if permitted by the 
+    configuration file and contains command line flags to force dropping 
+    of privileges.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users are recommended to update to honeyd version 0.8:
+    </p>
+    <code>
+    $> emerge sync
+    $> emerge -pv ">=net-analyzer/honeyd-0.8"
+    $> emerge ">=net-analyzer/honeyd-0.8"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.honeyd.org/adv.2004-01.asc">Honeyd Security Advisory 2004-001</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200401-03.xml b/xml/htdocs/security/en/glsa/glsa-200401-03.xml
new file mode 100644
index 00000000..affef9ae
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200401-03.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200401-03">
+  <title>Apache mod_python Denial of Service vulnerability</title>
+  <synopsis>
+    Apache's mod_python module could crash the httpd process if a specific,
+    malformed query string was sent.
+  </synopsis>
+  <product type="ebuild">mod_python</product>
+  <announced>January 27, 2004</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>39154</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apache/mod_python" auto="yes" arch="*">
+      <unaffected range="ge">2.7.10</unaffected>
+      <vulnerable range="lt">2.7.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mod_python is an Apache module that embeds the Python interpreter
+    within the server allowing Python-based web-applications to be
+    created.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Apache Foundation has reported that mod_python may be prone to
+    Denial of Service attacks when handling a malformed
+    query. Mod_python 2.7.9 was released to fix the vulnerability,
+    however, because the vulnerability has not been fully fixed,
+    version 2.7.10 has been released.
+    </p>
+    <p>
+    Users of mod_python 3.0.4 are not affected by this vulnerability.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    Although there are no known public exploits known for this
+    exploit, users are recommended to upgrade mod_python to ensure the
+    security of their infrastructure.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Mod_python 2.7.10 has been released to solve this issue; there is
+    no immediate workaround.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users using mod_python 2.7.9 or below are recommended to
+    update their mod_python installation:
+    </p>
+    <code>
+    $> emerge sync
+    $> emerge -pv ">=www-apache/mod_python-2.7.10"
+    $> emerge ">=www-apache/mod_python-2.7.10"
+    $> /etc/init.d/apache restart</code>
+  </resolution>
+  <references>
+    <uri link="http://www.modpython.org/pipermail/mod_python/2004-January/014879.html">Mod_python 2.7.10 release announcement</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200401-04.xml b/xml/htdocs/security/en/glsa/glsa-200401-04.xml
new file mode 100644
index 00000000..1291d6b2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200401-04.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200401-04">
+  <title>GAIM 0.75 Remote overflows</title>
+  <synopsis>
+    Various overflows in the handling of AIM DirectIM packets was revealed in
+    GAIM that could lead to a remote compromise of the IM client.
+  </synopsis>
+  <product type="ebuild">GAIM</product>
+  <announced>January 26, 2004</announced>
+  <revised>January 26, 2004: 01</revised>
+  <bug>39470</bug>
+  <access>man-in-the-middle</access>
+  <affected>
+    <package name="net-im/gaim" auto="yes" arch="*">
+      <unaffected range="ge">0.75-r7</unaffected>
+      <vulnerable range="lt">0.75-r7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gaim is a multi-platform and multi-protocol instant messaging
+    client.  It is compatible with AIM , ICQ, MSN Messenger, Yahoo,
+    IRC, Jabber, Gadu-Gadu, and the Zephyr networks.
+    </p>
+  </background>
+  <description>
+    <p>
+    Yahoo changed the authentication methods to their IM servers,
+    rendering GAIM useless. The GAIM team released a rushed release
+    solving this issue, however, at the same time a code audit
+    revealed 12 new vulnerabilities.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Due to the nature of instant messaging many of these bugs require
+    man-in-the-middle attacks between the client and the server. But
+    the underlying protocols are easy to implement and attacking
+    ordinary TCP sessions is a fairly simple task. As a result, all
+    users are advised to upgrade their GAIM installation.
+    </p>
+    <ul>
+      <li>
+        Users of GAIM 0.74 or below are affected by 7 of the
+        vulnerabilities and are encouraged to upgrade.
+      </li>
+      <li>
+        Users of GAIM 0.75 are affected by 11 of the vulnerabilities
+        and are encouraged to upgrade to the patched version of GAIM
+        offered by Gentoo.
+      </li>
+      <li>
+        Users of GAIM 0.75-r6 are only affected by
+        4 of the vulnerabilities, but are still urged to upgrade to
+        maintain security.
+      </li>
+    </ul>
+  </impact>
+  <workaround>
+    <p>
+    There is no immediate workaround; a software upgrade is required.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users are recommended to upgrade GAIM to 0.75-r7.
+    </p>
+    <code>
+    $> emerge sync
+    $> emerge -pv ">=net-im/gaim-0.75-r7"
+    $> emerge ">=net-im/gaim-0.75-r7"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/351235/2004-01-23/2004-01-29/0">Security advisory from Stefan Esser</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200402-01.xml b/xml/htdocs/security/en/glsa/glsa-200402-01.xml
new file mode 100644
index 00000000..5cff9f88
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200402-01.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200402-01">
+  <title>PHP setting leaks from .htaccess files on virtual hosts</title>
+  <synopsis>
+    If the server configuration &quot;php.ini&quot; file has
+    &quot;register_globals = on&quot; and a request is made to one virtual host
+    (which has &quot;php_admin_flag register_globals off&quot;) and the next
+    request is sent to the another virtual host (which does not have the
+    setting) global variables may leak and may be used to exploit the 
+    site.
+  </synopsis>
+  <product type="ebuild">PHP</product>
+  <announced>February 07, 2004</announced>
+  <revised>February 07, 2004: 01</revised>
+  <bug>39952</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-php/mod_php" auto="yes" arch="*">
+      <unaffected range="ge">4.3.4-r4</unaffected>
+      <vulnerable range="lt">4.3.4-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHP is a widely-used general-purpose scripting language that is
+    especially suited for Web development and can be embedded into HTML.
+    </p>
+  </background>
+  <description>
+    <p>
+    If the server configuration &quot;php.ini&quot; file has
+    &quot;register_globals = on&quot; and a request is made to one virtual host
+    (which has &quot;php_admin_flag register_globals off&quot;) and the next
+    request is sent to the another virtual host (which does not have the
+    setting) through the same apache child, the setting will persist.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Depending on the server and site, an attacker may be able to exploit
+    global variables to gain access to reserved areas, such as MySQL passwords,
+    or this vulnerability may simply cause a lack of functionality. As a
+    result, users are urged to upgrade their PHP installations.
+    </p>
+    <p>
+    Gentoo ships PHP with &quot;register_globals&quot; set to &quot;off&quot;
+    by default.
+    </p>
+    <p>    
+    This issue affects both servers running Apache 1.x and servers running
+    Apache 2.x.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    No immediate workaround is available; a software upgrade is required.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users are recommended to upgrade their PHP installation to 4.3.4-r4:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv ">=dev-php/mod_php-4.3.4-r4"
+    # emerge ">=dev-php/mod_php-4.3.4-r4"</code>
+  </resolution>
+  <references>
+    <uri link="http://bugs.php.net/bug.php?id=25753">Corresponding PHP bug</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200402-02.xml b/xml/htdocs/security/en/glsa/glsa-200402-02.xml
new file mode 100644
index 00000000..c96c3326
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200402-02.xml
@@ -0,0 +1,94 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200402-02">
+  <title>XFree86 Font Information File Buffer Overflow</title>
+  <synopsis>
+    Exploitation of a buffer overflow in the XFree86 Project Inc.'s XFree86 X
+    Window System allows local attackers to gain root privileges.
+  </synopsis>
+  <product type="ebuild">200402-02</product>
+  <announced>February 11, 2004</announced>
+  <revised>February 11, 2004: 01</revised>
+  <access>local</access>
+  <affected>
+    <package name="x11-base/xfree" auto="yes" arch="*">
+      <vulnerable range="lt">4.3.99.902-r1</vulnerable>
+      <unaffected range="eq">4.2.1-r3</unaffected>
+      <unaffected range="eq">4.3.0-r4</unaffected>
+      <unaffected range="ge">4.3.99.902-r1</unaffected>
+    </package>
+  </affected>
+  <background>
+    <p>
+    XFree86, provides a client/server interface between display
+    hardware and the desktop environment while also providing both the
+    windowing infrastructure and a standardized API. XFree86 is
+    platform independent, network-transparent and extensible.
+    </p>
+  </background>
+  <description>
+    <p>
+    Exploitation of a buffer overflow in The XFree86 Window System
+    discovered by iDefence allows local attackers to gain root
+    privileges.
+    </p>
+    <p>
+    The problem exists in the parsing of the 'font.alias' file. The X
+    server (running as root) fails to check the length of the user
+    provided input, so a malicious user may craft a malformed
+    'font.alias' file causing a buffer overflow upon parsing,
+    eventually leading to the execution of arbitrary code.
+    </p>
+    <p>
+    To reproduce the overflow on the command line one can run:
+    </p>
+    <code>
+    # cat > fonts.dir &lt;&lt;EOF 
+    1
+    word.bdf -misc-fixed-medium-r-semicondensed--13-120-75-75-c-60-iso8859-1
+    EOF
+    # perl -e 'print "0" x 1024 . "A" x 96 . "\n"' > fonts.alias
+    # X :0 -fp $PWD</code>
+    <p>
+    {Some output removed}... Server aborting... Segmentation fault (core dumped)
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Successful exploitation can lead to a root compromise provided
+    that the attacker is able to execute commands in the X11
+    subsystem. This can be done either by having console access to the
+    target or through a remote exploit against any X client program
+    such as a web-browser, mail-reader or game.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    No immediate workaround is available; a software upgrade is required.
+    </p>
+    <p>
+    Gentoo has released XFree 4.2.1-r3, 4.3.0-r4 and 4.3.99.902-r1 and
+    encourages all users to upgrade their XFree86
+    installations. Vulnerable versions are no longer available in
+    Portage.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users are recommended to upgrade their XFree86 installation:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv x11-base/xfree
+    # emerge x11-base/xfree</code>
+  </resolution>
+  <references>
+    <uri
+    link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0083">CVE: CAN-2004-0083</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=72&amp;type=vulnerabilities">Vulnerability:
+    XFree86 Font Information File Buffer Overflow</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200402-03.xml b/xml/htdocs/security/en/glsa/glsa-200402-03.xml
new file mode 100644
index 00000000..ffeefb17
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200402-03.xml
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200402-03">
+  <title>Monkeyd Denial of Service vulnerability</title>
+  <synopsis>
+    A bug in get_real_string() function allows for a Denial of Service attack to be
+    launched against the webserver.
+  </synopsis>
+  <product type="ebuild">monkeyd</product>
+  <announced>February 11, 2004</announced>
+  <revised>February 11, 2004: 01</revised>
+  <bug>41156</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/monkeyd" auto="yes" arch="*">
+      <unaffected range="ge">0.8.2</unaffected>
+      <vulnerable range="lt">0.8.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Monkey HTTP daemon is a Web server written in C that works
+    under Linux and is based on the HTTP/1.1 protocol. It aims to develop
+    a fast, efficient and small web server.
+    </p>
+  </background>
+  <description>
+    <p>
+    A bug in the URI processing of incoming requests allows for a Denial of
+    Service to be launched against the webserver, which may cause the server
+    to crash or behave sporadically.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Although there are no public exploits known for bug, users are recommended
+    to upgrade to ensure the security of their infrastructure.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no immediate workaround; a software upgrade is
+    required. The vulnerable function in the code has been rewritten.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users are recommended to upgrade monkeyd to 0.8.2:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv ">=www-servers/monkeyd-0.8.2"
+    # emerge ">=www-servers/monkeyd-0.8.2"</code>
+  </resolution>
+  <references>
+    <uri link="http://cvs.sourceforge.net/viewcvs.py/monkeyd/monkeyd/src/utils.c?r1=1.3&amp;r2=1.4">CVS Patch</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200402-04.xml b/xml/htdocs/security/en/glsa/glsa-200402-04.xml
new file mode 100644
index 00000000..407a1987
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200402-04.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200402-04">
+  <title>Gallery 1.4.1 and below remote exploit vulnerability</title>
+  <synopsis>
+    The Gallery developers have discovered a potentially serious security flaw
+    in Gallery 1.3.1, 1.3.2, 1.3.3, 1.4 and 1.4.1 which can allow a 
+    remote exploit of your webserver.
+  </synopsis>
+  <product type="ebuild">Gallery</product>
+  <announced>February 11, 2004</announced>
+  <revised>February 11, 2004: 01</revised>
+  <bug>39638</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/gallery" auto="yes" arch="*">
+      <unaffected range="ge">1.4.1_p1</unaffected>
+      <vulnerable range="lt">1.4.1_p1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gallery is an open source image management system written in PHP.
+    More information is available at http://gallery.sourceforge.net
+    </p>
+  </background>
+  <description>
+    <p>
+    Starting in the 1.3.1 release, Gallery includes code to simulate the behaviour
+    of the PHP 'register_globals' variable in environments where that setting
+    is disabled.  It is simulated by extracting the values of the various
+    $HTTP_ global variables into the global namespace.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A crafted URL such as 
+    http://example.com/gallery/init.php?HTTP_POST_VARS=xxx  causes the
+    'register_globals' simulation code to overwrite the $HTTP_POST_VARS which,
+    when it is extracted, will deliver the given payload. If the
+    payload compromises $GALLERY_BASEDIR then the malicious user can perform a
+    PHP injection exploit and gain remote access to the webserver with PHP 
+    user UID access rights.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    The workaround for the vulnerability is to replace init.php and
+    setup/init.php with the files in the following ZIP file:
+    http://prdownloads.sourceforge.net/gallery/patch_1.4.1-to-1.4.1-pl1.zip?download 
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users are encouraged to upgrade their gallery installation:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -p ">=www-apps/gallery-1.4.1_p1"
+    # emerge ">=www-apps/gallery-1.4.1_p1"</code>
+  </resolution>
+  <references>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200402-05.xml b/xml/htdocs/security/en/glsa/glsa-200402-05.xml
new file mode 100644
index 00000000..3b84cf46
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200402-05.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200402-05">
+  <title>phpMyAdmin &lt; 2.5.6-rc1: possible attack against export.php</title>
+  <synopsis>
+    A vulnerability in phpMyAdmin which was not properly verifying user
+    generated input could lead to a directory traversal attack.
+  </synopsis>
+  <product type="ebuild">phpmyadmin</product>
+  <announced>February 17, 2004</announced>
+  <revised>February 17, 2004: 01</revised>
+  <bug>40268</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/phpmyadmin" auto="yes" arch="*">
+      <unaffected range="ge">2.5.6_rc1</unaffected>
+      <vulnerable range="le">2.5.5_p1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpMyAdmin is a tool written in PHP intended to handle the administration
+    of MySQL databased over the Web.
+    </p>
+  </background>
+  <description>
+    <p>
+    One component of the phpMyAdmin software package (export.php) does not
+    properly verify input that is passed to it from a remote user.  Since the
+    input is used to include other files, it is possible to launch a directory
+    traversal attack.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Private information could be gleaned from the remote server if an attacker
+    uses a malformed URL such as http://phpmyadmin.example.com/export.php?what=../../../[existing_file] 
+    </p>
+    <p>
+    In this scenario, the script does not sanitize the "what" argument passed
+    to it, allowing directory traversal attacks to take place, disclosing
+    the contents of files if the file is readable as the web-server user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    The workaround is to either patch the export.php file using the 
+    referenced CVS patch or upgrade the software via Portage.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Users are encouraged to upgrade to phpMyAdmin-2.5.6_rc1:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv ">=dev-db/phpmyadmin-2.5.6_rc1"
+    # emerge ">=dev-db/phpmyadmin-2.5.6_rc1"
+    # emerge clean</code>
+  </resolution>
+  <references>
+    <uri link="http://cvs.sourceforge.net/viewcvs.py/phpmyadmin/phpMyAdmin/export.php?r1=2.3&amp;r2=2.3.2.1">CVS Patch</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200402-06.xml b/xml/htdocs/security/en/glsa/glsa-200402-06.xml
new file mode 100644
index 00000000..fbbcf64e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200402-06.xml
@@ -0,0 +1,92 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200402-06">
+  <title>Updated kernel packages fix the AMD64 ptrace vulnerability</title>
+  <synopsis>
+    A vulnerability has been discovered by in the ptrace emulation code for
+    AMD64 platforms when eflags are processed, allowing a local user to obtain
+    elevated priveleges. 
+  </synopsis>
+  <product type="ebuild">Kernel</product>
+  <announced>February 17, 2004</announced>
+  <revised>February 17, 2004: 01</revised>
+  <access>local</access>
+  <affected>
+    <package name="sys-kernel/ck-sources" auto="yes" arch="amd64">
+      <unaffected range="ge">2.6.2</unaffected>
+      <vulnerable range="lt">2.6.2</vulnerable>
+    </package>
+    <package name="sys-kernel/development-sources" auto="yes" arch="amd64">
+      <unaffected range="ge">2.6.2</unaffected>
+      <vulnerable range="lt">2.6.2</vulnerable>
+    </package>
+    <package name="sys-kernel/gentoo-dev-sources" auto="yes" arch="amd64">
+      <unaffected range="ge">2.6.2</unaffected>
+      <vulnerable range="lt">2.6.2</vulnerable>
+    </package>
+    <package name="sys-kernel/gentoo-sources" auto="yes" arch="amd64">
+      <unaffected range="ge">2.4.22-r6</unaffected>
+      <vulnerable range="lt">2.4.22-r6</vulnerable>
+    </package>
+    <package name="sys-kernel/gentoo-test-sources" auto="yes" arch="amd64">
+      <unaffected range="ge">2.6.2-r1</unaffected>
+      <vulnerable range="lt">2.6.2</vulnerable>
+    </package>
+    <package name="sys-kernel/gs-sources" auto="yes" arch="amd64">
+      <unaffected range="ge">2.4.25_pre7-r1</unaffected>
+      <vulnerable range="lt">2.4.25_pre7-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/vanilla-prepatch-sources" auto="yes" arch="amd64">
+      <unaffected range="ge">2.4.25_rc3</unaffected>
+      <vulnerable range="lt">2.4.25_rc3</vulnerable>
+    </package>
+    <package name="sys-kernel/vanilla-sources" auto="yes" arch="amd64">
+      <unaffected range="ge">2.4.24-r1</unaffected>
+      <vulnerable range="lt">2.4.24-r1</vulnerable>
+    </package>
+  </affected>
+  <description>
+    <p>
+    A vulnerability has been discovered by Andi Kleen in the ptrace emulation
+    code for AMD64 platforms when eflags are processed, allowing a local user
+    to obtain elevated priveleges.  The Common Vulnerabilities and Exposures
+    project, http://cve.mitre.org, has assigned CAN-2004-0001 to this issue.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Only users of the AMD64 platform are affected: in this scenario, a user may
+    be able to obtain elevated priveleges, including root access. However, no
+    public exploit is known for the vulnerability at this time.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no temporary workaround - a kernel upgrade is required. A list of
+    unaffected kernels is provided along with this announcement.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Users are encouraged to upgrade to the latest available sources for
+    their system:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv your-favourite-sources
+    # emerge your-favourite-sources
+    # # Follow usual procedure for compiling and installing a kernel.
+    # # If you use genkernel, run genkernel as you would do normally.
+    </code>
+    <code>
+    # # IF YOUR KERNEL IS MARKED as "remerge required!" THEN
+    # # YOU SHOULD UPDATE YOUR KERNEL EVEN IF PORTAGE
+    # # REPORTS THAT THE SAME VERSION IS INSTALLED.
+    </code>
+  </resolution>
+  <references>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200402-07.xml b/xml/htdocs/security/en/glsa/glsa-200402-07.xml
new file mode 100644
index 00000000..89904223
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200402-07.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200402-07">
+  <title>Clam Antivirus DoS vulnerability</title>
+  <synopsis>
+    Oliver Eikemeier has reported a vulnerability in Clam AV, which can be
+    exploited by a malformed uuencoded message causing a denial of service for
+    programs that rely on the clamav daemon, such as SMTP daemons.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>February 17, 2004</announced>
+  <revised>February 17, 2004: 01</revised>
+  <bug>41248</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.67</unaffected>
+      <vulnerable range="lt">0.67</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Clam AntiVirus is a GPLed anti-virus toolkit, designed for integration with
+    mail servers to perform attachment scanning. Clam AV also provides a
+    command line scanner and a tool for fetching updates of the virus database.
+    </p>
+  </background>
+  <description>
+    <p>
+    Oliver Eikemeier of Fillmore Labs discovered the overflow in Clam AV 0.65
+    when it handled malformed UUEncoded messages, causing the daemon to shut
+    down.
+    </p>
+    <p>
+    The problem originated in libclamav which calculates the line length of an
+    uuencoded message by taking the ASCII value of the first character minus 64
+    while doing an assertion if the length is not in the allowed range,
+    effectively terminating the calling program as clamav would not be
+    available.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malformed message would cause a denial of service,
+    and depending on the server configuration this may impact other daemons
+    relying on Clam AV in a fatal manner.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no immediate workaround, a software upgrade is required.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users are urged to upgrade their Clam AV installations to Clam AV 0.67:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv ">=app-antivirus/clamav-0.6.7"
+    # emerge ">=app-antivirus/clamav-0.6.7"</code>
+  </resolution>
+  <references>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200403-01.xml b/xml/htdocs/security/en/glsa/glsa-200403-01.xml
new file mode 100644
index 00000000..0cde74d9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200403-01.xml
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200403-01">
+  <title>Libxml2 URI Parsing Buffer Overflow Vulnerabilities</title>
+  <synopsis>
+    A buffer overflow has been discovered in libxml2 versions prior to
+    2.6.6 which may be exploited by an attacker allowing the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">libxml</product>
+  <announced>March 05, 2004</announced>
+  <revised>March 05, 2004: 01</revised>
+  <bug>42735</bug>
+  <access>local and remote combination</access>
+  <affected>
+    <package name="dev-libs/libxml2" auto="yes" arch="*">
+      <unaffected range="ge">2.6.6</unaffected>
+      <vulnerable range="lt">2.6.6</vulnerable>
+    </package>
+  </affected>
+  <description>
+    <p>
+    Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6.
+    When the libxml2 library fetches a remote resource via FTP or HTTP, libxml2
+    uses parsing routines that can overflow a buffer caused by improper bounds
+    checking if they are passed a URL longer than 4096 bytes.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    If an attacker is able to exploit an application using libxml2 that parses
+    remote resources, then this flaw could be used to execute arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    No workaround is available; users are urged to upgrade libxml2 to 2.6.6.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users are recommended to upgrade their libxml2 installation:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv ">=dev-libs/libxml2-2.6.6"
+    # emerge ">=dev-libs/libxml2-2.6.6"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0110">CVE 2004-0110</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200403-02.xml b/xml/htdocs/security/en/glsa/glsa-200403-02.xml
new file mode 100644
index 00000000..6c91741f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200403-02.xml
@@ -0,0 +1,244 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200403-02">
+  <title>Linux kernel do_mremap local privilege escalation vulnerability</title>
+  <synopsis>
+    A critical security vulnerability has been found in recent Linux kernels by
+    Paul Starzetz of iSEC Security Research which allows for local privilege
+    escalations.
+  </synopsis>
+  <product type="ebuild">Kernel</product>
+  <announced>March 05, 2004</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>42024</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-kernel/aa-sources" auto="no" arch="*">
+      <unaffected range="ge">2.4.23-r1</unaffected>
+      <vulnerable range="lt">2.4.23-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/alpha-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.21-r4</unaffected>
+      <vulnerable range="lt">2.4.21-r4</vulnerable>
+    </package>
+    <package name="sys-kernel/ck-sources" auto="no" arch="*">
+      <unaffected range="eq">2.4.24-r1</unaffected>
+      <unaffected range="ge">2.6.2-r1</unaffected>
+      <vulnerable range="lt">2.6.2-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/compaq-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.9.32.7-r2</unaffected>
+      <vulnerable range="lt">2.4.9.32.7-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/development-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.3_rc1</unaffected>
+      <vulnerable range="lt">2.6.3_rc1</vulnerable>
+    </package>
+    <package name="sys-kernel/gaming-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.20-r8</unaffected>
+      <vulnerable range="lt">2.4.20-r8</vulnerable>
+    </package>
+    <package name="sys-kernel/gentoo-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.3_rc1</unaffected>
+      <vulnerable range="lt">2.6.3_rc1</vulnerable>
+    </package>
+    <package name="sys-kernel/gentoo-sources" auto="yes" arch="*">
+      <unaffected range="eq">2.4.19-r11</unaffected>
+      <unaffected range="eq">2.4.20-r12</unaffected>
+      <unaffected range="ge">2.4.22-r7</unaffected>
+      <vulnerable range="lt">2.4.22-r7</vulnerable>
+    </package>
+    <package name="sys-kernel/grsec-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.24.1.9.13-r1</unaffected>
+      <vulnerable range="lt">2.4.24.1.9.13-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/gs-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.25_pre7-r2</unaffected>
+      <vulnerable range="lt">2.4.25_pre7-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/hardened-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.24-r1</unaffected>
+      <vulnerable range="lt">2.4.24-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/hppa-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.2_p3-r1</unaffected>
+      <vulnerable range="lt">2.6.2_p3-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/hppa-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.24_p0-r1</unaffected>
+      <vulnerable range="lt">2.4.24_p0-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/ia64-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.24-r1</unaffected>
+      <vulnerable range="lt">2.4.24-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/mips-prepatch-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.25_pre6-r1</unaffected>
+      <vulnerable range="lt">2.4.25_pre6-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/mips-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.25_rc4</unaffected>
+      <vulnerable range="lt">2.4.25_rc4</vulnerable>
+    </package>
+    <package name="sys-kernel/mm-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.3_rc1-r1</unaffected>
+      <vulnerable range="lt">2.6.3_rc1-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/openmosix-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.22-r4</unaffected>
+      <vulnerable range="lt">2.4.22-r4</vulnerable>
+    </package>
+    <package name="sys-kernel/pac-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.23-r3</unaffected>
+      <vulnerable range="lt">2.4.23-r3</vulnerable>
+    </package>
+    <package name="sys-kernel/planet-ccrma-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.21-r5</unaffected>
+      <vulnerable range="lt">2.4.21-r5</vulnerable>
+    </package>
+    <package name="sys-kernel/ppc-development-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.3_rc1-r1</unaffected>
+      <vulnerable range="lt">2.6.3_rc1-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/ppc-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.24-r1</unaffected>
+      <vulnerable range="lt">2.4.24-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/ppc-sources-benh" auto="yes" arch="*">
+      <unaffected range="ge">2.4.22-r5</unaffected>
+      <vulnerable range="lt">2.4.22-r5</vulnerable>
+    </package>
+    <package name="sys-kernel/ppc-sources-crypto" auto="yes" arch="*">
+      <unaffected range="ge">2.4.20-r3</unaffected>
+      <vulnerable range="lt">2.4.20-r3</vulnerable>
+    </package>
+    <package name="sys-kernel/ppc-sources-dev" auto="yes" arch="*">
+      <unaffected range="ge">2.4.24-r2</unaffected>
+      <vulnerable range="lt">2.4.24-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/selinux-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.24-r2</unaffected>
+      <vulnerable range="lt">2.4.24-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/sparc-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.3_rc1</unaffected>
+      <vulnerable range="lt">2.6.3_rc1</vulnerable>
+    </package>
+    <package name="sys-kernel/sparc-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.24-r2</unaffected>
+      <vulnerable range="lt">2.4.24-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/usermode-sources" auto="yes" arch="*">
+      <unaffected range="rge">2.4.24-r1</unaffected>
+      <unaffected range="rge">2.4.26</unaffected>
+      <unaffected range="ge">2.6.3-r1</unaffected>
+      <vulnerable range="lt">2.6.3-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/vanilla-prepatch-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.25_rc4</unaffected>
+      <vulnerable range="lt">2.4.25_rc4</vulnerable>
+    </package>
+    <package name="sys-kernel/vanilla-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.25</unaffected>
+      <vulnerable range="lt">2.4.25</vulnerable>
+    </package>
+    <package name="sys-kernel/win4lin-sources" auto="yes" arch="*">
+      <unaffected range="eq">2.4.23-r2</unaffected>
+      <unaffected range="ge">2.6.2-r1</unaffected>
+      <vulnerable range="lt">2.6.2-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/wolk-sources" auto="yes" arch="*">
+      <unaffected range="eq">4.9-r4</unaffected>
+      <unaffected range="ge">4.10_pre7-r3</unaffected>
+      <vulnerable range="lt">4.10_pre7-r3</vulnerable>
+    </package>
+    <package name="sys-kernel/xfs-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.24-r2</unaffected>
+      <vulnerable range="lt">2.4.24-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Linux kernel is responsible for memory management in a working
+    system - to allow this, processes are allowed to allocate and
+    unallocate memory.
+    </p>
+  </background>
+  <description>
+    <p>
+    The memory subsystem allows for shrinking, growing, and moving of
+    chunks of memory along any of the allocated memory areas which the
+    kernel posesses.
+    </p>
+    <p>
+    To accomplish this, the do_mremap code calls the do_munmap() kernel
+    function to remove any old memory mappings in the new location - but,
+    the code doesn't check the return value of the do_munmap() function
+    which may fail if the maximum number of available virtual memory area
+    descriptors has been exceeded.
+    </p>
+    <p>
+    Due to the missing return value check after trying to unmap the middle
+    of the first memory area, the corresponding page table entries from the
+    second new area are inserted into the page table locations described by
+    the first old one, thus they are subject to page protection flags of
+    the first area. As a result, arbitrary code can be executed.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Arbitrary code with normal non-super-user privelerges may be able to
+    exploit this vulnerability and may disrupt the operation of other parts
+    of the kernel memory management subroutines finally leading to
+    unexpected behavior.
+    </p>
+    <p>
+    Since no special privileges are required to use the mremap() and
+    mummap() system calls any process may misuse this unexpected behavior
+    to disrupt the kernel memory management subsystem. Proper exploitation
+    of this vulnerability may lead to local privilege escalation allowing
+    for the execution of arbitrary code with kernel level root access.
+    </p>
+    <p>
+    Proof-of-concept exploit code has been created and successfully tested,
+    permitting root escalation on vulnerable systems. As a result, all
+    users should upgrade their kernels to new or patched versions.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Users who are unable to upgrade their kernels may attempt to use
+    "sysctl -w vm.max_map_count=1000000", however, this is a temporary fix
+    which only solves the problem by increasing the number of memory areas
+    that can be created by each process. Because of the static nature of
+    this workaround, it is not recommended and users are urged to upgrade
+    their systems to the latest avaiable patched sources.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Users are encouraged to upgrade to the latest available sources for
+    their system:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv your-favourite-sources
+    # emerge your-favourite-sources
+    # # Follow usual procedure for compiling and installing a kernel.
+    # # If you use genkernel, run genkernel as you would do normally.
+    
+    # # IF YOUR KERNEL IS MARKED as &quot;remerge required!&quot; THEN
+    # # YOU SHOULD UPDATE YOUR KERNEL EVEN IF PORTAGE
+    # # REPORTS THAT THE SAME VERSION IS INSTALLED.</code>
+  </resolution>
+  <references>
+    <uri link="http://isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt">Advisory released by iSEC</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0077">CVE-2004-0077</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat,  2 Apr 2005 12:59:08 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200403-03.xml b/xml/htdocs/security/en/glsa/glsa-200403-03.xml
new file mode 100644
index 00000000..9088df95
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200403-03.xml
@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200403-03">
+  <title>Multiple OpenSSL Vulnerabilities</title>
+  <synopsis>
+    Three vulnerabilities have been found in OpenSSL via a commercial test
+    suite for the TLS protocol developed by Codenomicon Ltd.
+  </synopsis>
+  <product type="ebuild">OpenSSL</product>
+  <announced>March 17, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>44941</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/openssl" auto="yes" arch="*">
+      <unaffected range="ge">0.9.7d</unaffected>
+      <unaffected range="eq">0.9.6m</unaffected>
+      <vulnerable range="le">0.9.7c</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The OpenSSL Project is a collaborative effort to develop a robust,
+    commercial-grade, full-featured, and Open Source toolkit implementing
+    the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS
+    v1) protocols as well as a full-strength general purpose cryptography
+    library.
+    </p>
+  </background>
+  <description>
+    <ol>
+    <li>
+    Testing performed by the OpenSSL group using the Codenomicon TLS Test
+    Tool uncovered a null-pointer assignment in the do_change_cipher_spec()
+    function. A remote attacker could perform a carefully crafted SSL/TLS
+    handshake against a server that used the OpenSSL library in such a way
+    as to cause OpenSSL to crash. Depending on the application this could
+    lead to a denial of service. All versions of OpenSSL from 0.9.6c to
+    0.9.6l inclusive and from 0.9.7a to 0.9.7c inclusive are affected by
+    this issue.
+    </li>
+    <li>
+    A flaw has been discovered in SSL/TLS handshaking code when using
+    Kerberos ciphersuites. A remote attacker could perform a carefully
+    crafted SSL/TLS handshake against a server configured to use Kerberos
+    ciphersuites in such a way as to cause OpenSSL to crash. Most
+    applications have no ability to use Kerberos cipher suites and will
+    therefore be unaffected. Versions 0.9.7a, 0.9.7b, and 0.9.7c of OpenSSL
+    are affected by this issue.
+    </li>
+    <li>
+    Testing performed by the OpenSSL group using the Codenomicon TLS Test
+    Tool uncovered a bug in older versions of OpenSSL 0.9.6 that can lead
+    to a Denial of Service attack (infinite loop). This issue was traced to
+    a fix that was added to OpenSSL 0.9.6d some time ago. This issue will
+    affect vendors that ship older versions of OpenSSL with backported
+    security patches.
+    </li>
+    </ol>
+  </description>
+  <impact type="normal">
+    <p>
+    Although there are no public exploits known for bug, users are
+    recommended to upgrade to ensure the security of their infrastructure.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no immediate workaround; a software upgrade is required. The
+    vulnerable function in the code has been rewritten.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users are recommened to upgrade openssl to either 0.9.7d or 0.9.6m:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv &quot;&gt;=dev-libs/openssl-0.9.7d&quot;
+    # emerge &quot;&gt;=dev-libs/openssl-0.9.7d&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0079">CVE-2004-0079</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0081">CVE-2004-0081</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0112">CVE-2004-0112</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 22 May 2006 05:54:03 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200403-04.xml b/xml/htdocs/security/en/glsa/glsa-200403-04.xml
new file mode 100644
index 00000000..c6a9d9d2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200403-04.xml
@@ -0,0 +1,113 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200403-04">
+  <title>Multiple security vulnerabilities in Apache 2</title>
+  <synopsis>
+    A memory leak in mod_ssl allows a remote denial of service attack against
+    an SSL-enabled server via plain HTTP requests. Another flaw was found when
+    arbitrary client-supplied strings can be written to the error log, allowing
+    the exploit of certain terminal emulators. A third flaw exists with the
+    mod_disk_cache module.
+  </synopsis>
+  <product type="ebuild">Apache</product>
+  <announced>March 22, 2004</announced>
+  <revised>December 30, 2007: 03</revised>
+  <bug>45206</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="eq">1.3*</unaffected>
+      <unaffected range="ge">2.0.49</unaffected>
+      <vulnerable range="le">2.0.48</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP Server Project is an effort to develop and maintain an
+    open-source HTTP server for modern operating systems. The goal of this
+    project is to provide a secure, efficient and extensible server that
+    provides services in tune with the current HTTP standards.
+    </p>
+  </background>
+  <description>
+    <p>
+    Three vulnerabilities were found:
+    </p>
+    <ol>
+    <li>
+    A memory leak in ssl_engine_io.c for mod_ssl in Apache 2.0.48 and below
+    allows remote attackers to cause a denial of service attack via plain
+    HTTP requests to the SSL port of an SSL-enabled server.
+    </li>
+    <li>
+    Apache fails to filter terminal escape sequences from error logs that
+    begin with the ASCII (0x1B) sequence and are followed by a  series of
+    arguments. If a remote attacker could inject escape sequences into an
+    Apache error log, the attacker could take advantages of weaknesses in
+    various terminal emulators, launching attacks against remote users
+    including further denial of service attacks, file modification, and the
+    execution of arbitrary commands.
+    </li>
+    <li>
+    The Apache mod_disk_cache has been found to be vulnerable to a weakness
+    that allows attackers to gain access to authentication credentials
+    through the issue of caching HTTP hop-by-hop headers which would
+    contain plaintext user passwords. There is no available resolution for
+    this issue yet.
+    </li>
+    </ol>
+  </description>
+  <impact type="normal">
+    <p>
+    No special privileges are required for these vulnerabilities. As a
+    result, all users are recommended to upgrade their Apache
+    installations.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no immediate workaround; a software upgrade is required. There
+    is no workaround for the mod_disk_cache issue; users are recommended to
+    disable the feature on their servers until a patched version is
+    released.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Users are urged to upgrade to Apache 2.0.49:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv &quot;&gt;=www-servers/apache-2.0.49&quot;
+    # emerge &quot;&gt;=www-servers/apache-2.0.49&quot;
+    
+    # ** IMPORTANT **
+    
+    # If you are migrating from Apache 2.0.48-r1 or earlier versions,
+    # it is important that the following directories are removed.
+    
+    # The following commands should cause no data loss since these
+    # are symbolic links.
+    
+    # rm /etc/apache2/lib /etc/apache2/logs /etc/apache2/modules
+    # rm /etc/apache2/modules
+    
+    # ** ** ** ** **
+    
+    # ** ALSO NOTE **
+    
+    # Users who use mod_disk_cache should edit their Apache
+    # configuration and disable mod_disk_cache.</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/bid/9933/info/">Apache mod_disk_cache authentication storage weakness vulnerability</uri>
+    <uri link="http://www.apache.org/dist/httpd/Announcement2.html">Apache HTTP Server 2.0.49 Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0113">CVE-2004-0113</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 22 May 2006 05:52:59 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200403-05.xml b/xml/htdocs/security/en/glsa/glsa-200403-05.xml
new file mode 100644
index 00000000..4f60a180
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200403-05.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200403-05">
+  <title>UUDeview MIME Buffer Overflow</title>
+  <synopsis>
+    A specially-crafted MIME file (.mim, .uue, .uu, .b64, .bhx, .hqx, and .xxe
+    extensions) may cause UUDeview to crash or execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">UUDeview</product>
+  <announced>March 26, 2004</announced>
+  <revised>March 26, 2004: 01</revised>
+  <bug>44859</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/uudeview" auto="yes" arch="*">
+      <unaffected range="ge">0.5.20</unaffected>
+      <vulnerable range="lt">0.5.20</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    UUDeview is a program which is used to transmit binary files over the
+    Internet in a text-only format. It is commonly used for email and Usenet
+    attachments. It supports multiple encoding formats, including Base64,
+    BinHex and UUEncoding.
+    </p>
+  </background>
+  <description>
+    <p>
+    By decoding a MIME archive with excessively long strings for various
+    parameters, it is possible to crash UUDeview, or cause it to execute
+    arbitrary code.
+    </p>
+    <p>
+    This vulnerability was originally reported by iDEFENSE as part of a WinZip
+    advisory [ Reference: 1 ].
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could create a specially-crafted MIME file and send it via
+    email. When recipient decodes the file, UUDeview may execute arbitrary code
+    which is embedded in the MIME file, thus granting the attacker access to
+    the recipient's account.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. As a result, a software upgrade
+    is required and users should upgrade to uudeview 0.5.20.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to uudeview 0.5.20:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv ">=app-text/uudeview-0.5.20"
+    # emerge ">=app-text/uudeview-0.5.20"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://www.idefense.com/application/poi/display?id=76&amp;type=vulnerabilities">iDEFENSE advisory</uri>
+    <uri link="http://www.securityfocus.com/bid/9758">SecurityFocus advisory</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200403-06.xml b/xml/htdocs/security/en/glsa/glsa-200403-06.xml
new file mode 100644
index 00000000..7dfad640
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200403-06.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200403-06">
+  <title>Multiple remote buffer overflow vulnerabilities in Courier</title>
+  <synopsis>
+    Remote buffer overflow vulnerabilites have been found in Courier-IMAP and
+    Courier MTA. These exploits may allow the execution of abritrary code,
+    allowing unauthorized access to a vulnerable system. 
+  </synopsis>
+  <product type="ebuild">Courier</product>
+  <announced>March 26, 2004</announced>
+  <revised>March 26, 2004: 01</revised>
+  <bug>45584</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/courier-imap" auto="yes" arch="*">
+      <unaffected range="ge">3.0.0</unaffected>
+      <vulnerable range="lt">3.0.0</vulnerable>
+    </package>
+    <package name="mail-mta/courier" auto="yes" arch="*">
+      <unaffected range="ge">0.45</unaffected>
+      <vulnerable range="lt">0.45</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Courier MTA is a multiprotocol mail server suite that provides webmail,
+    mailing lists, IMAP, and POP3 services. Courier-IMAP is a standalone server
+    that gives IMAP access to local mailboxes.
+    </p>
+  </background>
+  <description>
+    <p>
+    The vulnerabilities have been found in the 'SHIFT_JIS' converter in
+    'shiftjis.c' and 'ISO2022JP' converter in 'so2022jp.c'. An attacker may
+    supply Unicode characters that exceed BMP (Basic Multilingual Plane) range,
+    causing an overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker without privileges may exploit this vulnerability remotely, allowing arbitrary code to be executed in order to gain unauthorized access. 
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    While a workaround is not currently known for this issue, all users are
+    advised to upgrade to the latest version of the affected packages.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to current versions of the affected packages:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-mail/courier-imap-3.0.0"
+    # emerge ">=net-mail/courier-imap-3.0.0"
+
+    # ** Or; depending on your installation... **
+
+    # emerge -pv ">=mail-mta/courier-0.45"
+    # emerge ">=mail-mta/courier-0.45"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/bid/9845">Courier Multiple Remote Buffer Overflow Vulnerabilities</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0224">CAN-2004-0224</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200403-07.xml b/xml/htdocs/security/en/glsa/glsa-200403-07.xml
new file mode 100644
index 00000000..bab50d0c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200403-07.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200403-07">
+  <title>Multiple remote overflows and vulnerabilities in Ethereal</title>
+  <synopsis>
+    Mulitple overflows and vulnerabilities exist in Ethereal which may allow an
+    attacker to crash the program or run arbitrary code.
+  </synopsis>
+  <product type="ebuild">ethereal</product>
+  <announced>March 28, 2004</announced>
+  <revised>March 28, 2004: 01</revised>
+  <bug>45543</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/ethereal" auto="yes" arch="*">
+      <unaffected range="ge">0.10.3</unaffected>
+      <vulnerable range="le">0.10.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Quote from http://www.ethereal.com
+    </p>
+    <p>
+    &quot;Ethereal is used by network professionals around the world for
+    troubleshooting, analysis, software and protocol development, and
+    education. It has all of the standard features you would expect in a
+    protocol analyzer, and several features not seen in any other product. Its
+    open source license allows talented experts in the networking community to
+    add enhancements. It runs on all popular computing platforms, including
+    Unix, Linux, and Windows.&quot;
+    </p>
+  </background>
+  <description>
+    <p>There are multiple vulnerabilities in versions of Ethereal earlier than 0.10.3, including:</p>
+    <ul>
+	<li>Thirteen buffer overflows in the following protocol dissectors: NetFlow, IGAP, EIGRP, PGM, IrDA, BGP, ISUP, and TCAP.</li>
+      	<li>A zero-length Presentation protocol selector could make Ethereal crash.</li>
+     	<li>A vulnerability in the RADIUS packet dissector which may crash ethereal.</li>
+      	<li>A corrupt color filter file could cause a segmentation fault.</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    These vulnerabilities may cause Ethereal to crash or may allow an attacker
+    to run arbitrary code on the user's computer.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    While a workaround is not currently known for this issue, all users are
+    advised to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the current version of the affected package:
+    </p>
+    <code>

+    # emerge sync

+    

+    # emerge -pv ">=net-analyzer/ethereal-0.10.3"

+    # emerge ">=net-analyzer/ethereal-0.10.3"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.ethereal.com/appnotes/enpa-sa-00013.html">Multiple security problems in Ethereal 0.10.2</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0176">CAN-2004-0176</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0365">CAN-2004-0365</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0367">CAN-2004-0367</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200403-08.xml b/xml/htdocs/security/en/glsa/glsa-200403-08.xml
new file mode 100644
index 00000000..3a7f2c7a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200403-08.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200403-08">
+  <title>oftpd DoS vulnerability</title>
+  <synopsis>
+    A remotely-exploitable overflow exists in oftpd, allowing an attacker to
+    crash the oftpd daemon.
+  </synopsis>
+  <product type="ebuild">oftpd</product>
+  <announced>March 29, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>45738</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-ftp/oftpd" auto="yes" arch="*">
+      <unaffected range="ge">0.3.7</unaffected>
+      <vulnerable range="le">0.3.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Quote from <uri
+    link="http://www.time-travellers.org/oftpd/">http://www.time-travellers
+    .org/oftpd/</uri>
+    </p>
+    <p>
+    "oftpd is designed to be as secure as an anonymous FTP server can
+    possibly be. It runs as non-root for most of the time, and uses the
+    Unix chroot() command to hide most of the systems directories from
+    external users - they cannot change into them even if the server is
+    totally compromised! It contains its own directory change code, so that
+    it can run efficiently as a threaded server, and its own directory
+    listing code (most FTP servers execute the system "ls" command to list
+    files)."
+    </p>
+  </background>
+  <description>
+    <p>
+    Issuing a port command with a number higher than 255 causes the server
+    to crash. The port command may be issued before any authentication
+    takes place, meaning the attacker does not need to know a valid
+    username and password in order to exploit this vulnerability.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    This exploit causes a denial of service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    While a workaround is not currently known for this issue, all users are
+    advised to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the current version of the affected
+    package:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-ftp/oftpd-0.3.7&quot;
+    # emerge &quot;&gt;=net-ftp/oftpd-0.3.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.time-travellers.org/oftpd/oftpd-dos.html">osftpd DoS Vulnerability</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0376">CVE-2004-0376</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 22 May 2006 05:52:22 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200403-09.xml b/xml/htdocs/security/en/glsa/glsa-200403-09.xml
new file mode 100644
index 00000000..ebf4ff60
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200403-09.xml
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200403-09">
+  <title>Buffer overflow in Midnight Commander</title>
+  <synopsis>
+    A remotely-exploitable buffer overflow in Midnight Commander allows
+    arbitrary code to be run on a user's computer
+  </synopsis>
+  <product type="ebuild">mc</product>
+  <announced>March 29, 2004</announced>
+  <revised>March 29, 2004: 01</revised>
+  <bug>45957</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-misc/mc" auto="yes" arch="*">
+      <unaffected range="ge">4.6.0-r5</unaffected>
+      <vulnerable range="le">4.6.0-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Midnight Commander is a visual file manager.
+    </p>
+  </background>
+  <description>
+    <p>
+    A stack-based buffer overflow has been found in Midnight Commander's
+    virtual filesystem.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    This overflow allows an attacker to run arbitrary code on the user's
+    computer during the symlink conversion process.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    While a workaround is not currently known for this issue, all users are
+    advised to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the current version of the affected package:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv ">=app-misc/mc-4.6.0-r5"
+    # emerge ">=app-misc/mc-4.6.0-r5"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-1023">CAN-2003-1023</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200403-10.xml b/xml/htdocs/security/en/glsa/glsa-200403-10.xml
new file mode 100644
index 00000000..3459fc88
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200403-10.xml
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200403-10">
+  <title>Fetchmail 6.2.5 fixes a remote DoS</title>
+  <synopsis>
+    Fetchmail versions 6.2.4 and earlier can be crashed by sending a
+    specially-crafted email to a fetchmail user.
+  </synopsis>
+  <product type="ebuild">fetchmail</product>
+  <announced>March 30, 2004</announced>
+  <revised>March 30, 2004: 01</revised>
+  <bug>37717</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/fetchmail" auto="yes" arch="*">
+      <unaffected range="ge">6.2.5</unaffected>
+      <vulnerable range="le">6.2.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Fetchmail is a utility that retrieves and forwards mail from remote systems
+    using IMAP, POP, and other protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    Fetchmail versions 6.2.4 and earlier can be crashed by sending a
+    specially-crafted email to a fetchmail user. This problem occurs because
+    Fetchmail does not properly allocate memory for long lines in an incoming
+    email.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Fetchmail users who receive a malicious email may have their fetchmail
+    program crash.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    While a workaround is not currently known for this issue, all users are advised to upgrade to the latest version of fetchmail.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Fetchmail users should upgrade to version 6.2.5 or later:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv ">=net-mail/fetchmail-6.2.5"
+    # emerge ">=net-mail/fetchmail-6.2.5"</code>
+  </resolution>
+  <references>
+    <uri link="http://xforce.iss.net/xforce/xfdb/13450">ISS X-Force Listing</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0792">CVE Candidate (CAN-2003-0792)</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200403-11.xml b/xml/htdocs/security/en/glsa/glsa-200403-11.xml
new file mode 100644
index 00000000..a52fe8eb
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200403-11.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200403-11">
+  <title>Squid ACL [url_regex] bypass vulnerability</title>
+  <synopsis>
+    Squid versions 2.0 through to 2.5.STABLE4 could allow a remote attacker to
+    bypass Access Control Lists by sending a specially-crafted URL request
+    containing '%00': in such circumstances; the url_regex ACL may not properly
+    detect the malicious URL, allowing the attacker to effectively bypass the
+    ACL.
+  </synopsis>
+  <product type="ebuild">Squid</product>
+  <announced>March 30, 2004</announced>
+  <revised>September 02, 2004: 02</revised>
+  <bug>45273</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-proxy/squid" auto="yes" arch="*">
+      <unaffected range="ge">2.5.5</unaffected>
+      <vulnerable range="lt">2.5.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Squid is a fully-featured Web Proxy Cache designed to run on Unix systems
+    that supports proxying and caching of HTTP, FTP, and other URLs, as well as
+    SSL support, cache hierarchies, transparent caching, access control lists
+    and many other features.
+    </p>
+  </background>
+  <description>
+    <p>
+    A bug in Squid allows users to bypass certain access controls by passing a
+    URL containing &quot;%00&quot; which exploits the Squid decoding function.
+    This may insert a NUL character into decoded URLs, which may allow users to
+    bypass url_regex access control lists that are enforced upon them.
+    </p>
+    <p>
+    In such a scenario, Squid will insert a NUL character after
+    the&quot;%00&quot; and it will make a comparison between the URL to the end
+    of the NUL character rather than the contents after it: the comparison does
+    not result in a match, and the user's request is not denied.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Restricted users may be able to bypass url_regex access control lists that
+    are enforced upon them which may cause unwanted network traffic as well as
+    a route for other possible exploits. Users of Squid 2.5STABLE4 and below
+    who require the url_regex features are recommended to upgrade to 2.5STABLE5
+    to maintain the security of their infrastructure.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are advised
+    to upgrade to the latest version of Squid.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Squid can be updated as follows:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-proxy/squid-2.5.5"
+    # emerge ">=net-proxy/squid-2.5.5"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0189">CAN-2004-0189</uri>
+    <uri link="http://www.squid-cache.org/Advisories/SQUID-2004_1.txt">Squid 2.5.STABLE5 Release Announcement</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu,  2 Sep 2004 21:11:59 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200403-12.xml b/xml/htdocs/security/en/glsa/glsa-200403-12.xml
new file mode 100644
index 00000000..65e6c203
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200403-12.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200403-12">
+  <title>OpenLDAP DoS Vulnerability</title>
+  <synopsis>
+    A failed password operation can cause the OpenLDAP slapd server, if it is
+    using the back-ldbm backend, to free memory that was never allocated.
+  </synopsis>
+  <product type="ebuild">openldap</product>
+  <announced>March 31, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>26728</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-nds/openldap" auto="yes" arch="*">
+      <unaffected range="ge">2.1.13</unaffected>
+      <vulnerable range="le">2.1.12</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenLDAP is a suite of LDAP-related application and development tools.
+    It includes slapd (the standalone LDAP server), slurpd (the standalone
+    LDAP replication server), and various LDAP libraries, utilities and
+    example clients.
+    </p>
+  </background>
+  <description>
+    <p>
+    A password extended operation (password EXOP) which fails will cause
+    the slapd server to free() an uninitialized pointer, possibly resulting
+    in a segfault. This only affects servers using the back-ldbm backend.
+    </p>
+    <p>
+    Such a crash is not guaranteed with every failed operation, however, it
+    is possible.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker (or indeed, a normal user) may crash the OpenLDAP server,
+    creating a Denial of Service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are
+    advised to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    OpenLDAP users should upgrade to version 2.1.13 or later:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-nds/openldap-2.1.13&quot;
+    # emerge &quot;&gt;=net-nds/openldap-2.1.13&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.openldap.org/its/index.cgi?findid=2390">OpenLDAP ITS Bug and Patch</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1201">CVE-2003-1201</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 22 May 2006 05:51:37 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200403-13.xml b/xml/htdocs/security/en/glsa/glsa-200403-13.xml
new file mode 100644
index 00000000..5df64b56
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200403-13.xml
@@ -0,0 +1,100 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200403-13">
+  <title>Remote buffer overflow in MPlayer</title>
+  <synopsis>
+    MPlayer contains a remotely exploitable buffer overflow in the HTTP parser
+    that may allow attackers to run arbitrary code on a user's computer.
+  </synopsis>
+  <product type="ebuild">mplayer</product>
+  <announced>March 31, 2004</announced>
+  <revised>October 11, 2006: 03</revised>
+  <bug>46246</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/mplayer" auto="yes" arch="x86 and sparc">
+      <unaffected range="ge">0.92-r1</unaffected>
+      <vulnerable range="le">0.92</vulnerable>
+    </package>
+    <package name="media-video/mplayer" auto="yes" arch="amd64">
+      <unaffected range="ge">1.0_pre2-r1</unaffected>
+      <vulnerable range="le">1.0_pre2</vulnerable>
+    </package>
+    <package name="media-video/mplayer" auto="yes" arch="ppc">
+      <unaffected range="ge">1.0_pre3-r3</unaffected>
+      <vulnerable range="le">1.0_pre3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Quote from <uri link="http://mplayerhq.hu">http://mplayerhq.hu</uri>
+    </p>
+    <p>
+    "MPlayer is a movie player for LINUX (runs on many other Unices, and
+    non-x86 CPUs, see the documentation). It plays most MPEG, VOB, AVI,
+    OGG/OGM, VIVO, ASF/WMA/WMV, QT/MOV/MP4, FLI, RM, NuppelVideo, YUV4MPEG,
+    FILM, RoQ, PVA files, supported by many native, XAnim, and Win32 DLL
+    codecs. You can watch VideoCD, SVCD, DVD, 3ivx, DivX 3/4/5 and even WMV
+    movies, too."
+    </p>
+  </background>
+  <description>
+    <p>
+    A vulnerability exists in the MPlayer HTTP parser which may allow an
+    attacker to craft a special HTTP header ("Location:") which will trick
+    MPlayer into executing arbitrary code on the user's computer.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker without privileges may exploit this vulnerability remotely,
+    allowing arbitrary code to be executed in order to gain unauthorized
+    access.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are
+    advised to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    MPlayer may be upgraded as follows:
+    </p>
+    <p>
+    x86 and SPARC users should:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=media-video/mplayer-0.92-r1&quot;
+    # emerge &quot;&gt;=media-video/mplayer-0.92-r1&quot;</code>
+    <p>
+    AMD64 users should:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=media-video/mplayer-1.0_pre2-r1&quot;
+    # emerge &quot;&gt;=media-video/mplayer-1.0_pre2-r1&quot;</code>
+    <p>
+    PPC users should:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=media-video/mplayer-1.0_pre3-r2&quot;
+    # emerge &quot;&gt;=media-video/mplayer-1.0_pre3-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.mplayerhq.hu/homepage/design6/news.html">MPlayerHQ News</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0386">CVE-2004-0386</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 22 May 2006 05:45:24 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200403-14.xml b/xml/htdocs/security/en/glsa/glsa-200403-14.xml
new file mode 100644
index 00000000..6451659d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200403-14.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200403-14">
+  <title>Multiple Security Vulnerabilities in Monit</title>
+  <synopsis>
+    A denial of service and a buffer overflow vulnerability have been found in
+    Monit.
+  </synopsis>
+  <product type="ebuild">app-admin/monit</product>
+  <announced>March 31, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>43967</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-admin/monit" auto="yes" arch="*">
+      <unaffected range="ge">4.2</unaffected>
+      <vulnerable range="le">4.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Monit is a system administration utility that allows management and
+    monitoring of processes, files, directories and devices on a Unix
+    system.
+    </p>
+  </background>
+  <description>
+    <p>
+    A denial of service may occur due to Monit not sanitizing remotely
+    supplied HTTP parameters before passing them to memory allocation
+    functions. This could allow an attacker to cause an unexpected
+    condition that could lead to the Monit daemon crashing.
+    </p>
+    <p>
+    An overly long http request method may cause a buffer overflow due to
+    Monit performing insufficient bounds checking when handling HTTP
+    requests.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker may crash the Monit daemon to create a denial of service
+    condition or cause a buffer overflow that would allow arbitrary code to
+    be executed with root privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are
+    advised to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Monit users should upgrade to version 4.2 or later:
+    </p>
+    <code> 
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=app-admin/monit-4.2&quot;
+    # emerge &quot;&gt;=app-admin/monit-4.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/bid/9098">Monit HTTP Content-Length Parameter Denial of Service Vulnerability</uri>
+    <uri link="http://www.securityfocus.com/bid/9099">Monit Overly Long HTTP Request Buffer Overrun Vulnerability</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1083">CVE-2003-1083</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1084">CVE-2003-1084</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 22 May 2006 05:44:45 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-01.xml b/xml/htdocs/security/en/glsa/glsa-200404-01.xml
new file mode 100644
index 00000000..0c2e1a4e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-01.xml
@@ -0,0 +1,95 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-01">
+  <title>Insecure sandbox temporary lockfile vulnerabilities in Portage</title>
+  <synopsis>
+    A flaw has been found in the temporary file handling algorithms for the
+    sandboxing code used within Portage. Lockfiles created during normal Portage
+    operation of portage could be manipulated by local users resulting in the
+    truncation of hard linked files; causing a Denial of Service attack on
+    the system.
+  </synopsis>
+  <product type="ebuild">Portage</product>
+  <announced>April 04, 2004</announced>
+  <revised>April 04, 2004: 01</revised>
+  <bug>21923</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-apps/portage" auto="yes" arch="*">
+      <unaffected range="ge">2.0.50-r3</unaffected>
+      <vulnerable range="lt">2.0.50-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Portage is Gentoo's package management system which is responsible for
+    installing, compiling and updating any ebuilds on the system through the
+    Gentoo rsync tree. Under default configurations, most ebuilds run under a
+    sandbox which prevent the build process writing to the &quot;real&quot;
+    system outside the build directory - packages are installed into a
+    temporary location and then copied over safely by Portage instead. During
+    the process the sandbox wrapper creates lockfiles in the /tmp directory
+    which are vulnerable to a hard-link attack.
+    </p>
+  </background>
+  <description>
+    <p>
+    A flaw in Portage's sandbox wrapper has been found where the temporary
+    lockfiles are subject to a hard-link attack which allows linkable files to
+    be overwritten to an empty file. This can be used to damage critical files
+    on a system causing a Denial of Service, or alternatively this attack may
+    be used to cause other security risks; for example firewall configuration
+    data could be overwritten without notice.
+    </p>
+    <p>
+    The vulnerable sandbox functions have been patched to test for these new
+    conditions: namely; for the existance of a hard-link which would be removed
+    before the sandbox process would continue, for the existance of a
+    world-writable lockfile in which case the sandbox would also remove it, and
+    also for any mismatches in the UID ( anything but root ) and the GID (
+    anything but the group of the sandbox process ).
+    </p>
+    <p>
+    If the vulnerable files cannot be removed by the sandbox, then the sandbox
+    would exit with a fatal error warning the adminstrator of the issue. The
+    patched functions also fix any other sandbox I/O operations which do not
+    explicitly include the mentioned lockfile.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Any user with write access to the /tmp directory can hard-link a file to
+    /tmp/sandboxpids.tmp - this file would eventually be replaced with an empty
+    one; effectively wiping out the file it was linked to as well with no prior
+    warning. This could be used to potentially disable a vital component of the
+    system and cause a path for other possible exploits.
+    </p>
+    <p>
+    This vulnerability only affects systems that have /tmp on the root
+    partition: since symbolic link attacks are filtered, /tmp has to be on the
+    same partition for an attack to take place.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are advised
+    to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Users should upgrade to Portage 2.0.50-r3 or later:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv ">=sys-apps/portage-2.0.50-r3"
+    # emerge ">=sys-apps/portage-2.0.50-r3"</code>
+  </resolution>
+  <references>
+  </references>
+  <metadata tag="submitter">plasmaroo</metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-02.xml b/xml/htdocs/security/en/glsa/glsa-200404-02.xml
new file mode 100644
index 00000000..3b6f7c9f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-02.xml
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-02">
+  <title>KDE Personal Information Management Suite Remote Buffer Overflow Vulnerability</title>
+  <synopsis>
+    KDE-PIM may be vulnerable to a remote buffer overflow attack that may allow
+    unauthorized access to an affected system. 
+  </synopsis>
+  <product type="ebuild">kde-base/kde</product>
+  <announced>April 06, 2004</announced>
+  <revised>April 06, 2004: 01</revised>
+  <bug>38256</bug>
+  <access>remote</access>
+  <affected>
+    <package name="kde-base/kde" auto="yes" arch="*">
+      <unaffected range="ge">3.1.5</unaffected>
+      <vulnerable range="le">3.1.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDE-PIM is an application suite designed to manage mail, addresses,
+    appointments, and contacts.
+    </p>
+  </background>
+  <description>
+    <p>
+    A buffer overflow may occur in KDE-PIM's VCF file reader when a maliciously
+    crafted VCF file is opened by a user on a vulnerable system.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker may unauthorized access to a user's personal data or
+    execute commands with the user's privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are advised
+    to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    KDE users should upgrade to version 3.1.5 or later:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv ">=kde-base/kde-3.1.5"
+    # emerge ">=kde-base/kde-3.1.5"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0988">CAN-2003-0988</uri>
+  </references>
+  <metadata tag="submitter">aescriva</metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-03.xml b/xml/htdocs/security/en/glsa/glsa-200404-03.xml
new file mode 100644
index 00000000..329c442e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-03.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-03">
+  <title>Tcpdump Vulnerabilities in ISAKMP Parsing</title>
+  <synopsis>
+    There are multiple vulnerabilities in tcpdump and libpcap related to
+    parsing of ISAKMP packets.
+  </synopsis>
+  <product type="ebuild">tcpdump</product>
+  <announced>March 31, 2004</announced>
+  <revised>March 31, 2004: 01</revised>
+  <bug>38206</bug>
+  <bug>46258</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/tcpdump" auto="yes" arch="*">
+      <unaffected range="ge">3.8.3-r1</unaffected>
+      <vulnerable range="le">3.8.1</vulnerable>
+    </package>
+    <package name="net-libs/libpcap" auto="yes" arch="*">
+      <unaffected range="ge">0.8.3-r1</unaffected>
+      <vulnerable range="le">0.8.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Tcpdump is a program for monitoring IP network traffic. Libpcap is a
+    supporting library which is responsibile for capturing packets off a network
+    interface.
+    </p>
+  </background>
+  <description>
+    <p>
+    There are two specific vulnerabilities in tcpdump, outlined in [ reference
+    1 ]. In the first scenario, an attacker may send a specially-crafted ISAKMP
+    Delete packet which causes tcpdump to read past the end of its buffer. In
+    the second scenario, an attacker may send an ISAKMP packet with the wrong
+    payload length, again causing tcpdump to read past the end of a buffer.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Remote attackers could potentially cause tcpdump to crash or execute
+    arbitrary code as the 'pcap' user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All tcpdump users are encouraged
+    to upgrade to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All tcpdump users should upgrade to the latest available version.
+    ADDITIONALLY, the net-libs/libpcap package should be upgraded.
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-libs/libpcap-0.8.3-r1" ">=net-analyzer/tcpdump-3.8.3-r1"
+    # emerge ">=net-libs/libpcap-0.8.3-r1" ">=net-analyzer/tcpdump-3.8.3-r1"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.rapid7.com/advisories/R7-0017.html">Rapid7 Advisory</uri>
+    <uri link="http://rhn.redhat.com/errata/RHSA-2004-008.html">Red Hat Security Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0989">CVE Advisory</uri>
+  </references>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-04.xml b/xml/htdocs/security/en/glsa/glsa-200404-04.xml
new file mode 100644
index 00000000..862c1362
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-04.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-04">
+  <title>Multiple vulnerabilities in sysstat</title>
+  <synopsis>
+    Multiple vulnerabilities in the way sysstat handles symlinks may allow an
+    attacker to execute arbitrary code or overwrite arbitrary files
+  </synopsis>
+  <product type="ebuild">sysstat</product>
+  <announced>April 06, 2004</announced>
+  <revised>April 06, 2004: 01</revised>
+  <bug>45159</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-admin/sysstat" auto="yes" arch="x86 ppc sparc amd64">
+      <unaffected range="ge">5.0.2</unaffected>
+      <vulnerable range="lt">5.0.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    sysstat is a package containing a number of performance monitoring
+    utilities for Linux, including sar, mpstat, iostat and sa tools
+    </p>
+  </background>
+  <description>
+    <p>
+    There are two vulnerabilities in the way sysstat handles symlinks:
+    </p>
+	<ol>
+    <li>The isag utility, which displays sysstat data in a graphical format,
+    creates a temporary file in an insecure manner.</li>
+    <li>Two scripts in the sysstat package, post and trigger, create temporary
+    files in an insecure manner.</li>
+	</ol>
+  </description>
+  <impact type="normal">
+    <p>
+    Both vulnerabilities may allow an attacker to overwrite arbitrary files
+    under the permissions of the user executing any of the affected 
+    utilities.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are advised
+    to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Systat users should upgrade to version 4.2 or later:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv ">=app-admin/sysstat-5.0.2"
+    # emerge ">=app-admin/sysstat-5.0.2"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0107">CVE (1)</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0108">CVE (2)</uri>
+  </references>
+  <metadata tag="submitter">klieber</metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-05.xml b/xml/htdocs/security/en/glsa/glsa-200404-05.xml
new file mode 100644
index 00000000..1ba1d3a6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-05.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-05">
+  <title>ipsec-tools contains an X.509 certificates vulnerability.</title>
+  <synopsis>
+    ipsec-tools contains a vulnerability that affects connections authenticated 
+    with X.509 certificates.
+  </synopsis>
+  <product type="ebuild">ipsec-tools</product>
+  <announced>April 07, 2004</announced>
+  <revised>April 07, 2004: 01</revised>
+  <bug>47013</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-firewall/ipsec-tools" auto="yes" arch="amd64">
+      <unaffected range="ge">0.2.5</unaffected>
+      <vulnerable range="le">0.2.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    From http://ipsec-tools.sourceforge.net/ :
+    </p>
+    <p>
+    &quot;IPsec-Tools is a port of KAME's IPsec utilities to the Linux-2.6
+    IPsec implementation.&quot;
+    </p>
+  </background>
+  <description>
+    <p>
+    <i>racoon</i> (a utility in the ipsec-tools package) does not verify digital
+    signatures on Phase1 packets.  This means  that anybody holding the correct
+    X.509 certificate would be able to establish a connection, even if they did
+    not have the corresponding private key.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Since digital signatures are not verified by the <i>racoon</i> tool, an attacker may
+	be able to connect to the VPN gateway and/or execute a man-in-the-middle attack.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are advised
+    to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    ipsec-tools users should upgrade to version 0.2.5 or later:
+    </p>
+    <code>
+    # emerge sync
+ 
+    # emerge -pv ">=net-firewall/ipsec-tools-0.2.5"
+    # emerge ">=net-firewall/ipsec-tools-0.2.5"</code>
+  </resolution>
+  <references>
+  </references>
+  <metadata tag="submitter">klieber</metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-06.xml b/xml/htdocs/security/en/glsa/glsa-200404-06.xml
new file mode 100644
index 00000000..478eb527
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-06.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-06">
+  <title>Util-linux login may leak sensitive data</title>
+  <synopsis>
+    The login program included in util-linux could leak sensitive information
+    under certain conditions.
+  </synopsis>
+  <product type="ebuild"> </product>
+  <announced>April 07, 2004</announced>
+  <revised>April 07, 2004: 01</revised>
+  <bug>46422</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-apps/util-linux" auto="yes" arch="*">
+      <unaffected range="ge">2.12</unaffected>
+      <vulnerable range="le">2.11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Util-linux is a suite of essential system utilites, including login,
+    agetty, fdisk. 
+    </p>
+  </background>
+  <description>
+    <p>
+    In some situations the login program could leak sensitive data due to an
+    incorrect usage of a reallocated pointer.
+    </p>
+    <p>
+	<b>NOTE:</b> Only users who have PAM support <b>disabled</b> on their
+	systems (i.e.  <i>-PAM</i> in their USE variable) will be affected by this
+	vulnerability.  By default, this USE flag is <b>enabled</b> on all
+	architectures.  Users with PAM support on their system receive login binaries
+	as part of the pam-login package, which remains unaffected.
+	</p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker may obtain sensitive data.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+     A workaround is not currently known for this issue. All users are advised to upgrade to the latest version of the affected package.
+	</p>
+  </workaround>
+  <resolution>
+    <p>
+    All util-linux users should upgrade to version 2.12 or later:
+    </p>
+    <code>
+    # emerge sync
+    
+	# emerge -pv ">=sys-apps/util-linux-2.12"
+    # emerge ">=sys-apps/util-linux-2.12"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0080">CAN-2004-0080</uri>
+  </references>
+  <metadata tag="submitter">lcars</metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-07.xml b/xml/htdocs/security/en/glsa/glsa-200404-07.xml
new file mode 100644
index 00000000..8f740db3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-07.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-07">
+  <title>ClamAV RAR Archive Remote Denial Of Service Vulnerability</title>
+  <synopsis>
+    ClamAV is vulnerable to a denial of service attack when processing certain
+    RAR archives.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>April 07, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>45357</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.68.1</unaffected>
+      <vulnerable range="le">0.68</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    From <uri link="http://www.clamav.net/">http://www.clamav.net/</uri> :
+    </p>
+    <p>
+    "Clam AntiVirus is a GPL anti-virus toolkit for UNIX. The main purpose
+    of this software is the integration with mail servers (attachment
+    scanning). The package provides a flexible and scalable multi-threaded
+    daemon, a command line scanner, and a tool for automatic updating via
+    Internet. The programs are based on a shared library distributed with
+    the Clam AntiVirus package, which you can use with your own software.
+    Most importantly, the virus database is kept up to date."
+    </p>
+  </background>
+  <description>
+    <p>
+    Certain types of RAR archives, including those created by variants of
+    the W32.Beagle.A@mm worm, may cause clamav to crash when it attempts to
+    process them.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    This vulnerability causes a Denial of Service in the clamav process.
+    Depending on	configuration, this may cause dependent services such as
+    mail to fail as well.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are
+    advised to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    ClamAV users should upgrade to version 0.68.1 or later:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=app-antivirus/clamav-0.68.1&quot;
+    # emerge &quot;&gt;=app-antivirus/clamav-0.68.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1909">CVE-2004-1909</uri>
+  </references>
+  <metadata tag="submitter">
+    klieber
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-08.xml b/xml/htdocs/security/en/glsa/glsa-200404-08.xml
new file mode 100644
index 00000000..8e4bc840
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-08.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-08">
+  <title>GNU Automake symbolic link vulnerability</title>
+  <synopsis>
+    Automake may be vulnerable to a symbolic link attack which may allow an
+    attacker to modify data or elevate their privileges.
+  </synopsis>
+  <product type="ebuild">automake</product>
+  <announced>April 08, 2004</announced>
+  <revised>January 31, 2005: 05</revised>
+  <bug>45646</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-devel/automake" auto="yes" arch="*">
+      <unaffected range="ge">1.8.5-r3</unaffected>
+      <unaffected range="rge">1.7.9-r1</unaffected>
+      <unaffected range="lt">1.7</unaffected>
+      <vulnerable range="le">1.8.5-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Automake is a tool for automatically generating `Makefile.in' files
+    which is often used in conjuction with Autoconf and other GNU Autotools
+    to ease portability among applications. It also provides a standardized
+    and light way of writing complex Makefiles through the use of many
+    built-in macros.
+    </p>
+  </background>
+  <description>
+    <p>
+    Automake may be vulnerable to a symbolic link attack which may allow an
+    attacker to modify data or escalate their privileges. This is due to
+    the insecure way Automake creates directories during compilation. An
+    attacker may be able to create symbolic links in the place of files
+    contained in the affected directories, which may potentially lead to
+    elevated privileges due to modification of data.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker may be able to use this vulnerability to modify data in an
+    unauthorized fashion or elevate their privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are
+    advised to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Automake users should upgrade to the latest versions:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose sys-devel/automake</code>
+  </resolution>
+  <references/>
+  <metadata tag="submitter">
+    klieber
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-09.xml b/xml/htdocs/security/en/glsa/glsa-200404-09.xml
new file mode 100644
index 00000000..f53b2133
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-09.xml
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-09">
+  <title>Cross-realm trust vulnerability in Heimdal</title>
+  <synopsis>
+    Heimdal contains cross-realm vulnerability allowing someone with control
+    over a realm to impersonate anyone in the cross-realm trust path.
+  </synopsis>
+  <product type="ebuild">heimdal</product>
+  <announced>April 09, 2004</announced>
+  <revised>April 09, 2004: 01</revised>
+  <bug>46590</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-crypt/heimdal" auto="yes" arch="*">
+      <unaffected range="ge">0.6.1</unaffected>
+      <vulnerable range="le">0.6.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Heimdal is a free implementation of Kerberos 5.
+    </p>
+  </background>
+  <description>
+    <p>
+    Heimdal does not properly perform certain consistency checks for
+    cross-realm requests, which allows remote attackers with control of a realm
+    to impersonate others in the cross-realm trust path.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote attackers with control of a realm may be able to impersonate other
+    users in the cross-realm trust path.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are advised
+    to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Heimdal users should upgrade to version 0.6.1 or later:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv ">=app-crypt/heimdal-0.6.1"
+    # emerge ">=app-crypt/heimdal-0.6.1"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0371">CVE</uri>
+  </references>
+  <metadata tag="submitter">klieber</metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-10.xml b/xml/htdocs/security/en/glsa/glsa-200404-10.xml
new file mode 100644
index 00000000..cf514427
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-10.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-10">
+  <title>iproute local Denial of Service vulnerability</title>
+  <synopsis>
+    The iproute package allows local users to cause a denial of service.
+  </synopsis>
+  <product type="ebuild"></product>
+  <announced>April 09, 2004</announced>
+  <revised>April 09, 2004: 01</revised>
+  <bug>34294</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-apps/iproute" auto="yes" arch="*">
+      <unaffected range="ge">20010824-r5</unaffected>
+      <vulnerable range="le">20010824-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    iproute is a set of tools for managing linux network routing and advanced
+    features.
+    </p>
+  </background>
+  <description>
+    <p>
+    It has been reported that iproute can accept spoofed messages on the kernel
+    netlink interface from local users. This could lead to a local Denial of
+    Service condition.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    Local users could cause a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+     A workaround is not currently known for this issue. All users are advised
+     to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All iproute users should upgrade to version 20010824-r5 or later:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=sys-apps/iproute-20010824-r5";
+    # emerge ">=sys-apps/iproute-20010824-r5";
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0856">CAN-2003-0856</uri>
+  </references>
+  <metadata tag="submitter">
+    lcars
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-11.xml b/xml/htdocs/security/en/glsa/glsa-200404-11.xml
new file mode 100644
index 00000000..d06093da
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-11.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-11">
+  <title>Multiple Vulnerabilities in pwlib</title>
+  <synopsis>
+    Multiple vulnerabilites have been found in pwlib that may lead to a remote
+    denial of service or buffer overflow attack. 
+  </synopsis>
+  <product type="ebuild">dev-libs/pwlib</product>
+  <announced>April 09, 2004</announced>
+  <revised>April 09, 2004: 01</revised>
+  <bug>45846</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/pwlib" auto="yes" arch="*">
+      <unaffected range="ge">1.5.2-r3</unaffected>
+      <vulnerable range="le">1.5.2-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    pwlib is a multi-platform library designed for OpenH323.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been found in the implimentation of protocol
+    H.323 contained in pwlib. Most of the vulnerabilies are in the parsing of
+    ASN.1 elements which would allow an attacker to use a maliciously crafted
+    ASN.1 element to cause unpredictable behavior in pwlib.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker may cause a denial of service condition or cause a buffer
+    overflow that would allow arbitrary code to be executed with root
+    privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Blocking ports 1719 and 1720 may reduce the likelihood of an attack. All
+    users are advised to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All pwlib users are advised to upgrade to version 1.5.2-r3 or later:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=dev-libs/pwlib-1.5.2-r3"
+    # emerge ">=dev-libs/pwlib-1.5.2-r3"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0097">CAN-2004-0097</uri>
+    <uri link="http://www.uniras.gov.uk/vuls/2004/006489/h323.htm">NISCC Vulnerability Advisory 006489/H323</uri>
+  </references>
+  <metadata tag="submitter">
+    aescriva
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-12.xml b/xml/htdocs/security/en/glsa/glsa-200404-12.xml
new file mode 100644
index 00000000..4ef2052e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-12.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-12">
+  <title>Scorched 3D server chat box format string vulnerability</title>
+  <synopsis>
+    Scorched 3D is vulnerable to a format string attack in the chat box that
+    leads to Denial of Service on the game server and possibly allows execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">scorched3d</product>
+  <announced>April 09, 2004</announced>
+  <revised>April 09, 2004: 08</revised>
+  <bug>39302</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-strategy/scorched3d" auto="yes" arch="*">
+      <unaffected range="ge">37</unaffected>
+      <vulnerable range="lt">37</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Scorched 3D is a game based loosely on the classic DOS game &quot;Scorched
+    Earth&quot;. Scorched 3D adds amongst other new features a 3D island
+    environment and LAN and internet play. Scorched 3D is totally free and is
+    available for multiple operating systems.
+    </p>
+  </background>
+  <description>
+    <p>
+    Scorched 3D (build 36.2 and before) does not properly check the text
+    entered in the Chat box (T key). Using format string characters, you can
+    generate a heap overflow. This and several other unchecked buffers have
+    been corrected in the build 37 release.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    This vulnerability can be easily exploited to remotely crash the Scorched
+    3D server, disconnecting all clients. It could also theorically be used to
+    execute arbitrary code on the server with the rights of the user running
+    the server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are advised
+    to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Scorched 3D users should upgrade to version 37 or later:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=games-strategy/scorched3d-37"
+    # emerge ">=games-strategy/scorched3d-37"</code>
+  </resolution>
+  <references>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-13.xml b/xml/htdocs/security/en/glsa/glsa-200404-13.xml
new file mode 100644
index 00000000..f12f710a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-13.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-13">
+  <title>CVS Server and Client Vulnerabilities</title>
+  <synopsis>
+    There are two vulnerabilities in CVS; one in the server and one in the
+    client. These vulnerabilities allow the reading and writing of arbitrary
+    files on both client and server.
+  </synopsis>
+  <product type="ebuild">cvs</product>
+  <announced>April 14, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>47800</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-util/cvs" auto="yes" arch="*">
+      <unaffected range="ge">1.11.15</unaffected>
+      <vulnerable range="le">1.11.14</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CVS, which stands for Concurrent Versions System, is a client/server
+    application which tracks changes to sets of files. It allows multiple
+    users to work concurrently on files, and then merge their changes back
+    into the main tree (which can be on a remote system). It also allows
+    branching, or maintaining separate versions for files.
+    </p>
+  </background>
+  <description>
+    <p>
+    There are two vulnerabilities in CVS; one in the server and one in the
+    client. The server vulnerability allows a malicious client to request
+    the contents of any RCS file to which the server has permission, even
+    those not located under $CVSROOT. The client vulnerability allows a
+    malicious server to overwrite files on the client machine anywhere the
+    client has permissions.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Arbitrary files may be read or written on CVS clients and servers by
+    anybody with access to the CVS tree.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest stable version of CVS.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CVS users should upgrade to the latest stable version.
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=dev-util/cvs-1.11.15&quot;
+    # emerge &quot;&gt;=dev-util/cvs-1.11.15&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://ccvs.cvshome.org/source/browse/ccvs/NEWS?rev=1.116.2.92&amp;content-type=text/x-cvsweb-markup">CVS commit log</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0180">CVE-2004-0180</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0405">CVE-2004-0405</uri>
+  </references>
+  <metadata tag="submitter">
+    condordes
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-14.xml b/xml/htdocs/security/en/glsa/glsa-200404-14.xml
new file mode 100644
index 00000000..9cfea2c0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-14.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-14">
+  <title>Multiple format string vulnerabilities in cadaver</title>
+  <synopsis>
+    There are multiple format string vulnerabilities in the neon library used
+    in cadaver, possibly leading to execution of arbitrary code when connected
+    to a malicious server.
+  </synopsis>
+  <product type="ebuild">cadaver</product>
+  <announced>April 19, 2004</announced>
+  <revised>April 19, 2004: 01</revised>
+  <bug>47799</bug>
+  <access>remote </access>
+  <affected>
+    <package name="net-misc/cadaver" auto="yes" arch="*">
+      <unaffected range="ge">0.22.1</unaffected>
+      <vulnerable range="lt">0.22.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    According to <uri
+    link="http://www.webdav.org/cadaver">http://www.webdav.org/cadaver</uri>,
+    cadaver is a command-line WebDAV client for Unix. It supports file upload,
+    download, on-screen display, namespace operations (move/copy), collection
+    creation and deletion, and locking operations.
+    </p>
+  </background>
+  <description>
+    <p>
+    Cadaver code includes the neon library, which in versions 0.24.4 and
+    previous is vulnerable to multiple format string attacks. The latest
+    version of cadaver uses version 0.24.5 of the neon library, which makes it
+    immune to this vulnerability.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    When using cadaver to connect to an untrusted WebDAV server, this
+    vulnerability can allow a malicious remote server to execute arbitrary code
+    on the client with the rights of the user using cadaver.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are advised
+    to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    cadaver users should upgrade to version 0.22.1 or later:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-misc/cadaver-0.22.1"
+    # emerge ">=net-misc/cadaver-0.22.1"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0179">CAN-2004-0179</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-15.xml b/xml/htdocs/security/en/glsa/glsa-200404-15.xml
new file mode 100644
index 00000000..1b1071d7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-15.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-15">
+  <title>XChat 2.0.x SOCKS5 Vulnerability</title>
+  <synopsis>
+    XChat is vulnerable to a stack overflow that may allow a remote attacker to
+    run arbitrary code.
+  </synopsis>
+  <product type="ebuild">xchat</product>
+  <announced>April 19, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>46856</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-irc/xchat" auto="yes" arch="*">
+      <unaffected range="ge">2.0.8-r1</unaffected>
+      <vulnerable range="lt">2.0.8-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    XChat is a multiplatform IRC client.
+    </p>
+  </background>
+  <description>
+    <p>
+    The SOCKS 5 proxy code in XChat is vulnerable to a remote exploit.
+    Users would have to be using XChat through a SOCKS 5 server, enable
+    SOCKS 5 traversal which is disabled by default and also connect to an
+    attacker's custom proxy server.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    This vulnerability may allow an attacker to run arbitrary code within
+    the context of the user ID of the XChat client.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are
+    advised to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All XChat users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-irc/xchat-2.0.8-r1&quot;
+    # emerge &quot;&gt;=net-irc/xchat-2.0.8-r1&quot;</code>
+    <p>
+    Note that users of the gtk1 version of xchat (1.8.*) should upgrade to
+    xchat-1.8.11-r1:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;=net-irc/xchat-1.8.11-r1&quot;
+    # emerge &quot;=net-irc/xchat-1.8.11-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://mail.nl.linux.org/xchat-announce/2004-04/msg00000.html">XChat 2.0.x SOCKS5 Vulnerability</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0409">CVE-2004-0409</uri>
+  </references>
+  <metadata tag="submitter">
+    klieber
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-16.xml b/xml/htdocs/security/en/glsa/glsa-200404-16.xml
new file mode 100644
index 00000000..777b0fac
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-16.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-16">
+  <title>Multiple new security vulnerabilities in monit</title>
+  <synopsis>
+    Two new vulnerabilities have been found in the HTTP interface of monit,
+    possibly leading to denial of service or execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">monit</product>
+  <announced>April 19, 2004</announced>
+  <revised>April 19, 2004: 01</revised>
+  <bug>47631</bug>
+  <access>remote </access>
+  <affected>
+    <package name="app-admin/monit" auto="yes" arch="*">
+      <unaffected range="ge">4.2.1</unaffected>
+      <vulnerable range="le">4.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Monit is a system administration utility that allows management and
+    monitoring of processes, files, directories and devices on a Unix system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Monit has several vulnerabilities in its HTTP interface : a buffer overflow
+    vulnerability in the authentication handling code and a off-by-one error in
+    the POST method handling code.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker may exploit the off-by-one error to crash the Monit daemon and
+    create a denial of service condition, or cause a buffer overflow that would
+    allow arbitrary code to be executed with root privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are advised
+    to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Monit users should upgrade to version 4.2.1 or later:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-admin/monit-4.2.1"
+    # emerge ">=app-admin/monit-4.2.1"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.tildeslash.com/monit/secadv_20040305.txt">Monit security advisory 20040305</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-17.xml b/xml/htdocs/security/en/glsa/glsa-200404-17.xml
new file mode 100644
index 00000000..53f36113
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-17.xml
@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-17">
+  <title>ipsec-tools and iputils contain a remote DoS vulnerability</title>
+  <synopsis>
+    racoon, which is included in the ipsec-tools and iputils packages in
+    Portage, does not check the length of ISAKMP headers. Attackers may be able
+    to craft an ISAKMP header of sufficient length to consume all available
+    system resoources, causing a Denial of Service.
+  </synopsis>
+  <product type="ebuild">ipsec-utils</product>
+  <announced>April 24, 2004</announced>
+  <revised>April 24, 2004: 01</revised>
+  <bug>48847</bug>
+  <access>remote </access>
+  <affected>
+    <package name="net-firewall/ipsec-tools" auto="yes" arch="amd64">
+      <unaffected range="ge">0.3.1</unaffected>
+      <vulnerable range="lt">0.3.1</vulnerable>
+    </package>
+    <package name="net-misc/iputils" auto="yes" arch="ppc amd64 ppc64 s390">
+      <unaffected range="eq">021109-r3</unaffected>
+      <vulnerable range="eq">021109-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    From <uri link="http://ipsec-tools.sourceforge.net/">http://ipsec-tools.sourceforge.n
+    et/</uri>
+    </p>
+    <p>
+    "IPsec-Tools is a port of KAME's IPsec utilities to the Linux-2.6 IPsec
+    implementation."
+    </p>
+    <p>
+    iputils is a collection of network monitoring tools, including racoon, ping
+    and ping6.
+    </p>
+  </background>
+  <description>
+    <p>
+    When racoon receives an ISAKMP header, it allocates memory based on the
+    length of the header field. Thus, an attacker may be able to cause a Denial
+    of Services by creating a header that is large enough to consume all
+    available system resources.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    This vulnerability may allow an attacker to remotely cause a Denial of
+    Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are advised
+    to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    ipsec-tools users should upgrade to version 0.2.5 or later:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-firewall/ipsec-tools-0.3.1"
+    # emerge ">=net-firewall/ipsec-tools-0.3.1"</code>
+    <p>
+    iputils users should upgrade to version 021109-r3 or later:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-misc/iputils-021109-r3"
+    # emerge ">=net-misc/iputils-021109-r3"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0403">CVE</uri>
+  </references>
+  <metadata tag="submitter">
+    klieber
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-18.xml b/xml/htdocs/security/en/glsa/glsa-200404-18.xml
new file mode 100644
index 00000000..1873c799
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-18.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-18">
+  <title>Multiple Vulnerabilities in ssmtp</title>
+  <synopsis>
+    There are multiple format string vulnerabilities in the SSMTP package,
+    which may allow an attacker to run arbitrary code with ssmtp's privileges
+    (potentially root).
+  </synopsis>
+  <product type="ebuild">ssmtp</product>
+  <announced>April 26, 2004</announced>
+  <revised>April 26, 2004: 01</revised>
+  <bug>47918</bug>
+  <bug>48435</bug>
+  <access>remote root </access>
+  <affected>
+    <package name="mail-mta/ssmtp" auto="yes" arch="*">
+      <unaffected range="ge">2.60.7</unaffected>
+      <vulnerable range="le">2.60.4-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SSMTP is a very simple mail transfer agent (MTA) that relays mail from the
+    local machine to another SMTP host. It is not designed to function as a
+    full mail server; its sole purpose is to relay mail.
+    </p>
+  </background>
+  <description>
+    <p>
+    There are two format string vulnerabilities inside the log_event() and
+    die() functions of ssmtp. Strings from outside ssmtp are passed to various
+    printf()-like functions from within log_event() and die() as format
+    strings. An attacker could cause a specially-crafted string to be passed to
+    these functions, and potentially cause ssmtp to execute arbitrary code.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    If ssmtp connects to a malicious mail relay server, this vulnerability can
+    be used to execute code with the rights of the mail sender, including root.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are advised to upgrade
+    to the latest available version of ssmtp.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users are advised to upgrade to the latest available version of ssmtp.
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=mail-mta/ssmtp-2.60.7"
+    # emerge ">=mail-mta/ssmtp-2.60.7"</code>
+  </resolution>
+  <references>
+    <uri link="http://secunia.com/advisories/11378/">Secunia Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0156">CVE Reference</uri>
+    <uri link="http://lists.debian.org/debian-security-announce/debian-security-announce-2004/msg00084.html">Debian Advisory</uri>
+  </references>
+  <metadata tag="submitter">
+    condordes
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-19.xml b/xml/htdocs/security/en/glsa/glsa-200404-19.xml
new file mode 100644
index 00000000..b5bf011b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-19.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-19">
+  <title>Buffer overflows and format string vulnerabilities in LCDproc</title>
+  <synopsis>
+    Multiple remote vulnerabilities have been found in the LCDd server,
+    allowing execution of arbitrary code with the rights of the LCDd user.
+  </synopsis>
+  <product type="ebuild">lcdproc</product>
+  <announced>April 27, 2004</announced>
+  <revised>April 27, 2004: 01</revised>
+  <bug>47340</bug>
+  <access>remote </access>
+  <affected>
+    <package name="app-misc/lcdproc" auto="yes" arch="*">
+      <unaffected range="ge">0.4.5</unaffected>
+      <vulnerable range="le">0.4.4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    LCDproc is a program that displays various bits of real-time system
+    information on an LCD. It makes use of a local server (LCDd) to collect
+    information to display on the LCD.
+    </p>
+  </background>
+  <description>
+    <p>
+    Due to insufficient checking of client-supplied data, the LCDd server is
+    susceptible to two buffer overflows and one string buffer vulnerability. If
+    the server is configured to listen on all network interfaces (see the Bind
+    parameter in LCDproc configuration), these vulnerabilities can be triggered
+    remotely.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    These vulnerabilities allow an attacker to execute code with the rights of
+    the user running the LCDproc server. By default, this is the "nobody" user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are advised
+    to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    LCDproc users should upgrade to version 0.4.5 or later:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-misc/lcdproc-0.4.5"
+    # emerge ">=app-misc/lcdproc-0.4.5"</code>
+  </resolution>
+  <references>
+    <uri link="http://lists.omnipotent.net/pipermail/lcdproc/2004-April/008884.html">LCDproc advisory</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-20.xml b/xml/htdocs/security/en/glsa/glsa-200404-20.xml
new file mode 100644
index 00000000..8944b860
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-20.xml
@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-20">
+  <title>Multiple vulnerabilities in xine</title>
+  <synopsis>
+    Several vulnerabilities have been found in xine-ui and xine-lib,
+    potentially allowing an attacker to overwrite files with the rights of the
+    user.
+  </synopsis>
+  <product type="ebuild">xine</product>
+  <announced>April 27, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>45448</bug>
+  <bug>48107</bug>
+  <bug>48108</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/xine-ui" auto="yes" arch="*">
+      <unaffected range="ge">0.9.23-r2</unaffected>
+      <vulnerable range="le">0.9.23-r1</vulnerable>
+    </package>
+    <package name="media-libs/xine-lib" auto="yes" arch="*">
+      <unaffected range="ge">1_rc3-r3</unaffected>
+      <vulnerable range="le">1_rc3-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xine is a multimedia player allowing to play back CDs, DVDs, and VCDs
+    and decoding multimedia files like AVI, MOV, WMV, and MP3 from local
+    disk drives, and displays multimedia streamed over the Internet. It is
+    available in Gentoo as a reusable library (xine-lib) with a standard
+    user interface (xine-ui).
+    </p>
+  </background>
+  <description>
+    <p>
+    Several vulnerabilities were found in xine-ui and xine-lib. By opening
+    a malicious MRL in any xine-lib based media player, an attacker can
+    write arbitrary content to an arbitrary file, only restricted by the
+    permissions of the user running the application. By opening a malicious
+    playlist in the xine-ui media player, an attacker can write arbitrary
+    content to an arbitrary file, only restricted by the permissions of the
+    user running xine-ui. Finally, a temporary file is created in an
+    insecure manner by the xine-check and xine-bugreport scripts,
+    potentially allowing a local attacker to use a symlink attack.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    These three vulnerabilities may alow an attacker to corrupt system
+    files, thus potentially leading to a Denial of Service. It is also
+    theoretically possible, though very unlikely, to use these
+    vulnerabilities to elevate the privileges of the attacker.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are advised to
+    upgrade to the latest available versions of xine-ui and xine-lib.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users of xine-ui or another xine-based player should upgrade to the
+    latest stable versions:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=media-video/xine-ui-0.9.23-r2&quot;
+    # emerge &quot;&gt;=media-video/xine-ui-0.9.23-r2&quot;
+    
+    # emerge -pv &quot;&gt;=media-libs/xine-lib-1_rc3-r3&quot;
+    # emerge &quot;&gt;=media-libs/xine-lib-1_rc3-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://xinehq.de/index.php/security">Xine Security Advisories</uri>
+    <uri link="http://nettwerked.mg2.org/advisories/xinebug">xine-bugreport and xine-check vulnerability</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0372">CVE-2004-0372</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1951">CVE-2004-1951</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200404-21.xml b/xml/htdocs/security/en/glsa/glsa-200404-21.xml
new file mode 100644
index 00000000..cd05b6be
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200404-21.xml
@@ -0,0 +1,99 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200404-21">
+  <title>Multiple Vulnerabilities in Samba</title>
+  <synopsis>
+    There is a bug in smbfs which may allow local users to gain root via a
+    setuid file on a mounted Samba share. Also, there is a tmpfile symlink
+    vulnerability in the smbprint script distributed with Samba.
+  </synopsis>
+  <product type="ebuild">samba</product>
+  <announced>April 29, 2004</announced>
+  <revised>April 29, 2004: 01</revised>
+  <bug>41800</bug>
+  <bug>45965</bug>
+  <access>local </access>
+  <affected>
+    <package name="net-fs/samba" auto="yes" arch="*">
+      <unaffected range="ge">3.0.2a-r2</unaffected>
+      <vulnerable range="le">3.0.2a</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Samba is a package which allows UNIX systems to act as file servers for
+    Windows computers. It also allows UNIX systems to mount shares exported by
+    a Samba/CIFS/Windows server. smbmount is a program in the Samba package
+    which allows normal users on a UNIX system to mount remote shares. smbprint
+    is an example script included in the Samba package which can be used to
+    facilitate network printing.
+    </p>
+  </background>
+  <description>
+    <p>
+    Two vulnerabilities have been discovered in Samba. The first vulnerability
+    allows a local user who has access to the smbmount command to gain root. An
+    attacker could place a setuid-root binary on a Samba share/server he or she
+    controls, and then use the smbmount command to mount the share on the
+    target UNIX box. The remote Samba server must support UNIX extensions for
+    this to work. This has been fixed in version 3.0.2a.
+    </p>
+    <p>
+    The second vulnerability is in the smbprint script. By creating a symlink
+    from /tmp/smbprint.log, an attacker could cause the smbprint script to
+    write to an arbitrary file on the system. This has been fixed in version
+    3.0.2a-r2.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Local users with access to the smbmount command may gain root access. Also,
+    arbitrary files may be overwritten using the smbprint script.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    To workaround the setuid bug, remove the setuid bits from the
+    /usr/bin/smbmnt, /usr/bin/smbumount and /usr/bin/mount.cifs binaries.
+    However, please note that this workaround will prevent ordinary users from
+    mounting remote SMB and CIFS shares.
+    </p>
+    <p>
+    To work around the smbprint vulnerability, set "debug=no" in the smbprint
+    configuration.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should update to the latest version of the Samba package.
+    </p>
+    <p>
+    The following commands will perform the upgrade:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-fs/samba-3.0.2a-r2"
+    # emerge ">=net-fs/samba-3.0.2a-r2"</code>
+    <p>
+    Those who are using Samba's password database also need to run the
+    following command:
+    </p>
+    <code>
+    # pdbedit --force-initialized-passwords</code>
+    <p>
+    Those using LDAP for Samba passwords also need to check the sambaPwdLastSet
+    attribute on each account, and ensure it is not 0.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/353222/2004-04-09/2004-04-15/1">BugTraq Thread: Samba 3.x + kernel 2.6.x local root vulnerability</uri>
+    <uri link="http://seclists.org/lists/bugtraq/2004/Mar/0189.html">BugTraq: smbprint Vulnerability</uri>
+  </references>
+  <metadata tag="submitter">
+    condordes
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-01.xml b/xml/htdocs/security/en/glsa/glsa-200405-01.xml
new file mode 100644
index 00000000..e74351d1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-01.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-01">
+  <title>Multiple format string vulnerabilities in neon 0.24.4 and earlier</title>
+  <synopsis>
+    There are multiple format string vulnerabilities in libneon which may allow
+    a malicious WebDAV server to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">neon</product>
+  <announced>May 09, 2004</announced>
+  <revised>May 09, 2004: 01</revised>
+  <bug>48448</bug>
+  <access>remote </access>
+  <affected>
+    <package name="net-misc/neon" auto="yes" arch="*">
+      <unaffected range="ge">0.24.5</unaffected>
+      <vulnerable range="le">0.24.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    neon provides an HTTP and WebDAV client library.
+    </p>
+  </background>
+  <description>
+    <p>
+    There are multiple format string vulnerabilities in libneon which may allow
+    a malicious WebDAV server to execute arbitrary code under the context of
+    the process using libneon.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker may be able to execute arbitrary code under the context of the
+    process using libneon.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are advised
+    to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Neon users should upgrade to version 0.24.5 or later:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-misc/neon-0.24.5"
+    # emerge ">=net-misc/neon-0.24.5"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0179">CVE</uri>
+  </references>
+  <metadata tag="submitter">
+    klieber
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-02.xml b/xml/htdocs/security/en/glsa/glsa-200405-02.xml
new file mode 100644
index 00000000..0a7c999c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-02.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-02">
+  <title>Multiple vulnerabilities in LHa</title>
+  <synopsis>
+    Two stack-based buffer overflows and two directory traversal problems have
+    been found in LHa. These vulnerabilities can be used to execute arbitrary
+    code or as a denial of service attack.
+  </synopsis>
+  <product type="ebuild">lha</product>
+  <announced>May 09, 2004</announced>
+  <revised>October 20, 2006: 02</revised>
+  <bug>49961</bug>
+  <access>remote </access>
+  <affected>
+    <package name="app-arch/lha" auto="yes" arch="*">
+      <unaffected range="rge">114i-r2</unaffected>
+      <vulnerable range="rle">114i-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    LHa is a console-based program for packing and unpacking LHarc archives.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ulf Harnhammar found two stack overflows and two directory traversal
+    vulnerabilities in LHa version 1.14 and 1.17. A stack overflow occurs when
+    testing or extracting archives containing long file or directory names.
+    Furthermore, LHa doesn't contain sufficient protection against relative or
+    absolute archive paths.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    The stack overflows can be exploited to execute arbitrary code with the
+    rights of the user testing or extracting the archive. The directory
+    traversal vulnerabilities can be used to overwrite files in the filesystem
+    with the rights of the user extracting the archive, potentially leading to
+    denial of service or privilege escalation. Since LHa is often interfaced to
+    other software like an email virus scanner, this attack can be used
+    remotely.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are advised to upgrade
+    to the latest available version of LHa.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users of LHa should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-arch/lha-114i-r2"
+    # emerge ">=app-arch/lha-114i-r2"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0234">CAN-2004-0234</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0235">CAN-2004-0235</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-03.xml b/xml/htdocs/security/en/glsa/glsa-200405-03.xml
new file mode 100644
index 00000000..06008e60
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-03.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-03">
+  <title>ClamAV VirusEvent parameter vulnerability</title>
+  <synopsis>
+    With a specific configuration (using %f in the VirusEvent parameter), Clam
+    AntiVirus is vulnerable to an attack allowing execution of arbitrary
+    commands.
+  </synopsis>
+  <product type="ebuild">ClamAV</product>
+  <announced>May 11, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>46264</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.70</unaffected>
+      <vulnerable range="lt">0.70</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    From <uri link="http://www.clamav.net/">http://www.clamav.net/</uri> :
+    </p>
+    <p>
+    "Clam AntiVirus is a GPL anti-virus toolkit for UNIX. The main purpose
+    of this software is the integration with mail servers (attachment
+    scanning). The package provides a flexible and scalable multi-threaded
+    daemon, a command line scanner, and a tool for automatic updating via
+    Internet. The programs are based on a shared library distributed with
+    the Clam AntiVirus package, which you can use with your own software.
+    Most importantly, the virus database is kept up to date."
+    </p>
+  </background>
+  <description>
+    <p>
+    The VirusEvent parameter in the clamav.conf configuration file allows
+    to specify a system command to run whenever a virus is found. This
+    system command can make use of the "%f" parameter which is replaced by
+    the name of the file infected. The name of the file scanned is under
+    control of the attacker and is not sufficiently checked. Version 0.70
+    of clamav disables the use of the "%f" parameter.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Sending a virus with a malicious file name can result in execution of
+    arbirary system commands with the rights of the antivirus process.
+    Since clamav is often associated to mail servers for email scanning,
+    this attack can be used remotely.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    You should not use the "%f" parameter in your VirusEvent configuration.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users of Clam AntiVirus should upgrade to the latest stable
+    version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=app-antivirus/clamav-0.70&quot;
+    # emerge &quot;&gt;=app-antivirus/clamav-0.70&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1876">CVE-2004-1876</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-04.xml b/xml/htdocs/security/en/glsa/glsa-200405-04.xml
new file mode 100644
index 00000000..fedfce51
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-04.xml
@@ -0,0 +1,123 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-04">
+  <title>OpenOffice.org vulnerability when using DAV servers</title>
+  <synopsis>
+    Several format string vulnerabilities are present in the Neon library
+    included in OpenOffice.org, allowing remote execution of arbitrary code
+    when connected to an untrusted WebDAV server.
+  </synopsis>
+  <product type="ebuild">openoffice</product>
+  <announced>May 11, 2004</announced>
+  <revised>October 27, 2004: 02</revised>
+  <bug>47926</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/openoffice" auto="yes" arch="x86">
+      <unaffected range="ge">1.1.1-r1</unaffected>
+      <vulnerable range="le">1.1.1</vulnerable>
+    </package>
+    <package name="app-office/openoffice" auto="yes" arch="ppc">
+      <unaffected range="ge">1.0.3-r2</unaffected>
+      <vulnerable range="le">1.0.3-r1</vulnerable>
+    </package>
+    <package name="app-office/openoffice" auto="yes" arch="sparc">
+      <unaffected range="ge">1.1.0-r4</unaffected>
+      <vulnerable range="le">1.1.0-r3</vulnerable>
+    </package>
+    <package name="app-office/openoffice-ximian" auto="yes" arch="*">
+      <unaffected range="ge">1.1.51-r1</unaffected>
+      <vulnerable range="le">1.1.51</vulnerable>
+    </package>
+    <package name="app-office/openoffice-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.1.2</unaffected>
+      <vulnerable range="lt">1.1.2</vulnerable>
+    </package>
+    <package name="app-office/openoffice-ximian-bin" auto="no" arch="*">
+      <vulnerable range="le">1.1.52</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenOffice.org is an office productivity suite, including word processing,
+    spreadsheets, presentations, drawings, data charting, formula editing, and
+    file conversion facilities.
+    </p>
+  </background>
+  <description>
+    <p>
+    OpenOffice.org includes code from the Neon library in functions related to
+    publication on WebDAV servers. This library is vulnerable to several format
+    string attacks.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    If you use the WebDAV publication and connect to a malicious WebDAV server,
+    this server can exploit these vulnerabilities to execute arbitrary code
+    with the rights of the user running OpenOffice.org.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    As a workaround, you should not use the WebDAV publication facilities.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    There is no Ximian OpenOffice.org binary version including the fix yet. All
+    users of the openoffice-ximian-bin package making use of the WebDAV
+    openoffice-ximian source-based package.
+    </p>
+    <p>
+    openoffice users on the x86 architecture should:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-office/openoffice-1.1.1-r1"
+    # emerge ">=app-office/openoffice-1.1.1-r1"</code>
+    <p>
+    openoffice users on the sparc architecture should:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-office/openoffice-1.1.0-r3"
+    # emerge ">=app-office/openoffice-1.1.0-r3"</code>
+    <p>
+    openoffice users on the ppc architecture should:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-office/openoffice-1.0.3-r1"
+    # emerge ">=app-office/openoffice-1.0.3-r1"</code>
+    <p>
+    openoffice-ximian users should:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-office/openoffice-ximian-1.1.51-r1"
+    # emerge ">=app-office/openoffice-ximian-1.1.51-r1"</code>
+    <p>
+    openoffice-bin users should:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-office/openoffice-bin-1.1.2"
+    # emerge ">=app-office/openoffice-bin-1.1.2"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0179">CAN-2004-0179</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200405-01.xml">Neon vulnerabilities (GLSA 200405-01)</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-05.xml b/xml/htdocs/security/en/glsa/glsa-200405-05.xml
new file mode 100644
index 00000000..620a84e6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-05.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-05">
+  <title>Utempter symlink vulnerability</title>
+  <synopsis>
+    Utempter contains a vulnerability that may allow local users to overwrite
+    arbitrary files via a symlink attack.
+  </synopsis>
+  <product type="ebuild">utempter</product>
+  <announced>May 13, 2004</announced>
+  <revised>May 13, 2004: 01</revised>
+  <bug>49536</bug>
+  <access>local </access>
+  <affected>
+    <package name="sys-apps/utempter" auto="yes" arch="*">
+      <unaffected range="ge">0.5.5.4</unaffected>
+      <vulnerable range="lt">0.5.5.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Utempter is an application that allows non-privileged apps to write utmp
+    (login) info, which otherwise needs root access.
+    </p>
+  </background>
+  <description>
+    <p>
+    Utempter contains a vulnerability that may allow local users to overwrite
+    arbitrary files via a symlink attack.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    This vulnerability may allow arbitrary files to be overwritten with root
+    privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are advised to upgrade
+    to the latest available version of utempter.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users of utempter should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=sys-apps/utempter-0.5.5.4"
+    # emerge ">=sys-apps/utempter-0.5.5.4"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0233">CAN-2004-0233</uri>
+  </references>
+  <metadata tag="submitter">
+    klieber
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-06.xml b/xml/htdocs/security/en/glsa/glsa-200405-06.xml
new file mode 100644
index 00000000..85926a9b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-06.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-06">
+  <title>libpng denial of service vulnerability</title>
+  <synopsis>
+    A bug in the libpng library can be abused to crash programs making use of
+    that library to decode PNG images.
+  </synopsis>
+  <product type="ebuild">libpng</product>
+  <announced>May 14, 2004</announced>
+  <revised>May 14, 2004: 01</revised>
+  <bug>49887</bug>
+  <access>remote </access>
+  <affected>
+    <package name="media-libs/libpng" auto="yes" arch="*">
+      <unaffected range="ge">1.2.5-r5</unaffected>
+      <vulnerable range="le">1.2.5-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libpng is a standard library used to process PNG (Portable Network
+    Graphics) images.
+    </p>
+  </background>
+  <description>
+    <p>
+    libpng provides two functions (png_chunk_error and png_chunk_warning) for
+    default error and warning messages handling. These functions do not perform
+    proper bounds checking on the provided message, which is limited to 64
+    bytes. Programs linked against this library may crash when handling a
+    malicious PNG image.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    This vulnerability could be used to crash various programs using the libpng
+    library, potentially resulting in a denial of service attack on vulnerable
+    daemon processes.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are advised to upgrade
+    to the latest available version of libpng.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users of libpng should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=media-libs/libpng-1.2.5-r5"
+    # emerge ">=media-libs/libpng-1.2.5-r5"</code>
+    <p>
+    You should also run revdep-rebuild to rebuild any packages that depend on
+    older versions of libpng :
+    </p>
+    <code>
+    # revdep-rebuild</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0421">CAN-2004-0421</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-07.xml b/xml/htdocs/security/en/glsa/glsa-200405-07.xml
new file mode 100644
index 00000000..c224178f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-07.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-07">
+  <title>Exim verify=header_syntax buffer overflow</title>
+  <synopsis>
+    When the verify=header_syntax option is set, there is a buffer overflow in
+    Exim that allows remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Exim</product>
+  <announced>May 14, 2004</announced>
+  <revised>May 14, 2004: 01</revised>
+  <bug>50217</bug>
+  <access>remote </access>
+  <affected>
+    <package name="mail-mta/exim" auto="yes" arch="*">
+      <unaffected range="ge">4.33-r1</unaffected>
+      <vulnerable range="le">4.33</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Exim is an highly configurable message transfer agent (MTA) developed at
+    the University of Cambridge.
+    </p>
+  </background>
+  <description>
+    <p>
+    When the option "verify = header_syntax" is used in an ACL in the
+    configuration file, Exim is vulnerable to a buffer overflow attack that can
+    be triggered remotely by sending malicious headers in an email message.
+    Note that this option is not enabled in Exim's default configuration file.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    This vulnerability can be exploited to trigger a denial of service attack
+    and potentially execute arbitrary code with the rights of the user used by
+    the Exim daemon (by default this is the "mail" user in Gentoo Linux).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Make sure the verify=header_syntax option is not used in your exim.conf
+    file.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users of Exim should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=mail-mta/exim-4.33-r1"
+    # emerge ">=mail-mta/exim-4.33-r1"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0400">CAN-2004-0400</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-08.xml b/xml/htdocs/security/en/glsa/glsa-200405-08.xml
new file mode 100644
index 00000000..4de9c02c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-08.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-08">
+  <title>Pound format string vulnerability</title>
+  <synopsis>
+    There is a format string flaw in Pound, allowing remote execution of
+    arbitrary code with the rights of the Pound process.
+  </synopsis>
+  <product type="ebuild">pound</product>
+  <announced>May 18, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>50421</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/pound" auto="yes" arch="*">
+      <unaffected range="ge">1.6</unaffected>
+      <vulnerable range="le">1.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Pound is a reverse proxy, load balancer and HTTPS front-end. It allows
+    to distribute the load on several web servers and offers a SSL wrapper
+    for web servers that do not support SSL directly.
+    </p>
+  </background>
+  <description>
+    <p>
+    A format string flaw in the processing of syslog messages was
+    discovered and corrected in Pound.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    This flaw may allow remote execution of arbitrary code with the rights
+    of the Pound daemon process. By default, Gentoo uses the "nobody" user
+    to run the Pound daemon.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are advised to
+    upgrade to the latest available version of Pound.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users of Pound should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=www-servers/pound-1.6&quot;
+    # emerge &quot;&gt;=www-servers/pound-1.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.apsis.ch/pound/pound_list/archive/2003/2003-12/1070234315000#1070234315000">Pound announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2026">CVE-2004-2026</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-09.xml b/xml/htdocs/security/en/glsa/glsa-200405-09.xml
new file mode 100644
index 00000000..ee35e367
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-09.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-09">
+  <title>ProFTPD Access Control List bypass vulnerability</title>
+  <synopsis>
+    Version 1.2.9 of ProFTPD introduced a vulnerability that causes CIDR-based
+    Access Control Lists (ACLs) to be treated as &quot;AllowAll&quot;, thereby
+    allowing remote users full access to files available to the FTP daemon.
+  </synopsis>
+  <product type="ebuild">proftpd</product>
+  <announced>May 19, 2004</announced>
+  <revised>May 19, 2004: 01</revised>
+  <bug>49496</bug>
+  <access>remote </access>
+  <affected>
+    <package name="net-ftp/proftpd" auto="yes" arch="*">
+      <unaffected range="ge">1.2.9-r2</unaffected>
+      <vulnerable range="eq">1.2.9-r1</vulnerable>
+      <vulnerable range="eq">1.2.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ProFTPD is an FTP daemon.
+    </p>
+  </background>
+  <description>
+    <p>
+    ProFTPD 1.2.9 introduced a vulnerability that allows CIDR-based ACLs (such
+    as 10.0.0.1/24) to be bypassed. The CIDR ACLs are disregarded, with the net
+    effect being similar to an "AllowAll" directive.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    This vulnerability may allow unauthorized files, including critical system
+    files to be downloaded and/or modified, thereby allowing a potential remote
+    compromise of the server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Users may work around the problem by avoiding use of CIDR-based ACLs.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    ProFTPD users are encouraged to upgrade to the latest version of the
+    package:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-ftp/proftpd-1.2.9-r2"
+    # emerge ">=net-ftp/proftpd-1.2.9-r2"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0432">CAN-2004-0432</uri>
+  </references>
+  <metadata tag="submitter">
+    klieber
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-10.xml b/xml/htdocs/security/en/glsa/glsa-200405-10.xml
new file mode 100644
index 00000000..32a8fb9d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-10.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-10">
+  <title>Icecast denial of service vulnerability</title>
+  <synopsis>
+    Icecast is vulnerable to a denial of service attack allowing remote users
+    to crash the application.
+  </synopsis>
+  <product type="ebuild">icecast</product>
+  <announced>May 19, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>50935</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/icecast" auto="yes" arch="*">
+      <unaffected range="ge">2.0.1</unaffected>
+      <vulnerable range="le">2.0.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Icecast is a program that streams audio data to listeners over the
+    Internet.
+    </p>
+  </background>
+  <description>
+    <p>
+    There is an out-of-bounds read error in the web interface of Icecast
+    when handling Basic Authorization requests. This vulnerability can
+    theorically be exploited by sending a specially crafted Authorization
+    header to the server.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By exploiting this vulnerability, it is possible to crash the Icecast
+    server remotely, resulting in a denial of service attack.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are advised to
+    upgrade to the latest available version of Icecast.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users of Icecast should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-misc/icecast-2.0.1&quot;
+    # emerge &quot;&gt;=net-misc/icecast-2.0.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.xiph.org/archives/icecast/7144.html">Icecast 2.0.1 announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2027">CVE-2004-2027</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-11.xml b/xml/htdocs/security/en/glsa/glsa-200405-11.xml
new file mode 100644
index 00000000..3282ad9c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-11.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-11">
+  <title>KDE URI Handler Vulnerabilities</title>
+  <synopsis>
+    Vulnerabilities in KDE URI handlers makes your system vulnerable to various
+    attacks.
+  </synopsis>
+  <product type="ebuild">kdelibs</product>
+  <announced>May 19, 2004</announced>
+  <revised>May 19, 2004: 01</revised>
+  <bug>51276</bug>
+  <access>remote </access>
+  <affected>
+    <package name="kde-base/kdelibs" auto="yes" arch="*">
+      <unaffected range="ge">3.2.2-r1</unaffected>
+      <unaffected range="eq">3.1.5-r1</unaffected>
+      <vulnerable range="le">3.2.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The K Desktop Environment (KDE) is a powerful Free Software graphical
+    desktop environment. KDE makes use of URI handlers to trigger various
+    programs when specific URLs are received.
+    </p>
+  </background>
+  <description>
+    <p>
+    The telnet, rlogin, ssh and mailto URI handlers in KDE do not check for '-'
+    at the beginning of the hostname passed. By crafting a malicious URI and
+    entice an user to click on it, it is possible to pass an option to the
+    programs started by the handlers (typically telnet, kmail...).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    If the attacker controls the options passed to the URI handling programs,
+    it becomes possible for example to overwrite arbitrary files (possibly
+    leading to denial of service), to open kmail on an attacker-controlled
+    remote display or with an alternate configuration file (possibly leading to
+    control of the user account).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are advised to upgrade
+    to a corrected version of kdelibs.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Users of KDE 3.1 should upgrade to the corrected version of kdelibs:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv "=kde-base/kdelibs-3.1.5-r1"
+    # emerge "=kde-base/kdelibs-3.1.5-r1"</code>
+    <p>
+    Users of KDE 3.2 should upgrade to the latest available version of kdelibs:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=kde-base/kdelibs-3.2.2-r1"
+    # emerge ">=kde-base/kdelibs-3.2.2-r1"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0411">CAN-2004-0411</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-12.xml b/xml/htdocs/security/en/glsa/glsa-200405-12.xml
new file mode 100644
index 00000000..5708e3af
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-12.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-12">
+  <title>CVS heap overflow vulnerability</title>
+  <synopsis>
+    CVS is subject to a heap overflow vulnerability allowing source repository
+    compromise.
+  </synopsis>
+  <product type="ebuild">cvs</product>
+  <announced>May 20, 2004</announced>
+  <revised>May 20, 2004: 01</revised>
+  <bug>51460</bug>
+  <access>remote </access>
+  <affected>
+    <package name="dev-util/cvs" auto="yes" arch="*">
+      <unaffected range="ge">1.11.16</unaffected>
+      <vulnerable range="le">1.11.15</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CVS (Concurrent Versions System) is an open-source network-transparent
+    version control system. It contains both a client utility and a server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Esser discovered a heap overflow in the CVS server, which can be
+    triggered by sending malicious "Entry" lines and manipulating the flags
+    related to that Entry. This vulnerability was proven to be exploitable.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker can execute arbitrary code on the CVS server, with the
+    rights of the CVS server. By default, Gentoo uses the "cvs" user to run the
+    CVS server. In particular, this flaw allows a complete compromise of CVS
+    source repositories. If you're not running a server, then you are not
+    vulnerable.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are advised to upgrade
+    to the latest available version of CVS.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users running a CVS server should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=dev-util/cvs-1.11.16"
+    # emerge ">=dev-util/cvs-1.11.16"</code>
+  </resolution>
+  <references>
+    <uri link="http://security.e-matters.de/advisories/072004.html">E-matters advisory 07/2004</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0396">CAN-2004-0396</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-13.xml b/xml/htdocs/security/en/glsa/glsa-200405-13.xml
new file mode 100644
index 00000000..4a76ee58
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-13.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-13">
+  <title>neon heap-based buffer overflow</title>
+  <synopsis>
+    A vulnerability potentially allowing remote execution of arbitrary code has
+    been discovered in the neon library.
+  </synopsis>
+  <product type="ebuild">neon</product>
+  <announced>May 20, 2004</announced>
+  <revised>May 20, 2004: 01</revised>
+  <bug>51490</bug>
+  <access>remote </access>
+  <affected>
+    <package name="net-misc/neon" auto="yes" arch="*">
+      <unaffected range="ge">0.24.6</unaffected>
+      <vulnerable range="le">0.24.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    neon provides an HTTP and WebDAV client library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Esser discovered a vulnerability in the code of the neon library :
+    if a malicious date string is passed to the ne_rfc1036_parse() function, it
+    can trigger a string overflow into static heap variables.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Depending on the application linked against libneon and when connected to a
+    malicious WebDAV server, this vulnerability could allow execution of
+    arbitrary code with the rights of the user running that application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are advised to upgrade
+    to the latest available version of neon.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users of neon should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-misc/neon-0.24.6"
+    # emerge ">=net-misc/neon-0.24.6"</code>
+  </resolution>
+  <references>
+    <uri link="http://security.e-matters.de/advisories/062004.html">E-matters advisory 06/2004</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0398">CAN-2004-0398</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-14.xml b/xml/htdocs/security/en/glsa/glsa-200405-14.xml
new file mode 100644
index 00000000..3f481268
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-14.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-14">
+  <title>Buffer overflow in Subversion</title>
+  <synopsis>
+    There is a vulnerability in the Subversion date parsing code which may lead
+    to denial of service attacks, or execution of arbitrary code. Both the
+    client and server are vulnerable.
+  </synopsis>
+  <product type="ebuild">subversion</product>
+  <announced>May 20, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>51462</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-util/subversion" auto="yes" arch="*">
+      <unaffected range="ge">1.0.3</unaffected>
+      <vulnerable range="le">1.0.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Subversion is a version control system intended to eventually replace
+    CVS. Like CVS, it has an optional client-server architecture (where the
+    server can be an Apache server running mod_svn, or an ssh program as in
+    CVS's :ext: method). In addition to supporting the features found in
+    CVS, Subversion also provides support for moving and copying files and
+    directories.
+    </p>
+  </background>
+  <description>
+    <p>
+    All releases of Subversion prior to 1.0.3 have a vulnerability in the
+    date-parsing code. This vulnerability may allow denial of service or
+    arbitrary code execution as the Subversion user. Both the client and
+    server are vulnerable, and write access is NOT required to the server's
+    repository.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    All servers and clients are vulnerable. Specifically, clients that
+    allow other users to write to administrative files in a working copy
+    may be exploited. Additionally all servers (whether they are httpd/DAV
+    or svnserve) are vulnerable. Write access to the server is not
+    required; public read-only Subversion servers are also exploitable.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Subversion users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=dev-util/subversion-1.0.3&quot;
+    # emerge &quot;&gt;=dev-util/subversion-1.0.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://subversion.tigris.org/servlets/ReadMsg?list=announce&amp;msgNo=125">Subversion Announcement</uri>
+    <uri link="http://security.e-matters.de/advisories/082004.html">E-Matters Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0397">CVE-2004-0397</uri>
+  </references>
+  <metadata tag="submitter">
+    condordes
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-15.xml b/xml/htdocs/security/en/glsa/glsa-200405-15.xml
new file mode 100644
index 00000000..fae074cf
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-15.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-15">
+  <title>cadaver heap-based buffer overflow</title>
+  <synopsis>
+    There is a heap-based buffer overflow vulnerability in the neon library
+    used in cadaver, possibly leading to execution of arbitrary code when
+    connected to a malicious server.
+  </synopsis>
+  <product type="ebuild">cadaver</product>
+  <announced>May 20, 2004</announced>
+  <revised>May 20, 2004: 01</revised>
+  <bug>51461</bug>
+  <access>remote </access>
+  <affected>
+    <package name="net-misc/cadaver" auto="yes" arch="*">
+      <unaffected range="ge">0.22.2</unaffected>
+      <vulnerable range="le">0.22.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    cadaver is a command-line WebDAV client.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Esser discovered a vulnerability in the code of the neon library
+    (see GLSA 200405-13). This library is also included in cadaver.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    When connected to a malicious WebDAV server, this vulnerability could allow
+    remote execution of arbitrary code with the rights of the user running
+    cadaver.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are advised to upgrade
+    to the latest available version of cadaver.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users of cadaver should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-misc/cadaver-0.22.2"
+    # emerge ">=net-misc/cadaver-0.22.2"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0398">CAN-2004-0398</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200405-13.xml">GLSA 200405-13</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-16.xml b/xml/htdocs/security/en/glsa/glsa-200405-16.xml
new file mode 100644
index 00000000..d854cbba
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-16.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-16">
+  <title>Multiple XSS Vulnerabilities in SquirrelMail</title>
+  <synopsis>
+    SquirrelMail is subject to several XSS and one SQL injection vulnerability.
+  </synopsis>
+  <product type="ebuild">SquirrelMail</product>
+  <announced>May 25, 2004</announced>
+  <revised>May 27, 2006: 04</revised>
+  <bug>49675</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/squirrelmail" auto="yes" arch="*">
+      <unaffected range="ge">1.4.3_rc1</unaffected>
+      <vulnerable range="lt">1.4.3_rc1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SquirrelMail is a webmail package written in PHP. It supports IMAP and
+    SMTP, and can optionally be installed with SQL support.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several unspecified cross-site scripting (XSS) vulnerabilities and a
+    well hidden SQL injection vulnerability were found. An XSS attack
+    allows an attacker to insert malicious code into a web-based
+    application. SquirrelMail does not check for code when parsing
+    variables received via the URL query string.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    One of the XSS vulnerabilities could be exploited by an attacker to
+    steal cookie-based authentication credentials from the user's browser.
+    The SQL injection issue could potentially be used by an attacker to run
+    arbitrary SQL commands inside the SquirrelMail database with privileges
+    of the SquirrelMail database user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are advised to
+    upgrade to version 1.4.3_rc1 or higher of SquirrelMail.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SquirrelMail users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=mail-client/squirrelmail-1.4.3_rc1&quot;
+    # emerge &quot;&gt;=mail-client/squirrelmail-1.4.3_rc1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://sourceforge.net/mailarchive/forum.php?thread_id=4199060&amp;forum_id=1988">SquirrelMail 1.4.3_rc1 release annoucement</uri>
+    <uri link="http://www.securityfocus.com/bid/10246/">Bugtraq security annoucement</uri>
+    <uri link="http://www.cert.org/advisories/CA-2000-02.html">CERT description of XSS</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0519">CVE-2004-0519</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0521">CVE-2004-0521</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-17.xml b/xml/htdocs/security/en/glsa/glsa-200405-17.xml
new file mode 100644
index 00000000..d4448381
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-17.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-17">
+  <title>Multiple vulnerabilities in metamail</title>
+  <synopsis>
+    Several format string bugs and buffer overflows were discovered in
+    metamail, potentially allowing execution of arbitrary code remotely.
+  </synopsis>
+  <product type="ebuild">metamail</product>
+  <announced>May 21, 2004</announced>
+  <revised>May 21, 2004: 01</revised>
+  <bug>42133</bug>
+  <access>remote </access>
+  <affected>
+    <package name="net-mail/metamail" auto="yes" arch="*">
+      <unaffected range="ge">2.7.45.3</unaffected>
+      <vulnerable range="lt">2.7.45.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Metamail is a program that decodes MIME encoded mail. It is therefore often
+    automatically called when an email is received or read.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ulf Harnhammar found two format string bugs and two buffer overflow bugs in
+    Metamail.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send a malicious email message and execute
+    arbitrary code with the rights of the process calling the Metamail program.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users of Metamail should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-mail/metamail-2.7.45.3"
+    # emerge ">=net-mail/metamail-2.7.45.3"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0104">CAN-2004-0104</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0105">CAN-2004-0105</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-18.xml b/xml/htdocs/security/en/glsa/glsa-200405-18.xml
new file mode 100644
index 00000000..5643c175
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-18.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-18">
+  <title>Buffer Overflow in Firebird</title>
+  <synopsis>
+    A buffer overflow via environmental variables in Firebird may allow a local
+    user to manipulate or destroy local databases and trojan the Firebird
+    binaries.
+  </synopsis>
+  <product type="ebuild">firebird</product>
+  <announced>May 23, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>20837</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-db/firebird" auto="yes" arch="*">
+      <unaffected range="ge">1.5</unaffected>
+      <vulnerable range="lt">1.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Firebird is an open source relational database that runs on Linux,
+    Windows, and various UNIX systems.
+    </p>
+  </background>
+  <description>
+    <p>
+    A buffer overflow exists in three Firebird binaries (gds_inet_server,
+    gds_lock_mgr, and gds_drop) that is exploitable by setting a large
+    value to the INTERBASE environment variable.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could control program execution, allowing privilege
+    escalation to the UID of Firebird, full access to Firebird databases,
+    and trojaning the Firebird binaries. An attacker could use this to
+    compromise other user or root accounts.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the latest version of Firebird:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=dev-db/firebird-1.5&quot;
+    # emerge &quot;&gt;=dev-db/firebird-1.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://securityfocus.com/bid/7546/info/">Bugtraq Security Announcement</uri>
+    <uri link=" http://sourceforge.net/tracker/?group_id=9028&amp;atid=109028&amp;func=detail&amp;aid=739480">Sourceforge BugTracker Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0281">CVE-2003-0281</uri>
+  </references>
+  <metadata tag="submitter">
+    dmargoli
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-19.xml b/xml/htdocs/security/en/glsa/glsa-200405-19.xml
new file mode 100644
index 00000000..a7323d86
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-19.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-19">
+  <title>Opera telnet URI handler file creation/truncation vulnerability</title>
+  <synopsis>
+    A vulnerability exists in Opera's telnet URI handler that may allow a
+    remote attacker to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">opera</product>
+  <announced>May 25, 2004</announced>
+  <revised>December 30, 2007: 03</revised>
+  <bug>50857</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/opera" auto="yes" arch="*">
+      <unaffected range="ge">7.50_beta1</unaffected>
+      <vulnerable range="lt">7.50_beta1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Opera is a multi-platform web browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    The telnet URI handler in Opera does not check for leading '-'
+    characters in the host name. Consequently, a maliciously-crafted
+    telnet:// link may be able to pass options to the telnet program
+    itself. One example would be the following:
+    </p>
+    <p>
+    telnet://-nMyFile
+    </p>
+    <p>
+    If MyFile exists in the user's home directory and the user clicking on
+    the link has write permissions to it, the contents of the file will be
+    overwritten with the output of the telnet trace information. If MyFile
+    does not exist, the file will be created in the user's home directory.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    This exploit has two possible impacts. First, it may create new files
+    in the user's home directory. Second, and far more serious, it may
+    overwrite existing files that the user has write permissions to. An
+    attacker with some knowledge of a user's home directory might be able
+    to destroy important files stored within.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable the telnet URI handler from within Opera.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Opera users are encouraged to upgrade to the latest version of the
+    program:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=www-client/opera-7.50_beta1&quot;
+    # emerge &quot;&gt;=www-client/opera-7.50_beta1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.idefense.com/application/poi/display?id=104&amp;type=vulnerabilities&amp;flashstatus=true">iDEFENSE Security Advisory 05.12.04</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0473">CVE-2004-0473</uri>
+  </references>
+  <metadata tag="submitter">
+    klieber
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-20.xml b/xml/htdocs/security/en/glsa/glsa-200405-20.xml
new file mode 100644
index 00000000..d87d7831
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-20.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-20">
+  <title>Insecure Temporary File Creation In MySQL</title>
+  <synopsis>
+    Two MySQL utilities create temporary files with hardcoded paths, allowing
+    an attacker to use a symlink to trick MySQL into overwriting important
+    data.
+  </synopsis>
+  <product type="ebuild">MySQL</product>
+  <announced>May 25, 2004</announced>
+  <revised>May 25, 2004: 01</revised>
+  <bug>46242</bug>
+  <access>local </access>
+  <affected>
+    <package name="dev-db/mysql" auto="yes" arch="*">
+      <unaffected range="ge">4.0.18-r2</unaffected>
+      <vulnerable range="lt">4.0.18-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MySQL is a popular open-source multi-threaded, multi-user SQL database
+    server.
+    </p>
+  </background>
+  <description>
+    <p>
+    The MySQL bug reporting utility (mysqlbug) creates a temporary file to log
+    bug reports to. A malicious local user with write access to the /tmp
+    directory could create a symbolic link of the name mysqlbug-<i>N</i>
+    pointing to a protected file, such as /etc/passwd, such that when mysqlbug
+    creates the <i>N</i>th log file, it would end up overwriting the target
+    file. A similar vulnerability exists with the mysql_multi utility, which
+    creates a temporary file called mysql_multi.log.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Since mysql_multi runs as root, a local attacker could use this to destroy
+    any other users' data or corrupt and destroy system files.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    One could modify both scripts to log to a directory that users do not have
+    write permission to, such as /var/log/mysql/.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the latest stable version of MySQL.
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=dev-db/mysql-4.0.18-r2"
+    # emerge ">=dev-db/mysql-4.0.18-r2"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0381">CAN-2004-0381</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0388">CAN-2004-0388</uri>
+  </references>
+  <metadata tag="submitter">
+    dmargoli
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-21.xml b/xml/htdocs/security/en/glsa/glsa-200405-21.xml
new file mode 100644
index 00000000..af584984
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-21.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-21">
+  <title>Midnight Commander: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple security issues have been discovered in Midnight Commander
+    including several buffer overflows and string format vulnerabilities.
+  </synopsis>
+  <product type="ebuild">MC</product>
+  <announced>May 26, 2004</announced>
+  <revised>May 26, 2004: 01</revised>
+  <bug>49990</bug>
+  <access>local </access>
+  <affected>
+    <package name="app-misc/mc" auto="yes" arch="*">
+      <unaffected range="ge">4.6.0-r7</unaffected>
+      <vulnerable range="le">4.6.0-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Midnight Commander is a visual console file manager.
+    </p>
+  </background>
+  <description>
+    <p>
+    Numerous security issues have been discovered in Midnight Commander,
+    including several buffer overflow vulnerabilities, multiple vulnerabilities
+    in the handling of temporary file and directory creation, and multiple
+    format string vulnerabilities.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    The buffer overflows and format string vulnerabilites may allow attackers
+    to cause a denial of service or execute arbitrary code with permissions of
+    the user running MC. The insecure creation of temporary files and
+    directories could lead to a privilege escalation, including root
+    privileges, for a local attacker.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are advised to upgrade
+    to version 4.6.0-r7 or higher of Midnight Commander.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Midnight Commander users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-misc/mc-4.6.0-r7
+    # emerge ">=app-misc/mc-4.6.0-r7"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0226">CAN-2004-0226</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0231">CAN-2004-0231</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0232">CAN-2004-0232</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-22.xml b/xml/htdocs/security/en/glsa/glsa-200405-22.xml
new file mode 100644
index 00000000..c2c4beec
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-22.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-22">
+  <title>Apache 1.3: Multiple vulnerabilities</title>
+  <synopsis>
+    Several security vulnerabilites have been fixed in the latest release of
+    Apache 1.3.
+  </synopsis>
+  <product type="ebuild">Apache</product>
+  <announced>May 26, 2004</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>51815</bug>
+  <access>remote </access>
+  <affected>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="ge">1.3.31</unaffected>
+      <vulnerable range="lt">1.3.31</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP Server Project is an effort to develop and maintain an
+    open-source HTTP server for modern operating systems. The goal of this
+    project is to provide a secure, efficient and extensible server that
+    provides services in tune with the current HTTP standards.
+    </p>
+  </background>
+  <description>
+    <p>
+    On 64-bit big-endian platforms, mod_access does not properly parse
+    Allow/Deny rules using IP addresses without a netmask which could result in
+    failure to match certain IP addresses.
+    </p>
+    <p>
+    Terminal escape sequences are not filtered from error logs. This could be
+    used by an attacker to insert escape sequences into a terminal emulater
+    vulnerable to escape sequences.
+    </p>
+    <p>
+    mod_digest does not properly verify the nonce of a client response by using
+    a AuthNonce secret. This could permit an attacker to replay the response of
+    another website. This does not affect mod_auth_digest.
+    </p>
+    <p>
+    On certain platforms there is a starvation issue where listening sockets
+    fails to handle short-lived connection on a rarely-accessed listening
+    socket. This causes the child to hold the accept mutex and block out new
+    connections until another connection arrives on the same rarely-accessed
+    listening socket thus leading to a denial of service.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    These vulnerabilities could lead to attackers bypassing intended access
+    restrictions, denial of service, and possibly execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the latest stable version of Apache 1.3.
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=www-servers/apache-1.3.31"
+    # emerge ">=www-servers/apache-1.3.31"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0993">CAN-2003-0993</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0020">CAN-2003-0020</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0987">CAN-2003-0987</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0174">CAN-2004-0174</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-23.xml b/xml/htdocs/security/en/glsa/glsa-200405-23.xml
new file mode 100644
index 00000000..a2fe3d71
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-23.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-23">
+  <title>Heimdal: Kerberos 4 buffer overflow in kadmin</title>
+  <synopsis>
+    A possible buffer overflow in the Kerberos 4 component of Heimdal has been
+    discovered.
+  </synopsis>
+  <product type="ebuild">Heimdal</product>
+  <announced>May 27, 2004</announced>
+  <revised>May 27, 2004: 01</revised>
+  <bug>50208</bug>
+  <access>remote </access>
+  <affected>
+    <package name="app-crypt/heimdal" auto="yes" arch="*">
+      <unaffected range="ge">0.6.2</unaffected>
+      <vulnerable range="lt">0.6.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Heimdal is a free implementation of Kerberos.
+    </p>
+  </background>
+  <description>
+    <p>
+    A buffer overflow was discovered in kadmind, a server for administrative
+    access to the Kerberos database.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By sending a specially formatted message to kadmind, a remote attacker may
+    be able to crash kadmind causing a denial of service, or execute arbitrary
+    code with the permissions of the kadmind process.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    For a temporary workaround, providing you do not require Kerberos 4
+    support, you may turn off Kerberos 4 kadmin by running kadmind with the
+    --no-kerberos4 option.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Heimdal users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-crypt/heimdal-0.6.2"
+    # emerge ">=app-crypt/heimdal-0.6.2"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.pdc.kth.se/heimdal/advisory/2004-05-06/">Heimdal 0.6.2 Release Notice</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0434">CAN-2004-0434</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-24.xml b/xml/htdocs/security/en/glsa/glsa-200405-24.xml
new file mode 100644
index 00000000..5a3c9afe
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-24.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-24">
+  <title>MPlayer, xine-lib: vulnerabilities in RTSP stream handling</title>
+  <synopsis>
+    Multiple vulnerabilities, including remotely exploitable buffer overflows,
+    have been found in code common to MPlayer and the xine library.
+  </synopsis>
+  <product type="ebuild">mplayer</product>
+  <announced>May 28, 2004</announced>
+  <revised>May 28, 2004: 01</revised>
+  <bug>49387</bug>
+  <access>remote </access>
+  <affected>
+    <package name="media-video/mplayer" auto="yes" arch="*">
+      <unaffected range="ge">1.0_pre4</unaffected>
+      <unaffected range="le">0.92-r1</unaffected>
+      <vulnerable range="lt">1.0_pre4</vulnerable>
+    </package>
+    <package name="media-libs/xine-lib" auto="yes" arch="*">
+      <unaffected range="ge">1_rc4</unaffected>
+      <unaffected range="le">0.9.13-r3</unaffected>
+      <vulnerable range="lt">1_rc4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MPlayer is a movie player capable of handling multiple multimedia file
+    formats. xine-lib is a multimedia player library used by several graphical
+    user interfaces, including xine-ui. They both use the same code to handle
+    Real-Time Streaming Protocol (RTSP) streams from RealNetworks servers.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been found and fixed in the RTSP handling
+    code common to recent versions of these two packages. These vulnerabilities
+    include several remotely exploitable buffer overflows.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker, posing as a RTSP stream server, can execute arbitrary
+    code with the rights of the user of the software playing the stream
+    (MPlayer or any player using xine-lib). Another attacker may entice a user
+    to use a maliciously crafted URL or playlist to achieve the same results.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    For MPlayer, there is no known workaround at this time. For xine-lib, you
+    can delete the xineplug_inp_rtsp.so file.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to non-vulnerable versions of MPlayer and
+    xine-lib:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=media-video/mplayer-1.0_pre4"
+    # emerge ">=media-video/mplayer-1.0_pre4"
+
+    # emerge -pv ">=media-libs/xine-lib-1_rc4"
+    # emerge ">=media-libs/xine-lib-1_rc4"</code>
+  </resolution>
+  <references>
+    <uri link="http://xinehq.de/index.php/security/XSA-2004-3">Xine security advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0433">CAN-2004-0433</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200405-25.xml b/xml/htdocs/security/en/glsa/glsa-200405-25.xml
new file mode 100644
index 00000000..f951ba78
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200405-25.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200405-25">
+  <title>tla: Multiple vulnerabilities in included libneon</title>
+  <synopsis>
+    tla includes a vulnerable version of the neon library.
+  </synopsis>
+  <product type="ebuild">tla</product>
+  <announced>May 30, 2004</announced>
+  <revised>June 02, 2004: 02</revised>
+  <bug>51586</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-util/tla" auto="yes" arch="*">
+      <unaffected range="ge">1.2-r2</unaffected>
+      <vulnerable range="le">1.2-r1</vulnerable>
+      <vulnerable range="eq">1.2.1_pre1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GNU Arch (tla) is a revision control system suited for widely distributed
+    development.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple format string vulnerabilities and a heap overflow vulnerability
+    were discovered in the code of the neon library (GLSA 200405-01 and
+    200405-13). Current versions of the tla package include their own version
+    of this library.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    When connected to a malicious WebDAV server, these vulnerabilities could
+    allow execution of arbitrary code with the rights of the user running tla.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users of tla should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=dev-util/tla-1.2-r2"
+    # emerge ">=dev-util/tla-1.2-r2"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200405-01.xml">GLSA 200405-01</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200405-13.xml">GLSA 200405-13</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-01.xml b/xml/htdocs/security/en/glsa/glsa-200406-01.xml
new file mode 100644
index 00000000..3ca995c4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-01.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-01">
+  <title>Ethereal: Multiple security problems</title>
+  <synopsis>
+    Multiple vulnerabilities including one buffer overflow exist in Ethereal,
+    which may allow an attacker to run arbitrary code or crash the program.
+  </synopsis>
+  <product type="ebuild">Ethereal</product>
+  <announced>June 04, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>51022</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/ethereal" auto="yes" arch="*">
+      <unaffected range="ge">0.10.4</unaffected>
+      <vulnerable range="le">0.10.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ethereal is a feature rich network protocol analyzer.
+    </p>
+  </background>
+  <description>
+    <p>
+    There are multiple vulnerabilities in versions of Ethereal earlier than
+    0.10.4, including:
+    </p>
+    <ul>
+    <li>A buffer overflow in the MMSE dissector.</li>
+    <li>Under specific conditions a SIP packet could make Ethereal
+    crash.</li>
+    <li>The AIM dissector could throw an assertion, causing Ethereal to
+    crash.</li>
+    <li>The SPNEGO dissector could dereference a null pointer, causing a
+    crash.</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could use these vulnerabilities to crash Ethereal or even
+    execute arbitrary code with the permissions of the user running
+    Ethereal, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    For a temporary workaround you can disable all affected protocol
+    dissectors by selecting Analyze->Enabled Protocols... and deselecting
+    them from the list. However, it is strongly recommended to upgrade to
+    the latest stable release.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ethereal users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-analyzer/ethereal-0.10.4&quot;
+    # emerge &quot;&gt;=net-analyzer/ethereal-0.10.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.ethereal.com/appnotes/enpa-sa-00014.html">Ethereal enpa-sa-00014</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0504">CVE-2004-0504</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0505">CVE-2004-0505</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0506">CVE-2004-0506</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0507">CVE-2004-0507</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-02.xml b/xml/htdocs/security/en/glsa/glsa-200406-02.xml
new file mode 100644
index 00000000..5286aa39
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-02.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-02">
+  <title>tripwire: Format string vulnerability</title>
+  <synopsis>
+    A vulnerability allowing arbitrary code execution under certain
+    circumstances has been found.
+  </synopsis>
+  <product type="ebuild">tripwire</product>
+  <announced>June 04, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>52945</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-admin/tripwire" auto="yes" arch="*">
+      <unaffected range="ge">2.3.1.2-r1</unaffected>
+      <vulnerable range="le">2.3.1.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    tripwire is an open source file integrity checker.
+    </p>
+  </background>
+  <description>
+    <p>
+    The code that generates email reports contains a format string
+    vulnerability in pipedmailmessage.cpp.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    With a carefully crafted filename on a local filesystem an attacker
+    could cause execution of arbitrary code with permissions of the user
+    running tripwire, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All tripwire users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=app-admin/tripwire-2.3.1.2-r1&quot;
+    # emerge &quot;&gt;=app-admin/tripwire-2.3.1.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/365036/2004-05-31/2004-06-06/0">Bugtraq Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0536">CVE-2004-0536</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-03.xml b/xml/htdocs/security/en/glsa/glsa-200406-03.xml
new file mode 100644
index 00000000..5830b11f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-03.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-03">
+  <title>sitecopy: Multiple vulnerabilities in included libneon</title>
+  <synopsis>
+    sitecopy includes a vulnerable version of the neon library.
+  </synopsis>
+  <product type="ebuild">sitecopy</product>
+  <announced>June 05, 2004</announced>
+  <revised>August 15, 2004: 04</revised>
+  <bug>51585</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/sitecopy" auto="yes" arch="*">
+      <unaffected range="ge">0.13.4-r2</unaffected>
+      <vulnerable range="le">0.13.4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    sitecopy easily maintains remote websites. It makes it simple to keep a
+    remote site synchronized with the local site with one command.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple format string vulnerabilities and a heap overflow vulnerability
+    were discovered in the code of the neon library (GLSA 200405-01 and
+    200405-13). Current versions of the sitecopy package include their own
+    version of this library.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    When connected to a malicious WebDAV server, these vulnerabilities could
+    allow execution of arbitrary code with the rights of the user running
+    sitecopy.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of sitecopy.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All sitecopy users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-misc/sitecopy-0.13.4-r2"
+    # emerge ">=net-misc/sitecopy-0.13.4-r2"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200405-01.xml">GLSA 200405-01</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200405-13.xml">GLSA 200405-13</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-04.xml b/xml/htdocs/security/en/glsa/glsa-200406-04.xml
new file mode 100644
index 00000000..361bcf22
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-04.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-04">
+  <title>Mailman: Member password disclosure vulnerability</title>
+  <synopsis>
+    Mailman contains a bug allowing 3rd parties to retrieve member passwords.
+  </synopsis>
+  <product type="ebuild">mailman</product>
+  <announced>June 09, 2004</announced>
+  <revised>June 09, 2004: 01</revised>
+  <bug>51671</bug>
+  <access>remote  </access>
+  <affected>
+    <package name="net-mail/mailman" auto="yes" arch="*">
+      <unaffected range="ge">2.1.5</unaffected>
+      <vulnerable range="lt">2.1.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mailman is a python-based mailing list server with an extensive web
+    interface.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mailman contains an unspecified vulnerability in the handling of request
+    emails.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a carefully crafted email request to the mailman server an
+    attacker could obtain member passwords.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users of Mailman should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-mail/mailman-2.1.5"
+    # emerge ">=net-mail/mailman-2.1.5"</code>
+  </resolution>
+  <references>
+    <uri link="http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html">Mailman 2.1.5 Release Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0412">CAN-2004-0412</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-05.xml b/xml/htdocs/security/en/glsa/glsa-200406-05.xml
new file mode 100644
index 00000000..2264a933
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-05.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-05">
+  <title>Apache: Buffer overflow in mod_ssl</title>
+  <synopsis>
+    A bug in mod_ssl may allow a remote attacker to execute remote code when
+    Apache is configured a certain way.
+  </synopsis>
+  <product type="ebuild">Apache</product>
+  <announced>June 09, 2004</announced>
+  <revised>December 30, 2007: 03</revised>
+  <bug>51368</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-www/mod_ssl" auto="yes" arch="*">
+      <unaffected range="ge">2.8.18</unaffected>
+      <vulnerable range="lt">2.8.18</vulnerable>
+    </package>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="lt">2.0</unaffected>
+      <unaffected range="ge">2.0.49-r3</unaffected>
+      <vulnerable range="le">2.0.49-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Apache is the most popular Web server on the Internet. mod_ssl provides
+    Secure Sockets Layer encryption and authentication to Apache 1.3. Apache 2
+    contains the functionality of mod_ssl.
+    </p>
+  </background>
+  <description>
+    <p>
+    A bug in the function ssl_util_uuencode_binary in ssl_util.c may lead to a
+    remote buffer overflow on a server configured to use FakeBasicAuth that
+    will trust a client certificate with an issuing CA with a subject DN longer
+    than 6k.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Given the right server configuration, an attacker could cause a Denial of
+    Service or execute code as the user running Apache, usually
+    &quot;apache&quot;. It is thought to be impossible to exploit this to
+    execute code on the x86 platform, but the possibility for other platforms
+    is unknown. This does not preclude a DoS on x86 systems.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A server should not be vulnerable if it is not configured to use
+    FakeBasicAuth and to trust a client CA with a long subject DN.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Apache 1.x users should upgrade to the latest version of mod_ssl:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-www/mod_ssl-2.8.18"
+    # emerge ">=net-www/mod_ssl-2.8.18"</code>
+    <p>
+    Apache 2.x users should upgrade to the latest version of Apache:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=www-servers/apache-2.0.49-r3"
+    # emerge ">=www-servers/apache-2.0.49-r3"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0488">CAN-2004-0488</uri>
+  </references>
+  <metadata tag="submitter">
+    dmargoli
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-06.xml b/xml/htdocs/security/en/glsa/glsa-200406-06.xml
new file mode 100644
index 00000000..277cea6e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-06.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-06">
+  <title>CVS: additional DoS and arbitrary code execution vulnerabilities</title>
+  <synopsis>
+    Several serious new vulnerabilities have been found in CVS, which may allow
+    an attacker to remotely compromise a CVS server.
+  </synopsis>
+  <product type="ebuild">CVS</product>
+  <announced>June 10, 2004</announced>
+  <revised>June 10, 2004: 01</revised>
+  <bug>53408</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-util/cvs" auto="yes" arch="*">
+      <unaffected range="ge">1.11.17</unaffected>
+      <vulnerable range="le">1.11.16-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CVS (Concurrent Versions System) is an open-source network-transparent
+    version control system. It contains both a client utility and a server.
+    </p>
+  </background>
+  <description>
+    <p>
+    A team audit of the CVS source code performed by Stefan Esser and Sebastian
+    Krahmer resulted in the discovery of several remotely exploitable
+    vulnerabilities including:
+    </p>
+    <ul>
+    <li>no-null-termination of &quot;Entry&quot; lines</li>
+    <li>error_prog_name &quot;double-free()&quot;</li>
+    <li>Argument integer overflow</li>
+    <li>serve_notify() out of bounds writes</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could use these vulnerabilities to cause a Denial of Service or
+    execute arbitrary code with the permissions of the user running cvs.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are advised to upgrade
+    to the latest available version of CVS.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CVS users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=dev-util/cvs-1.11.17"
+    # emerge ">=dev-util/cvs-1.11.17"</code>
+  </resolution>
+  <references>
+    <uri link="http://security.e-matters.de/advisories/092004.html">E-matters Advisory 09/2004</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0414">CAN-2004-0414</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0416">CAN-2004-0416</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0417">CAN-2004-0417</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0418">CAN-2004-0418</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-07.xml b/xml/htdocs/security/en/glsa/glsa-200406-07.xml
new file mode 100644
index 00000000..de8fc117
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-07.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-07">
+  <title>Subversion: Remote heap overflow</title>
+  <synopsis>
+    Subversion is vulnerable to a remote Denial of Service that may be
+    exploitable to execute arbitrary code on the server running svnserve.
+  </synopsis>
+  <product type="ebuild">dev-util/subversion</product>
+  <announced>June 10, 2004</announced>
+  <revised>June 10, 2004: 01</revised>
+  <access>remote</access>
+  <affected>
+    <package name="dev-util/subversion" auto="yes" arch="*">
+      <unaffected range="ge">1.0.4-r1</unaffected>
+      <vulnerable range="le">1.0.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Subversion is a revision control system that aims to be a &quot;compelling
+    replacement for CVS&quot;. It enjoys wide use in the open source community.
+    svnserve allows access to Subversion repositories using URIs with the
+    svn://, svn+ssh://, and other tunelled svn+*:// protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    The svn protocol parser trusts the indicated length of a URI string sent by
+    a client. This allows a client to specify a very long string, thereby
+    causing svnserve to allocate enough memory to hold that string. This may
+    cause a Denial of Service. Alternately, given a string that causes an
+    integer overflow in the variable holding the string length, the server
+    might allocate less memory than required, allowing a heap overflow. This
+    heap overflow may then be exploitable, allowing remote code execution. The
+    attacker does not need read or write access to the Subversion repository
+    being served, since even un-authenticated users can send svn protocol
+    requests.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Ranges from remote Denial of Service to potential arbitrary code execution
+    with privileges of the svnserve process.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Servers without svnserve running are not vulnerable. Disable svnserve and
+    use DAV for access instead.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the latest version of Subversion.
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=dev-util/subversion-1.0.4-r1"
+    # emerge ">=dev-util/subversion-1.0.4-r1"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0413">CAN-2004-0413</uri>
+  </references>
+  <metadata tag="submitter">
+    dmargoli
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-08.xml b/xml/htdocs/security/en/glsa/glsa-200406-08.xml
new file mode 100644
index 00000000..a736f7d3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-08.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-08">
+  <title>Squirrelmail: Another XSS vulnerability</title>
+  <synopsis>
+    Squirrelmail fails to properly sanitize user input, which could lead to a
+    compromise of webmail accounts.
+  </synopsis>
+  <product type="ebuild">Squirrelmail</product>
+  <announced>June 15, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>52434</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/squirrelmail" auto="yes" arch="*">
+      <unaffected range="ge">1.4.3</unaffected>
+      <vulnerable range="le">1.4.3_rc1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SquirrelMail is a webmail package written in PHP. It supports IMAP and
+    SMTP, and can optionally be installed with SQL support.
+    </p>
+  </background>
+  <description>
+    <p>
+    A new cross-site scripting (XSS) vulnerability in
+    Squirrelmail-1.4.3_rc1 has been discovered. In functions/mime.php
+    Squirrelmail fails to properly sanitize user input.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to read a specially crafted e-mail, an attacker can
+    execute arbitrary scripts running in the context of the victim's
+    browser. This could lead to a compromise of the user's webmail account,
+    cookie theft, etc.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SquirrelMail users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=mail-client/squirrelmail-1.4.3&quot;
+    # emerge &quot;&gt;=mail-client/squirrelmail-1.4.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-1.txt">RS-Labs Advisory</uri>
+    <uri link="http://www.cert.org/advisories/CA-2000-02.html">CERT description of XSS</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0520">CVE-2004-0520</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-09.xml b/xml/htdocs/security/en/glsa/glsa-200406-09.xml
new file mode 100644
index 00000000..30858750
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-09.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-09">
+  <title>Horde-Chora: Remote code execution</title>
+  <synopsis>
+    A vulnerability in Chora allows remote code execution and file upload.
+  </synopsis>
+  <product type="ebuild">www-apps/horde-chora</product>
+  <announced>June 15, 2004</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>53800</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/horde-chora" auto="yes" arch="*">
+      <unaffected range="ge">1.2.2</unaffected>
+      <vulnerable range="lt">1.2.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Chora is a PHP-based SVN/CVS repository viewer by the HORDE project.
+    </p>
+  </background>
+  <description>
+    <p>
+    A vulnerability in the diff viewer of Chora allows an attacker to inject
+    shellcode. An attacker can exploit PHP's file upload functionality to
+    upload a malicious binary to a vulnerable server, chmod it as executable,
+    and run the file.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could remotely execute arbitrary binaries with the permissions
+    of the PHP script, conceivably allowing further exploitation of local
+    vulnerabilities and remote root access.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users are advised to upgrade to the latest version of Chora:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=www-apps/horde-chora-1.2.2"
+    # emerge ">=www-apps/horde-chora-1.2.2"</code>
+  </resolution>
+  <references>
+    <uri link="http://security.e-matters.de/advisories/102004.html">e-matters Advisory</uri>
+  </references>
+  <metadata tag="submitter">
+    dmargoli
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-10.xml b/xml/htdocs/security/en/glsa/glsa-200406-10.xml
new file mode 100644
index 00000000..be4326f3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-10.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-10">
+  <title>Gallery: Privilege escalation vulnerability</title>
+  <synopsis>
+    There is a vulnerability in the Gallery photo album software which may
+    allow an attacker to gain administrator privileges within Gallery.
+  </synopsis>
+  <product type="ebuild">gallery</product>
+  <announced>June 15, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>52798</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/gallery" auto="yes" arch="*">
+      <unaffected range="ge">1.4.3_p2</unaffected>
+      <vulnerable range="le">1.4.3_p1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gallery is a web application written in PHP which is used to organize
+    and publish photo albums. It allows multiple users to build and
+    maintain their own albums. It also supports the mirroring of images on
+    other servers.
+    </p>
+  </background>
+  <description>
+    <p>
+    There is a vulnerability in the Gallery photo album software which may
+    allow an attacker to gain administrator privileges within Gallery. A
+    Gallery administrator has full access to all albums and photos on the
+    server, thus attackers may add or delete photos at will.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Attackers may gain full access to all Gallery albums. There is no risk
+    to the webserver itself, or the server on which it runs.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the latest available version of Gallery.
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=www-apps/gallery-1.4.3_p2&quot;
+    # emerge &quot;&gt;=www-apps/gallery-1.4.3_p2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://gallery.menalto.com/modules.php?op=modload&amp;name=News&amp;file=article&amp;sid=123&amp;mode=thread&amp;order=0&amp;thold=0">Gallery Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0522">CVE-2004-0522</uri>
+  </references>
+  <metadata tag="submitter">
+    condordes
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-11.xml b/xml/htdocs/security/en/glsa/glsa-200406-11.xml
new file mode 100644
index 00000000..7ebd0fbf
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-11.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-11">
+  <title>Horde-IMP: Input validation vulnerability</title>
+  <synopsis>
+    An input validation vulnerability has been discovered in Horde-IMP.
+  </synopsis>
+  <product type="ebuild">horde-imp</product>
+  <announced>June 16, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>53862</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/horde-imp" auto="yes" arch="*">
+      <unaffected range="ge">3.2.4</unaffected>
+      <vulnerable range="le">3.2.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Horde-IMP is the Internet Messaging Program. It is written in PHP and
+    provides webmail access to IMAP and POP3 accounts.
+    </p>
+  </background>
+  <description>
+    <p>
+    Horde-IMP fails to properly sanitize email messages that contain
+    malicious HTML or script code.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to read a specially crafted e-mail, an attacker can
+    execute arbitrary scripts running in the context of the victim's
+    browser. This could lead to a compromise of the user's webmail account,
+    cookie theft, etc.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Horde-IMP users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=www-apps/horde-imp-3.2.4&quot;
+    # emerge &quot;&gt;=www-apps/horde-imp-3.2.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/bid/10501">Bugtraq Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0584">CVE-2004-0584</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-12.xml b/xml/htdocs/security/en/glsa/glsa-200406-12.xml
new file mode 100644
index 00000000..e438dda3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-12.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-12">
+  <title>Webmin: Multiple vulnerabilities</title>
+  <synopsis>
+    Webmin contains two security vulnerabilities which could lead to a Denial
+    of Service attack and information disclosure.
+  </synopsis>
+  <product type="ebuild">webmin</product>
+  <announced>June 16, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>53375</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-admin/webmin" auto="yes" arch="*">
+      <unaffected range="ge">1.150</unaffected>
+      <vulnerable range="le">1.140-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Webmin is a web-based administration tool for Unix. It supports a wide
+    range of applications including Apache, DNS, file sharing and others.
+    </p>
+  </background>
+  <description>
+    <p>
+    Webmin contains two security vulnerabilities. One allows any user to
+    view the configuration of any module and the other could allow an
+    attacker to lock out a valid user by sending an invalid username and
+    password.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An authenticated user could use these vulnerabilities to view the
+    configuration of any module thus potentially obtaining important
+    knowledge about configuration settings. Furthermore an attacker could
+    lock out legitimate users by sending invalid login information.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Webmin users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=app-admin/app-admin/webmin-1.150&quot;
+    # emerge &quot;&gt;=app-admin/app-admin/webmin-1.150&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/bid/10474">Bugtraq Announcement</uri>
+    <uri link="http://www.webmin.com/changes-1.150.html">Webmin Changelog</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0582">CVE-2004-0582</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0583">CVE-2004-0583</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-13.xml b/xml/htdocs/security/en/glsa/glsa-200406-13.xml
new file mode 100644
index 00000000..97e9a7df
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-13.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-13">
+  <title>Squid: NTLM authentication helper buffer overflow</title>
+  <synopsis>
+    Squid contains a bug where it fails to properly check bounds of the 'pass'
+    variable.
+  </synopsis>
+  <product type="ebuild">squid</product>
+  <announced>June 17, 2004</announced>
+  <revised>September 02, 2004: 02</revised>
+  <bug>53367</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-proxy/squid" auto="yes" arch="*">
+      <unaffected range="ge">2.5.5-r2</unaffected>
+      <vulnerable range="le">2.5.5-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Squid contains a bug in the function ntlm_check_auth(). It fails to do
+    proper bounds checking on the values copyied to the 'pass' variable.
+    </p>
+  </background>
+  <description>
+    <p>
+    Squid is a full-featured Web Proxy Cache designed to run on Unix systems.
+    It supports proxying and caching of HTTP, FTP, and other URLs, as well as
+    SSL support, cache hierarchies, transparent caching, access control lists
+    and many other features.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    If Squid is configured to use NTLM authentication, an attacker could
+    exploit this vulnerability by sending a very long password. This could lead
+    to arbitrary code execution with the permissions of the user running Squid.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Squid users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-proxy/squid-2.5.5-r2"
+    # emerge ">=net-proxy/squid-2.5.5-r2"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0541">CAN-2004-0541</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-14.xml b/xml/htdocs/security/en/glsa/glsa-200406-14.xml
new file mode 100644
index 00000000..8e00a488
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-14.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-14">
+  <title>aspell: Buffer overflow in word-list-compress</title>
+  <synopsis>
+    A bug in the aspell utility word-list-compress can allow an attacker to
+    execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">aspell</product>
+  <announced>June 17, 2004</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>53389</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-text/aspell" auto="yes" arch="*">
+      <unaffected range="ge">0.50.5-r4</unaffected>
+      <vulnerable range="le">0.50.5-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    aspell is a popular spell-checker. Dictionaries are available for many
+    languages.
+    </p>
+  </background>
+  <description>
+    <p>
+    aspell includes a utility for handling wordlists called
+    word-list-compress. This utility fails to do proper bounds checking
+    when processing words longer than 256 bytes.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    If an attacker could entice a user to handle a wordlist containing very
+    long word lengths it could result in the execution of arbitrary code
+    with the permissions of the user running the program.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the latest available version of aspell.
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=app-text/aspell-0.50.5-r4&quot;
+    # emerge &quot;&gt;=app-text/aspell-0.50.5-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://nettwerked.mg2.org/advisories/wlc">Nettwerked Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0548">CVE-2004-0548</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-15.xml b/xml/htdocs/security/en/glsa/glsa-200406-15.xml
new file mode 100644
index 00000000..28fc8125
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-15.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-15">
+  <title>Usermin: Multiple vulnerabilities</title>
+  <synopsis>
+    Usermin contains two security vulnerabilities which could lead to a Denial
+    of Service attack and information disclosure.
+  </synopsis>
+  <product type="ebuild">Usermin</product>
+  <announced>June 18, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>54030</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-admin/usermin" auto="yes" arch="*">
+      <unaffected range="ge">1.080</unaffected>
+      <vulnerable range="le">1.070-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Usermin is a web-based administration tool for Unix. It supports a wide
+    range of user applications including configuring mail forwarding,
+    setting up SSH or reading mail.
+    </p>
+  </background>
+  <description>
+    <p>
+    Usermin contains two security vulnerabilities. One fails to properly
+    sanitize email messages that contain malicious HTML or script code and
+    the other could allow an attacker to lock out a valid user by sending
+    an invalid username and password.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a specially crafted e-mail, an attacker can execute
+    arbitrary scripts running in the context of the victim's browser. This
+    can be lead to cookie theft and potentially to compromise of user
+    accounts. Furthermore, an attacker could lock out legitimate users by
+    sending invalid login information.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Usermin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=app-admin/usermin-1.080&quot;
+    # emerge &quot;&gt;=app-admin/usermin-1.080&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/bid/10521">Bugtraq Announcement</uri>
+    <uri link="http://www.lac.co.jp/security/csl/intelligence/SNSadvisory_e/75_e.html">SNS Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0583">CVE-2004-0583</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0588">CVE-2004-0588</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-16.xml b/xml/htdocs/security/en/glsa/glsa-200406-16.xml
new file mode 100644
index 00000000..06454de4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-16.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-16">
+  <title>Apache 1.3: Buffer overflow in mod_proxy</title>
+  <synopsis>
+    A bug in mod_proxy may allow a remote attacker to execute arbitrary code
+    when Apache is configured a certain way.
+  </synopsis>
+  <product type="ebuild">Apache</product>
+  <announced>June 21, 2004</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>53544</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="ge">1.3.31-r2</unaffected>
+      <vulnerable range="le">1.3.31-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP Server Project is an effort to develop and maintain an
+    open-source HTTP server for modern operating systems. The goal of this
+    project is to provide a secure, efficient and extensible server that
+    provides services in tune with the current HTTP standards.
+    </p>
+  </background>
+  <description>
+    <p>
+    A bug in the proxy_util.c file may lead to a remote buffer overflow. To
+    trigger the vulnerability an attacker would have to get mod_proxy to
+    connect to a malicous server which returns an invalid (negative)
+    Content-Length.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could cause a Denial of Service as the Apache child handling
+    the request, which will die and under some circumstances execute arbitrary
+    code as the user running Apache, usually &quot;apache&quot;.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version:
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Apache 1.x users should upgrade to the latest version of Apache:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=www-servers/apache-1.3.31-r2"
+    # emerge ">=www-servers/apache-1.3.31-r2"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.guninski.com/modproxy1.html">Georgi Guninski security advisory #69, 2004</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0492">CAN-2004-0492</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-17.xml b/xml/htdocs/security/en/glsa/glsa-200406-17.xml
new file mode 100644
index 00000000..e812634e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-17.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-17">
+  <title>IPsec-Tools: authentication bug in racoon</title>
+  <synopsis>
+    racoon provided as part of IPsec-Tools fails do proper authentication.
+  </synopsis>
+  <product type="ebuild">IPsec-Tools</product>
+  <announced>June 22, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>53915</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-firewall/ipsec-tools" auto="yes" arch="*">
+      <unaffected range="ge">0.3.3</unaffected>
+      <vulnerable range="lt">0.3.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    IPsec-Tools is a port of KAME's implementation of the IPsec utilities.
+    It contains a collection of network monitoring tools, including racoon,
+    ping, and ping6.
+    </p>
+  </background>
+  <description>
+    <p>
+    The KAME IKE daemon racoon is used to authenticate peers during Phase 1
+    when using either preshared keys, GSS-API, or RSA signatures. When
+    using RSA signatures racoon validates the X.509 certificate but not the
+    RSA signature.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a valid and trusted X.509 certificate and any private key an
+    attacker could exploit this vulnerability to perform man-in-the-middle
+    attacks and initiate unauthorized connections.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All IPsec-Tools users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-firewall/ipsec-tools-0.3.3&quot;
+    # emerge &quot;&gt;=net-firewall/ipsec-tools-0.3.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://ipsec-tools.sourceforge.net/x509sig.html">IPsec-Tools Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0155">CVE-2004-0155</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0607">CVE-2004-0607</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-18.xml b/xml/htdocs/security/en/glsa/glsa-200406-18.xml
new file mode 100644
index 00000000..13e5188d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-18.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-18">
+  <title>gzip: Insecure creation of temporary files</title>
+  <synopsis>
+    gzip contain a bug potentially allowing an attacker to execute arbitrary
+    commands.
+  </synopsis>
+  <product type="ebuild">gzip</product>
+  <announced>June 24, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>54890</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-arch/gzip" auto="yes" arch="*">
+      <unaffected range="ge">1.3.3-r4</unaffected>
+      <vulnerable range="le">1.3.3-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    gzip (GNU zip) is popular compression program. The included gzexe
+    utility allows you to compress executables in place and have them
+    automatically uncompress and execute when you run them.
+    </p>
+  </background>
+  <description>
+    <p>
+    The script gzexe included with gzip contains a bug in the code that
+    handles tempfile creation. If the creation of a temp file fails when
+    using gzexe fails instead of bailing out it executes the command given
+    as argument.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    This could lead to priviege escalation by running commands under the
+    rights of the user running the self extracting file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All gzip users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=app-arch/gzip-1.3.3-r4&quot;
+    # emerge &quot;&gt;=app-arch/gzip-1.3.3-r4&quot;</code>
+    <p>
+    Additionally, once the upgrade is complete, all self extracting files
+    created with earlier versions gzexe should be recreated, since the
+    vulnerability is actually embedded in those executables.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0603">CVE-2004-0603</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-19.xml b/xml/htdocs/security/en/glsa/glsa-200406-19.xml
new file mode 100644
index 00000000..cb12a021
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-19.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-19">
+  <title>giFT-FastTrack: remote denial of service attack</title>
+  <synopsis>
+    There is a vulnerability where a carefully crafted signal sent to the
+    giFT-FastTrack plugin will cause the giFT daemon to crash.
+  </synopsis>
+  <product type="ebuild">giFT-FastTrack</product>
+  <announced>June 24, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>54452</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-p2p/gift-fasttrack" auto="yes" arch="*">
+      <unaffected range="ge">0.8.7</unaffected>
+      <vulnerable range="le">0.8.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    giFT-FastTrack is a plugin for the giFT file-sharing application. It
+    allows giFT users to connect to the fasttrack network to share files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Alan Fitton found a vulnerability in the giFT-FastTrack plugin in
+    version 0.8.6 and earlier. It can be used to remotely crash the giFT
+    daemon.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    Attackers may use this vulnerability to perform a Denial of Service
+    attack against the giFT daemon. There is no risk of code execution.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the latest available version of
+    gift-fasttrack:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-p2p/gift-fasttrack-0.8.7&quot;
+    # emerge &quot;&gt;=net-p2p/gift-fasttrack-0.8.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://gift-fasttrack.berlios.de/">giFT-FastTrack announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0604">CVE-2004-0604</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-20.xml b/xml/htdocs/security/en/glsa/glsa-200406-20.xml
new file mode 100644
index 00000000..abefada9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-20.xml
@@ -0,0 +1,122 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-20">
+  <title>FreeS/WAN, Openswan, strongSwan: Vulnerabilities in certificate handling</title>
+  <synopsis>
+    FreeS/WAN, Openswan, strongSwan and Super-FreeS/WAN contain two bugs when
+    authenticating PKCS#7 certificates. This could allow an attacker to
+    authenticate with a fake certificate.
+  </synopsis>
+  <product type="ebuild">Openswan</product>
+  <announced>June 25, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/freeswan" auto="yes" arch="*">
+      <unaffected range="ge">2.04-r1</unaffected>
+      <unaffected range="eq">1.99-r1</unaffected>
+      <vulnerable range="lt">2.04-r1</vulnerable>
+    </package>
+    <package name="net-misc/openswan" auto="yes" arch="*">
+      <unaffected range="ge">2.1.4</unaffected>
+      <unaffected range="eq">1.0.6_rc1</unaffected>
+      <vulnerable range="lt">2.1.4</vulnerable>
+    </package>
+    <package name="net-misc/strongswan" auto="yes" arch="*">
+      <unaffected range="ge">2.1.3</unaffected>
+      <vulnerable range="lt">2.1.3</vulnerable>
+    </package>
+    <package name="net-misc/super-freeswan" auto="yes" arch="*">
+      <vulnerable range="le">1.99.7.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    FreeS/WAN, Openswan, strongSwan and Super-FreeS/WAN are Open Source
+    implementations of IPsec for the Linux operating system. They are all
+    based on the discontinued FreeS/WAN project.
+    </p>
+  </background>
+  <description>
+    <p>
+    All these IPsec implementations have several bugs in the
+    verify_x509cert() function, which performs certificate validation, that
+    make them vulnerable to malicious PKCS#7 wrapped objects.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    With a carefully crafted certificate payload an attacker can
+    successfully authenticate against FreeS/WAN, Openswan, strongSwan or
+    Super-FreeS/WAN, or make the daemon go into an endless loop.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All FreeS/WAN 1.9x users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;=net-misc/freeswan-1.99-r1&quot;
+    # emerge &quot;=net-misc/freeswan-1.99-r1&quot;</code>
+    <p>
+    All FreeS/WAN 2.x users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-misc/freeswan-2.04-r1&quot;
+    # emerge &quot;&gt;=net-misc/freeswan-2.04-r1&quot;</code>
+    <p>
+    All Openswan 1.x users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;=net-misc/openswan-1.0.6_rc1&quot;
+    # emerge &quot;=net-misc/openswan-1.0.6_rc1&quot;</code>
+    <p>
+    All Openswan 2.x users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-misc/openswan-2.1.4&quot;
+    # emerge &quot;&gt;=net-misc/openswan-2.1.4&quot;</code>
+    <p>
+    All strongSwan users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-misc/strongswan-2.1.3&quot;
+    # emerge &quot;&gt;=net-misc/strongswan-2.1.3&quot;</code>
+    <p>
+    All Super-FreeS/WAN users should migrate to the latest stable version
+    of Openswan. Note that Portage will force a move for Super-FreeS/WAN
+    users to Openswan.
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;=net-misc/openswan-1.0.6_rc1&quot;
+    # emerge &quot;=net-misc/openswan-1.0.6_rc1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://lists.openswan.org/pipermail/dev/2004-June/000370.html">Openswan/strongSwan Authentication Bug</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0590">CVE-2004-0590</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-21.xml b/xml/htdocs/security/en/glsa/glsa-200406-21.xml
new file mode 100644
index 00000000..866ed896
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-21.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-21">
+  <title>mit-krb5: Multiple buffer overflows in krb5_aname_to_localname</title>
+  <synopsis>
+    mit-krb5 contains multiple buffer overflows in the function
+    krb5_aname_to_localname(). This could potentially lead to a complete remote
+    system compromise.
+  </synopsis>
+  <product type="ebuild">mit-krb5</product>
+  <announced>June 29, 2004</announced>
+  <revised>June 29, 2004: 01</revised>
+  <bug>52744</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/mit-krb5" auto="yes" arch="*">
+      <unaffected range="ge">1.3.3-r1</unaffected>
+      <vulnerable range="le">1.3.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    mit-krb5 is the free implementation of the Kerberos network authentication
+    protocol by the Massachusetts Institute of Technology.
+    </p>
+  </background>
+  <description>
+    <p>
+    The library function krb5_aname_to_localname() contains multiple buffer
+    overflows. This is only exploitable if explicit mapping or rules-based
+    mapping is enabled. These are not enabled as default.
+    </p>
+    <p>
+    With explicit mapping enabled, an attacker must authenticate using a
+    principal name listed in the explicit mapping list.
+    </p>
+    <p>
+    With rules-based mapping enabled, an attacker must first be able to create
+    arbitrary principal names either in the local realm Kerberos realm or in a
+    remote realm from which the local realm's service are reachable by
+    cross-realm authentication.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could use these vulnerabilities to execute arbitrary code with
+    the permissions of the user running mit-krb5, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    mit-krb5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-crypt/mit-krb5-1.3.3-r1"
+    # emerge ">=app-crypt/mit-krb5-1.3.3-r1"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0523">CAN-2004-0523</uri>
+    <uri link="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-001-an_to_ln.txt">MIT krb5 Security Advisory</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200406-22.xml b/xml/htdocs/security/en/glsa/glsa-200406-22.xml
new file mode 100644
index 00000000..f70e3694
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200406-22.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200406-22">
+  <title>Pavuk: Remote buffer overflow</title>
+  <synopsis>
+    Pavuk contains a bug potentially allowing an attacker to run arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">Pavuk</product>
+  <announced>June 30, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/pavuk" auto="yes" arch="*">
+      <unaffected range="ge">0.9.28-r2</unaffected>
+      <vulnerable range="le">0.9.28-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Pavuk is web spider and website mirroring tool.
+    </p>
+  </background>
+  <description>
+    <p>
+    When Pavuk connects to a web server and the server sends back the HTTP
+    status code 305 (Use Proxy), Pavuk copies data from the HTTP Location
+    header in an unsafe manner.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could cause a stack-based buffer overflow which could lead
+    to arbitrary code execution with the rights of the user running Pavuk.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Pavuk users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-misc/pavuk-0.9.28-r2&quot;
+    # emerge &quot;&gt;=&quot;net-misc/pavuk-0.9.28-r2</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0456">CVE-2004-0456</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-01.xml b/xml/htdocs/security/en/glsa/glsa-200407-01.xml
new file mode 100644
index 00000000..fef7a809
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-01.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-01">
+  <title>Esearch: Insecure temp file handling</title>
+  <synopsis>
+    The eupdatedb utility in esearch creates a file in /tmp without first
+    checking for symlinks. This makes it possible for any user to create
+    arbitrary files.
+  </synopsis>
+  <product type="ebuild">esearch</product>
+  <announced>July 01, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>55424</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-portage/esearch" auto="yes" arch="*">
+      <unaffected range="ge">0.6.2</unaffected>
+      <vulnerable range="le">0.6.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Esearch is a replacement for the Portage command "emerge search". It
+    uses an index to speed up searching of the Portage tree.
+    </p>
+  </background>
+  <description>
+    <p>
+    The eupdatedb utility uses a temporary file (/tmp/esearchdb.py.tmp) to
+    indicate that the eupdatedb process is running. When run, eupdatedb
+    checks to see if this file exists, but it does not check to see if it
+    is a broken symlink. In the event that the file is a broken symlink,
+    the script will create the file pointed to by the symlink, instead of
+    printing an error and exiting.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could create a symlink from /tmp/esearchdb.py.tmp to a
+    nonexistent file (such as /etc/nologin), and the file will be created
+    the next time esearchdb is run.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users should upgrade to
+    the latest available version of esearch.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the latest available version of esearch, as
+    follows:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=app-portage/esearch-0.6.2&quot;
+    # emerge &quot;&gt;=app-portage/esearch-0.6.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0655">CVE-2004-0655</uri>
+  </references>
+  <metadata tag="submitter">
+    condordes
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-02.xml b/xml/htdocs/security/en/glsa/glsa-200407-02.xml
new file mode 100644
index 00000000..51b29dff
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-02.xml
@@ -0,0 +1,320 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-02">
+  <title>Linux Kernel: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been found in the Linux kernel used by
+    GNU/Linux systems. Patched, or updated versions of these kernels have been
+    released and details are included in this advisory.
+  </synopsis>
+  <product type="ebuild">Kernel</product>
+  <announced>July 03, 2004</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>47881</bug>
+  <bug>49637</bug>
+  <bug>53804</bug>
+  <bug>54976</bug>
+  <bug>55698</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-kernel/aa-sources" auto="no" arch="*">
+      <unaffected range="eq">2.4.23-r2</unaffected>
+      <vulnerable range="lt">2.4.23-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/alpha-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.21-r8</unaffected>
+      <vulnerable range="lt">2.4.21-r8</vulnerable>
+    </package>
+    <package name="sys-kernel/ck-sources" auto="no" arch="*">
+      <unaffected range="eq">2.4.26-r1</unaffected>
+      <unaffected range="ge">2.6.7-r1</unaffected>
+      <vulnerable range="lt">2.6.7-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/compaq-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.9.32.7-r7</unaffected>
+      <vulnerable range="lt">2.4.9.32.7-r7</vulnerable>
+    </package>
+    <package name="sys-kernel/development-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7</unaffected>
+      <vulnerable range="lt">2.6.7</vulnerable>
+    </package>
+    <package name="sys-kernel/gaming-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.20-r14</unaffected>
+      <vulnerable range="lt">2.4.20-r14</vulnerable>
+    </package>
+    <package name="sys-kernel/gentoo-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7</unaffected>
+      <vulnerable range="lt">2.6.7</vulnerable>
+    </package>
+    <package name="sys-kernel/gentoo-sources" auto="yes" arch="*">
+      <unaffected range="rge">2.4.19-r17</unaffected>
+      <unaffected range="rge">2.4.20-r20</unaffected>
+      <unaffected range="rge">2.4.22-r12</unaffected>
+      <unaffected range="rge">2.4.25-r5</unaffected>
+      <unaffected range="ge">2.4.26-r3</unaffected>
+      <vulnerable range="lt">2.4.26-r3</vulnerable>
+    </package>
+    <package name="sys-kernel/grsec-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26.2.0-r5</unaffected>
+      <vulnerable range="lt">2.4.26.2.0-r5</vulnerable>
+    </package>
+    <package name="sys-kernel/gs-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.25_pre7-r7</unaffected>
+      <vulnerable range="lt">2.4.25_pre7-r7</vulnerable>
+    </package>
+    <package name="sys-kernel/hardened-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7</unaffected>
+      <vulnerable range="lt">2.6.7</vulnerable>
+    </package>
+    <package name="sys-kernel/hardened-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26-r2</unaffected>
+      <vulnerable range="lt">2.4.26-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/hppa-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7</unaffected>
+      <vulnerable range="lt">2.6.7</vulnerable>
+    </package>
+    <package name="sys-kernel/hppa-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26_p6</unaffected>
+      <vulnerable range="lt">2.4.26_p6</vulnerable>
+    </package>
+    <package name="sys-kernel/ia64-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.24-r5</unaffected>
+      <vulnerable range="lt">2.4.24-r5</vulnerable>
+    </package>
+    <package name="sys-kernel/mips-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26-r3</unaffected>
+      <vulnerable range="lt">2.4.26-r3</vulnerable>
+    </package>
+    <package name="sys-kernel/mm-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7-r1</unaffected>
+      <vulnerable range="lt">2.6.7-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/openmosix-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.22-r10</unaffected>
+      <vulnerable range="lt">2.4.22-r10</vulnerable>
+    </package>
+    <package name="sys-kernel/pac-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.23-r8</unaffected>
+      <vulnerable range="lt">2.4.23-r8</vulnerable>
+    </package>
+    <package name="sys-kernel/pegasos-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7</unaffected>
+      <vulnerable range="lt">2.6.7</vulnerable>
+    </package>
+    <package name="sys-kernel/pegasos-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26-r2</unaffected>
+      <vulnerable range="lt">2.4.26-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/planet-ccrma-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.21-r10</unaffected>
+      <vulnerable range="lt">2.4.21-r10</vulnerable>
+    </package>
+    <package name="sys-kernel/ppc-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26-r2</unaffected>
+      <vulnerable range="lt">2.4.26-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/ppc64-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7</unaffected>
+      <vulnerable range="lt">2.6.7</vulnerable>
+    </package>
+    <package name="sys-kernel/rsbac-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26-r2</unaffected>
+      <vulnerable range="lt">2.4.26-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/rsbac-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7-r1</unaffected>
+      <vulnerable range="lt">2.6.7-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/selinux-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26-r2</unaffected>
+      <vulnerable range="lt">2.4.26-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/sparc-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26-r2</unaffected>
+      <vulnerable range="lt">2.4.26-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/uclinux-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26_p0-r2</unaffected>
+      <vulnerable range="lt">2.4.26_p0-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/usermode-sources" auto="yes" arch="*">
+      <unaffected range="rge">2.4.24-r5</unaffected>
+      <unaffected range="ge">2.4.26-r2</unaffected>
+      <vulnerable range="lt">2.4.26-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/vserver-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26.1.3.9-r2</unaffected>
+      <vulnerable range="lt">2.4.26.1.3.9-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/win4lin-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26-r2</unaffected>
+      <vulnerable range="lt">2.4.26-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/wolk-sources" auto="yes" arch="*">
+      <unaffected range="rge">4.9-r9</unaffected>
+      <unaffected range="rge">4.11-r6</unaffected>
+      <unaffected range="ge">4.14-r3</unaffected>
+      <vulnerable range="lt">4.14-r3</vulnerable>
+    </package>
+    <package name="sys-kernel/xbox-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7</unaffected>
+      <vulnerable range="lt">2.6.7</vulnerable>
+    </package>
+    <package name="sys-kernel/xfs-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.24-r8</unaffected>
+      <vulnerable range="lt">2.4.24-r8</vulnerable>
+    </package>
+    <package name="sys-kernel/vanilla-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.27</unaffected>
+      <vulnerable range="le">2.4.26</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Linux kernel is responsible for managing the core aspects of a
+    GNU/Linux system, providing an interface for core system applications
+    as well as providing the essential structure and capability to access
+    hardware that is needed for a running system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple flaws have been discovered in the Linux kernel. This advisory
+    corrects the following issues:
+    </p>
+    <ul>
+    <li>
+    CAN-2004-0109: This vulnerability allows privilege escalation using
+    ISO9660 file systems through a buffer overflow via a malformed file
+    system containing a long symbolic link entry. This can allow arbitrary
+    code execution at kernel level.
+    </li>
+    <li>
+    CAN-2004-0133: The XFS file system in 2.4 series kernels has an
+    information leak by which data in the memory can be written to the
+    device hosting the file system, allowing users to obtain portions of
+    kernel memory by reading the raw block device.
+    </li>
+    <li>
+    CAN-2004-0177: The ext3 file system in 2.4 series kernels does not
+    properly initialize journal descriptor blocks, causing an information
+    leak by which data in the memory can be written to the device hosting
+    the file system, allowing users to obtain portions of kernel memory by
+    reading the raw device.
+    </li>
+    <li>
+    CAN-2004-0181: The JFS file system in 2.4 series kernels has an
+    information leak by which data in the memory can be written to the
+    device hosting the file system, allowing users to obtain portions of
+    kernel memory by reading the raw device.
+    </li>
+    <li>
+    CAN-2004-0178: The OSS Sound Blaster [R] Driver has a Denial of Service
+    vulnerability since it does not handle certain sample sizes properly.
+    This allows local users to hang the kernel.
+    </li>
+    <li>
+    CAN-2004-0228: Due to an integer signedness error in the CPUFreq /proc
+    handler code in 2.6 series Linux kernels, local users can escalate
+    their privileges.
+    </li>
+    <li>
+    CAN-2004-0229: The framebuffer driver in 2.6 series kernel drivers does
+    not use the fb_copy_cmap method of copying structures. The impact of
+    this issue is unknown, however.
+    </li>
+    <li>
+    CAN-2004-0394: A buffer overflow in the panic() function of 2.4 series
+    Linux kernels exists, but it may not be exploitable under normal
+    circumstances due to its functionality.
+    </li>
+    <li>
+    CAN-2004-0427: The do_fork() function in both 2.4 and 2.6 series Linux
+    kernels does not properly decrement the mm_count counter when an error
+    occurs, triggering a memory leak that allows local users to cause a
+    Denial of Service by exhausting other applications of memory; causing
+    the kernel to panic or to kill services.
+    </li>
+    <li>
+    CAN-2004-0495: Multiple vulnerabilities found by the Sparse source
+    checker in the kernel allow local users to escalate their privileges or
+    gain access to kernel memory.
+    </li>
+    <li>
+    CAN-2004-0535: The e1000 NIC driver does not properly initialize memory
+    structures before using them, allowing users to read kernel memory.
+    </li>
+    <li>
+    CAN-2004-0554: 2.4 and 2.6 series kernels running on an x86 or an AMD64
+    architecture allow local users to cause a Denial of Service by a total
+    system hang, due to an infinite loop that triggers a signal handler
+    with a certain sequence of fsave and frstor instructions.
+    </li>
+    <li>
+    Local DoS in PaX: If ASLR is enabled as a GRSecurity PaX feature, a
+    Denial of Service can be achieved by putting the kernel into an
+    infinite loop. Only 2.6 series GRSecurity kernels are affected by this
+    issue.
+    </li>
+    <li>
+    RSBAC 1.2.3 JAIL issues: A flaw in the RSBAC JAIL implementation allows
+    suid/sgid files to be created inside the jail since the relevant module
+    does not check the corresponding mode values. This can allow privilege
+    escalation inside the jail. Only rsbac-(dev-)sources are affected by
+    this issue.
+    </li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    Arbitrary code with normal non-super-user privileges may be able to
+    exploit any of these vulnerabilities; gaining kernel level access to
+    memory structures and hardware devices. This may be used for further
+    exploitation of the system, to leak sensitive data or to cause a Denial
+    of Service on the affected kernel.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Although users may not be affected by certain vulnerabilities, all
+    kernels are affected by the CAN-2004-0394, CAN-2004-0427 and
+    CAN-2004-0554 issues which have no workaround. As a result, all users
+    are urged to upgrade their kernels to patched versions.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Users are encouraged to upgrade to the latest available sources for
+    their system:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv your-favorite-sources
+    # emerge your-favorite-sources
+    
+    # # Follow usual procedure for compiling and installing a kernel.
+    # # If you use genkernel, run genkernel as you would do normally.</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0109">CVE-2004-0109</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0133">CVE-2004-0133</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0177">CVE-2004-0177</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0178">CVE-2004-0178</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0181">CVE-2004-0181</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0228">CVE-2004-0228</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0229">CVE-2004-0229</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0394">CVE-2004-0394</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0427">CVE-2004-0427</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0495">CVE-2004-0495</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0535">CVE-2004-0535</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0554">CVE-2004-0554</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1983">CVE-2004-1983</uri>
+  </references>
+  <metadata tag="submitter">
+    plasmaroo
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-03.xml b/xml/htdocs/security/en/glsa/glsa-200407-03.xml
new file mode 100644
index 00000000..932c6b44
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-03.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-03">
+  <title>Apache 2: Remote denial of service attack</title>
+  <synopsis>
+    A bug in Apache may allow a remote attacker to perform a Denial of Service
+    attack. With certain configurations this could lead to a heap based buffer
+    overflow.
+  </synopsis>
+  <product type="ebuild">Apache</product>
+  <announced>July 04, 2004</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>55441</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="ge">2.0.49-r4</unaffected>
+      <unaffected range="lt">2</unaffected>
+      <vulnerable range="le">2.0.49-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP Server Project is an effort to develop and maintain an
+    open-source HTTP server for modern operating systems. The goal of this
+    project is to provide a secure, efficient and extensible server that
+    provides services in tune with the current HTTP standards.
+    </p>
+  </background>
+  <description>
+    <p>
+    A bug in the protocol.c file handling header lines will cause Apache to
+    allocate memory for header lines starting with TAB or SPACE.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker can exploit this vulnerability to perform a Denial of Service
+    attack by causing Apache to exhaust all memory. On 64 bit systems with more
+    than 4GB of virtual memory a possible integer signedness error could lead
+    to a buffer based overflow causing Apache to crash and under some
+    circumstances execute arbitrary code as the user running Apache, usually
+    "apache".
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version:
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Apache 2 users should upgrade to the latest version of Apache:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=www-servers/apache-2.0.49-r4"
+    # emerge ">=www-servers/apache-2.0.49-r4"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.guninski.com/httpd1.html">Georgi Guninski security advisory #70, 2004</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0493">CAN-2004-0493</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-04.xml b/xml/htdocs/security/en/glsa/glsa-200407-04.xml
new file mode 100644
index 00000000..9598b0ef
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-04.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-04">
+  <title>Pure-FTPd: Potential DoS when maximum connections is reached</title>
+  <synopsis>
+    Pure-FTPd contains a bug potentially allowing a Denial of Service attack
+    when the maximum number of connections is reached.
+  </synopsis>
+  <product type="ebuild">Pure-FTPd</product>
+  <announced>July 04, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>54590</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-ftp/pure-ftpd" auto="yes" arch="*">
+      <unaffected range="ge">1.0.18-r1</unaffected>
+      <vulnerable range="le">1.0.18</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Pure-FTPd is a fast, production-quality and standards-compliant FTP
+    server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Pure-FTPd contains a bug in the accept_client function handling the
+    setup of new connections.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    When the maximum number of connections is reached an attacker could
+    exploit this vulnerability to perform a Denial of Service attack.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Pure-FTPd users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-ftp/pure-ftpd-1.0.18-r1&quot;
+    # emerge &quot;&gt;=net-ftp/pure-ftpd-1.0.18-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.pureftpd.org">Pure-FTPd website</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0656">CVE-2004-0656</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-05.xml b/xml/htdocs/security/en/glsa/glsa-200407-05.xml
new file mode 100644
index 00000000..c8adc33a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-05.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-05">
+  <title>XFree86, X.org: XDM ignores requestPort setting</title>
+  <synopsis>
+    XDM will open TCP sockets for its chooser, even if the
+    DisplayManager.requestPort setting is set to 0. This may allow authorized
+    users to access a machine remotely via X, even if the administrator has
+    configured XDM to refuse such connections.
+  </synopsis>
+  <product type="ebuild">xdm</product>
+  <announced>July 05, 2004</announced>
+  <revised>July 05, 2004: 01</revised>
+  <bug>53226</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-base/xfree" auto="yes" arch="*">
+      <unaffected range="ge">4.3.0-r6</unaffected>
+      <vulnerable range="le">4.3.0-r5</vulnerable>
+    </package>
+    <package name="x11-base/xorg-x11" auto="yes" arch="*">
+      <unaffected range="ge">6.7.0-r1</unaffected>
+      <vulnerable range="le">6.7.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The X Display Manager (XDM) is a program which provides a graphical login
+    prompt to users on the console or on remote X terminals. It has largely
+    been superseded by programs such as GDM and KDM.
+    </p>
+  </background>
+  <description>
+    <p>
+    XDM will open TCP sockets for its chooser, even if the
+    DisplayManager.requestPort setting is set to 0. Remote clients can use this
+    port to connect to XDM and request a login window, thus allowing access to
+    the system.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    Authorized users may be able to login remotely to a machine running XDM,
+    even if this option is disabled in XDM's configuration. Please note that an
+    attacker must have a preexisting account on the machine in order to exploit
+    this vulnerability.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users should upgrade to the
+    latest available version of X.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    If you are using XFree86, you should run the following:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=x11-base/xfree-4.3.0-r6"
+    # emerge ">=x11-base/xfree-4.3.0-r6"</code>
+    <p>
+    If you are using X.org's X11 server, you should run the following:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=x11-base/xorg-x11-6.7.0-r1"
+    # emerge ">=x11-base/xorg-x11-6.7.0-r1"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0419">CAN 2004-0419</uri>
+    <uri link="http://bugs.xfree86.org/show_bug.cgi?id=1376">XFree86 Bug</uri>
+  </references>
+  <metadata tag="submitter">
+    condordes
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-06.xml b/xml/htdocs/security/en/glsa/glsa-200407-06.xml
new file mode 100644
index 00000000..bccd352d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-06.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-06">
+  <title>libpng: Buffer overflow on row buffers</title>
+  <synopsis>
+    libpng contains a buffer overflow vulnerability potentially allowing an
+    attacker to perform a Denial of Service attack or even execute arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">libpng</product>
+  <announced>July 08, 2004</announced>
+  <revised>July 08, 2004: 01</revised>
+  <bug>56307</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libpng" auto="yes" arch="*">
+      <unaffected range="ge">1.2.5-r7</unaffected>
+      <vulnerable range="le">1.2.5-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libpng is a standard library used to process PNG (Portable Network
+    Graphics) images. It is used by several other programs, including web
+    browsers and potentially server processes.
+    </p>
+  </background>
+  <description>
+    <p>
+    Due to a wrong calculation of loop offset values, libpng contains a buffer
+    overflow vulnerability on the row buffers. This vulnerability was initially
+    patched in January 2003 but since it has been discovered that libpng
+    contains the same vulnerability in two other places.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit this vulnerability to cause programs linked
+    against the library to crash or execute arbitrary code with the permissions
+    of the user running the vulnerable program, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libpng users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=media-libs/libpng-1.2.5-r7"
+    # emerge ">=media-libs/libpng-1.2.5-r7"</code>
+    <p>
+    You should also run revdep-rebuild to rebuild any packages that depend on
+    older versions of libpng :
+    </p>
+    <code>
+    # revdep-rebuild</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1363">CAN-2002-1363</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-07.xml b/xml/htdocs/security/en/glsa/glsa-200407-07.xml
new file mode 100644
index 00000000..8057469c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-07.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-07">
+  <title>Shorewall : Insecure temp file handling</title>
+  <synopsis>
+    Shorewall contains a bug in the code handling the creation of temporary
+    files and directories. This can allow a non-root user to overwrite
+    arbitrary system files.
+  </synopsis>
+  <product type="ebuild">Shorewall</product>
+  <announced>July 08, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>55675</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-firewall/shorewall" auto="yes" arch="*">
+      <unaffected range="ge">1.4.10f</unaffected>
+      <vulnerable range="le">1.4.10c</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Shorewall is a high level tool for configuring Netfilter, the firewall
+    facility included in the Linux Kernel.
+    </p>
+  </background>
+  <description>
+    <p>
+    Shorewall uses temporary files and directories in an insecure manner. A
+    local user could create symbolic links at specific locations,
+    eventually overwriting other files on the filesystem with the rights of
+    the shorewall process.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit this vulnerability to overwrite arbitrary
+    system files with root privileges, resulting in Denial of Service or
+    further exploitation.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users should upgrade to
+    the latest available version of Shorewall.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the latest available version of Shorewall,
+    as follows:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-firewall/shorewall-1.4.10f&quot;
+    # emerge &quot;&gt;=net-firewall/shorewall-1.4.10f&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://lists.shorewall.net/pipermail/shorewall-announce/2004-June/000385.html">Shorewall Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0647">CVE-2004-0647</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-08.xml b/xml/htdocs/security/en/glsa/glsa-200407-08.xml
new file mode 100644
index 00000000..4ae3df7e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-08.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-08">
+  <title>Ethereal: Multiple security problems</title>
+  <synopsis>
+    Multiple vulnerabilities including one buffer overflow exist in Ethereal,
+    which may allow an attacker to run arbitrary code or crash the program.
+  </synopsis>
+  <product type="ebuild">Ethereal</product>
+  <announced>July 09, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>56423</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/ethereal" auto="yes" arch="*">
+      <unaffected range="ge">0.10.5</unaffected>
+      <vulnerable range="le">0.10.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ethereal is a feature rich network protocol analyzer.
+    </p>
+  </background>
+  <description>
+    <p>
+    There are multiple vulnerabilities in versions of Ethereal earlier than
+    0.10.5, including:
+    </p>
+    <ul>
+    <li>In some cases the iSNS dissector could cause Ethereal to
+    abort.</li>
+    <li>If there was no policy name for a handle for SMB SID snooping it
+    could cause a crash.</li>
+    <li>A malformed or missing community string could cause the SNMP
+    dissector to crash.</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could use these vulnerabilities to crash Ethereal or even
+    execute arbitrary code with the permissions of the user running
+    Ethereal, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    For a temporary workaround you can disable all affected protocol
+    dissectors by selecting Analyze->Enabled Protocols... and deselecting
+    them from the list. For SMB you can disable SID snooping in the SMB
+    protocol preference. However, it is strongly recommended to upgrade to
+    the latest stable version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ethereal users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-analyzer/ethereal-0.10.5&quot;
+    # emerge &quot;&gt;=net-analyzer/ethereal-0.10.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.ethereal.com/appnotes/enpa-sa-00015.html">Ethereal enpa-sa-00015</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0633">CVE-2004-0633</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0634">CVE-2004-0634</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0635">CVE-2004-0635</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-09.xml b/xml/htdocs/security/en/glsa/glsa-200407-09.xml
new file mode 100644
index 00000000..35400e32
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-09.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-09">
+  <title>MoinMoin: Group ACL bypass</title>
+  <synopsis>
+    MoinMoin contains a bug allowing a user to bypass group ACLs (Access
+    Control Lists).
+  </synopsis>
+  <product type="ebuild">MoinMoin</product>
+  <announced>July 11, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>53126</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/moinmoin" auto="yes" arch="*">
+      <unaffected range="ge">1.2.2</unaffected>
+      <vulnerable range="le">1.2.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MoinMoin is a Python clone of WikiWiki, based on PikiPiki.
+    </p>
+  </background>
+  <description>
+    <p>
+    MoinMoin contains a bug in the code handling administrative group ACLs.
+    A user created with the same name as an administrative group gains the
+    privileges of the administrative group.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    If an administrative group called AdminGroup existed an attacker could
+    create a user called AdminGroup and gain the privileges of the group
+    AdminGroup. This could lead to unauthorized users gaining
+    administrative access.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    For every administrative group with special privileges create a user
+    with the same name as the group.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the latest available version of MoinMoin,
+    as follows:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=www-apps/moinmoin-1.2.2&quot;
+    # emerge &quot;&gt;=www-apps/moinmoin-1.2.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://sourceforge.net/tracker/index.php?func=detail&amp;aid=948103&amp;group_id=8482&amp;atid=108482">MoinMoin Announcement</uri>
+    <uri link="http://www.osvdb.org/6704">OSVDB Entry</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0708">CVE-2004-0708</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-10.xml b/xml/htdocs/security/en/glsa/glsa-200407-10.xml
new file mode 100644
index 00000000..afef1cb3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-10.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-10">
+  <title>rsync: Directory traversal in rsync daemon</title>
+  <synopsis>
+    Under specific conditions, the rsync daemon is vulnerable to a directory
+    traversal allowing to write files outside a sync module.
+  </synopsis>
+  <product type="ebuild">rsync</product>
+  <announced>July 12, 2004</announced>
+  <revised>July 12, 2004: 01</revised>
+  <bug>49534</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/rsync" auto="yes" arch="*">
+      <unaffected range="ge">2.6.0-r2</unaffected>
+      <vulnerable range="le">2.6.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    rsync is a utility that provides fast incremental file transfers. It is
+    used to efficiently synchronize files between hosts and is used by emerge
+    to fetch Gentoo's Portage tree. rsyncd is the rsync daemon, which listens
+    to connections from rsync clients.
+    </p>
+  </background>
+  <description>
+    <p>
+    When rsyncd is used without chroot ("use chroot = false" in the rsyncd.conf
+    file), the paths sent by the client are not checked thoroughly enough. If
+    rsyncd is used with read-write permissions ("read only = false"), this
+    vulnerability can be used to write files anywhere with the rights of the
+    rsyncd daemon. With default Gentoo installations, rsyncd runs in a chroot,
+    without write permissions and with the rights of the "nobody" user.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    On affected configurations and if the rsync daemon runs under a privileged
+    user, a remote client can exploit this vulnerability to completely
+    compromise the host.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    You should never set the rsync daemon to run with "use chroot = false". If
+    for some reason you have to run rsyncd without a chroot, then you should
+    not set "read only = false".
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should update to the latest version of the rsync package.
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-misc/rsync-2.6.0-r2"
+    # emerge ">=net-misc/rsync-2.6.0-r2"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0426">CAN-2004-0426</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-11.xml b/xml/htdocs/security/en/glsa/glsa-200407-11.xml
new file mode 100644
index 00000000..236f03da
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-11.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-11">
+  <title>wv: Buffer overflow vulnerability</title>
+  <synopsis>
+    A buffer overflow vulnerability exists in the wv library that can allow an
+    attacker to execute arbitrary code with the privileges of the user running
+    the vulnerable application.
+  </synopsis>
+  <product type="ebuild">app-text/wv</product>
+  <announced>July 14, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>56595</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/wv" auto="yes" arch="*">
+      <unaffected range="ge">1.0.0-r1</unaffected>
+      <vulnerable range="lt">1.0.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The wv library allows access to MS Word files. It can parse Word files
+    and allow other applications, such as abiword, to import those files
+    into their native formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    A use of strcat without proper bounds checking leads to an exploitable
+    buffer overflow. The vulnerable code is executed when wv encounters an
+    unrecognized token, so a specially crafted file, loaded in wv, can
+    trigger the vulnerable code and execute it's own arbitrary code. This
+    exploit is only possible when the user loads the document into HTML
+    view mode.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By inducing a user into running wv on a special file, an attacker can
+    execute arbitrary code with the permissions of the user running the
+    vulnerable program.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Users should not view untrusted documents with wvHtml or applications
+    using wv. When loading an untrusted document in an application using
+    the wv library, make sure HTML view is disabled.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the latest available version.
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=app-text/wv-1.0.0-r1&quot;
+    # emerge &quot;&gt;=app-text/wv-1.0.0-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.idefense.com/application/poi/display?id=115&amp;type=vulnerabilities&amp;flashstatus=true">iDEFENSE Security Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0645">CVE-2004-0645</uri>
+  </references>
+  <metadata tag="submitter">
+    dmargoli
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-12.xml b/xml/htdocs/security/en/glsa/glsa-200407-12.xml
new file mode 100644
index 00000000..ec83f446
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-12.xml
@@ -0,0 +1,135 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-12">
+  <title>Linux Kernel: Remote DoS vulnerability with IPTables TCP Handling</title>
+  <synopsis>
+    A flaw has been discovered in 2.6 series Linux kernels that allows an
+    attacker to send a malformed TCP packet, causing the affected kernel to
+    possibly enter an infinite loop and hang the vulnerable machine.
+  </synopsis>
+  <product type="ebuild">Kernel</product>
+  <announced>July 14, 2004</announced>
+  <revised>October 10, 2004: 02</revised>
+  <bug>55694</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-kernel/aa-sources" auto="no" arch="*">
+      <unaffected range="ge">2.6.5-r5</unaffected>
+      <unaffected range="lt">2.6</unaffected>
+      <vulnerable range="lt">2.6.5-r5</vulnerable>
+    </package>
+    <package name="sys-kernel/ck-sources" auto="no" arch="*">
+      <unaffected range="ge">2.6.7-r2</unaffected>
+      <unaffected range="lt">2.6</unaffected>
+      <vulnerable range="lt">2.6.7-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/development-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.8</unaffected>
+      <vulnerable range="lt">2.6.8</vulnerable>
+    </package>
+    <package name="sys-kernel/gentoo-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7-r7</unaffected>
+      <vulnerable range="lt">2.6.7-r7</vulnerable>
+    </package>
+    <package name="sys-kernel/hardened-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7-r1</unaffected>
+      <vulnerable range="lt">2.6.7-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/hppa-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7_p1-r1</unaffected>
+      <vulnerable range="lt">2.6.7_p1-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/mips-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.4-r4</unaffected>
+      <unaffected range="lt">2.6</unaffected>
+      <vulnerable range="lt">2.6.4-r4</vulnerable>
+    </package>
+    <package name="sys-kernel/mm-sources" auto="no" arch="*">
+      <unaffected range="ge">2.6.7-r4</unaffected>
+      <unaffected range="lt">2.6</unaffected>
+      <vulnerable range="lt">2.6.7-r4</vulnerable>
+    </package>
+    <package name="sys-kernel/pegasos-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7-r1</unaffected>
+      <vulnerable range="lt">2.6.7-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/rsbac-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7-r1</unaffected>
+      <vulnerable range="lt">2.6.7-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/uclinux-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7_p0-r1</unaffected>
+      <unaffected range="lt">2.6</unaffected>
+      <vulnerable range="lt">2.6.7_p0</vulnerable>
+    </package>
+    <package name="sys-kernel/usermode-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.6-r2</unaffected>
+      <unaffected range="lt">2.6</unaffected>
+      <vulnerable range="lt">2.6.6-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/win4lin-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7-r1</unaffected>
+      <unaffected range="lt">2.6</unaffected>
+      <vulnerable range="lt">2.6.7-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/xbox-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7-r1</unaffected>
+      <unaffected range="lt">2.6</unaffected>
+      <vulnerable range="lt">2.6.7-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Linux kernel is responsible for managing the core aspects of a
+    GNU/Linux system, providing an interface for core system applications as
+    well as providing the essential structure and capability to access hardware
+    that is needed for a running system.
+    </p>
+  </background>
+  <description>
+    <p>
+    An attacker can utilize an erroneous data type in the IPTables TCP option
+    handling code, which lies in an iterator. By making a TCP packet with a
+    header length larger than 127 bytes, a negative integer would be implied in
+    the iterator.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By sending one malformed packet, the kernel could get stuck in a loop,
+    consuming all of the CPU resources and rendering the machine useless,
+    causing a Denial of Service. This vulnerability requires no local access.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    If users do not use the netfilter functionality or do not use any
+    ``--tcp-option'' rules they are not vulnerable to this exploit. Users that
+    are may remove netfilter support from their kernel or may remove any
+    ``--tcp-option'' rules they might be using. However, all users are urged to
+    upgrade their kernels to patched versions.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Users are encouraged to upgrade to the latest available sources for their
+    system:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv your-favorite-sources
+    # emerge your-favorite-sources
+
+    # # Follow usual procedure for compiling and installing a kernel.
+    # # If you use genkernel, run genkernel as you would do normally.</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0626">CAN-2004-0626</uri>
+  </references>
+  <metadata tag="submitter">
+    plasmaroo
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-13.xml b/xml/htdocs/security/en/glsa/glsa-200407-13.xml
new file mode 100644
index 00000000..2bd83e99
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-13.xml
@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-13">
+  <title>PHP: Multiple security vulnerabilities</title>
+  <synopsis>
+    Multiple security vulnerabilities, potentially allowing remote code
+    execution, were found and fixed in PHP.
+  </synopsis>
+  <product type="ebuild">PHP</product>
+  <announced>July 15, 2004</announced>
+  <revised>July 15, 2004: 01</revised>
+  <bug>56985</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-php/php" auto="yes" arch="*">
+      <unaffected range="ge">4.3.8</unaffected>
+      <vulnerable range="le">4.3.7-r1</vulnerable>
+    </package>
+    <package name="dev-php/mod_php" auto="yes" arch="*">
+      <unaffected range="ge">4.3.8</unaffected>
+      <vulnerable range="le">4.3.7-r1</vulnerable>
+    </package>
+    <package name="dev-php/php-cgi" auto="yes" arch="*">
+      <unaffected range="ge">4.3.8</unaffected>
+      <vulnerable range="le">4.3.7-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHP is a general-purpose scripting language widely used to develop
+    web-based applications. It can run inside a web server using the mod_php
+    module or the CGI version of PHP, or can run stand-alone in a CLI.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several security vulnerabilities were found and fixed in version 4.3.8 of
+    PHP. The strip_tags() function, used to sanitize user input, could in
+    certain cases allow tags containing \0 characters (CAN-2004-0595). When
+    memory_limit is used, PHP might unsafely interrupt other functions
+    (CAN-2004-0594). The ftok and itpc functions were missing safe_mode checks.
+    It was possible to bypass open_basedir restrictions using MySQL's LOAD DATA
+    LOCAL function. Furthermore, the IMAP extension was incorrectly allocating
+    memory and alloca() calls were replaced with emalloc() for better stack
+    protection.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Successfully exploited, the memory_limit problem could allow remote
+    excution of arbitrary code. By exploiting the strip_tags vulnerability, it
+    is possible to pass HTML code that would be considered as valid tags by the
+    Microsoft Internet Explorer and Safari browsers. Using ftok, itpc or
+    MySQL's LOAD DATA LOCAL, it is possible to bypass PHP configuration
+    restrictions.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround that would solve all these problems. All users
+    are encouraged to upgrade to the latest available versions.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHP, mod_php and php-cgi users should upgrade to the latest stable
+    version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=dev-php/php-4.3.8"
+    # emerge ">=dev-php/php-4.3.8"
+
+    # emerge -pv ">=dev-php/mod_php-4.3.8"
+    # emerge ">=dev-php/mod_php-4.3.8"
+
+    # emerge -pv ">=dev-php/php-cgi-4.3.8"
+    # emerge ">=dev-php/php-cgi-4.3.8"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0594">CAN-2004-0594</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0595">CAN-2004-0595</uri>
+    <uri link="http://security.e-matters.de/advisories/112004.html">E-Matters Advisory 11/2004</uri>
+    <uri link="http://security.e-matters.de/advisories/122004.html">E-Matters Advisory 12/2004</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-14.xml b/xml/htdocs/security/en/glsa/glsa-200407-14.xml
new file mode 100644
index 00000000..b5ee6e93
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-14.xml
@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-14">
+  <title>Unreal Tournament 2003/2004: Buffer overflow in 'secure' queries</title>
+  <synopsis>
+    Game servers based on the Unreal engine are vulnerable to remote code
+    execution through malformed 'secure' queries.
+  </synopsis>
+  <product type="ebuild">Unreal Tournament</product>
+  <announced>July 19, 2004</announced>
+  <revised>July 19, 2004: 01</revised>
+  <bug>54726</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-fps/ut2003" auto="yes" arch="*">
+      <unaffected range="ge">2225-r3</unaffected>
+      <vulnerable range="le">2225-r2</vulnerable>
+    </package>
+    <package name="games-server/ut2003-ded" auto="yes" arch="*">
+      <unaffected range="ge">2225-r2</unaffected>
+      <vulnerable range="le">2225-r1</vulnerable>
+    </package>
+    <package name="games-fps/ut2004" auto="yes" arch="*">
+      <unaffected range="ge">3236</unaffected>
+      <vulnerable range="lt">3236</vulnerable>
+    </package>
+    <package name="games-fps/ut2004-demo" auto="yes" arch="*">
+      <unaffected range="ge">3120-r4</unaffected>
+      <vulnerable range="le">3120-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Unreal Tournament 2003 and 2004 are popular first-person-shooter games.
+    They are both based on the Unreal engine, and can be used in a game server
+    / client setup.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Unreal-based game servers support a specific type of query called
+    'secure'. Part of the Gamespy protocol, this query is used to ask if the
+    game server is able to calculate an exact response using a provided string.
+    Luigi Auriemma found that sending a long 'secure' query triggers a buffer
+    overflow in the game server.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By sending a malicious UDP-based 'secure' query, an attacker could execute
+    arbitrary code on the game server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Users can avoid this vulnerability by not using Unreal Tournament to host
+    games as a server. All users running a server should upgrade to the latest
+    versions.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Unreal Tournament users should upgrade to the latest available
+    versions:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=games-fps/ut2003-2225-r3"
+    # emerge ">=games-fps/ut2003-2225-r3"
+
+    # emerge -pv ">=games-server/ut2003-ded-2225-r2"
+    # emerge ">=games-server/ut2003-ded-2225-r2"
+
+    # emerge -pv ">=games-fps/ut2004-3236"
+    # emerge ">=games-fps/ut2004-3236"
+
+    # emerge -pv ">=games-fps/ut2004-demo-3120-r4"
+    # emerge ">=games-fps/ut2004-demo-3120-r4"</code>
+  </resolution>
+  <references>
+    <uri link="http://aluigi.altervista.org/adv/unsecure-adv.txt">Luigi Auriemma advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0608">CAN-2004-0608</uri>
+  </references>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-15.xml b/xml/htdocs/security/en/glsa/glsa-200407-15.xml
new file mode 100644
index 00000000..93dbc7b2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-15.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-15">
+  <title>Opera: Multiple spoofing vulnerabilities</title>
+  <synopsis>
+    Opera contains three vulnerabilities, allowing an attacker to impersonate
+    legitimate websites with URI obfuscation or to spoof websites with frame
+    injection.
+  </synopsis>
+  <product type="ebuild">opera</product>
+  <announced>July 20, 2004</announced>
+  <revised>July 20, 2004: 01</revised>
+  <bug>56311</bug>
+  <bug>56109</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/opera" auto="yes" arch="*">
+      <unaffected range="ge">7.53</unaffected>
+      <vulnerable range="le">7.52</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Opera is a multi-platform web browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    Opera fails to remove illegal characters from an URI of a link and to check
+    that the target frame of a link belongs to the same website as the link.
+    Opera also updates the address bar before loading a page. Additionally,
+    Opera contains a certificate verification problem.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    These vulnerabilities could allow an attacker to impersonate legitimate
+    websites to steal sensitive information from users. This could be done by
+    obfuscating the real URI of a link or by injecting a malicious frame into
+    an arbitrary frame of another browser window.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Opera users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=www-client/opera-7.53"
+    # emerge ">=www-client/opera-7.53"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/bid/10517">Bugtraq Announcement</uri>
+    <uri link="http://secunia.com/advisories/11978/">Secunia Advisory SA11978</uri>
+    <uri link="http://secunia.com/advisories/12028/">Secunia Advisory SA12028</uri>
+    <uri link="http://www.opera.com/linux/changelogs/753/">Opera Changelog</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-16.xml b/xml/htdocs/security/en/glsa/glsa-200407-16.xml
new file mode 100644
index 00000000..33a29bcd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-16.xml
@@ -0,0 +1,299 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-16">
+  <title>Linux Kernel: Multiple DoS and permission vulnerabilities</title>
+  <synopsis>
+    Multiple permission vulnerabilities have been found in the Linux kernel,
+    allowing an attacker to change the group IDs of files mounted on a remote
+    filesystem (CAN-2004-0497), as well as an issue in 2.6 series kernels which
+    allows /proc permissions to be bypassed. A context sharing vulnerability in
+    vserver-sources is also handled by this advisory as well as CAN-2004-0447,
+    CAN-2004-0496 and CAN-2004-0565. Patched, or updated versions of these
+    kernels have been released and details are included along with this
+    advisory.
+  </synopsis>
+  <product type="ebuild">Kernel</product>
+  <announced>July 22, 2004</announced>
+  <revised>October 29, 2004: 02</revised>
+  <bug>56171</bug>
+  <bug>56479</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-kernel/aa-sources" auto="no" arch="*">
+      <unaffected range="rge">2.4.23-r2</unaffected>
+      <unaffected range="ge">2.6.5-r5</unaffected>
+      <vulnerable range="lt">2.6.5-r5</vulnerable>
+    </package>
+    <package name="sys-kernel/alpha-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.21-r9</unaffected>
+      <vulnerable range="lt">2.4.21-r9</vulnerable>
+    </package>
+    <package name="sys-kernel/ck-sources" auto="no" arch="*">
+      <unaffected range="rge">2.4.26-r1</unaffected>
+      <unaffected range="ge">2.6.7-r5</unaffected>
+      <vulnerable range="lt">2.6.7-r5</vulnerable>
+    </package>
+    <package name="sys-kernel/compaq-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.9.32.7-r8</unaffected>
+      <vulnerable range="lt">2.4.9.32.7-r8</vulnerable>
+    </package>
+    <package name="sys-kernel/development-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.8_rc1</unaffected>
+      <vulnerable range="lt">2.6.8_rc1</vulnerable>
+    </package>
+    <package name="sys-kernel/gentoo-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7-r8</unaffected>
+      <vulnerable range="lt">2.6.7-r8</vulnerable>
+    </package>
+    <package name="sys-kernel/gentoo-sources" auto="yes" arch="*">
+      <unaffected range="rge">2.4.19-r18</unaffected>
+      <unaffected range="rge">2.4.20-r21</unaffected>
+      <unaffected range="rge">2.4.22-r13</unaffected>
+      <unaffected range="rge">2.4.25-r6</unaffected>
+      <unaffected range="ge">2.4.26-r5</unaffected>
+      <vulnerable range="lt">2.4.26-r5</vulnerable>
+    </package>
+    <package name="sys-kernel/grsec-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26.2.0-r6</unaffected>
+      <vulnerable range="lt">2.4.26.2.0-r6</vulnerable>
+    </package>
+    <package name="sys-kernel/gs-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.25_pre7-r8</unaffected>
+      <vulnerable range="lt">2.4.25_pre7-r8</vulnerable>
+    </package>
+    <package name="sys-kernel/hardened-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7-r2</unaffected>
+      <vulnerable range="lt">2.6.7-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/hardened-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26-r3</unaffected>
+      <vulnerable range="lt">2.4.26-r3</vulnerable>
+    </package>
+    <package name="sys-kernel/hppa-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7_p1-r2</unaffected>
+      <vulnerable range="lt">2.6.7_p1-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/hppa-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26_p6-r1</unaffected>
+      <vulnerable range="lt">2.4.26_p6-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/ia64-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.24-r7</unaffected>
+      <vulnerable range="lt">2.4.24-r7</vulnerable>
+    </package>
+    <package name="sys-kernel/mm-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7-r6</unaffected>
+      <vulnerable range="lt">2.6.7-r6</vulnerable>
+    </package>
+    <package name="sys-kernel/openmosix-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.22-r11</unaffected>
+      <vulnerable range="lt">2.4.22-r11</vulnerable>
+    </package>
+    <package name="sys-kernel/pac-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.23-r9</unaffected>
+      <vulnerable range="lt">2.4.23-r9</vulnerable>
+    </package>
+    <package name="sys-kernel/planet-ccrma-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.21-r11</unaffected>
+      <vulnerable range="lt">2.4.21-r11</vulnerable>
+    </package>
+    <package name="sys-kernel/pegasos-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7-r2</unaffected>
+      <vulnerable range="lt">2.6.7-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/pegasos-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26-r3</unaffected>
+      <vulnerable range="lt">2.4.26-r3</vulnerable>
+    </package>
+    <package name="sys-kernel/ppc-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26-r3</unaffected>
+      <vulnerable range="lt">2.4.26-r3</vulnerable>
+    </package>
+    <package name="sys-kernel/rsbac-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26-r3</unaffected>
+      <vulnerable range="lt">2.4.26-r3</vulnerable>
+    </package>
+    <package name="sys-kernel/rsbac-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7-r2</unaffected>
+      <vulnerable range="lt">2.6.7-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/selinux-sources" auto="no" arch="*">
+      <unaffected range="ge">2.4.26-r2</unaffected>
+      <vulnerable range="lt">2.4.26-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/sparc-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26-r3</unaffected>
+      <vulnerable range="lt">2.4.26-r3</vulnerable>
+    </package>
+    <package name="sys-kernel/uclinux-sources" auto="yes" arch="*">
+      <unaffected range="rge">2.4.26_p0-r3</unaffected>
+      <unaffected range="ge">2.6.7_p0-r2</unaffected>
+      <vulnerable range="lt">2.6.7_p0-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/usermode-sources" auto="yes" arch="*">
+      <unaffected range="rge">2.4.24-r6</unaffected>
+      <unaffected range="rge">2.4.26-r3</unaffected>
+      <unaffected range="ge">2.6.6-r4</unaffected>
+      <vulnerable range="lt">2.6.6-r4</vulnerable>
+    </package>
+    <package name="sys-kernel/vserver-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26.1.28-r1</unaffected>
+      <vulnerable range="lt">2.4.26.1.28-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/win4lin-sources" auto="yes" arch="*">
+      <unaffected range="rge">2.4.26-r3</unaffected>
+      <unaffected range="ge">2.6.7-r2</unaffected>
+      <vulnerable range="lt">2.6.7-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/wolk-sources" auto="yes" arch="*">
+      <unaffected range="rge">4.9-r10</unaffected>
+      <unaffected range="rge">4.11-r7</unaffected>
+      <unaffected range="ge">4.14-r4</unaffected>
+      <vulnerable range="lt">4.14-r4</vulnerable>
+    </package>
+    <package name="sys-kernel/xbox-sources" auto="yes" arch="*">
+      <unaffected range="rge">2.4.26-r3</unaffected>
+      <unaffected range="ge">2.6.7-r2</unaffected>
+      <vulnerable range="lt">2.6.7-r2</vulnerable>
+    </package>
+    <package name="sys-kernel/mips-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.27</unaffected>
+      <vulnerable range="lt">2.4.27</vulnerable>
+    </package>
+    <package name="sys-kernel/vanilla-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.27</unaffected>
+      <vulnerable range="le">2.4.26</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Linux kernel is responsible for managing the core aspects of a
+    GNU/Linux system, providing an interface for core system applications as
+    well as providing the essential structure and capability to access hardware
+    that is needed for a running system.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Linux kernel allows a local attacker to mount a remote file system on a
+    vulnerable Linux host and modify files' group IDs. On 2.4 series kernels
+    this vulnerability only affects shared NFS file systems. This vulnerability
+    has been assigned CAN-2004-0497 by the Common Vulnerabilities and Exposures
+    project.
+    </p>
+    <p>
+    Also, a flaw in the handling of /proc attributes has been found in 2.6
+    series kernels; allowing the unauthorized modification of /proc entries,
+    especially those which rely solely on file permissions for security to
+    vital kernel parameters.
+    </p>
+    <p>
+    An issue specific to the VServer Linux sources has been found, by which
+    /proc related changes in one virtual context are applied to other contexts
+    as well, including the host system.
+    </p>
+    <p>
+    CAN-2004-0447 resolves a local DoS vulnerability on IA64 platforms which
+    can cause unknown behaviour and CAN-2004-0565 resolves a floating point
+    information leak on IA64 platforms by which registers of other processes
+    can be read by a local user.
+    </p>
+    <p>
+    Finally, CAN-2004-0496 addresses some more unknown vulnerabilities in 2.6
+    series Linux kernels older than 2.6.7 which were found by the Sparse source
+    code checking tool.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Bad Group IDs can possibly cause a Denial of Service on parts of a host if
+    the changed files normally require a special GID to properly operate. By
+    exploiting this vulnerability, users in the original file group would also
+    be blocked from accessing the changed files.
+    </p>
+    <p>
+    The /proc attribute vulnerability allows local users with previously no
+    permissions to certain /proc entries to exploit the vulnerability and then
+    gain read, write and execute access to entries.
+    </p>
+    <p>
+    These new privileges can be used to cause unknown behaviour ranging from
+    reduced system performance to a Denial of Service by manipulating various
+    kernel options which are usually reserved for the superuser. This flaw
+    might also be used for opening restrictions set through /proc entries,
+    allowing further attacks to take place through another possibly unexpected
+    attack vector.
+    </p>
+    <p>
+    The VServer issue can also be used to induce similar unexpected behaviour
+    to other VServer contexts, including the host. By successful exploitation,
+    a Denial of Service for other contexts can be caused allowing only root to
+    read certain /proc entries. Such a change would also be replicated to other
+    contexts, forbidding normal users on those contexts to read /proc entries
+    which could contain details needed by daemons running as a non-root user,
+    for example.
+    </p>
+    <p>
+    Additionally, this vulnerability allows an attacker to read information
+    from another context, possibly hosting a different server, gaining critical
+    information such as what processes are running. This may be used for
+    furthering the exploitation of either context.
+    </p>
+    <p>
+    CAN-2004-0447 and CAN-2004-0496 permit various local unknown Denial of
+    Service vulnerabilities with unknown impacts - these vulnerabilities can be
+    used to possibly elevate privileges or access reserved kernel memory which
+    can be used for further exploitation of the system.
+    </p>
+    <p>
+    CAN-2004-0565 allows FPU register values of other processes to be read by a
+    local user setting the MFH bit during a floating point operation - since no
+    check was in place to ensure that the FPH bit was owned by the requesting
+    process, but only an MFH bit check, an attacker can simply set the MFH bit
+    and access FPU registers of processes running as other users, possibly
+    those running as root.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    2.4 users may not be affected by CAN-2004-0497 if they do not use remote
+    network filesystems and do not have support for any such filesystems in
+    their kernel configuration. All 2.6 users are affected by the /proc
+    attribute issue and the only known workaround is to disable /proc support.
+    The VServer flaw applies only to vserver-sources, and no workaround is
+    currently known for the issue. There is no known fix to CAN-2004-0447,
+    CAN-2004-0496 or CAN-2004-0565 other than to upgrade the kernel to a
+    patched version.
+    </p>
+    <p>
+    As a result, all users affected by any of these vulnerabilities should
+    upgrade their kernels to ensure the integrity of their systems.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Users are encouraged to upgrade to the latest available sources for their
+    system:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv your-favorite-sources
+    # emerge your-favorite-sources
+
+    # # Follow usual procedure for compiling and installing a kernel.
+    # # If you use genkernel, run genkernel as you would do normally.</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0447">CAN-2004-0447</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0496">CAN-2004-0496</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0497">CAN-2004-0497</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0565">CAN-2004-0565</uri>
+    <uri link="http://www.securityfocus.com/archive/1/367977">VServer /proc Context Vulnerability</uri>
+  </references>
+  <metadata tag="submitter">
+    plasmaroo
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-17.xml b/xml/htdocs/security/en/glsa/glsa-200407-17.xml
new file mode 100644
index 00000000..3c1211b5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-17.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-17">
+  <title>l2tpd: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow in l2tpd could lead to remote code execution. It is not
+    known whether this bug is exploitable.
+  </synopsis>
+  <product type="ebuild">net-dialup/l2tpd</product>
+  <announced>July 22, 2004</announced>
+  <revised>July 22, 2004: 01</revised>
+  <bug>53009</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dialup/l2tpd" auto="yes" arch="*">
+      <unaffected range="ge">0.69-r2</unaffected>
+      <vulnerable range="lt">0.69-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    l2tpd is a GPL implentation of the Layer 2 Tunneling Protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    Thomas Walpuski discovered a buffer overflow that may be exploitable by
+    sending a specially crafted packet. In order to exploit the vulnerable
+    code, an attacker would need to fake the establishment of an L2TP tunnel.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker may be able to execute arbitrary code with the privileges
+    of the user running l2tpd.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround for this vulnerability.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users are recommended to upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-l2tpd-0.69-r2"
+    # emerge ">=net-l2tpd-0.69-r2"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0649">CAN-2004-0649</uri>
+    <uri link="http://seclists.org/lists/fulldisclosure/2004/Jun/0094.html">Full Disclosure Report</uri>
+  </references>
+  <metadata tag="requester">
+    koon
+  </metadata>
+  <metadata tag="submitter">
+    dmargoli
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-18.xml b/xml/htdocs/security/en/glsa/glsa-200407-18.xml
new file mode 100644
index 00000000..ea0429bd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-18.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-18">
+  <title>mod_ssl: Format string vulnerability</title>
+  <synopsis>
+    A bug in mod_ssl may allow a remote attacker to execute arbitrary code when
+    Apache is configured to use mod_ssl and mod_proxy.
+  </synopsis>
+  <product type="ebuild">mod_ssl</product>
+  <announced>July 22, 2004</announced>
+  <revised>July 22, 2004: 01</revised>
+  <bug>57379</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-www/mod_ssl" auto="yes" arch="*">
+      <unaffected range="ge">2.8.19</unaffected>
+      <vulnerable range="le">2.8.18</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    mod_ssl provides Secure Sockets Layer encryption and authentication to
+    Apache 1.3.
+    </p>
+  </background>
+  <description>
+    <p>
+    A bug in ssl_engine_ext.c makes mod_ssl vulnerable to a ssl_log() related
+    format string vulnerability in the mod_proxy hook functions.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Given the right server configuration, an attacker could execute code as the
+    user running Apache, usually &quot;apache&quot;.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A server should not be vulnerable if it is not using both mod_ssl and
+    mod_proxy. Otherwise there is no workaround other than to disable mod_ssl.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mod_ssl users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-www/mod_ssl-2.8.19"
+    # emerge ">=net-www/mod_ssl-2.8.19"</code>
+  </resolution>
+  <references>
+    <uri link="http://marc.theaimsgroup.com/?l=apache-modssl&amp;m=109001100906749&amp;w=2">mod_ssl Announcement</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-19.xml b/xml/htdocs/security/en/glsa/glsa-200407-19.xml
new file mode 100644
index 00000000..313f65d4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-19.xml
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-19">
+  <title>Pavuk: Digest authentication helper buffer overflow</title>
+  <synopsis>
+    Pavuk contains a bug that can allow an attacker to run arbitrary code.
+  </synopsis>
+  <product type="ebuild">Pavuk</product>
+  <announced>July 26, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/pavuk" auto="yes" arch="*">
+      <unaffected range="ge">0.9.28-r3</unaffected>
+      <vulnerable range="le">0.9.28-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Pavuk is web spider and website mirroring tool.
+    </p>
+  </background>
+  <description>
+    <p>
+    Pavuk contains several buffer overflow vulnerabilities in the code
+    handling digest authentication.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could cause a buffer overflow, leading to arbitrary code
+    execution with the rights of the user running Pavuk.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of Pavuk.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Pavuk users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-misc/pavuk-0.9.28-r3&quot;
+    # emerge &quot;&gt;=net-misc/pavuk-0.9.28-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1437">CVE-2004-1437</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-20.xml b/xml/htdocs/security/en/glsa/glsa-200407-20.xml
new file mode 100644
index 00000000..b962a02d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-20.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-20">
+  <title>Subversion: Vulnerability in mod_authz_svn</title>
+  <synopsis>
+    Users with write access to parts of a Subversion repository may bypass read
+    restrictions in mod_authz_svn and read any part of the repository they
+    wish.
+  </synopsis>
+  <product type="ebuild">subversion</product>
+  <announced>July 26, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>57747</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-util/subversion" auto="yes" arch="*">
+      <unaffected range="ge">1.0.6</unaffected>
+      <vulnerable range="le">1.0.4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Subversion is an advanced version control system, similar to CVS, which
+    supports additional functionality such as the ability to move, copy and
+    delete files and directories. A Subversion server may be run as an
+    Apache module, a standalone server (svnserve), or on-demand over ssh (a
+    la CVS' ":ext:" protocol). The mod_authz_svn Apache module works with
+    Subversion in Apache to limit access to parts of Subversion
+    repositories based on policy set by the administrator.
+    </p>
+  </background>
+  <description>
+    <p>
+    Users with write access to part of a Subversion repository may bypass
+    read restrictions on any part of that repository. This can be done
+    using an "svn copy" command to copy the portion of a repository the
+    user wishes to read into an area where they have write access.
+    </p>
+    <p>
+    Since copies are versioned, any such copy attempts will be readily
+    apparent.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    This is a low-risk vulnerability. It affects only users of Subversion
+    who are running servers inside Apache and using mod_authz_svn.
+    Additionally, this vulnerability may be exploited only by users with
+    write access to some portion of a repository.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Keep sensitive content separated into different Subversion
+    repositories, or disable the Apache Subversion server and use svnserve
+    instead.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Subversion users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=dev-util/subversion-1.0.6&quot;
+    # emerve &quot;&gt;=dev-util/subversion-1.0.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://svn.collab.net/repos/svn/tags/1.0.6/CHANGES">ChangeLog for Subversion 1.0.6</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1438">CVE-2004-1438</uri>
+  </references>
+  <metadata tag="requester">
+    koon
+  </metadata>
+  <metadata tag="submitter">
+    condordes
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-21.xml b/xml/htdocs/security/en/glsa/glsa-200407-21.xml
new file mode 100644
index 00000000..65e1a7db
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-21.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-21">
+  <title>Samba: Multiple buffer overflows</title>
+  <synopsis>
+    Two buffer overflows vulnerabilities were found in Samba, potentially
+    allowing the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Samba</product>
+  <announced>July 29, 2004</announced>
+  <revised>July 29, 2004: 02</revised>
+  <bug>57962</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-fs/samba" auto="yes" arch="*">
+      <unaffected range="ge">3.0.5</unaffected>
+      <vulnerable range="le">3.0.4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Samba is a package which allows *nix systems to act as file servers for
+    Windows computers. It also allows *nix systems to mount shares exported by
+    a Samba/CIFS/Windows server. The Samba Web Administration Tool (SWAT) is a
+    web-based configuration tool part of the Samba package.
+    </p>
+  </background>
+  <description>
+    <p>
+    Evgeny Demidov found a buffer overflow in SWAT, located in the base64 data
+    decoder used to handle HTTP basic authentication (CAN-2004-0600). The same
+    flaw is present in the code used to handle the sambaMungedDial attribute
+    value, when using the ldapsam passdb backend. Another buffer overflow was
+    found in the code used to support the 'mangling method = hash' smb.conf
+    option (CAN-2004-0686). Note that the default Samba value for this option
+    is 'mangling method = hash2' which is not vulnerable.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    The SWAT authentication overflow could be exploited to execute arbitrary
+    code with the rights of the Samba daemon process. The overflow in the
+    sambaMungedDial handling code is not thought to be exploitable. The buffer
+    overflow in 'mangling method = hash' code could also be used to execute
+    arbitrary code on vulnerable configurations.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Users disabling SWAT, not using ldapsam passdb backends and not using the
+    'mangling method = hash' option are not vulnerable.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Samba users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-fs/samba-3.0.5"
+    # emerge ">=net-fs/samba-3.0.5"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.samba.org/samba/whatsnew/samba-3.0.5.html">Samba 3.0.5 Release Notes</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0600">CAN-2004-0600</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0686">CAN-2004-0686</uri>
+  </references>
+  <metadata tag="requester">
+    koon
+  </metadata>
+  <metadata tag="submitter">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-22.xml b/xml/htdocs/security/en/glsa/glsa-200407-22.xml
new file mode 100644
index 00000000..31696d2c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-22.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-22">
+  <title>phpMyAdmin: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in phpMyAdmin may allow a remote attacker with a
+    valid user account to alter configuration variables and execute arbitrary
+    PHP code.
+  </synopsis>
+  <product type="ebuild">dev-db/phpmyadmin</product>
+  <announced>July 29, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>57890</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/phpmyadmin" auto="yes" arch="*">
+      <unaffected range="ge">2.5.7_p1</unaffected>
+      <vulnerable range="le">2.5.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpMyAdmin is a popular, web-based MySQL administration tool written in
+    PHP. It allows users to administer a MySQL database from a web-browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    Two serious vulnerabilities exist in phpMyAdmin. The first allows any
+    user to alter the server configuration variables (including host, name,
+    and password) by appending new settings to the array variables that
+    hold the configuration in a GET statement. The second allows users to
+    include arbitrary PHP code to be executed within an eval() statement in
+    table name configuration settings. This second vulnerability is only
+    exploitable if $cfg['LeftFrameLight'] is set to FALSE.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Authenticated users can alter configuration variables for their running
+    copy of phpMyAdmin. The impact of this should be minimal. However, the
+    second vulnerability would allow an authenticated user to execute
+    arbitrary PHP code with the permissions of the webserver, potentially
+    allowing a serious Denial of Service or further remote compromise.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    The second, more serious vulnerability is only exploitable if
+    $cfg['LeftFrameLight'] is set to FALSE. In the default Gentoo
+    installation, this is set to TRUE. There is no known workaround for the
+    first.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpMyAdmin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=dev-db/phpmyadmin-2.5.7_p1&quot;
+    # emerge &quot;&gt;=dev-db/phpmyadmin-2.5.7_p1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/367486">BugTraq Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2631">CVE-2004-2631</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2632">CVE-2004-2632</uri>
+  </references>
+  <metadata tag="requester">
+    koon
+  </metadata>
+  <metadata tag="submitter">
+    dmargoli
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200407-23.xml b/xml/htdocs/security/en/glsa/glsa-200407-23.xml
new file mode 100644
index 00000000..3e7f35b6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200407-23.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200407-23">
+  <title>SoX: Multiple buffer overflows</title>
+  <synopsis>
+    SoX contains two buffer overflow vulnerabilities in the WAV header parser
+    code.
+  </synopsis>
+  <product type="ebuild">SoX</product>
+  <announced>July 30, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>58733</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/sox" auto="yes" arch="*">
+      <unaffected range="ge">12.17.4-r2</unaffected>
+      <vulnerable range="le">12.17.4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SoX is a command line utility that can convert various formats of
+    computer audio files in to other formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ulf Harnhammar discovered two buffer overflows in the sox and play
+    commands when handling WAV files with specially crafted header fields.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to play or convert a specially crafted WAV file an
+    attacker could execute arbitrary code with the permissions of the user
+    running SoX.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of SoX.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SoX users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=media-sound/sox-12.17.4-r2&quot;
+    # emerge &quot;&gt;=media-sound/sox-12.17.4-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://archives.neohapsis.com/archives/fulldisclosure/2004-07/1141.html">Full Disclosure Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0557">CVE-2004-0557</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-01.xml b/xml/htdocs/security/en/glsa/glsa-200408-01.xml
new file mode 100644
index 00000000..26fe5c0d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-01.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-01">
+  <title>MPlayer: GUI filename handling overflow</title>
+  <synopsis>
+    When compiled with GUI support MPlayer is vulnerable to a remotely
+    exploitable buffer overflow attack.
+  </synopsis>
+  <product type="ebuild">MPlayer</product>
+  <announced>August 01, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>55456</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/mplayer" auto="yes" arch="*">
+      <unaffected range="ge">1.0_pre4-r7</unaffected>
+      <vulnerable range="lt">1.0_pre4-r7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MPlayer is a media player capable of handling multiple multimedia file
+    formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    The MPlayer GUI code contains several buffer overflow vulnerabilities,
+    and at least one in the TranslateFilename() function is exploitable.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to play a file with a carefully crafted filename an
+    attacker could execute arbitrary code with the permissions of the user
+    running MPlayer.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    To work around this issue, users can compile MPlayer without GUI
+    support by disabling the gtk USE flag. All users are encouraged to
+    upgrade to the latest available version of MPlayer.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MPlayer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=media-video/mplayer-1.0_pre4-r7&quot;
+    # emerge &quot;&gt;=media-video/mplayer-1.0_pre4-r7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/bid/10615/">Bugtraq Announcement</uri>
+    <uri link="http://www.open-security.org/advisories/5">Open-Security Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0659">CVE-2004-0659</uri>
+  </references>
+  <metadata tag="requester">
+    koon
+  </metadata>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-02.xml b/xml/htdocs/security/en/glsa/glsa-200408-02.xml
new file mode 100644
index 00000000..e04e2f25
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-02.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-02">
+  <title>Courier: Cross-site scripting vulnerability in SqWebMail</title>
+  <synopsis>
+    The SqWebMail web application, included in the Courier suite, is vulnerable
+    to cross-site scripting attacks.
+  </synopsis>
+  <product type="ebuild">Courier</product>
+  <announced>August 04, 2004</announced>
+  <revised>August 04, 2004: 01</revised>
+  <bug>58020</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-mta/courier" auto="yes" arch="*">
+      <unaffected range="ge">0.45.6.20040618</unaffected>
+      <vulnerable range="le">0.45.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Courier is an integrated mail and groupware server based on open protocols.
+    It provides ESMTP, IMAP, POP3, webmail, and mailing list services within a
+    single framework. The webmail functionality included in Courier called
+    SqWebMail allows you to access mailboxes from a web browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    Luca Legato found that SqWebMail is vulnerable to a cross-site scripting
+    (XSS) attack. An XSS attack allows an attacker to insert malicious code
+    into a web-based application. SqWebMail doesn't filter appropriately data
+    coming from message headers before displaying them.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a carefully crafted message, an attacker can inject and execute
+    script code in the victim's browser window. This allows to modify the
+    behaviour of the SqWebMail application, and/or leak session information
+    such as cookies to the attacker.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of Courier.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Courier users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=mail-mta/courier-0.45.6.20040618"
+    # emerge ">=mail-mta/courier-0.45.6.20040618"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0591">CAN-2004-0591</uri>
+    <uri link="http://www.cert.org/advisories/CA-2000-02.html">XSS definition</uri>
+  </references>
+  <metadata tag="requester">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue,  3 Aug 2004 15:23:08 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-03.xml b/xml/htdocs/security/en/glsa/glsa-200408-03.xml
new file mode 100644
index 00000000..f19c9bec
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-03.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-03">
+  <title>libpng: Numerous vulnerabilities</title>
+  <synopsis>
+    libpng contains numerous vulnerabilities potentially allowing an attacker
+    to perform a Denial of Service attack or even execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">libpng</product>
+  <announced>August 05, 2004</announced>
+  <revised>August 05, 2004: 01</revised>
+  <bug>59424</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libpng" auto="yes" arch="*">
+      <unaffected range="ge">1.2.5-r8</unaffected>
+      <vulnerable range="le">1.2.5-r7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libpng is a standard library used to process PNG (Portable Network
+    Graphics) images. It is used by several other programs, including web
+    browsers and potentially server processes.
+    </p>
+  </background>
+  <description>
+    <p>
+    libpng contains numerous vulnerabilities including null pointer dereference
+    errors and boundary errors in various functions.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit these vulnerabilities to cause programs linked
+    against the library to crash or execute arbitrary code with the permissions
+    of the user running the vulnerable program, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libpng users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=media-libs/libpng-1.2.5-r8"
+    # emerge ">=media-libs/libpng-1.2.5-r8"</code>
+    <p>
+    You should also run revdep-rebuild to rebuild any packages that depend on
+    older versions of libpng :
+    </p>
+    <code>
+    # revdep-rebuild</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0597">CAN-2004-0597</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0598">CAN-2004-0598</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0599">CAN-2004-0599</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu,  5 Aug 2004 09:45:46 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-04.xml b/xml/htdocs/security/en/glsa/glsa-200408-04.xml
new file mode 100644
index 00000000..c4e2d219
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-04.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-04">
+  <title>PuTTY: Pre-authentication arbitrary code execution</title>
+  <synopsis>
+    PuTTY contains a vulnerability allowing a SSH server to execute arbitrary
+    code on the connecting client.
+  </synopsis>
+  <product type="ebuild">PuTTY</product>
+  <announced>August 05, 2004</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>59383</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/putty" auto="yes" arch="*">
+      <unaffected range="ge">0.55</unaffected>
+      <vulnerable range="le">0.54</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PuTTY is a free implementation of Telnet and SSH for Win32 and Unix
+    platforms, along with an xterm terminal emulator.
+    </p>
+  </background>
+  <description>
+    <p>
+    PuTTY contains a vulnerability allowing a malicious server to execute
+    arbitrary code on the connecting client before host key verification.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    When connecting to a server using the SSH2 protocol an attacker is able
+    to execute arbitrary code with the permissions of the user running
+    PuTTY by sending specially crafted packets to the client during the
+    authentication process but before host key verification.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of PuTTY.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PuTTY users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-misc/putty-0.55&quot;
+    # emerge &quot;&gt;=net-misc/putty-0.55&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.coresecurity.com/common/showdoc.php?idx=417&amp;idxseccion=10">Corelabs Advisory</uri>
+    <uri link="http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html">PuTTY ChangeLog</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1440">CVE-2004-1440</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed,  4 Aug 2004 17:20:53 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu,  5 Aug 2004 09:03:08 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-05.xml b/xml/htdocs/security/en/glsa/glsa-200408-05.xml
new file mode 100644
index 00000000..332bf4d4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-05.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-05">
+  <title>Opera: Multiple new vulnerabilities</title>
+  <synopsis>
+    Several new vulnerabilities were found and fixed in Opera, including one
+    allowing an attacker to read the local filesystem remotely.
+  </synopsis>
+  <product type="ebuild">Opera</product>
+  <announced>August 05, 2004</announced>
+  <revised>December 30, 2007: 03</revised>
+  <bug>59503</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/opera" auto="yes" arch="*">
+      <unaffected range="ge">7.54</unaffected>
+      <vulnerable range="le">7.53</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Opera is a multi-platform web browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been found in the Opera web browser.
+    Opera fails to deny write access to the "location" browser object. An
+    attacker can overwrite methods in this object and gain script access to
+    any page that uses one of these methods. Furthermore, access to file://
+    URLs is possible even from pages loaded using other protocols. Finally,
+    spoofing a legitimate web page is still possible, despite the fixes
+    announced in GLSA 200407-15.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing an user to visit specially crafted web pages, an attacker
+    can read files located on the victim's file system, read emails written
+    or received by M2, Opera's mail program, steal cookies, spoof URLs,
+    track user browsing history, etc.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Opera users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=www-client/opera-7.54&quot;
+    # emerge &quot;&gt;=www-client/opera-7.54&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.opera.com/linux/changelogs/754/">Opera Changelog</uri>
+    <uri link="http://archives.neohapsis.com/archives/fulldisclosure/2004-07/1056.html">Address bar spoofing issue disclosure</uri>
+    <uri link="http://www.greymagic.com/security/advisories/gm008-op/">GreyMagic Security Advisory GM#008-OP</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2570">CVE-2004-2570</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu,  5 Aug 2004 18:21:29 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-06.xml b/xml/htdocs/security/en/glsa/glsa-200408-06.xml
new file mode 100644
index 00000000..be32f9d3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-06.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-06">
+  <title>SpamAssassin: Denial of Service vulnerability</title>
+  <synopsis>
+    SpamAssassin is vulnerable to a Denial of Service attack when handling
+    certain malformed messages.
+  </synopsis>
+  <product type="ebuild">SpamAssassin</product>
+  <announced>August 09, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>59483</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-filter/spamassassin" auto="yes" arch="*">
+      <unaffected range="ge">2.64</unaffected>
+      <vulnerable range="le">2.63-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SpamAssassin is an extensible email filter which is used to identify
+    spam.
+    </p>
+  </background>
+  <description>
+    <p>
+    SpamAssassin contains an unspecified Denial of Service vulnerability.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a specially crafted message an attacker could cause a Denial
+    of Service attack against the SpamAssassin service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of SpamAssassin.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SpamAssassin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=mail-filter/spamassassin-2.64&quot;
+    # emerge &quot;&gt;=mail-filter/spamassassin-2.64&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://marc.theaimsgroup.com/?l=spamassassin-announce&amp;m=109168121628767&amp;w=2">SpamAssassin Release Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0796">CVE-2004-0796</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu,  5 Aug 2004 09:14:09 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu,  5 Aug 2004 11:01:34 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-07.xml b/xml/htdocs/security/en/glsa/glsa-200408-07.xml
new file mode 100644
index 00000000..0a0b2f5a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-07.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-07">
+  <title>Horde-IMP: Input validation vulnerability for Internet Explorer users</title>
+  <synopsis>
+    An input validation vulnerability has been discovered in Horde-IMP. This
+    only affects users of Internet Explorer.
+  </synopsis>
+  <product type="ebuild">horde-imp</product>
+  <announced>August 10, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>59336</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/horde-imp" auto="yes" arch="*">
+      <unaffected range="ge">3.2.5</unaffected>
+      <vulnerable range="le">3.2.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Horde-IMP is the Internet Messaging Program. It is written in PHP and
+    provides webmail access to IMAP and POP3 accounts.
+    </p>
+  </background>
+  <description>
+    <p>
+    Horde-IMP fails to properly sanitize email messages that contain
+    malicious HTML or script code so that it is not safe for users of
+    Internet Explorer when using the inline MIME viewer for HTML messages.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to read a specially crafted e-mail, an attacker can
+    execute arbitrary scripts running in the context of the victim's
+    browser. This could lead to a compromise of the user's webmail account,
+    cookie theft, etc.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not use Internet Explorer to access Horde-IMP.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Horde-IMP users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=www-apps/horde-imp-3.2.5&quot;
+    # emerge &quot;&gt;=www-apps/horde-imp-3.2.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cvs.horde.org/diff.php/imp/docs/CHANGES?r1=1.389.2.106&amp;r2=1.389.2.109&amp;ty=h">Horde-IMP Changelog</uri>
+    <uri link="http://secunia.com/advisories/12202/">Secunia Advisory SA12202</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1443">CVE-2004-1443</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun,  8 Aug 2004 18:55:04 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-08.xml b/xml/htdocs/security/en/glsa/glsa-200408-08.xml
new file mode 100644
index 00000000..8e31510f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-08.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-08">
+  <title>Cfengine: RSA Authentication Heap Corruption</title>
+  <synopsis>
+    Cfengine is vulnerable to a remote root exploit from clients in
+    AllowConnectionsFrom.
+  </synopsis>
+  <product type="ebuild">Cfengine</product>
+  <announced>August 10, 2004</announced>
+  <revised>May 22, 2006: 05</revised>
+  <bug>59895</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/cfengine" auto="yes" arch="*">
+      <unaffected range="ge">2.1.8</unaffected>
+      <unaffected range="lt">2.0.0</unaffected>
+      <vulnerable range="le">2.1.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cfengine is an agent/software robot and a high level policy language
+    for building expert systems to administrate and configure large
+    computer networks.
+    </p>
+  </background>
+  <description>
+    <p>
+    Two vulnerabilities have been found in cfservd. One is a buffer
+    overflow in the AuthenticationDialogue function and the other is a
+    failure to check the proper return value of the ReceiveTransaction
+    function.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could use the buffer overflow to execute arbitrary code
+    with the permissions of the user running cfservd, which is usually the
+    root user. However, before such an attack could be mounted, the
+    IP-based ACL would have to be bypassed. With the second vulnerability,
+    an attacker could cause a denial of service attack.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of Cfengine. (It should be
+    noted that disabling cfservd will work around this particular problem.
+    However, in many cases, doing so will cripple your Cfengine setup.
+    Upgrading is strongly recommended.)
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cfengine users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-misc/cfengine-2.1.8&quot;
+    # emerge &quot;&gt;=net-misc/cfengine-2.1.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.coresecurity.com/common/showdoc.php?idx=387&amp;idxseccion=10">Corelabs Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1701">CVE-2004-1701</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1702">CVE-2004-1702</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon,  9 Aug 2004 21:29:04 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-09.xml b/xml/htdocs/security/en/glsa/glsa-200408-09.xml
new file mode 100644
index 00000000..c00e780e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-09.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-09">
+  <title>Roundup: Filesystem access vulnerability</title>
+  <synopsis>
+    Roundup will make files owned by the user that it's running as accessable
+    to a remote attacker.
+  </synopsis>
+  <product type="ebuild">Roundup</product>
+  <announced>August 11, 2004</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>53494</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/roundup" auto="yes" arch="*">
+      <unaffected range="ge">0.7.6</unaffected>
+      <vulnerable range="le">0.6.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Roundup is a simple to use issue-tracking system with command-line,
+    web, and e-mail interfaces.
+    </p>
+  </background>
+  <description>
+    <p>
+    Improper handling of a specially crafted URL allows access to the
+    server's filesystem, which could contain sensitive information.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    An attacker could view files owned by the user running Roundup. This
+    will never be root however, as Roundup will not run as root.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of Roundup.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Roundup users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=www-apps/roundup-0.7.6&quot;
+    # emerge &quot;&gt;=www-apps/roundup-0.7.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://secunia.com/advisories/11801/">Secunia Advisory SA11801</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1444">CVE-2004-1444</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon,  9 Aug 2004 18:49:24 +0000">
+    chriswhite
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-10.xml b/xml/htdocs/security/en/glsa/glsa-200408-10.xml
new file mode 100644
index 00000000..d34bc33e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-10.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-10">
+  <title>gv: Exploitable Buffer Overflow</title>
+  <synopsis>
+    gv contains an exploitable buffer overflow that allows an attacker to
+    execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">gv</product>
+  <announced>August 12, 2004</announced>
+  <revised>August 12, 2004: 01</revised>
+  <bug>59385</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/gv" auto="yes" arch="*">
+      <unaffected range="ge">3.5.8-r4</unaffected>
+      <vulnerable range="le">3.5.8-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    gv is a PostScript and PDF viewer for X which provides a user interface for
+    the ghostscript interpreter.
+    </p>
+  </background>
+  <description>
+    <p>
+    gv contains a buffer overflow vulnerability where an unsafe sscanf() call
+    is used to interpret PDF and PostScript files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to view a malformed PDF or PostScript file an attacker
+    could execute arbitrary code with the permissions of the user running gv.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of gv.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All gv users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-text/gv-3.5.8-r4"
+    # emerge ">=app-text/gv-3.5.8-r4"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0838">CAN-2002-0838</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu,  5 Aug 2004 09:15:36 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun,  8 Aug 2004 20:43:19 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-11.xml b/xml/htdocs/security/en/glsa/glsa-200408-11.xml
new file mode 100644
index 00000000..0dcdb9ef
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-11.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-11">
+  <title>Nessus: "adduser" race condition vulnerability</title>
+  <synopsis>
+    Nessus contains a vulnerability allowing a user to perform a privilege
+    escalation attack.
+  </synopsis>
+  <product type="ebuild">Nessus</product>
+  <announced>August 12, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>58014</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-analyzer/nessus" auto="yes" arch="*">
+      <unaffected range="ge">2.0.12</unaffected>
+      <vulnerable range="le">2.0.11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Nessus is a free and powerful network security scanner.
+    </p>
+  </background>
+  <description>
+    <p>
+    A race condition can occur in "nessus-adduser" if the user has not
+    configured their TMPDIR variable.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious user could exploit this bug to escalate privileges to the
+    rights of the user running "nessus-adduser".
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of Nessus.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Nessus users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-analyzer/nessus-2.0.12&quot;
+    # emerge &quot;&gt;=net-analyzer/nessus-2.0.12&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://secunia.com/advisories/12127/">Secunia Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1445">CVE-2004-1445</uri>
+  </references>
+  <metadata tag="requester">
+    koon
+  </metadata>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-12.xml b/xml/htdocs/security/en/glsa/glsa-200408-12.xml
new file mode 100644
index 00000000..130ddb35
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-12.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-12">
+  <title>Gaim: MSN protocol parsing function buffer overflow</title>
+  <synopsis>
+    Gaim contains a remotely exploitable buffer overflow vulnerability in the
+    MSN-protocol parsing code that may allow remote execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">gaim</product>
+  <announced>August 12, 2004</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>60034</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/gaim" auto="yes" arch="*">
+      <unaffected range="ge">0.81-r1</unaffected>
+      <vulnerable range="le">0.81</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gaim is a multi-protocol instant messaging client for Linux which
+    supports many instant messaging protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sebastian Krahmer of the SuSE Security Team has discovered a remotely
+    exploitable buffer overflow vulnerability in the code handling MSN
+    protocol parsing.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a carefully-crafted message, an attacker may execute
+    arbitrary code with the permissions of the user running Gaim.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of Gaim.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gaim users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-im/gaim-0.81-r1&quot;
+    # emerge &quot;&gt;=net-im/gaim-0.81-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.osvdb.org/displayvuln.php?osvdb_id=8382">OSVDB ID: 8382</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0500">CVE-2004-0500</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 12 Aug 2004 16:07:01 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-13.xml b/xml/htdocs/security/en/glsa/glsa-200408-13.xml
new file mode 100644
index 00000000..6f740ee3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-13.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-13">
+  <title>kdebase, kdelibs: Multiple security issues</title>
+  <synopsis>
+    KDE contains three security issues that can allow an attacker to compromise
+    system accounts, cause a Denial of Service, or spoof websites via frame
+    injection.
+  </synopsis>
+  <product type="ebuild">kde, kdebase, kdelibs</product>
+  <announced>August 12, 2004</announced>
+  <revised>August 12, 2004: 01</revised>
+  <bug>60068</bug>
+  <access>remote and local</access>
+  <affected>
+    <package name="kde-base/kdebase" auto="yes" arch="*">
+      <unaffected range="ge">3.2.3-r1</unaffected>
+      <vulnerable range="lt">3.2.3-r1</vulnerable>
+    </package>
+    <package name="kde-base/kdelibs" auto="yes" arch="*">
+      <unaffected range="ge">3.2.3-r1</unaffected>
+      <vulnerable range="lt">3.2.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDE is a powerful Free Software graphical desktop environment for Linux and
+    Unix-like Operating Systems.
+    </p>
+  </background>
+  <description>
+    <p>
+    KDE contains three security issues:
+    </p>
+    <ul>
+    <li>Insecure handling of temporary files when running KDE applications
+    outside of the KDE environment</li>
+    <li>DCOPServer creates temporary files in an insecure manner</li>
+    <li>The Konqueror browser allows websites to load webpages into a target
+    frame of any other open frame-based webpage</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit these vulnerabilities to create or overwrite
+    files with the permissions of another user, compromise the account of users
+    running a KDE application and insert arbitrary frames into an otherwise
+    trusted webpage.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of kdebase.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All KDE users should upgrade to the latest versions of kdelibs and kdebase:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=kde-base/kdebase-3.2.3-r1"
+    # emerge ">=kde-base/kdebase-3.2.3-r1"
+
+    # emerge -pv ">=kde-base/kdelibs-3.2.3-r1"
+    # emerge ">=kde-base/kdelibs-3.2.3-r1"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.kde.org/info/security/advisory-20040811-1.txt">KDE Advisory: Temporary Directory Vulnerability</uri>
+    <uri link="http://www.kde.org/info/security/advisory-20040811-2.txt">KDE Advisory: DCOPServer Temporary Filename Vulnerability</uri>
+    <uri link="http://www.kde.org/info/security/advisory-20040811-3.txt">KDE Advisory: Konqueror Frame Injection Vulnerability</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 11 Aug 2004 17:47:27 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-14.xml b/xml/htdocs/security/en/glsa/glsa-200408-14.xml
new file mode 100644
index 00000000..b1bf7c8d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-14.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-14">
+  <title>acroread: UUDecode filename buffer overflow</title>
+  <synopsis>
+    acroread contains two errors in the handling of UUEncoded filenames that
+    may lead to execution of arbitrary code or programs.
+  </synopsis>
+  <product type="ebuild">acroread</product>
+  <announced>August 15, 2004</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>60205</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/acroread" auto="yes" arch="*">
+      <unaffected range="ge">5.09</unaffected>
+      <vulnerable range="le">5.08</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    acroread is Adobe's Acrobat PDF reader for Linux.
+    </p>
+  </background>
+  <description>
+    <p>
+    acroread contains two errors in the handling of UUEncoded filenames.
+    First, it fails to check the length of a filename before copying it
+    into a fixed size buffer and, secondly, it fails to check for the
+    backtick shell metacharacter in the filename before executing a command
+    with a shell.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to open a PDF with a specially crafted filename, an
+    attacker could execute arbitrary code or programs with the permissions
+    of the user running acroread.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of acroread.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All acroread users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=app-text/acroread-5.09&quot;
+    # emerge &quot;&gt;=app-text/acroread-5.09&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://idefense.com/application/poi/display?id=124&amp;type=vulnerabilities">iDEFENSE Advisory 124</uri>
+    <uri link="http://idefense.com/application/poi/display?id=125&amp;type=vulnerabilities">iDEFENSE Advisory 125</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0630">CVE-2004-0630</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0631">CVE-2004-0631</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 14 Aug 2004 07:56:36 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-15.xml b/xml/htdocs/security/en/glsa/glsa-200408-15.xml
new file mode 100644
index 00000000..8b41b116
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-15.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-15">
+  <title>Tomcat: Insecure installation</title>
+  <synopsis>
+    Improper file ownership may allow a member of the tomcat group to execute
+    scripts as root.
+  </synopsis>
+  <product type="ebuild">tomcat</product>
+  <announced>August 15, 2004</announced>
+  <revised>May 22, 2006: 04</revised>
+  <bug>59232</bug>
+  <access>local</access>
+  <affected>
+    <package name="www-servers/tomcat" auto="yes" arch="*">
+      <unaffected range="ge">5.0.27-r3</unaffected>
+      <unaffected range="rge">4.1.30-r4</unaffected>
+      <unaffected range="rge">3.3.2-r2</unaffected>
+      <vulnerable range="lt">5.0.27-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Tomcat is the Apache Jakarta Project's official implementation of Java
+    Servlets and Java Server Pages.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Gentoo ebuild for Tomcat sets the ownership of the Tomcat init
+    scripts as tomcat:tomcat, but those scripts are executed with root
+    privileges when the system is started. This may allow a member of the
+    tomcat group to run arbitrary code with root privileges when the Tomcat
+    init scripts are run.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    This could lead to a local privilege escalation or root compromise by
+    authenticated users.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Users may change the ownership of /etc/init.d/tomcat* and
+    /etc/conf.d/tomcat* to be root:root:
+    </p>
+    <code>
+    # chown -R root:root /etc/init.d/tomcat*
+    # chown -R root:root /etc/conf.d/tomcat*</code>
+  </workaround>
+  <resolution>
+    <p>
+    All Tomcat users can upgrade to the latest stable version, or simply
+    apply the workaround:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv &quot;&gt;=www-servers/tomcat-5.0.27-r3&quot;
+    # emerge &quot;&gt;=www-servers/tomcat-5.0.27-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1452">CVE-2004-1452</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun,  8 Aug 2004 20:54:24 +0000">
+    dmargoli
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-16.xml b/xml/htdocs/security/en/glsa/glsa-200408-16.xml
new file mode 100644
index 00000000..51f23abf
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-16.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-16">
+  <title>glibc: Information leak with LD_DEBUG</title>
+  <synopsis>
+    glibc contains an information leak vulnerability allowing the debugging of
+    SUID binaries.
+  </synopsis>
+  <product type="ebuild">glibc</product>
+  <announced>August 16, 2004</announced>
+  <revised>May 28, 2006: 04</revised>
+  <bug>59526</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-libs/glibc" auto="yes" arch="alpha arm hppa ia64 sparc s390">
+      <unaffected range="ge">2.3.2-r11</unaffected>
+      <vulnerable range="le">2.3.2-r10</vulnerable>
+    </package>
+    <package name="sys-libs/glibc" auto="yes" arch="x86 ppc">
+      <unaffected range="ge">2.3.3.20040420-r1</unaffected>
+      <vulnerable range="le">2.3.3.20040420</vulnerable>
+    </package>
+    <package name="sys-libs/glibc" auto="yes" arch="mips">
+      <unaffected range="ge">2.3.4.20040619-r1</unaffected>
+      <vulnerable range="le">2.3.3.20040420</vulnerable>
+    </package>
+    <package name="sys-libs/glibc" auto="yes" arch="amd64">
+      <unaffected range="ge">2.3.4.20040619-r1</unaffected>
+      <vulnerable range="le">2.3.4.20040619</vulnerable>
+    </package>
+    <package name="sys-libs/glibc" auto="yes" arch="ppc64">
+      <unaffected range="ge">2.3.4.20040808</unaffected>
+      <vulnerable range="le">2.3.4.20040605</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The GNU C library defines various Unix-like "system calls" and other
+    basic facilities needed for a standard POSIX-like application to
+    operate.
+    </p>
+  </background>
+  <description>
+    <p>
+    Silvio Cesare discovered a potential information leak in glibc. It
+    allows LD_DEBUG on SUID binaries where it should not be allowed. This
+    has various security implications, which may be used to gain
+    confidentional information.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    An attacker can gain the list of symbols a SUID application uses and
+    their locations and can then use a trojaned library taking precendence
+    over those symbols to gain information or perform further exploitation.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of glibc.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All glibc users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv your_version
+    # emerge your_version</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1453">CVE-2004-1453</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu,  5 Aug 2004 17:16:41 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-17.xml b/xml/htdocs/security/en/glsa/glsa-200408-17.xml
new file mode 100644
index 00000000..c49553d7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-17.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-17">
+  <title>rsync: Potential information leakage</title>
+  <synopsis>
+    rsync fails to properly sanitize paths. This vulnerability could allow the
+    listing of arbitrary files and allow file overwriting outside module's path
+    on rsync server configurations that allow uploading.
+  </synopsis>
+  <product type="ebuild">rsync</product>
+  <announced>August 17, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>60309</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/rsync" auto="yes" arch="*">
+      <unaffected range="ge">2.6.0-r3</unaffected>
+      <vulnerable range="le">2.6.0-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    rsync is a utility that provides fast incremental file transfers. It is
+    used to efficiently synchronize files between hosts and is used by
+    emerge to fetch Gentoo's Portage tree. rsyncd is the rsync daemon,
+    which listens to connections from rsync clients.
+    </p>
+  </background>
+  <description>
+    <p>
+    The paths sent by the rsync client are not checked thoroughly enough.
+    It does not affect the normal send/receive filenames that specify what
+    files should be transferred. It does affect certain option paths that
+    cause auxilliary files to be read or written.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    When rsyncd is used without chroot ("use chroot = false" in the
+    rsyncd.conf file), this vulnerability could allow the listing of
+    arbitrary files outside module's path and allow file overwriting
+    outside module's path on rsync server configurations that allows
+    uploading. Both possibilities are exposed only when chroot option is
+    disabled.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    You should never set the rsync daemon to run with "use chroot = false".
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should update to the latest version of the rsync package.
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-misc/rsync-2.6.0-r3&quot;
+    # emerge &quot;&gt;=net-misc/rsync-2.6.0-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://samba.org/rsync/#security_aug04">rsync Advisory</uri>
+    <uri link="http://lists.samba.org/archive/rsync-announce/2004/000017.html">rsync 2.6.2 announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0792">CVE-2004-0792</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 14 Aug 2004 19:22:18 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-18.xml b/xml/htdocs/security/en/glsa/glsa-200408-18.xml
new file mode 100644
index 00000000..bdfaae11
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-18.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-18">
+  <title>xine-lib: VCD MRL buffer overflow</title>
+  <synopsis>
+    xine-lib contains an exploitable buffer overflow in the VCD handling code
+  </synopsis>
+  <product type="ebuild">xine-lib</product>
+  <announced>August 17, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>59948</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/xine-lib" auto="yes" arch="*">
+      <unaffected range="ge">1_rc5-r3</unaffected>
+      <vulnerable range="le">1_rc5-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xine-lib is a multimedia library which can be utilized to create
+    multimedia frontends.
+    </p>
+  </background>
+  <description>
+    <p>
+    xine-lib contains a bug where it is possible to overflow the vcd://
+    input source identifier management buffer through carefully crafted
+    playlists.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker may construct a carefully-crafted playlist file which will
+    cause xine-lib to execute arbitrary code with the permissions of the
+    user. In order to conform with the generic naming standards of most
+    Unix-like systems, playlists can have extensions other than .asx (the
+    standard xine playlist format), and made to look like another file
+    (MP3, AVI, or MPEG for example). If an attacker crafts a playlist with
+    a valid header, they can insert a VCD playlist line that can cause a
+    buffer overflow and possible shellcode execution.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of xine-lib.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xine-lib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=media-libs/xine-lib-1_rc5-r3&quot;
+    # emerge &quot;&gt;=media-libs/xine-lib-1_rc5-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.open-security.org/advisories/6">Open Security Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1475">CVE-2004-1475</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 14 Aug 2004 05:07:02 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-19.xml b/xml/htdocs/security/en/glsa/glsa-200408-19.xml
new file mode 100644
index 00000000..7f19d2ec
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-19.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-19">
+  <title>courier-imap: Remote Format String Vulnerability</title>
+  <synopsis>
+    There is a format string vulnerability in non-standard configurations of
+    courier-imapd which may be exploited remotely. An attacker may be able to
+    execute arbitrary code as the user running courier-imapd (oftentimes root).
+  </synopsis>
+  <product type="ebuild">courier-imap</product>
+  <announced>August 19, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>60865</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/courier-imap" auto="yes" arch="*">
+      <unaffected range="ge">3.0.5</unaffected>
+      <vulnerable range="le">3.0.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Courier-IMAP is an IMAP server which is part of the Courier mail
+    system. It provides access only to maildirs.
+    </p>
+  </background>
+  <description>
+    <p>
+    There is a format string vulnerability in the auth_debug() function
+    which can be exploited remotely, potentially leading to arbitrary code
+    execution as the user running the IMAP daemon (oftentimes root). A
+    remote attacker may send username or password information containing
+    printf() format tokens (such as "%s"), which will crash the server or
+    cause it to execute arbitrary code.
+    </p>
+    <p>
+    This vulnerability can only be exploited if DEBUG_LOGIN is set to
+    something other than 0 in the imapd config file.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    If DEBUG_LOGIN is enabled in the imapd configuration, a remote attacker
+    may execute arbitrary code as the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Set the DEBUG_LOGIN option in /etc/courier-imap/imapd to 0. (This is
+    the default value.)
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All courier-imap users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-mail/courier-imap-3.0.5&quot;
+    # emerge &quot;&gt;=net-mail/courier-imap-3.0.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.idefense.com/application/poi/display?id=131&amp;type=vulnerabilities&amp;flashstatus=true">iDEFENSE Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0777">CVE-2004-0777</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 19 Aug 2004 18:47:27 +0000">
+    condordes
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-20.xml b/xml/htdocs/security/en/glsa/glsa-200408-20.xml
new file mode 100644
index 00000000..84a7273d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-20.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-20">
+  <title>Qt: Image loader overflows</title>
+  <synopsis>
+    There are several bugs in Qt's image-handling code which could lead to
+    crashes or arbitrary code execution.
+  </synopsis>
+  <product type="ebuild">Qt</product>
+  <announced>August 22, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>60855</bug>
+  <access>local</access>
+  <affected>
+    <package name="x11-libs/qt" auto="yes" arch="*">
+      <unaffected range="ge">3.3.3</unaffected>
+      <vulnerable range="le">3.3.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Qt is a cross-platform GUI toolkit used by KDE.
+    </p>
+  </background>
+  <description>
+    <p>
+    There are several unspecified bugs in the QImage class which may cause
+    crashes or allow execution of arbitrary code as the user running the Qt
+    application. These bugs affect the PNG, XPM, BMP, GIF and JPEG image
+    types.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker may exploit these bugs by causing a user to open a
+    carefully-constructed image file in any one of these formats. This may
+    be accomplished through e-mail attachments (if the user uses KMail), or
+    by simply placing a malformed image on a website and then convicing the
+    user to load the site in a Qt-based browser (such as Konqueror).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of Qt.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Qt users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=x11-libs/qt-3.3.3&quot;
+    # emerge &quot;&gt;=x11-libs/qt-3.3.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:085">Mandrake Advisory</uri>
+    <uri link="http://www.trolltech.com/developer/changes/changes-3.3.3.html">Qt 3.3.3 ChangeLog</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0691">CVE-2004-0691</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0692">CVE-2004-0692</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0693">CVE-2004-0693</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 20 Aug 2004 22:45:25 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 21 Aug 2004 19:29:43 +0000">
+    condordes
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-21.xml b/xml/htdocs/security/en/glsa/glsa-200408-21.xml
new file mode 100644
index 00000000..6335d0cf
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-21.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-21">
+  <title>Cacti: SQL injection vulnerability</title>
+  <synopsis>
+    With special configurations of Cacti it is possible to change passwords via
+    a SQL injection attack.
+  </synopsis>
+  <product type="ebuild">cacti</product>
+  <announced>August 23, 2004</announced>
+  <revised>May 22, 2006: 04</revised>
+  <bug>60630</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/cacti" auto="yes" arch="*">
+      <unaffected range="ge">0.8.5a-r1</unaffected>
+      <vulnerable range="le">0.8.5a</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cacti is a complete web-based front end to rrdtool.
+    </p>
+  </background>
+  <description>
+    <p>
+    Cacti is vulnerable to a SQL injection attack where an attacker may
+    inject SQL into the Username field.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could compromise the Cacti service and potentially execute
+    programs with the permissions of the user running Cacti. Only systems
+    with php_flag magic_quotes_gpc set to Off are vulnerable. By default,
+    Gentoo Linux installs PHP with this option set to On.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of Cacti.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the latest available version of Cacti, as
+    follows:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-analyzer/cacti-0.8.5a-r1&quot;
+    # emerge &quot;&gt;=net-analyzer/cacti-0.8.5a-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0717.html">Full Disclosure Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1737">CVE-2004-1737</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 19 Aug 2004 05:36:15 +0000">
+    dmargoli
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 19 Aug 2004 08:02:41 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-22.xml b/xml/htdocs/security/en/glsa/glsa-200408-22.xml
new file mode 100644
index 00000000..870888e4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-22.xml
@@ -0,0 +1,119 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-22">
+  <title>Mozilla, Firefox, Thunderbird, Galeon, Epiphany: New releases fix vulnerabilities</title>
+  <synopsis>
+    New releases of Mozilla, Epiphany, Galeon, Mozilla Thunderbird, and Mozilla
+    Firefox fix several vulnerabilities, including remote DoS and buffer
+    overflows.
+  </synopsis>
+  <product type="ebuild">www-client/mozilla, www-client/mozilla-firefox, mail-client/mozilla-thunderbird, www-client/galeon, www-client/epiphany</product>
+  <announced>August 23, 2004</announced>
+  <revised>December 30, 2007: 06</revised>
+  <bug>57380</bug>
+  <bug>59419</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla" auto="yes" arch="*">
+      <unaffected range="ge">1.7.2</unaffected>
+      <vulnerable range="lt">1.7.2</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">0.9.3</unaffected>
+      <vulnerable range="lt">0.9.3</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird" auto="yes" arch="*">
+      <unaffected range="ge">0.7.3</unaffected>
+      <vulnerable range="lt">0.7.3</vulnerable>
+    </package>
+    <package name="www-client/mozilla-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.7.2</unaffected>
+      <vulnerable range="lt">1.7.2</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">0.9.3</unaffected>
+      <vulnerable range="lt">0.9.3</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird-bin" auto="yes" arch="*">
+      <unaffected range="ge">0.7.3</unaffected>
+      <vulnerable range="lt">0.7.3</vulnerable>
+    </package>
+    <package name="www-client/epiphany" auto="yes" arch="*">
+      <unaffected range="ge">1.2.7-r1</unaffected>
+      <vulnerable range="lt">1.2.7-r1</vulnerable>
+    </package>
+    <package name="www-client/galeon" auto="yes" arch="*">
+      <unaffected range="ge">1.3.17</unaffected>
+      <vulnerable range="lt">1.3.17</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla is a popular web browser that includes a mail and newsreader.
+    Galeon and Epiphany are both web browsers that use gecko, the Mozilla
+    rendering engine. Mozilla Firefox is the next-generation browser from
+    the Mozilla project that incorporates advanced features that are yet to
+    be incorporated into Mozilla. Mozilla Thunderbird is the
+    next-generation mail client from the Mozilla project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mozilla, Galeon, Epiphany, Mozilla Firefox and Mozilla Thunderbird
+    contain the following vulnerabilities:
+    </p>
+    <ul>
+    <li>All Mozilla tools use libpng for graphics. This library contains a
+    buffer overflow which may lead to arbitrary code execution.</li>
+    <li>If a user imports a forged Certificate Authority (CA) certificate,
+    it may overwrite and corrupt the valid CA already installed on the
+    machine.</li>
+    </ul>
+    <p>
+    Mozilla, Mozilla Firefox, and other gecko-based browsers also contain a
+    bug in their caching which may allow the SSL icon to remain visible,
+    even when the site in question is an insecure site.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Users of Mozilla, Mozilla Firefox, and other gecko-based browsers are
+    susceptible to SSL certificate spoofing, a Denial of Service against
+    legitimate SSL sites, crashes, and arbitrary code execution. Users of
+    Mozilla Thunderbird are susceptible to crashes and arbitrary code
+    execution via malicious e-mails.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround for most of these vulnerabilities. All
+    users are advised to upgrade to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv your-version
+    # emerge your-version</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0763">CAN-2004-0763</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0758">CAN-2004-0758</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0597">CAN-2004-0597</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0598">CAN-2004-0598</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0599">CAN-2004-0599</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu,  5 Aug 2004 18:21:36 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu,  5 Aug 2004 19:57:21 +0000">
+    dmargoli
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-23.xml b/xml/htdocs/security/en/glsa/glsa-200408-23.xml
new file mode 100644
index 00000000..38fd9261
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-23.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-23">
+  <title>kdelibs: Cross-domain cookie injection vulnerability</title>
+  <synopsis>
+    The cookie manager component in kdelibs contains a vulnerability allowing
+    an attacker to potentially gain access to a user's session on a legitimate
+    web server.
+  </synopsis>
+  <product type="ebuild">kdelibs</product>
+  <announced>August 24, 2004</announced>
+  <revised>August 24, 2004: 01</revised>
+  <bug>61389</bug>
+  <access>remote</access>
+  <affected>
+    <package name="kde-base/kdelibs" auto="yes" arch="*">
+      <unaffected range="ge">3.2.3-r2</unaffected>
+      <vulnerable range="le">3.2.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDE is a widely-used desktop environment based on the Qt toolkit.
+    kcookiejar in kdelibs is responsible for storing and managing HTTP cookies.
+    Konqueror uses kcookiejar for storing and managing cookies.
+    </p>
+  </background>
+  <description>
+    <p>
+    kcookiejar contains a vulnerability which may allow a malicious website to
+    set cookies for other websites under the same second-level domain.
+    </p>
+    <p>
+    This vulnerability applies to country-specific secondary top level domains
+    that use more than 2 characters in the secondary part of the domain name,
+    and that use a secondary part other than com, net, mil, org, gov, edu or
+    int. However, certain popular domains, such as co.uk, are not affected.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    Users visiting a malicious website using the Konqueror browser may have a
+    session cookie set for them by that site. Later, when the user visits
+    another website under the same domain, the attacker's session cookie will
+    be used instead of the cookie issued by the legitimate site. Depending on
+    the design of the legitimate site, this may allow an attacker to gain
+    access to the user's session. For further explanation on this type of
+    attack, see the paper titled &quot;Session Fixation Vulnerability in
+    Web-based Applications&quot; (reference 2).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of kdelibs.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All kdelibs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=kde-base/kdelibs-3.2.3-r2"
+    # emerge ">=kde-base/kdelibs-3.2.3-r2"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.kde.org/info/security/advisory-20040823-1.txt">KDE Advisory</uri>
+    <uri link="http://www.acros.si/papers/session_fixation.pdf">Session Fixation Vulnerability in Web-based Applications</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 23 Aug 2004 20:45:47 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 24 Aug 2004 19:26:35 +0000">
+    condordes
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-24.xml b/xml/htdocs/security/en/glsa/glsa-200408-24.xml
new file mode 100644
index 00000000..a0584ec2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-24.xml
@@ -0,0 +1,233 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-24">
+  <title>Linux Kernel: Multiple information leaks</title>
+  <synopsis>
+    Multiple information leaks have been found in the Linux kernel, allowing an
+    attacker to obtain sensitive data which may be used for further
+    exploitation of the system.
+  </synopsis>
+  <product type="ebuild">Kernel</product>
+  <announced>August 25, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>59378</bug>
+  <bug>59905</bug>
+  <bug>59769</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-kernel/aa-sources" auto="no" arch="*">
+      <unaffected range="rge">2.4.23-r2</unaffected>
+      <unaffected range="ge">2.6.5-r5</unaffected>
+      <vulnerable range="lt">2.6.5-r5</vulnerable>
+    </package>
+    <package name="sys-kernel/alpha-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.21-r12</unaffected>
+      <vulnerable range="lt">2.4.21-r12</vulnerable>
+    </package>
+    <package name="sys-kernel/ck-sources" auto="no" arch="*">
+      <unaffected range="rge">2.4.26-r1</unaffected>
+      <unaffected range="ge">2.6.7-r5</unaffected>
+      <vulnerable range="lt">2.6.7-r5</vulnerable>
+    </package>
+    <package name="sys-kernel/development-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.8</unaffected>
+      <vulnerable range="lt">2.6.8</vulnerable>
+    </package>
+    <package name="sys-kernel/gentoo-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7-r12</unaffected>
+      <vulnerable range="lt">2.6.7-r12</vulnerable>
+    </package>
+    <package name="sys-kernel/gentoo-sources" auto="yes" arch="*">
+      <unaffected range="rge">2.4.19-r22</unaffected>
+      <unaffected range="rge">2.4.20-r25</unaffected>
+      <unaffected range="rge">2.4.22-r16</unaffected>
+      <unaffected range="rge">2.4.25-r9</unaffected>
+      <unaffected range="ge">2.4.26-r9</unaffected>
+      <vulnerable range="lt">2.4.26-r9</vulnerable>
+    </package>
+    <package name="sys-kernel/grsec-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.27.2.0.1-r1</unaffected>
+      <vulnerable range="lt">2.4.27.2.0.1-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/gs-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.25_pre7-r11</unaffected>
+      <vulnerable range="lt">2.4.25_pre7-r11</vulnerable>
+    </package>
+    <package name="sys-kernel/hardened-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7-r7</unaffected>
+      <vulnerable range="lt">2.6.7-r7</vulnerable>
+    </package>
+    <package name="sys-kernel/hardened-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.27-r1</unaffected>
+      <vulnerable range="lt">2.4.27-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/hppa-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7_p14-r1</unaffected>
+      <vulnerable range="lt">2.6.7_p14-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/hppa-sources" auto="no" arch="*">
+      <unaffected range="ge">2.4.26_p7-r1</unaffected>
+      <vulnerable range="lt">2.4.26_p7-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/ia64-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.24-r10</unaffected>
+      <vulnerable range="lt">2.4.24-r10</vulnerable>
+    </package>
+    <package name="sys-kernel/mips-sources" auto="yes" arch="*">
+      <unaffected range="rge">2.4.25-r8</unaffected>
+      <unaffected range="rge">2.4.26-r8</unaffected>
+      <unaffected range="rge">2.6.4-r8</unaffected>
+      <unaffected range="rge">2.6.6-r8</unaffected>
+      <unaffected range="ge">2.6.7-r5</unaffected>
+      <vulnerable range="lt">2.6.6-r8</vulnerable>
+    </package>
+    <package name="sys-kernel/mm-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.8_rc4-r1</unaffected>
+      <vulnerable range="lt">2.6.8_rc4-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/openmosix-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.24-r4</unaffected>
+      <vulnerable range="lt">2.4.24-r4</vulnerable>
+    </package>
+    <package name="sys-kernel/pac-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.23-r12</unaffected>
+      <vulnerable range="lt">2.4.23-r12</vulnerable>
+    </package>
+    <package name="sys-kernel/pegasos-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.8</unaffected>
+      <vulnerable range="lt">2.6.8</vulnerable>
+    </package>
+    <package name="sys-kernel/rsbac-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26-r5</unaffected>
+      <vulnerable range="lt">2.4.26-r5</vulnerable>
+    </package>
+    <package name="sys-kernel/rsbac-dev-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7-r5</unaffected>
+      <vulnerable range="lt">2.6.7-r5</vulnerable>
+    </package>
+    <package name="sys-kernel/selinux-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26-r3</unaffected>
+      <vulnerable range="lt">2.4.26-r3</vulnerable>
+    </package>
+    <package name="sys-kernel/sparc-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.27-r1</unaffected>
+      <vulnerable range="lt">2.4.27-r1</vulnerable>
+    </package>
+    <package name="sys-kernel/uclinux-sources" auto="yes" arch="*">
+      <unaffected range="rge">2.4.26_p0-r6</unaffected>
+      <unaffected range="ge">2.6.7_p0-r5</unaffected>
+      <vulnerable range="lt">2.6.7_p0-r5</vulnerable>
+    </package>
+    <package name="sys-kernel/usermode-sources" auto="yes" arch="*">
+      <unaffected range="rge">2.4.24-r9</unaffected>
+      <unaffected range="rge">2.4.26-r6</unaffected>
+      <unaffected range="ge">2.6.6-r6</unaffected>
+      <vulnerable range="lt">2.6.6-r6</vulnerable>
+    </package>
+    <package name="sys-kernel/vanilla-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.27</unaffected>
+      <vulnerable range="lt">2.4.27</vulnerable>
+    </package>
+    <package name="sys-kernel/vserver-sources" auto="yes" arch="*">
+      <unaffected range="ge">2.4.26.1.28-r4</unaffected>
+      <vulnerable range="lt">2.4.26.1.28-r4</vulnerable>
+    </package>
+    <package name="sys-kernel/win4lin-sources" auto="yes" arch="*">
+      <unaffected range="rge">2.4.26-r6</unaffected>
+      <unaffected range="ge">2.6.7-r2</unaffected>
+      <vulnerable range="lt">2.6.7-r5</vulnerable>
+    </package>
+    <package name="sys-kernel/wolk-sources" auto="yes" arch="*">
+      <unaffected range="rge">4.9-r14</unaffected>
+      <unaffected range="rge">4.11-r10</unaffected>
+      <unaffected range="ge">4.14-r7</unaffected>
+      <vulnerable range="lt">4.14-r7</vulnerable>
+    </package>
+    <package name="sys-kernel/xbox-sources" auto="yes" arch="*">
+      <unaffected range="rge">2.4.27-r1</unaffected>
+      <unaffected range="ge">2.6.7-r5</unaffected>
+      <vulnerable range="lt">2.6.7-r5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Linux kernel is responsible for managing the core aspects of a
+    GNU/Linux system, providing an interface for core system applications
+    as well as providing the essential structure and capability to access
+    hardware that is needed for a running system.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Linux kernel allows a local attacker to obtain sensitive kernel
+    information by gaining access to kernel memory via several leaks in the
+    /proc interfaces. These vulnerabilities exist in various drivers which
+    make up a working Linux kernel, some of which are present across all
+    architectures and configurations.
+    </p>
+    <p>
+    CAN-2004-0415 deals with addressing invalid 32 to 64 bit conversions in
+    the kernel, as well as insecure direct access to file offset pointers
+    in kernel code which can be modified by the open(...), lseek(...) and
+    other core system I/O functions by an attacker.
+    </p>
+    <p>
+    CAN-2004-0685 deals with certain USB drivers using uninitialized
+    structures and then using the copy_to_user(...) kernel call to copy
+    these structures. This may leak uninitialized kernel memory, which can
+    contain sensitive information from user applications.
+    </p>
+    <p>
+    Finally, a race condition with the /proc/.../cmdline node was found,
+    allowing environment variables to be read while the process was still
+    spawning. If the race is won, environment variables of the process,
+    which might not be owned by the attacker, can be read.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    These vulnerabilities allow a local unprivileged attacker to access
+    segments of kernel memory or environment variables which may contain
+    sensitive information. Kernel memory may contain passwords, data
+    transferred between processes and any memory which applications did not
+    clear upon exiting as well as the kernel cache and kernel buffers.
+    </p>
+    <p>
+    This information may be used to read sensitive data, open other attack
+    vectors for further exploitation or cause a Denial of Service if the
+    attacker can gain superuser access via the leaked information.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no temporary workaround for any of these information leaks
+    other than totally disabling /proc support - otherwise, a kernel
+    upgrade is required. A list of unaffected kernels is provided along
+    with this announcement.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Users are encouraged to upgrade to the latest available sources for
+    their system:
+    </p>
+    <code>
+    # emerge sync
+    # emerge -pv your-favorite-sources
+    # emerge your-favorite-sources
+    
+    # # Follow usual procedure for compiling and installing a kernel.
+    # # If you use genkernel, run genkernel as you would normally.</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0415">CAN-2004-0415</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0685">CAN-2004-0685</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1058">CVE-2004-1058</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 17 Aug 2004 02:16:55 +0000">
+    plasmaroo
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-25.xml b/xml/htdocs/security/en/glsa/glsa-200408-25.xml
new file mode 100644
index 00000000..97a72e91
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-25.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-25">
+  <title>MoinMoin: Group ACL bypass</title>
+  <synopsis>
+    MoinMoin contains a bug allowing anonymous users to bypass ACLs (Access
+    Control Lists) and carry out operations that should be limited to
+    authorized users.
+  </synopsis>
+  <product type="ebuild">MoinMoin</product>
+  <announced>August 26, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>57913</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/moinmoin" auto="yes" arch="*">
+      <unaffected range="ge">1.2.3</unaffected>
+      <vulnerable range="le">1.2.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MoinMoin is a Python clone of WikiWiki, based on PikiPiki.
+    </p>
+  </background>
+  <description>
+    <p>
+    MoinMoin contains two unspecified bugs, one allowing anonymous users
+    elevated access when not using ACLs, and the other in the ACL handling
+    in the PageEditor.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Restrictions on anonymous users were not properly enforced. This could
+    lead to unauthorized users gaining administrative access to functions
+    such as "revert" and "delete". Sites are vulnerable whether or not they
+    are using ACLs.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the latest available version of MoinMoin,
+    as follows:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=www-apps/moinmoin-1.2.3&quot;
+    # emerge &quot;&gt;=www-apps/moinmoin-1.2.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="https://sourceforge.net/project/shownotes.php?group_id=8482&amp;release_id=254801">MoinMoin Announcement</uri>
+    <uri link="http://www.osvdb.org/displayvuln.php?osvdb_id=8194">OSVDB Advisory 8194</uri>
+    <uri link="http://www.osvdb.org/displayvuln.php?osvdb_id=8195">OSVDB Advisory 8195</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1462">CVE-2004-1462</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1463">CVE-2004-1463</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 19 Aug 2004 05:10:31 +0000">
+    dmargoli
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-26.xml b/xml/htdocs/security/en/glsa/glsa-200408-26.xml
new file mode 100644
index 00000000..0efe6071
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-26.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-26">
+  <title>zlib: Denial of service vulnerability</title>
+  <synopsis>
+    The zlib library contains a Denial of Service vulnerability.
+  </synopsis>
+  <product type="ebuild">zlib</product>
+  <announced>August 27, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>61749</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-libs/zlib" auto="yes" arch="*">
+      <unaffected range="ge">1.2.1-r3</unaffected>
+      <vulnerable range="le">1.2.1-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    zlib is a general-purpose data-compression library.
+    </p>
+  </background>
+  <description>
+    <p>
+    zlib contains a bug in the handling of errors in the "inflate()" and
+    "inflateBack()" functions.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit this vulnerability to launch a Denial of
+    Service attack on any application using the zlib library.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of zlib.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All zlib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=sys-libs/zlib-1.2.1-r3&quot;
+    # emerge &quot;&gt;=sys-libs/zlib-1.2.1-r3&quot;</code>
+    <p>
+    You should also run revdep-rebuild to rebuild any packages that depend
+    on older versions of zlib :
+    </p>
+    <code>
+    # revdep-rebuild</code>
+  </resolution>
+  <references>
+    <uri link="http://www.openpkg.org/security/OpenPKG-SA-2004.038-zlib.html">OpenPKG-SA-2004.038-zlib</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0797">CVE-2004-0797</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 26 Aug 2004 19:08:52 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 27 Aug 2004 05:21:24 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200408-27.xml b/xml/htdocs/security/en/glsa/glsa-200408-27.xml
new file mode 100644
index 00000000..bc97a369
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200408-27.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200408-27">
+  <title>Gaim: New vulnerabilities</title>
+  <synopsis>
+    Gaim contains several security issues that might allow an attacker to
+    execute arbitrary code or commands.
+  </synopsis>
+  <product type="ebuild">Gaim</product>
+  <announced>August 27, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>61457</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/gaim" auto="yes" arch="*">
+      <unaffected range="ge">0.81-r5</unaffected>
+      <vulnerable range="lt">0.81-r5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gaim is a multi-protocol instant messaging client for Linux which
+    supports many instant messaging protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    Gaim fails to do proper bounds checking when:
+    </p>
+    <ul>
+    <li>Handling MSN messages (partially fixed with GLSA 200408-12).</li>
+    <li>Handling rich text format messages.</li>
+    <li>Resolving local hostname.</li>
+    <li>Receiving long URLs.</li>
+    <li>Handling groupware messages.</li>
+    <li>Allocating memory for webpages with fake content-length
+    header.</li>
+    </ul>
+    <p>
+    Furthermore Gaim fails to escape filenames when using drag and drop
+    installation of smiley themes.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    These vulnerabilites could allow an attacker to crash Gaim or execute
+    arbitrary code or commands with the permissions of the user running
+    Gaim.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of Gaim.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All gaim users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-im/gaim-0.81-r5&quot;
+    # emerge &quot;&gt;=net-im/gaim-0.81-r5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://gaim.sourceforge.net/security/index.php">Gaim security issues</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0500">CVE-2004-0500</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0754">CVE-2004-0754</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0784">CVE-2004-0784</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0785">CVE-2004-0785</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 26 Aug 2004 15:30:26 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 26 Aug 2004 19:01:27 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-01.xml b/xml/htdocs/security/en/glsa/glsa-200409-01.xml
new file mode 100644
index 00000000..76a7d249
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-01.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-01">
+  <title>vpopmail: Multiple vulnerabilities</title>
+  <synopsis>
+    vpopmail contains several bugs making it vulnerable to several SQL
+    injection exploits as well as one buffer overflow and one format string
+    exploit when using Sybase. This could lead to the execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">vpopmail</product>
+  <announced>September 01, 2004</announced>
+  <revised>September 01, 2004: 01</revised>
+  <bug>60844</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/vpopmail" auto="yes" arch="*">
+      <unaffected range="ge">5.4.6</unaffected>
+      <vulnerable range="lt">5.4.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    vpopmail handles virtual mail domains for qmail and Postfix.
+    </p>
+  </background>
+  <description>
+    <p>
+    vpopmail is vulnerable to several unspecified SQL injection exploits.
+    Furthermore when using Sybase as the backend database vpopmail is
+    vulnerable to a buffer overflow and format string exploit.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    These vulnerabilities could allow an attacker to execute code with the
+    permissions of the user running vpopmail.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of vpopmail.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All vpopmail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-mail/vpopmail-5.4.6"
+    # emerge ">=net-mail/vpopmail-5.4.6"</code>
+  </resolution>
+  <references>
+    <uri link="http://sourceforge.net/forum/forum.php?forum_id=400873">vpopmail Announcement</uri>
+    <uri link="http://www.securityfocus.com/archive/1/371913/2004-08-15/2004-08-21/0">Bugtraq Announcement</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 26 Aug 2004 17:42:34 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-02.xml b/xml/htdocs/security/en/glsa/glsa-200409-02.xml
new file mode 100644
index 00000000..8204ab27
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-02.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-02">
+  <title>MySQL: Insecure temporary file creation in mysqlhotcopy</title>
+  <synopsis>
+    The mysqlhotcopy utility can create temporary files with predictable paths,
+    allowing an attacker to use a symlink to trick MySQL into overwriting
+    important data.
+  </synopsis>
+  <product type="ebuild">MySQL</product>
+  <announced>September 01, 2004</announced>
+  <revised>September 01, 2004: 01</revised>
+  <bug>60744</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-db/mysql" auto="yes" arch="*">
+      <unaffected range="ge">4.0.20-r1</unaffected>
+      <vulnerable range="le">4.0.20</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MySQL is a popular open-source multi-threaded, multi-user SQL database
+    server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jeroen van Wolffelaar discovered that the MySQL database hot copy utility
+    (mysqlhotcopy.sh), when using the scp method, uses temporary files with
+    predictable names. A malicious local user with write access to the /tmp
+    directory could create a symbolic link pointing to a file, which may then
+    be overwritten. In cases where mysqlhotcopy is run as root, a malicious
+    user could create a symlink to a critical file such as /etc/passwd and
+    cause it to be overwritten.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could use this vulnerability to destroy other users' data
+    or corrupt and destroy system files, possibly leading to a denial of
+    service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MySQL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=dev-db/mysql-4.0.20-r1"
+    # emerge ">=dev-db/mysql-4.0.20-r1"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0457">CAN-2004-0457</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 31 Aug 2004 08:03:33 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 31 Aug 2004 15:42:33 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-03.xml b/xml/htdocs/security/en/glsa/glsa-200409-03.xml
new file mode 100644
index 00000000..bb244491
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-03.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-03">
+  <title>Python 2.2: Buffer overflow in getaddrinfo()</title>
+  <synopsis>
+    Python 2.2 has a vulnerability in DNS handling when IPV6 is disabled and a
+    malformed IPV6 address is encountered by getaddrinfo().
+  </synopsis>
+  <product type="ebuild">Python</product>
+  <announced>September 02, 2004</announced>
+  <revised>September 02, 2004: 01</revised>
+  <bug>62440</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/python" auto="yes" arch="*">
+      <unaffected range="ge">2.2.2</unaffected>
+      <unaffected range="lt">2.2</unaffected>
+      <vulnerable range="lt">2.2.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Python is an interpreted, interactive, object-oriented, cross-platform
+    programming language.
+    </p>
+  </background>
+  <description>
+    <p>
+    If IPV6 is disabled in Python 2.2, getaddrinfo() is not able to handle IPV6
+    DNS requests properly and a buffer overflow occurs.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker can execute arbitrary code as the user running python.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Users with IPV6 enabled are not affected by this vulnerability.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Python 2.2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=dev-lang/python-2.2.2"
+    # emerge ">=dev-lang/python-2.2.2"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0150">CVE-2004-0150</uri>
+    <uri link="http://www.osvdb.org/4172">OSVDB:4172</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 31 Aug 2004 22:51:44 +0000">
+    chriswhite
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-04.xml b/xml/htdocs/security/en/glsa/glsa-200409-04.xml
new file mode 100644
index 00000000..7868f03d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-04.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-04">
+  <title>Squid: Denial of service when using NTLM authentication</title>
+  <synopsis>
+    Squid is vulnerable to a denial of service attack which could crash its
+    NTLM helpers.
+  </synopsis>
+  <product type="ebuild">squid</product>
+  <announced>September 02, 2004</announced>
+  <revised>December 30, 2007: 03</revised>
+  <bug>61280</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-proxy/squid" auto="yes" arch="*">
+      <unaffected range="ge">2.5.6-r2</unaffected>
+      <unaffected range="lt">2.5</unaffected>
+      <vulnerable range="le">2.5.6-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Squid is a full-featured Web Proxy Cache designed to run on Unix
+    systems. It supports proxying and caching of HTTP, FTP, and other URLs,
+    as well as SSL support, cache hierarchies, transparent caching, access
+    control lists and many other features.
+    </p>
+  </background>
+  <description>
+    <p>
+    Squid 2.5.x versions contain a bug in the functions ntlm_fetch_string()
+    and ntlm_get_string() which lack checking the int32_t offset "o" for
+    negative values.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could cause a denial of service situation by sending
+    certain malformed NTLMSSP packets if NTLM authentication is enabled.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable NTLM authentication by removing any "auth_param ntlm program
+    ..." directives from squid.conf or use ntlm_auth from Samba-3.x.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Squid users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-www/squid-2.5.6-r2&quot;
+    # emerge &quot;&gt;=net-www/squid-2.5.6-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www1.uk.squid-cache.org/squid/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-ntlm_fetch_string">Squid-2.5 Patches</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0832">CVE-2004-0832</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu,  2 Sep 2004 10:25:32 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-05.xml b/xml/htdocs/security/en/glsa/glsa-200409-05.xml
new file mode 100644
index 00000000..38d29d2e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-05.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-05">
+  <title>Gallery: Arbitrary command execution</title>
+  <synopsis>
+    The Gallery image upload code contains a temporary file handling
+    vulnerability which could lead to execution of arbitrary commands.
+  </synopsis>
+  <product type="ebuild">Gallery</product>
+  <announced>September 02, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>60742</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/gallery" auto="yes" arch="*">
+      <unaffected range="ge">1.4.4_p2</unaffected>
+      <vulnerable range="lt">1.4.4_p2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gallery is a PHP script for maintaining online photo albums.
+    </p>
+  </background>
+  <description>
+    <p>
+    The upload handling code in Gallery places uploaded files in a
+    temporary directory. After 30 seconds, these files are deleted if they
+    are not valid images. However, since the file exists for 30 seconds, a
+    carefully crafted script could be initiated by the remote attacker
+    during this 30 second timeout. Note that the temporary directory has to
+    be located inside the webroot and an attacker needs to have upload
+    rights either as an authenticated user or via "EVERYBODY".
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could run arbitrary code as the user running PHP.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are several workarounds to this vulnerability:
+    </p>
+    <ul>
+    <li>Make sure that your temporary directory is not contained in the
+    webroot; by default it is located outside the webroot.</li>
+    <li>Disable upload rights to all albums for "EVERYBODY"; upload is
+    disabled by default.</li>
+    <li>Disable debug and dev mode; these settings are disabled by
+    default.</li>
+    <li>Disable allow_url_fopen in php.ini.</li>
+    </ul>
+  </workaround>
+  <resolution>
+    <p>
+    All Gallery users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=www-apps/gallery-1.4.4_p2&quot;
+    # emerge &quot;&gt;=www-apps/gallery-1.4.4_p2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0757.html">Full Disclosure Announcement</uri>
+    <uri link="http://gallery.menalto.com/modules.php?op=modload&amp;name=News&amp;file=article&amp;sid=134&amp;mode=thread&amp;order=0&amp;thold=0">Gallery Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1466">CVE-2004-1466</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 22 Aug 2004 09:02:45 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 25 Aug 2004 23:33:36 +0000">
+    chriswhite
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-06.xml b/xml/htdocs/security/en/glsa/glsa-200409-06.xml
new file mode 100644
index 00000000..2e296117
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-06.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-06">
+  <title>eGroupWare: Multiple XSS vulnerabilities</title>
+  <synopsis>
+    The eGroupWare software contains multiple cross site scripting
+    vulnerabilities.
+  </synopsis>
+  <product type="ebuild">eGroupWare</product>
+  <announced>September 02, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>61510</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/egroupware" auto="yes" arch="*">
+      <unaffected range="ge">1.0.00.004</unaffected>
+      <vulnerable range="le">1.0.00.003</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    eGroupWare is a suite of web-based group applications including
+    calendar, address book, messenger and email.
+    </p>
+  </background>
+  <description>
+    <p>
+    Joxean Koret recently discovered multiple cross site scripting
+    vulnerabilities in various modules for the eGroupWare suite. This
+    includes the calendar, address book, messenger and ticket modules.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    These vulnerabilities give an attacker the ability to inject and
+    execute malicious script code, potentially compromising the victim's
+    browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time. All users are encouraged to
+    upgrade to the latest available version of eGroupWare.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All eGroupWare users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=www-apps/egroupware-1.0.00.004&quot;
+    # emerge &quot;&gt;=www-apps/egroupware-1.0.00.004&quot;</code>
+  </resolution>
+  <references>
+    <uri link="https://sourceforge.net/forum/forum.php?forum_id=401807">eGroupWare Announcement</uri>
+    <uri link="http://www.securityfocus.com/archive/1/372603/2004-08-21/2004-08-27/0">Bugtraq Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1467">CVE-2004-1467</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed,  1 Sep 2004 13:44:57 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed,  1 Sep 2004 19:01:03 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-07.xml b/xml/htdocs/security/en/glsa/glsa-200409-07.xml
new file mode 100644
index 00000000..309c6aef
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-07.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-07">
+  <title>xv: Buffer overflows in image handling</title>
+  <synopsis>
+    xv contains multiple exploitable buffer overflows in the image handling
+    code.
+  </synopsis>
+  <product type="ebuild">xv</product>
+  <announced>September 03, 2004</announced>
+  <revised>September 03, 2004: 01</revised>
+  <bug>61619</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/xv" auto="yes" arch="*">
+      <unaffected range="ge">3.10a-r7</unaffected>
+      <vulnerable range="lt">3.10a-r7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xv is a multi-format image manipulation utility.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple buffer overflow and integer handling vulnerabilities have been
+    discovered in xv's image processing code. These vulnerabilities have been
+    found in the xvbmp.c, xviris.c, xvpcx.c and xvpm.c source files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker might be able to embed malicious code into an image, which
+    would lead to the execution of arbitrary code under the privileges of the
+    user viewing the image.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xv users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=media-gfx/xv-3.10a-r7"
+    # emerge ">=media-gfx/xv-3.10a-r7"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/372345/2004-08-15/2004-08-21/0">BugTraq Advisory</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0802">CAN-2004-0802</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu,  2 Sep 2004 20:38:02 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu,  2 Sep 2004 23:57:51 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-08.xml b/xml/htdocs/security/en/glsa/glsa-200409-08.xml
new file mode 100644
index 00000000..5fef8c7a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-08.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-08">
+  <title>Ruby: CGI::Session creates files insecurely</title>
+  <synopsis>
+    When used for CGI scripting, Ruby creates session files in /tmp with the
+    permissions of the default umask. Depending on that umask, local users may
+    be able to read sensitive data stored in session files.
+  </synopsis>
+  <product type="ebuild">dev-lang/ruby</product>
+  <announced>September 03, 2004</announced>
+  <revised>September 03, 2004: 01</revised>
+  <bug>60525</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-lang/ruby" auto="yes" arch="*">
+      <unaffected range="rge">1.6.8-r11</unaffected>
+      <unaffected range="rge">1.8.0-r7</unaffected>
+      <unaffected range="ge">1.8.2_pre2</unaffected>
+      <vulnerable range="lt">1.8.2_pre2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ruby is an Object Oriented, interpreted scripting language used for many
+    system scripting tasks. It can also be used for CGI web applications.
+    </p>
+  </background>
+  <description>
+    <p>
+    The CGI::Session::FileStore implementation (and presumably
+    CGI::Session::PStore), which allow data associated with a particular
+    Session instance to be written to a file, writes to a file in /tmp with no
+    regard for secure permissions. As a result, the file is left with whatever
+    the default umask permissions are, which commonly would allow other local
+    users to read the data from that session file.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Depending on the default umask, any data stored using these methods could
+    be read by other users on the system.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    By changing the default umask on the system to not permit read access to
+    other users (e.g. 0700), one can prevent these files from being readable by
+    other users.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ruby users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=dev-lang/ruby-your_version"
+    # emerge ">=dev-lang/ruby-your_version"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0755">CAN-2004-0755</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 28 Aug 2004 23:01:05 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed,  1 Sep 2004 04:27:07 +0000">
+    dmargoli
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-09.xml b/xml/htdocs/security/en/glsa/glsa-200409-09.xml
new file mode 100644
index 00000000..ee1fe863
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-09.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-09">
+  <title>MIT krb5: Multiple vulnerabilities</title>
+  <synopsis>
+    MIT krb5 contains several double-free vulnerabilities, potentially allowing
+    the execution of arbitrary code, as well as a denial of service
+    vulnerability.
+  </synopsis>
+  <product type="ebuild">mit-krb5</product>
+  <announced>September 06, 2004</announced>
+  <revised>September 06, 2004: 01</revised>
+  <bug>62417</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/mit-krb5" auto="yes" arch="*">
+      <unaffected range="ge">1.3.4</unaffected>
+      <vulnerable range="lt">1.3.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MIT krb5 is the free implementation of the Kerberos network authentication
+    protocol by the Massachusetts Institute of Technology.
+    </p>
+  </background>
+  <description>
+    <p>
+    The implementation of the Key Distribution Center (KDC) and the MIT krb5
+    library contain double-free vulnerabilities, making client programs as well
+    as application servers vulnerable.
+    </p>
+    <p>
+    The ASN.1 decoder library is vulnerable to a denial of service attack,
+    including the KDC.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    The double-free vulnerabilities could allow an attacker to execute
+    arbitrary code on a KDC host and hosts running krb524d or vulnerable
+    services. In the case of a KDC host, this can lead to a compromise of the
+    entire Kerberos realm. Furthermore, an attacker impersonating a legitimate
+    KDC or application server can potentially execute arbitrary code on
+    authenticating clients.
+    </p>
+    <p>
+    An attacker can cause a denial of service for a KDC or application server
+    and clients, the latter if impersonating a legitimate KDC or application
+    server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mit-krb5 users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-crypt/mit-krb5-1.3.4"
+    # emerge ">=app-crypt/mit-krb5-1.3.4"</code>
+  </resolution>
+  <references>
+    <uri link="http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2004-002-dblfree.txt">MIT krb5 Security Advisory 2004-002</uri>
+    <uri link="http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2004-003-asn1.txt">MIT krb5 Security Advisory 2004-003</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0642">CAN-2004-0642</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0643">CAN-2004-0643</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0644">CAN-2004-0644</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0772">CAN-2004-0772</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri,  3 Sep 2004 20:07:22 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat,  4 Sep 2004 16:18:26 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-10.xml b/xml/htdocs/security/en/glsa/glsa-200409-10.xml
new file mode 100644
index 00000000..e0d27a58
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-10.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-10">
+  <title>multi-gnome-terminal: Information leak</title>
+  <synopsis>
+    Active keystroke logging in multi-gnome-terminal has been discovered in
+    potentially world-readable files. This could allow any authorized user on
+    the system to read sensitive data, including passwords.
+  </synopsis>
+  <product type="ebuild">multi-gnome-terminal</product>
+  <announced>September 06, 2004</announced>
+  <revised>September 06, 2004: 01</revised>
+  <bug>62322</bug>
+  <access>local</access>
+  <affected>
+    <package name="x11-terms/multi-gnome-terminal" auto="yes" arch="*">
+      <unaffected range="ge">1.6.2-r1</unaffected>
+      <vulnerable range="lt">1.6.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    multi-gnome-terminal is an enhanced terminal emulator that is derived from
+    gnome-terminal.
+    </p>
+  </background>
+  <description>
+    <p>
+    multi-gnome-terminal contains debugging code that has been known to output
+    active keystrokes to a potentially unsafe location. Output has been seen to
+    show up in the '.xsession-errors' file in the users home directory. Since
+    this file is world-readable on many machines, this bug has the potential to
+    leak sensitive information to anyone using the system.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Any authorized user on the local machine has the ability to read any
+    critical data that has been entered into the terminal, including passwords.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All multi-gnome-terminal users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=x11-terms/multi-gnome-terminal-1.6.2-r1"
+    # emerge ">=x11-terms/multi-gnome-terminal-1.6.2-r1"</code>
+  </resolution>
+  <references/>
+  <metadata tag="requester" timestamp="Sun,  5 Sep 2004 20:51:40 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon,  6 Sep 2004 00:32:18 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon,  6 Sep 2004 17:31:16 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-11.xml b/xml/htdocs/security/en/glsa/glsa-200409-11.xml
new file mode 100644
index 00000000..ce39b680
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-11.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-11">
+  <title>star: Suid root vulnerability</title>
+  <synopsis>
+    star contains a suid root vulnerability which could potentially grant
+    unauthorized root access to an attacker.
+  </synopsis>
+  <product type="ebuild">star</product>
+  <announced>September 07, 2004</announced>
+  <revised>May 30, 2006: 03</revised>
+  <bug>61797</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-arch/star" auto="yes" arch="*">
+      <unaffected range="ge">1.5_alpha46</unaffected>
+      <vulnerable range="lt">1.5_alpha46</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    star is an enhanced tape archiver, much like tar, that is recognized
+    for it's speed as well as it's enhanced mt/rmt support.
+    </p>
+  </background>
+  <description>
+    <p>
+    A suid root vulnerability exists in versions of star that are
+    configured to use ssh for remote tape access.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Attackers with local user level access could potentially gain root
+    level access.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All star users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=app-arch/star-1.5_alpha46&quot;
+    # emerge &quot;&gt;=app-arch/star-1.5_alpha46&quot;</code>
+  </resolution>
+  <references>
+    <uri link="https://lists.berlios.de/pipermail/star-users/2004-August/000239.html">Star Mailing List Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0850">CVE-2004-0850</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri,  3 Sep 2004 20:05:50 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat,  4 Sep 2004 19:37:00 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue,  7 Sep 2004 20:59:47 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-12.xml b/xml/htdocs/security/en/glsa/glsa-200409-12.xml
new file mode 100644
index 00000000..4a3a7fa0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-12.xml
@@ -0,0 +1,100 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-12">
+  <title>ImageMagick, imlib, imlib2: BMP decoding buffer overflows</title>
+  <synopsis>
+    ImageMagick, imlib and imlib2 contain exploitable buffer overflow
+    vulnerabilities in the BMP image processing code.
+  </synopsis>
+  <product type="ebuild">imagemagick imlib</product>
+  <announced>September 08, 2004</announced>
+  <revised>September 08, 2004: 01</revised>
+  <bug>62309</bug>
+  <bug>62487</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/imagemagick" auto="yes" arch="*">
+      <unaffected range="ge">6.0.7.1</unaffected>
+      <vulnerable range="lt">6.0.7.1</vulnerable>
+    </package>
+    <package name="media-libs/imlib" auto="yes" arch="*">
+      <unaffected range="ge">1.9.14-r2</unaffected>
+      <vulnerable range="lt">1.9.14-r2</vulnerable>
+    </package>
+    <package name="media-libs/imlib2" auto="yes" arch="*">
+      <unaffected range="ge">1.1.2</unaffected>
+      <vulnerable range="lt">1.1.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ImageMagick is a suite of image manipulation utilities and libraries used
+    for a wide variety of image formats. imlib is a general image loading and
+    rendering library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Due to improper bounds checking, ImageMagick and imlib are vulnerable to a
+    buffer overflow when decoding runlength-encoded bitmaps. This bug can be
+    exploited using a specially-crafted BMP image and could potentially allow
+    remote code execution when this image is decoded by the user.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A specially-crafted runlength-encoded BMP could lead ImageMagick and imlib
+    to crash or potentially execute arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ImageMagick users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=media-gfx/imagemagick-6.0.7.1"
+    # emerge ">=media-gfx/imagemagick-6.0.7.1"</code>
+    <p>
+    All imlib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=media-libs/imlib-1.9.14-r2"
+    # emerge ">=media-libs/imlib-1.9.14-r2"</code>
+    <p>
+    All imlib2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=media-libs/imlib2-1.1.2"
+    # emerge ">=media-libs/imlib2-1.1.2"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0817">CAN-2004-0817</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0802">CAN-2004-0802</uri>
+    <uri link="http://studio.imagemagick.org/pipermail/magick-developers/2004-August/002011.html">ImageMagick Mailing List</uri>
+    <uri link="http://securitytracker.com/alerts/2004/Aug/1011104.html">SecurityTracker #1011104</uri>
+    <uri link="http://securitytracker.com/alerts/2004/Aug/1011105.html">SecurityTracker #1011105</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon,  6 Sep 2004 16:14:33 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon,  6 Sep 2004 23:42:01 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed,  8 Sep 2004 07:22:02 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-13.xml b/xml/htdocs/security/en/glsa/glsa-200409-13.xml
new file mode 100644
index 00000000..9cd8112e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-13.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-13">
+  <title>LHa: Multiple vulnerabilities</title>
+  <synopsis>
+    Several buffer overflows and a shell metacharacter command execution
+    vulnerability have been found in LHa. These vulnerabilities can be used to
+    execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">lha</product>
+  <announced>September 08, 2004</announced>
+  <revised>October 20, 2006: 02</revised>
+  <bug>62618</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/lha" auto="yes" arch="*">
+      <unaffected range="rge">114i-r4</unaffected>
+      <vulnerable range="rle">114i-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    LHa is a console-based program for packing and unpacking LHarc archives.
+    </p>
+  </background>
+  <description>
+    <p>
+    The command line argument as well as the archive parsing code of LHa lack
+    sufficient bounds checking. Furthermore, a shell meta character command
+    execution vulnerability exists in LHa, since it does no proper filtering on
+    directory names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Using a specially crafted command line argument or archive, an attacker can
+    cause a buffer overflow and could possibly run arbitrary code. The shell
+    meta character command execution could lead to the execution of arbitrary
+    commands by an attacker using directories containing shell meta characters
+    in their names.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All LHa users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-arch/lha-114i-r4"
+    # emerge ">=app-arch/lha-114i-r4"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0694">CAN-2004-0694</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0745">CAN-2004-0745</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0769">CAN-2004-0769</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0771">CAN-2004-0771</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed,  8 Sep 2004 13:12:24 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed,  8 Sep 2004 19:32:24 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-14.xml b/xml/htdocs/security/en/glsa/glsa-200409-14.xml
new file mode 100644
index 00000000..20b8715d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-14.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-14">
+  <title>Samba: Remote printing non-vulnerability</title>
+  <synopsis>
+    Samba has a bug with out of sequence print change notification requests,
+    but it cannot be used to perform a remote denial of service attack.
+  </synopsis>
+  <product type="ebuild">samba</product>
+  <announced>September 09, 2004</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>62476</bug>
+  <access>remote</access>
+  <affected>
+  </affected>
+  <background>
+    <p>
+    Samba is a freely available SMB/CIFS implementation which allows
+    seamless interoperability of file and print services to other SMB/CIFS
+    clients.
+    </p>
+  </background>
+  <description>
+    <p>
+    Due to a bug in the printer_notify_info() function, authorized users
+    could potentially crash their smbd process by sending improperly
+    handled print change notification requests in an invalid order. Windows
+    XP SP2 clients can trigger this behavior by sending a
+    FindNextPrintChangeNotify() request before previously sending a
+    FindFirstPrintChangeNotify() request.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    We incorrectly thought that this bug could be exploited to deny service
+    to all Samba users. It is not the case, this bug has no security impact
+    whatsoever. Many thanks to Jerry Carter from the Samba team for
+    correcting our mistake.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no need for a workaround.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Samba users can keep their current versions.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://samba.org/samba/history/samba-3.0.6.html">Samba Release Notes</uri>
+    <uri link="https://bugzilla.samba.org/show_bug.cgi?id=1520">Samba Bug #1520</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0829">CVE-2004-0829</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri,  3 Sep 2004 20:09:15 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat,  4 Sep 2004 18:44:38 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu,  9 Sep 2004 04:56:22 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-15.xml b/xml/htdocs/security/en/glsa/glsa-200409-15.xml
new file mode 100644
index 00000000..21e23529
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-15.xml
@@ -0,0 +1,99 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-15">
+  <title>Webmin, Usermin: Multiple vulnerabilities in Usermin</title>
+  <synopsis>
+    A vulnerability in the webmail function of Usermin could be used by an
+    attacker to execute shell code via a specially-crafted e-mail. A bug in the
+    installation script of Webmin and Usermin also allows a local user to
+    execute a symlink attack at installation time.
+  </synopsis>
+  <product type="ebuild">Usermin</product>
+  <announced>September 12, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>63167</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-admin/usermin" auto="yes" arch="*">
+      <unaffected range="ge">1.090</unaffected>
+      <vulnerable range="lt">1.090</vulnerable>
+    </package>
+    <package name="app-admin/webmin" auto="yes" arch="*">
+      <unaffected range="ge">1.160</unaffected>
+      <vulnerable range="lt">1.160</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Webmin and Usermin are web-based system administration consoles. Webmin
+    allows an administrator to easily configure servers and other features.
+    Usermin allows users to configure their own accounts, execute commands,
+    and read e-mail. The Usermin functionality, including webmail, is also
+    included in Webmin.
+    </p>
+  </background>
+  <description>
+    <p>
+    There is an input validation bug in the webmail feature of Usermin.
+    </p>
+    <p>
+    Additionally, the Webmin and Usermin installation scripts write to
+    /tmp/.webmin without properly checking if it exists first.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    The first vulnerability allows a remote attacker to inject arbitrary
+    shell code in a specially-crafted e-mail. This could lead to remote
+    code execution with the privileges of the user running Webmin or
+    Usermin.
+    </p>
+    <p>
+    The second could allow local users who know Webmin or Usermin is going
+    to be installed to have arbitrary files be overwritten by creating a
+    symlink by the name /tmp/.webmin that points to some target file, e.g.
+    /etc/passwd.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Usermin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=app-admin/usermin-1.090&quot;
+    # emerge &quot;&gt;=app-admin/usermin-1.090&quot;</code>
+    <p>
+    All Webmin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=app-admin/webmin-1.160&quot;
+    # emerge &quot;&gt;=app-admin/webmin-1.160&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://secunia.com/advisories/12488/">Secunia Advisory SA12488</uri>
+    <uri link="http://www.webmin.com/uchanges.html">Usermin Changelog</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0559">CVE-2004-0559</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1468">CVE-2004-1468</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 10 Sep 2004 12:32:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 11 Sep 2004 10:07:56 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 11 Sep 2004 16:34:02 +0000">
+    dmargoli
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-16.xml b/xml/htdocs/security/en/glsa/glsa-200409-16.xml
new file mode 100644
index 00000000..72873741
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-16.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-16">
+  <title>Samba: Denial of Service vulnerabilities</title>
+  <synopsis>
+    Two Denial of Service vulnerabilities have been found and fixed in Samba.
+  </synopsis>
+  <product type="ebuild">Samba</product>
+  <announced>September 13, 2004</announced>
+  <revised>September 13, 2004: 01</revised>
+  <access>remote</access>
+  <affected>
+    <package name="net-fs/samba" auto="yes" arch="*">
+      <unaffected range="ge">3.0.7</unaffected>
+      <unaffected range="lt">3.0</unaffected>
+      <vulnerable range="lt">3.0.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Samba is a freely available SMB/CIFS implementation which allows seamless
+    interoperability of file and print services to other SMB/CIFS clients. smbd
+    and nmbd are two daemons used by the Samba server.
+    </p>
+  </background>
+  <description>
+    <p>
+    There is a defect in smbd's ASN.1 parsing. A bad packet received during the
+    authentication request could throw newly-spawned smbd processes into an
+    infinite loop (CAN-2004-0807). Another defect was found in nmbd's
+    processing of mailslot packets, where a bad NetBIOS request could crash the
+    nmbd process (CAN-2004-0808).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted packets to trigger both
+    defects. The ASN.1 parsing issue can be exploited to exhaust all available
+    memory on the Samba host, potentially denying all service to that server.
+    The nmbd issue can be exploited to crash the nmbd process, resulting in a
+    Denial of Service condition on the Samba server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Samba 3.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-fs/samba-3.0.7"
+    # emerge ">=net-fs/samba-3.0.7"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0807">CAN-2004-0807</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0808">CAN-2004-0808</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 11 Sep 2004 15:16:21 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 13 Sep 2004 12:15:40 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-17.xml b/xml/htdocs/security/en/glsa/glsa-200409-17.xml
new file mode 100644
index 00000000..1eaad893
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-17.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-17">
+  <title>SUS: Local root vulnerability</title>
+  <synopsis>
+    SUS contains a string format bug that could lead to local privilege
+    escalation.
+  </synopsis>
+  <product type="ebuild">SUS</product>
+  <announced>September 14, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>63927</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-admin/sus" auto="yes" arch="*">
+      <unaffected range="ge">2.0.2-r1</unaffected>
+      <vulnerable range="lt">2.0.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SUS is a utility that allows regular users to be able to execute
+    certain commands as root.
+    </p>
+  </background>
+  <description>
+    <p>
+    Leon Juranic found a bug in the logging functionality of SUS that can
+    lead to local privilege escalation. A format string vulnerability
+    exists in the log() function due to an incorrect call to the syslog()
+    function.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker with local user privileges can potentially exploit this
+    vulnerability to gain root access.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SUS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=app-admin/sus-2.0.2-r1&quot;
+    # emerge &quot;&gt;=app-admin/sus-2.0.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://pdg.uow.edu.au/sus/CHANGES">SUS ChangeLog</uri>
+    <uri link="http://www.securityfocus.com/archive/1/375109/2004-09-11/2004-09-17/0">BugTraq Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1469">CVE-2004-1469</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 13 Sep 2004 21:20:06 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 14 Sep 2004 00:10:33 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 14 Sep 2004 10:08:46 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-18.xml b/xml/htdocs/security/en/glsa/glsa-200409-18.xml
new file mode 100644
index 00000000..802c527b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-18.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-18">
+  <title>cdrtools: Local root vulnerability in cdrecord if set SUID root</title>
+  <synopsis>
+    cdrecord, if manually set SUID root, is vulnerable to a local root exploit
+    allowing users to escalate privileges.
+  </synopsis>
+  <product type="ebuild">cdrtools</product>
+  <announced>September 14, 2004</announced>
+  <revised>September 14, 2004: 01</revised>
+  <bug>63187</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-cdr/cdrtools" auto="yes" arch="*">
+      <unaffected range="ge">2.01_alpha37-r1</unaffected>
+      <unaffected range="rge">2.01_alpha28-r2</unaffected>
+      <vulnerable range="le">2.01_alpha37</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The cdrtools package is a set of tools for CD recording, including the
+    popular cdrecord command-line utility.
+    </p>
+  </background>
+  <description>
+    <p>
+    Max Vozeler discovered that the cdrecord utility, when set to SUID root,
+    fails to drop root privileges before executing a user-supplied RSH program.
+    By default, Gentoo does not ship the cdrecord utility as SUID root and
+    therefore is not vulnerable. However, many users (and CD-burning
+    front-ends) set this manually after installation.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could specify a malicious program using the $RSH
+    environment variable and have it executed by the SUID cdrecord, resulting
+    in root privileges escalation.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    As a workaround, you could remove the SUID rights from your cdrecord
+    utility :
+    </p>
+    <code>
+    # chmod a-s /usr/bin/cdrecord</code>
+  </workaround>
+  <resolution>
+    <p>
+    All cdrtools users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-cdr/cdrtools-2.01_alpha37-r1"
+    # emerge ">=app-cdr/cdrtools-2.01_alpha37-r1"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0806">CAN-2004-0806</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 14 Sep 2004 07:01:02 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 14 Sep 2004 15:13:17 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 14 Sep 2004 20:25:30 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-19.xml b/xml/htdocs/security/en/glsa/glsa-200409-19.xml
new file mode 100644
index 00000000..0389b568
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-19.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-19">
+  <title>Heimdal: ftpd root escalation</title>
+  <synopsis>
+    Several bugs exist in the Heimdal ftp daemon which could allow a remote
+    attacker to gain root privileges.
+  </synopsis>
+  <product type="ebuild">heimdal</product>
+  <announced>September 16, 2004</announced>
+  <revised>September 16, 2004: 01</revised>
+  <bug>61412</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/heimdal" auto="yes" arch="*">
+      <unaffected range="ge">0.6.3</unaffected>
+      <vulnerable range="lt">0.6.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Heimdal is an implementation of Kerberos 5.
+    </p>
+  </background>
+  <description>
+    <p>
+    Przemyslaw Frasunek discovered several flaws in lukemftpd, which also apply
+    to Heimdal ftpd's out-of-band signal handling code.
+    </p>
+    <p>
+    Additionally, a potential vulnerability that could lead to Denial of
+    Service by the Key Distribution Center (KDC) has been fixed in this
+    version.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could be able to run arbitrary code with escalated
+    privileges, which can result in a total compromise of the server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Heimdal users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-crypt/heimdal-0.6.3"
+    # emerge ">=app-crypt/heimdal-0.6.3"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.pdc.kth.se/heimdal/advisory/2004-09-13/">Heimdal advisory</uri>
+    <uri link="http://www.frasunek.com/lukemftpd.txt">Advisory by Przemyslaw Frasunek</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0794">CAN-2004-0794</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 13 Sep 2004 14:06:46 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 16 Sep 2004 04:33:06 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-20.xml b/xml/htdocs/security/en/glsa/glsa-200409-20.xml
new file mode 100644
index 00000000..5d99f240
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-20.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-20">
+  <title>mpg123: Buffer overflow vulnerability</title>
+  <synopsis>
+    mpg123 decoding routines contain a buffer overflow bug that might
+    lead to arbitrary code execution.
+  </synopsis>
+  <product type="ebuild">mpg123</product>
+  <announced>September 16, 2004</announced>
+  <revised>September 16, 2004: 01</revised>
+  <bug>63079</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/mpg123" auto="yes" arch="*">
+      <unaffected range="ge">0.59s-r4</unaffected>
+      <vulnerable range="le">0.59s-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    mpg123 is a MPEG Audio Player.
+    </p>
+  </background>
+  <description>
+    <p>
+    mpg123 contains a buffer overflow in the code that handles layer2
+    decoding of media files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker can possibly exploit this bug with a specially-crafted mp3 or mp2 file
+    to execute arbitrary code with the permissions of the user running mpg123.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mpg123 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=media-sound/mpg123-0.59s-r4"
+    # emerge ">=media-sound/mpg123-0.59s-r4"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/374433/2004-09-05/2004-09-11/0">BugTraq Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0805">CAN-2004-0805</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 14 Sep 2004 21:37:49 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 15 Sep 2004 15:59:24 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 15 Sep 2004 18:43:15 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-21.xml b/xml/htdocs/security/en/glsa/glsa-200409-21.xml
new file mode 100644
index 00000000..32a238d3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-21.xml
@@ -0,0 +1,101 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-21">
+  <title>Apache 2, mod_dav: Multiple vulnerabilities</title>
+  <synopsis>
+    Several vulnerabilities have been found in Apache 2 and mod_dav for Apache
+    1.3 which could allow a remote attacker to cause a Denial of Service or a
+    local user to get escalated privileges.
+  </synopsis>
+  <product type="ebuild">apache</product>
+  <announced>September 16, 2004</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>62626</bug>
+  <bug>63948</bug>
+  <bug>64145</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="ge">2.0.51</unaffected>
+      <unaffected range="lt">2.0</unaffected>
+      <vulnerable range="lt">2.0.51</vulnerable>
+    </package>
+    <package name="net-www/mod_dav" auto="yes" arch="*">
+      <unaffected range="ge">1.0.3-r2</unaffected>
+      <vulnerable range="le">1.0.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP server is one of most popular web servers on the internet.
+    mod_ssl provides SSL v2/v3 and TLS v1 support for it and mod_dav is the
+    Apache module for Distributed Authoring and Versioning (DAV).
+    </p>
+  </background>
+  <description>
+    <p>
+    A potential infinite loop has been found in the input filter of mod_ssl
+    (CAN-2004-0748) as well as a possible segmentation fault in the
+    char_buffer_read function if reverse proxying to a SSL server is being used
+    (CAN-2004-0751). Furthermore, mod_dav, as shipped in Apache httpd 2 or
+    mod_dav 1.0.x for Apache 1.3, contains a NULL pointer dereference which can
+    be triggered remotely (CAN-2004-0809). The third issue is an input
+    validation error found in the IPv6 URI parsing routines within the apr-util
+    library (CAN-2004-0786). Additionally a possible buffer overflow has been
+    reported when expanding environment variables during the parsing of
+    configuration files (CAN-2004-0747).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could cause a Denial of Service either by aborting a SSL
+    connection in a special way, resulting in CPU consumption, by exploiting
+    the segmentation fault in mod_ssl or the mod_dav flaw. A remote attacker
+    could also crash a httpd child process by sending a specially crafted URI.
+    The last vulnerabilty could be used by a local user to gain the privileges
+    of a httpd child, if the server parses a carefully prepared .htaccess file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Apache 2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=www-servers/apache-2.0.51"
+    # emerge ">=www-servers/apache-2.0.51"</code>
+    <p>
+    All mod_dav users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-www/mod_dav-1.0.3-r2"
+    # emerge ">=net-www/mod_dav-1.0.3-r2"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0747">CAN-2004-0747</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0748">CAN-2004-0748</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0751">CAN-2004-0751</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0786">CAN-2004-0786</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0809">CAN-2004-0809</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu,  9 Sep 2004 04:54:03 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 10 Sep 2004 18:02:25 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 16 Sep 2004 20:45:09 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-22.xml b/xml/htdocs/security/en/glsa/glsa-200409-22.xml
new file mode 100644
index 00000000..12557420
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-22.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-22">
+  <title>phpGroupWare: XSS vulnerability in wiki module</title>
+  <synopsis>
+    The phpGroupWare software contains a cross site scripting vulnerability in
+    the wiki module.
+  </synopsis>
+  <product type="ebuild">phpGroupWare</product>
+  <announced>September 16, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>63063</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phpgroupware" auto="yes" arch="*">
+      <unaffected range="ge">0.9.16.003</unaffected>
+      <vulnerable range="lt">0.9.16.003</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpGroupWare is a web-based suite of group applications including
+    calendar, todo-list, addressbook, email, wiki, news headlines, and a
+    file manager.
+    </p>
+  </background>
+  <description>
+    <p>
+    Due to an input validation error, the wiki module in the phpGroupWare
+    suite is vulnerable to cross site scripting attacks.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    This vulnerability gives an attacker the ability to inject and execute
+    malicious script code, potentially compromising the victim's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    The is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpGroupWare users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=www-apps/phpgroupware-0.9.16.003&quot;
+    # emerge &quot;&gt;=www-apps/phpgroupware-0.9.16.003&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://downloads.phpgroupware.org/changelog">phpGroupWare ChangeLog</uri>
+    <uri link="http://secunia.com/advisories/12466/">Secunia Advisory SA12466</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0875">CVE-2004-0875</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 10 Sep 2004 12:36:45 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 12 Sep 2004 14:15:58 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 16 Sep 2004 21:55:15 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-23.xml b/xml/htdocs/security/en/glsa/glsa-200409-23.xml
new file mode 100644
index 00000000..717ee2e5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-23.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-23">
+  <title>SnipSnap: HTTP response splitting</title>
+  <synopsis>
+    SnipSnap is vulnerable to HTTP response splitting attacks such as web cache
+    poisoning, cross-user defacement, and cross-site scripting.
+  </synopsis>
+  <product type="ebuild">snipsnap</product>
+  <announced>September 17, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>64154</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/snipsnap-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.0_beta1</unaffected>
+      <vulnerable range="lt">1.0_beta1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SnipSnap is a user friendly content management system with features
+    such as wiki and weblog.
+    </p>
+  </background>
+  <description>
+    <p>
+    SnipSnap contains various HTTP response splitting vulnerabilities that
+    could potentially compromise the sites data. Some of these attacks
+    include web cache poisoning, cross-user defacement, hijacking pages
+    with sensitive user information, and cross-site scripting. This
+    vulnerability is due to the lack of illegal input checking in the
+    software.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A malicious user could inject and execute arbitrary script code,
+    potentially compromising the victim's data or browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SnipSnap users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=dev-java/snipsnap-bin-1.0_beta1&quot;
+    # emerge &quot;&gt;=dev-java/snipsnap-bin-1.0beta1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://snipsnap.org/space/start/2004-09-14/1#SnipSnap_1.0b1_(uttoxeter)_released">SnipSnap Release Notes</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1470">CVE-2004-1470</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 16 Sep 2004 20:00:37 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 16 Sep 2004 20:40:46 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-24.xml b/xml/htdocs/security/en/glsa/glsa-200409-24.xml
new file mode 100644
index 00000000..d42ed0e3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-24.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-24">
+  <title>Foomatic: Arbitrary command execution in foomatic-rip filter</title>
+  <synopsis>
+    The foomatic-rip filter in foomatic-filters contains a vulnerability which
+    may allow arbitrary command execution on the print server.
+  </synopsis>
+  <product type="ebuild">foomatic</product>
+  <announced>September 20, 2004</announced>
+  <revised>September 20, 2004: 01</revised>
+  <bug>64166</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-print/foomatic" auto="yes" arch="*">
+      <unaffected range="ge">3.0.2</unaffected>
+      <vulnerable range="le">3.0.1</vulnerable>
+    </package>
+    <package name="net-print/foomatic-filters" auto="yes" arch="*">
+      <unaffected range="ge">3.0.2</unaffected>
+      <vulnerable range="le">3.0.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Foomatic is a system for connecting printer drivers with spooler systems
+    such as CUPS and LPD. The foomatic-filters package contains wrapper scripts
+    which are designed to be used with Foomatic.
+    </p>
+  </background>
+  <description>
+    <p>
+    There is a vulnerability in the foomatic-filters package. This
+    vulnerability is due to insufficient checking of command-line parameters
+    and environment variables in the foomatic-rip filter.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    This vulnerability may allow both local and remote attackers to execute
+    arbitrary commands on the print server with the permissions of the spooler
+    (oftentimes the &quot;lp&quot; user).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All foomatic users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-print/foomatic-3.0.2"
+    # emerge ">=net-print/foomatic-3.0.2"</code>
+    <p>
+    PLEASE NOTE: You should update foomatic, instead of foomatic-filters. This
+    will help to ensure that all other foomatic components remain functional.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://www.linuxprinting.org/pipermail/foomatic-devel/2004q3/001996.html">Foomatic Announcement</uri>
+    <uri link="http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:094">Mandrakesoft Security Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0801">CAN 2004-0801</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 16 Sep 2004 17:39:12 +0000">
+    condordes
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 20 Sep 2004 01:02:29 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-25.xml b/xml/htdocs/security/en/glsa/glsa-200409-25.xml
new file mode 100644
index 00000000..0c0f8a57
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-25.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-25">
+  <title>CUPS: Denial of service vulnerability</title>
+  <synopsis>
+    A vulnerability in CUPS allows remote attackers to cause a denial of
+    service when sending a carefully-crafted UDP packet to the IPP port.
+  </synopsis>
+  <product type="ebuild">CUPS</product>
+  <announced>September 20, 2004</announced>
+  <revised>September 21, 2004: 02</revised>
+  <bug>64168</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-print/cups" auto="yes" arch="*">
+      <unaffected range="ge">1.1.20-r2</unaffected>
+      <vulnerable range="lt">1.1.20-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Common UNIX Printing System (CUPS) is a cross-platform print spooler.
+    </p>
+  </background>
+  <description>
+    <p>
+    Alvaro Martinez Echevarria discovered a hole in the CUPS Internet Printing
+    Protocol (IPP) implementation that allows remote attackers to cause CUPS to
+    stop listening on the IPP port.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote user with malicious intent can easily cause a denial of service to
+    the CUPS daemon by sending a specially-crafted UDP datagram packet to the
+    IPP port.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CUPS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-print/cups-1.1.20-r2"
+    # emerge ">=net-print/cups-1.1.20-r2"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cups.org/str.php?L863">CUPS Software Trouble Report</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0558">CAN-2004-0558</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 19 Sep 2004 06:22:23 +0000">
+    lewk
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 20 Sep 2004 00:58:55 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 20 Sep 2004 00:59:53 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-26.xml b/xml/htdocs/security/en/glsa/glsa-200409-26.xml
new file mode 100644
index 00000000..84d24725
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-26.xml
@@ -0,0 +1,121 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-26">
+  <title>Mozilla, Firefox, Thunderbird, Epiphany: New releases fix vulnerabilities</title>
+  <synopsis>
+    New releases of Mozilla, Epiphany, Mozilla Thunderbird, and Mozilla Firefox
+    fix several vulnerabilities, including the remote execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">Mozilla</product>
+  <announced>September 20, 2004</announced>
+  <revised>December 30, 2007: 03</revised>
+  <bug>63996</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla" auto="yes" arch="*">
+      <unaffected range="ge">1.7.3</unaffected>
+      <vulnerable range="lt">1.7.3</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">1.0_pre</unaffected>
+      <vulnerable range="lt">1.0_pre</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird" auto="yes" arch="*">
+      <unaffected range="ge">0.8</unaffected>
+      <vulnerable range="lt">0.8</vulnerable>
+    </package>
+    <package name="www-client/mozilla-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.7.3</unaffected>
+      <vulnerable range="lt">1.7.3</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.0_pre</unaffected>
+      <vulnerable range="lt">1.0_pre</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird-bin" auto="yes" arch="*">
+      <unaffected range="ge">0.8</unaffected>
+      <vulnerable range="lt">0.8</vulnerable>
+    </package>
+    <package name="www-client/epiphany" auto="yes" arch="*">
+      <unaffected range="ge">1.2.9-r1</unaffected>
+      <vulnerable range="lt">1.2.9-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla is a popular web browser that includes a mail and newsreader.
+    Epiphany is a web browser that uses Gecko, the Mozilla rendering
+    engine. Mozilla Firefox and Mozilla Thunderbird are respectively the
+    next-generation browser and mail client from the Mozilla project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mozilla-based products are vulnerable to multiple security issues.
+    Firstly routines handling the display of BMP images and VCards contain
+    an integer overflow and a stack buffer overrun. Specific pages with
+    long links, when sent using the "Send Page" function, and links with
+    non-ASCII hostnames could both cause heap buffer overruns.
+    </p>
+    <p>
+    Several issues were found and fixed in JavaScript rights handling:
+    untrusted script code could read and write to the clipboard, signed
+    scripts could build confusing grant privileges dialog boxes, and when
+    dragged onto trusted frames or windows, JavaScript links could access
+    information and rights of the target frame or window. Finally,
+    Mozilla-based mail clients (Mozilla and Mozilla Thunderbird) are
+    vulnerable to a heap overflow caused by invalid POP3 mail server
+    responses.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker might be able to run arbitrary code with the rights of the
+    user running the software by enticing the user to perform one of the
+    following actions: view a specially-crafted BMP image or VCard, use the
+    "Send Page" function on a malicious page, follow links with malicious
+    hostnames, drag multiple JavaScript links in a row to another window,
+    or connect to an untrusted POP3 mail server. An attacker could also use
+    a malicious page with JavaScript to disclose clipboard contents or
+    abuse previously-given privileges to request XPI installation
+    privileges through a confusing dialog.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround covering all vulnerabilities.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv your-version
+    # emerge your-version</code>
+  </resolution>
+  <references>
+    <uri link="http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3">Mozilla Security Advisory</uri>
+    <uri link="http://www.us-cert.gov/cas/techalerts/TA04-261A.html">US-CERT Security Alert TA04-261A</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0902">CVE-2004-0902</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0903">CVE-2004-0903</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0904">CVE-2004-0904</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0905">CVE-2004-0905</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0906">CVE-2004-0906</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0907">CVE-2004-0907</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0908">CVE-2004-0908</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0909">CVE-2004-0909</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 19 Sep 2004 12:09:02 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 20 Sep 2004 15:58:46 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-27.xml b/xml/htdocs/security/en/glsa/glsa-200409-27.xml
new file mode 100644
index 00000000..d2420686
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-27.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-27">
+  <title>glFTPd: Local buffer overflow vulnerability</title>
+  <synopsis>
+    glFTPd is vulnerable to a local buffer overflow which may allow arbitrary
+    code execution.
+  </synopsis>
+  <product type="ebuild">glftpd</product>
+  <announced>September 21, 2004</announced>
+  <revised>September 21, 2004: 01</revised>
+  <bug>64809</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-ftp/glftpd" auto="yes" arch="*">
+      <unaffected range="ge">1.32-r1</unaffected>
+      <vulnerable range="lt">1.32-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    glFTPd is a highly configurable FTP server with many features.
+    </p>
+  </background>
+  <description>
+    <p>
+    The glFTPd server is vulnerable to a buffer overflow in the 'dupescan'
+    program. This vulnerability is due to an unsafe strcpy() call which can
+    cause the program to crash when a large argument is passed.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local user with malicious intent can pass a parameter to the dupescan
+    program that exceeds the size of the buffer, causing it to overflow. This
+    can lead the program to crash, and potentially allow arbitrary code
+    execution with the permissions of the user running glFTPd, which could be
+    the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All glFTPd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-ftp/glftpd-1.32-r1"
+    # emerge ">=net-ftp/glftpd-1.32-r1"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/375775/2004-09-17/2004-09-23/0">BugTraq Advisory</uri>
+    <uri link="http://www.glftpd.com/modules.php?op=modload&amp;name=News&amp;file=article&amp;sid=23&amp;mode=thread&amp;order=0&amp;thold=0">glFTPd Announcement</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 21 Sep 2004 03:12:24 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 21 Sep 2004 03:12:31 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-28.xml b/xml/htdocs/security/en/glsa/glsa-200409-28.xml
new file mode 100644
index 00000000..809ad51e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-28.xml
@@ -0,0 +1,94 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-28">
+  <title>GTK+ 2, gdk-pixbuf: Multiple image decoding vulnerabilities</title>
+  <synopsis>
+    The GdkPixbuf library, which is also included in GTK+ 2, contains several
+    vulnerabilities that could lead to a Denial of Service or the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">gtk+</product>
+  <announced>September 21, 2004</announced>
+  <revised>September 21, 2004: 01</revised>
+  <bug>64230</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-libs/gtk+" auto="yes" arch="*">
+      <unaffected range="ge">2.4.9-r1</unaffected>
+      <unaffected range="lt">2.0.0</unaffected>
+      <vulnerable range="lt">2.4.9-r1</vulnerable>
+    </package>
+    <package name="media-libs/gdk-pixbuf" auto="yes" arch="*">
+      <unaffected range="ge">0.22.0-r3</unaffected>
+      <vulnerable range="lt">0.22.0-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GTK+ (GIMP Toolkit +) is a toolkit for creating graphical user interfaces.
+    The GdkPixbuf library provides facilities for image handling. It is
+    available as a standalone library as well as shipped with GTK+ 2.
+    </p>
+  </background>
+  <description>
+    <p>
+    A vulnerability has been discovered in the BMP image preprocessor
+    (CAN-2004-0753). Furthermore, Chris Evans found a possible integer overflow
+    in the pixbuf_create_from_xpm() function, resulting in a heap overflow
+    (CAN-2004-0782). He also found a potential stack-based buffer overflow in
+    the xpm_extract_color() function (CAN-2004-0783). A possible integer
+    overflow has also been found in the ICO decoder.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    With a specially crafted BMP image an attacker could cause an affected
+    application to enter an infinite loop when that image is being processed.
+    Also, by making use of specially crafted XPM or ICO images an attacker
+    could trigger the overflows, which potentially allows the execution of
+    arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GTK+ 2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=x11-libs/gtk+-2.4.9-r1"
+    # emerge ">=x11-libs/gtk+-2.4.9-r1"</code>
+    <p>
+    All GdkPixbuf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=media-libs/gdk-pixbuf-0.22.0-r3"
+    # emerge ">=media-libs/gdk-pixbuf-0.22.0-r3"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0753">CAN-2004-0753</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0782">CAN-2004-0782</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0783">CAN-2004-0783</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0788">CAN-2004-0788</uri>
+    <uri link="http://bugzilla.gnome.org/show_bug.cgi?id=150601">GNOME Bug 150601</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 20 Sep 2004 06:35:32 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 21 Sep 2004 11:29:51 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 21 Sep 2004 13:51:30 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-29.xml b/xml/htdocs/security/en/glsa/glsa-200409-29.xml
new file mode 100644
index 00000000..b4ee4902
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-29.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-29">
+  <title>FreeRADIUS: Multiple Denial of Service vulnerabilities</title>
+  <synopsis>
+    Multiple Denial of Service vulnerabilities were found and fixed in
+    FreeRADIUS.
+  </synopsis>
+  <product type="ebuild">FreeRADIUS</product>
+  <announced>September 22, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>60587</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dialup/freeradius" auto="yes" arch="*">
+      <unaffected range="ge">1.0.1</unaffected>
+      <vulnerable range="lt">1.0.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    FreeRADIUS is an open source RADIUS authentication server
+    implementation.
+    </p>
+  </background>
+  <description>
+    <p>
+    There are undisclosed defects in the way FreeRADIUS handles incorrect
+    received packets.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially-crafted packets to the
+    FreeRADIUS server to deny service to other users by crashing the
+    server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All FreeRADIUS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-dialup/freeradius-1.0.1&quot;
+    # emerge &quot;&gt;=net-dialup/freeradius-1.0.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.freeradius.org/security.html">FreeRADIUS Vulnerability Notifications</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0938">CVE-2004-0938</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0960">CVE-2004-0960</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0961">CVE-2004-0961</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 20 Sep 2004 13:27:45 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 20 Sep 2004 15:22:58 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 21 Sep 2004 11:24:01 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-30.xml b/xml/htdocs/security/en/glsa/glsa-200409-30.xml
new file mode 100644
index 00000000..a0cf7fa0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-30.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-30">
+  <title>xine-lib: Multiple vulnerabilities</title>
+  <synopsis>
+    xine-lib contains several vulnerabilities potentially allowing the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">xine-lib</product>
+  <announced>September 22, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>64348</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/xine-lib" auto="yes" arch="*">
+      <unaffected range="ge">1_rc6</unaffected>
+      <vulnerable range="le">1_rc5-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xine-lib is a multimedia library which can be utilized to create
+    multimedia frontends.
+    </p>
+  </background>
+  <description>
+    <p>
+    xine-lib contains two stack-based overflows and one heap-based
+    overflow. In the code reading VCD disc labels, the ISO disc label is
+    copied into an unprotected stack buffer of fixed size. Also, there is a
+    buffer overflow in the code that parses subtitles and prepares them for
+    display (XSA-2004-4). Finally, xine-lib contains a heap-based overflow
+    in the DVD sub-picture decoder (XSA-2004-5).
+    </p>
+    <p>
+    (Please note that the VCD MRL issue mentioned in XSA-2004-4 was fixed
+    with GLSA 200408-18.)
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    With carefully-crafted VCDs, DVDs, MPEGs or subtitles, an attacker may
+    cause xine-lib to execute arbitrary code with the permissions of the
+    user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xine-lib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=media-libs/xine-lib-1_rc6&quot;
+    # emerge &quot;&gt;=media-libs/xine-lib-1_rc6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/375485/2004-09-02/2004-09-08/0">BugTraq Announcement (XSA-2004-4)</uri>
+    <uri link="http://www.securityfocus.com/archive/1/375482/2004-09-02/2004-09-08/0">BugTraq Announcement (XSA-2004-5)</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1379">CVE-2004-1379</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1475">CVE-2004-1475</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1476">CVE-2004-1476</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 20 Sep 2004 06:34:44 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 21 Sep 2004 20:55:54 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 22 Sep 2004 11:19:16 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-31.xml b/xml/htdocs/security/en/glsa/glsa-200409-31.xml
new file mode 100644
index 00000000..f0ff35b6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-31.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-31">
+  <title>jabberd 1.x: Denial of Service vulnerability</title>
+  <synopsis>
+    The jabberd server was found to be vulnerable to a remote Denial of Service
+    attack.
+  </synopsis>
+  <product type="ebuild">jabberd</product>
+  <announced>September 23, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>64741</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/jabberd" auto="yes" arch="*">
+      <unaffected range="ge">1.4.3-r4</unaffected>
+      <vulnerable range="le">1.4.3-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Jabber is a set of streaming XML protocols enabling message, presence,
+    and other structured information exchange between two hosts. jabberd is
+    the original implementation of the Jabber protocol server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jose Antonio Calvo found a defect in routines handling XML parsing of
+    incoming data. jabberd 1.x may crash upon reception of invalid data on
+    any socket connection on which XML is parsed.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker may send a specific sequence of bytes to an open
+    socket to crash the jabberd server, resulting in a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All jabberd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-im/jabberd-1.4.3-r4&quot;
+    # emerge &quot;&gt;=net-im/jabberd-1.4.3-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.jabber.org/pipermail/jabberd/2004-September/002004.html">Vulnerability disclosure</uri>
+    <uri link="http://www.jabber.org/pipermail/jadmin/2004-September/018046.html">Jabber announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1378">CVE-2004-1378</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 21 Sep 2004 11:27:04 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 21 Sep 2004 15:51:07 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 22 Sep 2004 17:38:09 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-32.xml b/xml/htdocs/security/en/glsa/glsa-200409-32.xml
new file mode 100644
index 00000000..4a7af905
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-32.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-32">
+  <title>getmail: Filesystem overwrite vulnerability</title>
+  <synopsis>
+    getmail contains a vulnerability that could potentially allow any local
+    user to create or overwrite files in any directory on the system. This flaw
+    can be escalated further and possibly lead to a complete system compromise.
+  </synopsis>
+  <product type="ebuild">getmail</product>
+  <announced>September 23, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>64643</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-mail/getmail" auto="yes" arch="*">
+      <unaffected range="ge">4.2.0</unaffected>
+      <vulnerable range="lt">4.2.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    getmail is a reliable fetchmail replacement that supports Maildir,
+    Mboxrd and external MDA delivery.
+    </p>
+  </background>
+  <description>
+    <p>
+    David Watson discovered a vulnerability in getmail when it is
+    configured to run as root and deliver mail to the maildirs/mbox files
+    of untrusted local users. A malicious local user can then exploit a
+    race condition, or a similar symlink attack, and potentially cause
+    getmail to create or overwrite files in any directory on the system.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An untrusted local user could potentially create or overwrite files in
+    any directory on the system. This vulnerability may also be exploited
+    to have arbitrary commands executed as root.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not run getmail as a privileged user; or, in version 4, use an
+    external MDA with explicitly configured user and group privileges.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All getmail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-mail/getmail-4.2.0&quot;
+    # emerge &quot;&gt;=net-mail/getmail-4.2.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.qcc.ca/~charlesc/software/getmail-4/CHANGELOG">getmail ChangeLog</uri>
+    <uri link="http://article.gmane.org/gmane.mail.getmail.user/1430">getmail Mailing List</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0880">CVE-2004-0880</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0881">CVE-2004-0881</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 21 Sep 2004 21:51:14 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 21 Sep 2004 21:52:24 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-33.xml b/xml/htdocs/security/en/glsa/glsa-200409-33.xml
new file mode 100644
index 00000000..fc9ca4d1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-33.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-33">
+  <title>Apache: Exposure of protected directories</title>
+  <synopsis>
+    A bug in the way Apache handles the Satisfy directive can lead to the
+    exposure of protected directories to unauthorized users.
+  </synopsis>
+  <product type="ebuild">net=www/apache</product>
+  <announced>September 24, 2004</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>64804</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="ge">2.0.51-r1</unaffected>
+      <unaffected range="lt">2.0.51</unaffected>
+      <vulnerable range="eq">2.0.51</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP server is one of most popular web servers on the Internet.
+    </p>
+  </background>
+  <description>
+    <p>
+    A bug in the way Apache handles the Satisfy directive, which is used to
+    require that certain conditions (client host, client authentication, etc)
+    be met before access to a certain directory is granted, could allow the
+    exposure of protected directories to unauthorized clients.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    Directories containing protected data could be exposed to all visitors to
+    the webserver.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Apache users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=www-servers/apache-2.0.51-r1"
+    # emerge ">=www-servers/apache-2.0.51-r1"</code>
+  </resolution>
+  <references>
+    <uri link="http://issues.apache.org/bugzilla/show_bug.cgi?id=31315">Apache Bug #31315</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0811">CAN-2004-0811</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 21 Sep 2004 16:24:09 +0000">
+    dmargoli
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 24 Sep 2004 04:13:15 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-34.xml b/xml/htdocs/security/en/glsa/glsa-200409-34.xml
new file mode 100644
index 00000000..fa09ad28
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-34.xml
@@ -0,0 +1,98 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-34">
+  <title>X.org, XFree86: Integer and stack overflows in libXpm</title>
+  <synopsis>
+    libXpm, the X Pixmap library that is a part of the X Window System,
+    contains multiple stack and integer overflows that may allow a
+    carefully-crafted XPM file to crash applications linked against libXpm,
+    potentially allowing the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">X</product>
+  <announced>September 27, 2004</announced>
+  <revised>May 27, 2006: 02</revised>
+  <bug>64152</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-base/xorg-x11" auto="yes" arch="*">
+      <unaffected range="rge">6.7.0-r2</unaffected>
+      <unaffected range="ge">6.8.0-r1</unaffected>
+      <vulnerable range="lt">6.7.0-r2</vulnerable>
+      <vulnerable range="eq">6.8.0</vulnerable>
+    </package>
+    <package name="x11-base/xfree" auto="yes" arch="alpha x86">
+      <unaffected range="ge">4.3.0-r7</unaffected>
+      <vulnerable range="lt">4.3.0-r7</vulnerable>
+    </package>
+    <package name="x11-base/xfree" auto="yes" arch="amd64 hppa ia64 mips ppc sparc">
+      <vulnerable range="lt">4.3.0-r7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    XFree86 and X.org are both implementations of the X Window System.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Evans has discovered multiple integer and stack overflow
+    vulnerabilities in the X Pixmap library, libXpm, which is a part of the
+    X Window System. These overflows can be exploited by the execution of a
+    malicious XPM file, which can crash applications that are dependent on
+    libXpm.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A carefully-crafted XPM file could crash applications that are linked
+    against libXpm, potentially allowing the execution of arbitrary code
+    with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All X.org users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=x11-base/xorg-x11-6.7.0-r2&quot;
+    # emerge &quot;&gt;=x11-base/xorg-x11-6.7.0-r2&quot;</code>
+    <p>
+    All XFree86 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=x11-base/xfree-4.3.0-r7&quot;
+    # emerge &quot;&gt;=x11-base/xfree-4.3.0-r7&quot;</code>
+    <p>
+    Note: Usage of XFree86 is deprecated on the AMD64, HPPA, IA64, MIPS,
+    PPC and SPARC architectures: XFree86 users on those architectures
+    should switch to X.org rather than upgrading XFree86.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://freedesktop.org/pipermail/xorg/2004-September/003196.html">X.org Security Advisory</uri>
+    <uri link="http://freedesktop.org/pipermail/xorg/2004-September/003172.html">X11R6.8.1 Release Notes</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0687">CAN-2004-0687</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0688">CAN-2004-0688</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 18 Sep 2004 17:10:48 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 20 Sep 2004 05:29:54 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 26 Sep 2004 20:54:15 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200409-35.xml b/xml/htdocs/security/en/glsa/glsa-200409-35.xml
new file mode 100644
index 00000000..e211aff2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200409-35.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200409-35">
+  <title>Subversion: Metadata information leak</title>
+  <synopsis>
+    An information leak in mod_authz_svn could allow sensitive metadata of
+    protected areas to be leaked to unauthorized users.
+  </synopsis>
+  <product type="ebuild">Subversion</product>
+  <announced>September 29, 2004</announced>
+  <revised>September 29, 2004: 01</revised>
+  <bug>65085</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-util/subversion" auto="yes" arch="*">
+      <unaffected range="ge">1.0.8</unaffected>
+      <vulnerable range="lt">1.0.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Subversion is a versioning system designed to be a replacement for CVS.
+    mod_authz_svn is an Apache module to do path-based authentication for
+    Subversion repositories.
+    </p>
+  </background>
+  <description>
+    <p>
+    There is a bug in mod_authz_svn that causes it to reveal logged metadata
+    regarding commits to protected areas.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    Protected files themselves will not be revealed, but an attacker could use
+    the metadata to reveal the existence of protected areas, such as paths,
+    file versions, and the commit logs from those areas.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Rather than using mod_authz_svn, move protected areas into seperate
+    repositories and use native Apache authentication to make these
+    repositories unreadable.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Subversion users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=dev-util/subversion-1.0.8"
+    # emerge ">=dev-util/subversion-1.0.8"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0749">CAN-2004-0749</uri>
+    <uri link="http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt">Subversion Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 27 Sep 2004 08:34:50 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 27 Sep 2004 23:33:38 +0000">
+    dmargoli
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 29 Sep 2004 19:12:44 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-01.xml b/xml/htdocs/security/en/glsa/glsa-200410-01.xml
new file mode 100644
index 00000000..594b2fca
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-01.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-01">
+  <title>sharutils: Buffer overflows in shar.c and unshar.c</title>
+  <synopsis>
+    sharutils contains two buffer overflow vulnerabilities that could lead to
+    arbitrary code execution.
+  </synopsis>
+  <product type="ebuild">sharutils</product>
+  <announced>October 01, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>65773</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/sharutils" auto="yes" arch="*">
+      <unaffected range="ge">4.2.1-r10</unaffected>
+      <vulnerable range="le">4.2.1-r9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    sharutils contains utilities to manage shell archives.
+    </p>
+  </background>
+  <description>
+    <p>
+    sharutils contains two buffer overflows. Ulf Harnhammar discovered a
+    buffer overflow in shar.c, where the length of data returned by the wc
+    command is not checked. Florian Schilhabel discovered another buffer
+    overflow in unshar.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit these vulnerabilities to execute arbitrary
+    code as the user running one of the sharutils programs.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All sharutils users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=app-arch/sharutils-4.2.1-r10&quot;
+    # emerge &quot;&gt;=app-arch/sharutils-4.2.1-r10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=265904">Debian Bug #265904</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1773">CVE-2004-1773</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 30 Sep 2004 04:54:59 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 30 Sep 2004 18:01:09 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri,  1 Oct 2004 08:08:15 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-02.xml b/xml/htdocs/security/en/glsa/glsa-200410-02.xml
new file mode 100644
index 00000000..d5f185c4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-02.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-02">
+  <title>Netpbm: Multiple temporary file issues</title>
+  <synopsis>
+    Utilities included in old Netpbm versions are vulnerable to multiple
+    temporary files issues, potentially allowing a local attacker to overwrite
+    files with the rights of the user running the utility.
+  </synopsis>
+  <product type="ebuild">Netpbm</product>
+  <announced>October 04, 2004</announced>
+  <revised>October 04, 2004: 01</revised>
+  <bug>65647</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-libs/netpbm" auto="yes" arch="*">
+      <unaffected range="ge">10.0</unaffected>
+      <vulnerable range="le">9.12-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Netpbm is a toolkit containing more than 200 separate utilities for
+    manipulation and conversion of graphic images.
+    </p>
+  </background>
+  <description>
+    <p>
+    Utilities contained in the Netpbm package prior to the 9.25 version contain
+    defects in temporary file handling. They create temporary files with
+    predictable names without checking first that the target file doesn't
+    already exist.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary files
+    directory, pointing to a valid file somewhere on the filesystem. When a
+    user or a tool calls one of the affected utilities, this would result in
+    file overwriting with the rights of the user running the utility.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Netpbm users should upgrade to an unaffected version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=media-libs/netpbm-10.0"
+    # emerge ">=media-libs/netpbm-10.0"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0924">CVE-2003-0924</uri>
+    <uri link="http://www.kb.cert.org/vuls/id/487102">US-CERT VU#487102</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat,  2 Oct 2004 00:18:31 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun,  3 Oct 2004 10:07:45 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun,  3 Oct 2004 13:46:27 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-03.xml b/xml/htdocs/security/en/glsa/glsa-200410-03.xml
new file mode 100644
index 00000000..2ccace36
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-03.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-03">
+  <title>NetKit-telnetd: buffer overflows in telnet and telnetd</title>
+  <synopsis>
+    Buffer overflows exist in the telnet client and daemon provided by
+    netkit-telnetd, which could possibly allow a remote attacker to gain root
+    privileges and compromise the system.
+  </synopsis>
+  <product type="ebuild">netkit-telnetd</product>
+  <announced>October 05, 2004</announced>
+  <revised>October 05, 2004: 01</revised>
+  <bug>64632</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/netkit-telnetd" auto="yes" arch="*">
+      <unaffected range="ge">0.17-r4</unaffected>
+      <vulnerable range="le">0.17-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    NetKit-telnetd is a standard Linux telnet client and server from the NetKit
+    utilities.
+    </p>
+  </background>
+  <description>
+    <p>
+    A possible buffer overflow exists in the parsing of option strings by the
+    telnet daemon, where proper bounds checking is not applied when writing to
+    a buffer. Additionaly, another possible buffer overflow has been found by
+    Josh Martin in the handling of the environment variable HOME.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker sending a specially-crafted options string to the telnet
+    daemon could be able to run arbitrary code with the privileges of the user
+    running the telnet daemon, usually root. Furthermore, an attacker could
+    make use of an overlong HOME variable to cause a buffer overflow in the
+    telnet client, potentially leading to the local execution of arbitrary
+    code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All NetKit-telnetd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-misc/netkit-telnetd-0.17-r4"
+    # emerge ">=net-misc/netkit-telnetd-0.17-r4"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0554">CVE-2001-0554</uri>
+    <uri link="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=264846">Debian Bug #264846</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon,  4 Oct 2004 14:59:18 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon,  4 Oct 2004 16:13:52 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue,  5 Oct 2004 14:10:00 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-04.xml b/xml/htdocs/security/en/glsa/glsa-200410-04.xml
new file mode 100644
index 00000000..b3f504e3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-04.xml
@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-04">
+  <title>PHP: Memory disclosure and arbitrary location file upload</title>
+  <synopsis>
+    Two bugs in PHP may allow the disclosure of portions of memory and allow
+    remote attackers to upload files to arbitrary locations.
+  </synopsis>
+  <product type="ebuild">PHP</product>
+  <announced>October 06, 2004</announced>
+  <revised>October 06, 2004: 01</revised>
+  <bug>64223</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-php/php" auto="yes" arch="*">
+      <unaffected range="ge">4.3.9 </unaffected>
+      <vulnerable range="lt">4.3.9</vulnerable>
+    </package>
+    <package name="dev-php/mod_php" auto="yes" arch="*">
+      <unaffected range="ge">4.3.9</unaffected>
+      <vulnerable range="lt">4.3.9</vulnerable>
+    </package>
+    <package name="dev-php/php-cgi" auto="yes" arch="*">
+      <unaffected range="ge">4.3.9</unaffected>
+      <vulnerable range="lt">4.3.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHP is a general-purpose scripting language widely used to develop
+    web-based applications. It can run inside a web server using the mod_php
+    module or the CGI version of PHP, or can run stand-alone in a CLI.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefano Di Paola discovered two bugs in PHP. The first is a parse error in
+    php_variables.c that could allow a remote attacker to view the contents of
+    the target machine's memory. Additionally, an array processing error in the
+    SAPI_POST_HANDLER_FUNC() function inside rfc1867.c could lead to the
+    $_FILES array being overwritten.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit the first vulnerability to view memory
+    contents. On a server with a script that provides file uploads, an attacker
+    could exploit the second vulnerability to upload files to an arbitrary
+    location. On systems where the HTTP server is allowed to write in a
+    HTTP-accessible location, this could lead to remote execution of arbitrary
+    commands with the rights of the HTTP server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHP, mod_php and php-cgi users should upgrade to the latest stable
+    version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=dev-php/php-4.3.9"
+    # emerge ">=dev-php/php-4.3.9"
+
+    # emerge -pv ">=dev-php/mod_php-4.3.9"
+    # emerge ">=dev-php/mod_php-4.3.9"
+
+    # emerge -pv ">=dev-php/php-cgi-4.3.9"
+    # emerge ">=dev-php/php-cgi-4.3.9"</code>
+  </resolution>
+  <references>
+    <uri link="http://secunia.com/advisories/12560/">Secunia Advisory</uri>
+    <uri link="http://www.securityfocus.com/archive/1/375294">BugTraq post regarding the php_variables.c issue</uri>
+    <uri link="http://www.securityfocus.com/archive/1/375370">BugTraq post regarding the rfc1867.c issue</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 29 Sep 2004 20:40:17 +0000">
+    dmargoli
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 30 Sep 2004 20:25:12 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun,  3 Oct 2004 18:04:56 +0000">
+    dmargoli
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-05.xml b/xml/htdocs/security/en/glsa/glsa-200410-05.xml
new file mode 100644
index 00000000..8c119f80
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-05.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-05">
+  <title>Cyrus-SASL: Buffer overflow and SASL_PATH vulnerabilities</title>
+  <synopsis>
+    Cyrus-SASL contains two vulnerabilities that might allow an attacker to
+    completely compromise the vulnerable system.
+  </synopsis>
+  <product type="ebuild">Cyrus-SASL</product>
+  <announced>October 07, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>56016</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/cyrus-sasl" auto="yes" arch="*">
+      <unaffected range="ge">2.1.18-r2</unaffected>
+      <vulnerable range="le">2.1.18-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cyrus-SASL is an implementation of the Simple Authentication and
+    Security Layer.
+    </p>
+  </background>
+  <description>
+    <p>
+    Cyrus-SASL contains a remote buffer overflow in the digestmda5.c file.
+    Additionally, under certain conditions it is possible for a local user
+    to exploit a vulnerability in the way the SASL_PATH environment
+    variable is honored (CAN-2004-0884).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker might be able to execute arbitrary code with the Effective
+    ID of the application calling the Cyrus-SASL libraries.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cyrus-SASL users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=dev-libs/cyrus-sasl-2.1.18-r2&quot;
+    # emerge &quot;&gt;=dev-libs/cyrus-sasl-2.1.18-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0884">CAN-2004-0884</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0373">CVE-2005-0373</uri>
+  </references>
+  <metadata tag="submitter">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat,  2 Oct 2004 04:16:09 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-06.xml b/xml/htdocs/security/en/glsa/glsa-200410-06.xml
new file mode 100644
index 00000000..5d05ccda
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-06.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-06">
+  <title>CUPS: Leakage of sensitive information</title>
+  <synopsis>
+    CUPS leaks information about user names and passwords when using remote
+    printing to SMB-shared printers which require authentication.
+  </synopsis>
+  <product type="ebuild">cups</product>
+  <announced>October 09, 2004</announced>
+  <revised>October 09, 2004: 01</revised>
+  <bug>66501</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-print/cups" auto="yes" arch="*">
+      <unaffected range="rge">1.1.20-r3</unaffected>
+      <unaffected range="ge">1.1.21-r1</unaffected>
+      <vulnerable range="le">1.1.20-r2</vulnerable>
+      <vulnerable range="eq">1.1.21</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Common UNIX Printing System (CUPS) is a cross-platform print spooler.
+    </p>
+  </background>
+  <description>
+    <p>
+    When printing to a SMB-shared printer requiring authentication, CUPS leaks
+    the user name and password to a logfile.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local user could gain knowledge of sensitive authentication data.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CUPS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-print/cups-1.1.20-r3"
+    # emerge ">=net-print/cups-1.1.20-r3"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0923">CAN-2004-0923</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri,  8 Oct 2004 18:27:07 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri,  8 Oct 2004 21:07:38 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-07.xml b/xml/htdocs/security/en/glsa/glsa-200410-07.xml
new file mode 100644
index 00000000..78192739
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-07.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-07">
+  <title>ed: Insecure temporary file handling</title>
+  <synopsis>
+    The ed utility is vulnerable to symlink attacks, potentially allowing a
+    local user to overwrite or change rights on arbitrary files with the rights
+    of the user running ed, which could be the root user.
+  </synopsis>
+  <product type="ebuild">ed</product>
+  <announced>October 09, 2004</announced>
+  <revised>October 09, 2004: 01</revised>
+  <bug>66400</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-apps/ed" auto="yes" arch="*">
+      <unaffected range="ge">0.2-r4</unaffected>
+      <vulnerable range="le">0.2-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ed is a line-oriented text editor, used to create or modify text files,
+    both interactively and via shell scripts.
+    </p>
+  </background>
+  <description>
+    <p>
+    ed insecurely creates temporary files in world-writeable directories with
+    predictable names. Given that ed is used in various system shell scripts,
+    they are by extension affected by the same vulnerability.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary files
+    directory, pointing to a valid file somewhere on the filesystem. When ed is
+    called, this would result in file access with the rights of the user
+    running the utility, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ed users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=sys-apps/ed-0.2-r4"
+    # emerge ">=sys-apps/ed-0.2-r4"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1137">CVE-2000-1137</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri,  8 Oct 2004 21:10:12 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri,  8 Oct 2004 21:10:49 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat,  9 Oct 2004 09:43:17 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-08.xml b/xml/htdocs/security/en/glsa/glsa-200410-08.xml
new file mode 100644
index 00000000..d9e7e5de
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-08.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-08">
+  <title>ncompress: Buffer overflow</title>
+  <synopsis>
+    compress and uncompress, which could be used by daemon programs, contain a
+    buffer overflow that could lead to remote execution of arbitrary code with
+    the rights of the daemon process.
+  </synopsis>
+  <product type="ebuild">ncompress</product>
+  <announced>October 09, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>66251</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/ncompress" auto="yes" arch="*">
+      <unaffected range="ge">4.2.4-r1</unaffected>
+      <vulnerable range="le">4.2.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ncompress is a utility handling compression and decompression of
+    Lempel-Ziv archives, compatible with the original *nix compress and
+    uncompress utilities (.Z extensions).
+    </p>
+  </background>
+  <description>
+    <p>
+    compress and uncompress do not properly check bounds on command line
+    options, including the filename. Large parameters would trigger a
+    buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By supplying a carefully crafted filename or other option, an attacker
+    could execute arbitrary code on the system. A local attacker could only
+    execute code with his own rights, but since compress and uncompress are
+    called by various daemon programs, this might also allow a remote
+    attacker to execute code with the rights of the daemon making use of
+    ncompress.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ncompress users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=app-arch/ncompress-4.2.4-r1&quot;
+    # emerge &quot;&gt;=app-arch/ncompress-4.2.4-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.kb.cert.org/vuls/id/176363">US-CERT Vulnerability Note VU#176363</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1413">CVE-2001-1413</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri,  8 Oct 2004 21:09:39 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri,  8 Oct 2004 21:11:15 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat,  9 Oct 2004 10:24:20 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-09.xml b/xml/htdocs/security/en/glsa/glsa-200410-09.xml
new file mode 100644
index 00000000..4673dfd3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-09.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-09">
+  <title>LessTif: Integer and stack overflows in libXpm</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in libXpm, which is included
+    in LessTif, that can potentially lead to remote code execution.
+  </synopsis>
+  <product type="ebuild">lesstif</product>
+  <announced>October 09, 2004</announced>
+  <revised>October 09, 2004: 01</revised>
+  <bug>66647</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-libs/lesstif" auto="yes" arch="*">
+      <unaffected range="ge">0.93.97</unaffected>
+      <vulnerable range="lt">0.93.97</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    LessTif is a clone of OSF/Motif, which is the standard user interface
+    toolkit available on Unix and Linux.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Evans has discovered various integer and stack overflows in libXpm,
+    which is shipped as a part of the X Window System. LessTif, an application
+    that includes this library, is susceptible to the same issues.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A carefully-crafted XPM file could crash applications that are linked
+    against libXpm, such as LessTif, potentially allowing the execution of
+    arbitrary code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All LessTif users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=x11-libs/lesstif-0.93.97"
+    # emerge ">=x11-libs/lesstif-0.93.97"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0687">CAN-2004-0687</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0688">CAN-2004-0688</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200409-34.xml">GLSA-200409-34</uri>
+    <uri link="http://www.lesstif.org/ReleaseNotes.html">LessTif Release Notes</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri,  8 Oct 2004 16:33:39 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat,  9 Oct 2004 05:48:24 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-10.xml b/xml/htdocs/security/en/glsa/glsa-200410-10.xml
new file mode 100644
index 00000000..b17382f5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-10.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-10">
+  <title>gettext: Insecure temporary file handling</title>
+  <synopsis>
+    The gettext utility is vulnerable to symlink attacks, potentially allowing
+    a local user to overwrite or change permissions on arbitrary files with the
+    rights of the user running gettext, which could be the root user.
+  </synopsis>
+  <product type="ebuild">gettext</product>
+  <announced>October 10, 2004</announced>
+  <revised>May 22, 2006: 04</revised>
+  <bug>66355</bug>
+  <bug>85766</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-devel/gettext" auto="yes" arch="*">
+      <unaffected range="ge">0.14.1-r1</unaffected>
+      <unaffected range="rge">0.12.1-r2</unaffected>
+      <vulnerable range="lt">0.14.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    gettext is a set of utilities for the GNU Translation Project which
+    provides a set of tools and documentation to help produce multi-lingual
+    messages in programs.
+    </p>
+  </background>
+  <description>
+    <p>
+    gettext insecurely creates temporary files in world-writeable
+    directories with predictable names.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A local attacker could create symbolic links in the temporary files
+    directory, pointing to a valid file somewhere on the filesystem. When
+    gettext is called, this would result in file access with the rights of
+    the user running the utility, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All gettext users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-devel/gettext-0.14.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/advisories/7263">BugTraq Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0966">CVE-2004-0966</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 10 Oct 2004 10:51:13 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 10 Oct 2004 10:51:21 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 10 Oct 2004 21:46:28 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-11.xml b/xml/htdocs/security/en/glsa/glsa-200410-11.xml
new file mode 100644
index 00000000..c4e42bfb
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-11.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-11">
+  <title>tiff: Buffer overflows in image decoding</title>
+  <synopsis>
+    Multiple heap-based overflows have been found in the tiff library image
+    decoding routines, potentially allowing to execute arbitrary code with the
+    rights of the user viewing a malicious image.
+  </synopsis>
+  <product type="ebuild">tiff</product>
+  <announced>October 13, 2004</announced>
+  <revised>October 13, 2004: 01</revised>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/tiff" auto="yes" arch="*">
+      <unaffected range="ge">3.6.1-r2</unaffected>
+      <vulnerable range="lt">3.6.1-r2</vulnerable>
+    </package>
+    <package name="media-gfx/xv" auto="yes" arch="*">
+      <unaffected range="ge">3.10a-r8</unaffected>
+      <vulnerable range="le">3.10a-r7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The tiff library contains encoding and decoding routines for the Tag Image
+    File Format. It is called by numerous programs, including GNOME and KDE, to
+    help in displaying TIFF images. xv is a multi-format image manipulation
+    utility that is statically linked to the tiff library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Evans found heap-based overflows in RLE decoding routines in
+    tif_next.c, tif_thunder.c and potentially tif_luv.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to view a carefully crafted TIFF
+    image file, which would potentially lead to execution of arbitrary code
+    with the rights of the user viewing the image. This affects any program
+    that makes use of the tiff library, including GNOME and KDE web browsers or
+    mail readers.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All tiff library users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=media-libs/tiff-3.6.1-r2"
+    # emerge ">=media-libs/tiff-3.6.1-r2"</code>
+    <p>
+    xv makes use of the tiff library and needs to be recompiled to receive the
+    new patched version of the library. All xv users should also upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=media-gfx/xv-3.10a-r8"
+    # emerge ">=media-gfx/xv-3.10a-r8"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0803">CAN-2004-0803</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 11 Oct 2004 13:05:01 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 13 Oct 2004 14:38:12 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-12.xml b/xml/htdocs/security/en/glsa/glsa-200410-12.xml
new file mode 100644
index 00000000..2887a46a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-12.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-12">
+  <title>WordPress: HTTP response splitting and XSS vulnerabilities</title>
+  <synopsis>
+    WordPress contains HTTP response splitting and cross-site scripting
+    vulnerabilities.
+  </synopsis>
+  <product type="ebuild">wordpress</product>
+  <announced>October 14, 2004</announced>
+  <revised>May 22, 2006: 04</revised>
+  <bug>65798</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/wordpress" auto="yes" arch="*">
+      <unaffected range="ge">1.2.2</unaffected>
+      <vulnerable range="lt">1.2.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    WordPress is a PHP and MySQL based content management and publishing
+    system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Due to the lack of input validation in the administration panel
+    scripts, WordPress is vulnerable to HTTP response splitting and
+    cross-site scripting attacks.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A malicious user could inject arbitrary response data, leading to
+    content spoofing, web cache poisoning and other cross-site scripting or
+    HTTP response splitting attacks. This could result in compromising the
+    victim's data or browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All WordPress users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/wordpress-1.2.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://wordpress.org/development/2004/12/one-point-two-two/">WordPress 1.2.2 Release Notes</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1584">CVE-2004-1584</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 12 Oct 2004 11:43:21 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 12 Oct 2004 11:44:27 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 12 Oct 2004 21:40:26 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-13.xml b/xml/htdocs/security/en/glsa/glsa-200410-13.xml
new file mode 100644
index 00000000..b2d4ea98
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-13.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-13">
+  <title>BNC: Input validation flaw</title>
+  <synopsis>
+    BNC contains an input validation flaw which might allow a remote attacker
+    to issue arbitrary IRC related commands.
+  </synopsis>
+  <product type="ebuild">bnc</product>
+  <announced>October 15, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>66912</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-irc/bnc" auto="yes" arch="*">
+      <unaffected range="ge">2.8.9</unaffected>
+      <vulnerable range="lt">2.8.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    BNC is an IRC proxying server
+    </p>
+  </background>
+  <description>
+    <p>
+    A flaw exists in the input parsing of BNC where part of the
+    sbuf_getmsg() function handles the backspace character incorrectly.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote user could issue commands using fake authentication
+    credentials and possibly gain access to scripts running on the client
+    side.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All BNC users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-irc/bnc-2.8.9&quot;
+    # emerge &quot;&gt;=net-irc/bnc-2.8.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gotbnc.com/changes.html#2.8.9">BNC Changes</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1482">CVE-2004-1482</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 12 Oct 2004 11:44:17 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 12 Oct 2004 11:44:35 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 13 Oct 2004 08:51:33 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-14.xml b/xml/htdocs/security/en/glsa/glsa-200410-14.xml
new file mode 100644
index 00000000..6e331245
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-14.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-14">
+  <title>phpMyAdmin: Vulnerability in MIME-based transformation system</title>
+  <synopsis>
+    A vulnerability has been found in the MIME-based transformation system of
+    phpMyAdmin, which may allow remote execution of arbitrary commands if PHP's
+    "safe mode" is disabled.
+  </synopsis>
+  <product type="ebuild">phpMyAdmin</product>
+  <announced>October 18, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>67409</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/phpmyadmin" auto="yes" arch="*">
+      <unaffected range="ge">2.6.0_p2</unaffected>
+      <vulnerable range="lt">2.6.0_p2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpMyAdmin is a popular web-based MySQL administration tool written in
+    PHP. It allows users to browse and administer a MySQL database from a
+    web-browser. Transformations are a phpMyAdmin feature allowing plug-ins
+    to rewrite the contents of any column seen in phpMyAdmin's Browsing
+    mode, including using insertion of PHP or JavaScript code.
+    </p>
+  </background>
+  <description>
+    <p>
+    A defect was found in phpMyAdmin's MIME-based transformation system,
+    when used with "external" transformations.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this vulnerability to execute arbitrary
+    commands on the server with the rights of the HTTP server user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Enabling PHP safe mode ("safe_mode = On" in php.ini) may serve as a
+    temporary workaround.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpMyAdmin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=dev-db/phpmyadmin-2.6.0_p2&quot;
+    # emerge &quot;&gt;=dev-db/phpmyadmin-2.6.0_p2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://sourceforge.net/forum/forum.php?forum_id=414281">phpMyAdmin 2.6.0_pl2 Release Announcement</uri>
+    <uri link="http://secunia.com/advisories/12813/">Secunia Advisory SA12813</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2630">CVE-2004-2630</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 14 Oct 2004 19:19:23 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 16 Oct 2004 10:34:28 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 17 Oct 2004 17:40:28 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-15.xml b/xml/htdocs/security/en/glsa/glsa-200410-15.xml
new file mode 100644
index 00000000..8dd7093c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-15.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-15">
+  <title>Squid: Remote DoS vulnerability</title>
+  <synopsis>
+    Squid contains a vulnerability in the SNMP module which may lead to a
+    denial of service.
+  </synopsis>
+  <product type="ebuild">squid</product>
+  <announced>October 18, 2004</announced>
+  <revised>December 30, 2007: 03</revised>
+  <bug>67167</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-proxy/squid" auto="yes" arch="*">
+      <unaffected range="ge">2.5.7</unaffected>
+      <vulnerable range="lt">2.5.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Squid is a full-featured Web proxy cache designed to run on Unix
+    systems. It supports proxying and caching of HTTP, FTP, and other URLs,
+    as well as SSL support, cache hierarchies, transparent caching, access
+    control lists and many other features.
+    </p>
+  </background>
+  <description>
+    <p>
+    A parsing error exists in the SNMP module of Squid where a
+    specially-crafted UDP packet can potentially cause the server to
+    restart, closing all current connections. This vulnerability only
+    exists in versions of Squid compiled with the 'snmp' USE flag.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker can repeatedly send these malicious UDP packets to the
+    Squid server, leading to a denial of service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable SNMP support or filter the port that has SNMP processing
+    (default is 3401) to allow only SNMP data from trusted hosts.
+    </p>
+    <p>
+    To disable SNMP support put the entry snmp_port 0 in the squid.conf
+    configuration file.
+    </p>
+    <p>
+    To allow only the local interface to process SNMP, add the entry
+    "snmp_incoming_address 127.0.0.1" in the squid.conf configuration file.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Squid users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=net-proxy/squid-2.5.7&quot;
+    # emerge &quot;&gt;=net-proxy/squid-2.5.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.idefense.com/application/poi/display?id=152&amp;type=vulnerabilities&amp;flashstatus=true">iDEFENSE Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0918">CVE-2004-0918</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 17 Oct 2004 17:38:48 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 17 Oct 2004 17:38:55 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 17 Oct 2004 18:44:11 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-16.xml b/xml/htdocs/security/en/glsa/glsa-200410-16.xml
new file mode 100644
index 00000000..0bf02a47
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-16.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-16">
+  <title>PostgreSQL: Insecure temporary file use in make_oidjoins_check</title>
+  <synopsis>
+    The make_oidjoins_check script, part of the PostgreSQL package, is
+    vulnerable to symlink attacks, potentially allowing a local user to
+    overwrite arbitrary files with the rights of the user running the utility.
+  </synopsis>
+  <product type="ebuild">PostgreSQL</product>
+  <announced>October 18, 2004</announced>
+  <revised>May 28, 2009: 04</revised>
+  <bug>66371</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-db/postgresql" auto="yes" arch="*">
+      <unaffected range="ge">7.4.5-r2</unaffected>
+      <unaffected range="rge">7.3.7-r2</unaffected>
+      <unaffected range="rge">7.3.15</unaffected>
+      <unaffected range="rge">7.3.16</unaffected>
+      <unaffected range="rge">7.3.18</unaffected>
+      <unaffected range="rge">7.3.21</unaffected>
+      <vulnerable range="le">7.4.5-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PostgreSQL is an open source database based on the POSTGRES database
+    management system. It includes several contributed scripts including
+    the make_oidjoins_check script.
+    </p>
+  </background>
+  <description>
+    <p>
+    The make_oidjoins_check script insecurely creates temporary files in
+    world-writeable directories with predictable names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary files
+    directory, pointing to a valid file somewhere on the filesystem. When
+    make_oidjoins_check is called, this would result in file overwrite with
+    the rights of the user running the utility, which could be the root
+    user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PostgreSQL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=dev-db/postgresql-7.4.5-r2&quot;
+    # emerge &quot;&gt;=dev-db/postgresql-7.4.5-r2&quot;</code>
+    <p>
+    Upgrade notes: PostgreSQL 7.3.x users should upgrade to the latest
+    available 7.3.x version to retain database compatibility.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://www.trustix.org/errata/2004/0050/">Trustix Advisory #2004-0050</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0977">CVE-2004-0977</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 18 Oct 2004 13:31:59 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 18 Oct 2004 13:32:56 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-17.xml b/xml/htdocs/security/en/glsa/glsa-200410-17.xml
new file mode 100644
index 00000000..b006688b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-17.xml
@@ -0,0 +1,102 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-17">
+  <title>OpenOffice.org: Temporary files disclosure</title>
+  <synopsis>
+    OpenOffice.org uses insecure temporary files which could allow a malicious
+    local user to gain knowledge of sensitive information from other users'
+    documents.
+  </synopsis>
+  <product type="ebuild">openoffice</product>
+  <announced>October 20, 2004</announced>
+  <revised>October 20, 2004: 01</revised>
+  <bug>63556</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-office/openoffice" auto="yes" arch="*">
+      <unaffected range="lt">1.1.2</unaffected>
+      <unaffected range="ge">1.1.3</unaffected>
+      <vulnerable range="eq">1.1.2</vulnerable>
+    </package>
+    <package name="app-office/openoffice-bin" auto="yes" arch="*">
+      <unaffected range="lt">1.1.2</unaffected>
+      <unaffected range="ge">1.1.3</unaffected>
+      <vulnerable range="eq">1.1.2</vulnerable>
+    </package>
+    <package name="app-office/openoffice-ximian" auto="yes" arch="*">
+      <unaffected range="lt">1.1.60</unaffected>
+      <unaffected range="ge">1.3.4</unaffected>
+      <vulnerable range="eq">1.1.60</vulnerable>
+      <vulnerable range="eq">1.1.61</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenOffice.org is an office productivity suite, including word processing,
+    spreadsheets, presentations, drawings, data charting, formula editing, and
+    file conversion facilities.
+    </p>
+  </background>
+  <description>
+    <p>
+    On start-up, OpenOffice.org 1.1.2 creates a temporary directory with
+    insecure permissions. When a document is saved, a compressed copy of it can
+    be found in that directory.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A malicious local user could obtain the temporary files and thus read
+    documents belonging to other users.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All affected OpenOffice.org users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-office/openoffice-1.1.3"
+    # emerge ">=app-office/openoffice-1.1.3"</code>
+    <p>
+    All affected OpenOffice.org binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-office/openoffice-bin-1.1.3"
+    # emerge ">=app-office/openoffice-bin-1.1.3"</code>
+    <p>
+    All affected OpenOffice.org Ximian users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-office/openoffice-ximian-1.3.4"
+    # emerge ">=app-office/openoffice-1.3.4"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0752">CAN-2004-0752</uri>
+    <uri link="http://www.openoffice.org/issues/show_bug.cgi?id=33357">OpenOffice.org Issue 33357</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 18 Oct 2004 17:29:15 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 19 Oct 2004 09:04:12 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 19 Oct 2004 12:14:40 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-18.xml b/xml/htdocs/security/en/glsa/glsa-200410-18.xml
new file mode 100644
index 00000000..c878f711
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-18.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-18">
+  <title>Ghostscript: Insecure temporary file use in multiple scripts</title>
+  <synopsis>
+    Multiple scripts in the Ghostscript package are vulnerable to symlink
+    attacks, potentially allowing a local user to overwrite arbitrary files
+    with the rights of the user running the script.
+  </synopsis>
+  <product type="ebuild">Ghostscript</product>
+  <announced>October 20, 2004</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>66357</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-text/ghostscript-esp" auto="yes" arch="*">
+      <unaffected range="ge">7.07.1-r7</unaffected>
+      <unaffected range="rge">7.05.6-r2</unaffected>
+      <vulnerable range="lt">7.07.1-r7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ghostscript is a software package providing an interpreter for the
+    PostScript language and the PDF file format. It also provides output
+    drivers for various file formats and printers.
+    </p>
+  </background>
+  <description>
+    <p>
+    The pj-gs.sh, ps2epsi, pv.sh and sysvlp.sh scripts create temporary files
+    in world-writeable directories with predictable names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary files
+    directory, pointing to a valid file somewhere on the filesystem. When an
+    affected script is called, this would result in the file to be overwritten
+    with the rights of the user running the script, which could be the root
+    user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Ghostscript users on all architectures except PPC should upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-text/ghostscript-esp-7.07.1-r7"
+    # emerge ">=app-text/ghostscript-esp-7.07.1-r7"</code>
+    <p>
+    Ghostscript users on the PPC architecture should upgrade to the latest
+    stable version on their architecture:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=app-text/ghostscript-esp-7.05.6-r2"
+    # emerge ">=app-text/ghostscript-esp-7.05.6-r2"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0967">CAN-2004-0967</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 19 Oct 2004 12:27:11 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 19 Oct 2004 12:27:18 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-19.xml b/xml/htdocs/security/en/glsa/glsa-200410-19.xml
new file mode 100644
index 00000000..ad9e6b22
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-19.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-19">
+  <title>glibc: Insecure tempfile handling in catchsegv script</title>
+  <synopsis>
+    The catchsegv script in the glibc package is vulnerable to symlink attacks,
+    potentially allowing a local user to overwrite arbitrary files with the
+    rights of the user running the script.
+  </synopsis>
+  <product type="ebuild">glibc</product>
+  <announced>October 21, 2004</announced>
+  <revised>October 21, 2004: 01</revised>
+  <bug>66358</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-libs/glibc" auto="yes" arch="*">
+      <unaffected range="rge">2.2.5-r9</unaffected>
+      <unaffected range="rge">2.3.2-r12</unaffected>
+      <unaffected range="rge">2.3.3.20040420-r2</unaffected>
+      <unaffected range="rge">2.3.4.20040619-r2</unaffected>
+      <unaffected range="ge">2.3.4.20040808-r1</unaffected>
+      <vulnerable range="le">2.3.4.20040808</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    glibc is a package that contains the GNU C library.
+    </p>
+  </background>
+  <description>
+    <p>
+    The catchsegv script creates temporary files in world-writeable directories
+    with predictable names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary files
+    directory, pointing to a valid file somewhere on the filesystem. When
+    catchsegv script is called, this would result in the file being overwritten
+    with the rights of the user running the utility, which could be the root
+    user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All glibc users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv sys-libs/glibc
+    # emerge sys-libs/glibc</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0968">CAN-2004-0968</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 20 Oct 2004 14:29:16 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 20 Oct 2004 14:29:39 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 20 Oct 2004 16:11:58 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-20.xml b/xml/htdocs/security/en/glsa/glsa-200410-20.xml
new file mode 100644
index 00000000..1fd20d59
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-20.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-20">
+  <title>Xpdf, CUPS: Multiple integer overflows</title>
+  <synopsis>
+    Multiple integer overflows were discovered in Xpdf, potentially resulting
+    in execution of arbitrary code upon viewing a malicious PDF file. CUPS
+    includes Xpdf code and therefore is vulnerable to the same issues.
+  </synopsis>
+  <product type="ebuild">Xpdf</product>
+  <announced>October 21, 2004</announced>
+  <revised>November 06, 2004: 02</revised>
+  <bug>69662</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/xpdf" auto="yes" arch="*">
+      <unaffected range="ge">3.00-r5</unaffected>
+      <vulnerable range="le">3.00-r4</vulnerable>
+    </package>
+    <package name="net-print/cups" auto="yes" arch="*">
+      <unaffected range="ge">1.1.20-r5</unaffected>
+      <vulnerable range="le">1.1.20-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Xpdf is an open source viewer for Portable Document Format (PDF) files. The
+    Common UNIX Printing System (CUPS) is a cross-platform print spooler that
+    includes some Xpdf code.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Evans discovered multiple integer overflow issues in Xpdf.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice an user to open a specially-crafted PDF file,
+    potentially resulting in execution of arbitrary code with the rights of the
+    user running Xpdf. By enticing an user to directly print the PDF file to a
+    CUPS printer, an attacker could also crash the CUPS spooler or execute
+    arbitrary code with the rights of the CUPS spooler, which is usually the
+    "lp" user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Xpdf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=app-text/xpdf-3.00-r5"</code>
+    <p>
+    All CUPS users should also upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=net-print/cups-1.1.20-r5"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0888">CAN-2004-0888</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0889">CAN-2004-0889</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 21 Oct 2004 10:10:18 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 21 Oct 2004 14:18:53 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-21.xml b/xml/htdocs/security/en/glsa/glsa-200410-21.xml
new file mode 100644
index 00000000..5d14459c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-21.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-21">
+  <title>Apache 2, mod_ssl: Bypass of SSLCipherSuite directive</title>
+  <synopsis>
+    In certain configurations, it can be possible to bypass restrictions set by
+    the "SSLCipherSuite" directive of mod_ssl.
+  </synopsis>
+  <product type="ebuild">apache</product>
+  <announced>October 21, 2004</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>66807</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="ge">2.0.52</unaffected>
+      <unaffected range="lt">2.0</unaffected>
+      <vulnerable range="lt">2.0.52</vulnerable>
+    </package>
+    <package name="net-www/mod_ssl" auto="yes" arch="*">
+      <unaffected range="ge">2.8.20</unaffected>
+      <vulnerable range="lt">2.8.20</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP server is one of the most popular web servers on the
+    internet. mod_ssl provides SSL v2/v3 and TLS v1 support for Apache 1.3 and
+    is also included in Apache 2.
+    </p>
+  </background>
+  <description>
+    <p>
+    A flaw has been found in mod_ssl where the "SSLCipherSuite" directive could
+    be bypassed in certain configurations if it is used in a directory or
+    location context to restrict the set of allowed cipher suites.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker could gain access to a location using any cipher suite
+    allowed by the server/virtual host configuration, disregarding the
+    restrictions by "SSLCipherSuite" for that location.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Apache 2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=www-servers/apache-2.0.52"
+    # emerge ">=www-servers/apache-2.0.52"</code>
+    <p>
+    All mod_ssl users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-www/mod_ssl-2.8.20"
+    # emerge ">=net-www/mod_ssl-2.8.20"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0885">CAN-2004-0885</uri>
+    <uri link="http://issues.apache.org/bugzilla/show_bug.cgi?id=31505">Apache HTTPD Bug 31505</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri,  8 Oct 2004 21:14:18 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 13 Oct 2004 20:52:28 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 21 Oct 2004 04:34:44 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-22.xml b/xml/htdocs/security/en/glsa/glsa-200410-22.xml
new file mode 100644
index 00000000..4ae77575
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-22.xml
@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-22">
+  <title>MySQL: Multiple vulnerabilities</title>
+  <synopsis>
+    Several vulnerabilities including privilege abuse, Denial of Service, and
+    potentially remote arbitrary code execution have been discovered in MySQL.
+  </synopsis>
+  <product type="ebuild">MySQL</product>
+  <announced>October 24, 2004</announced>
+  <revised>October 24, 2004: 01</revised>
+  <bug>67062</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/mysql" auto="yes" arch="*">
+      <unaffected range="ge">4.0.21</unaffected>
+      <vulnerable range="lt">4.0.21</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MySQL is a popular open-source, multi-threaded, multi-user SQL database
+    server.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were found and fixed in MySQL:
+    </p>
+    <p>
+    Oleksandr Byelkin found that ALTER TABLE ... RENAME checks CREATE/INSERT
+    rights of the old table instead of the new one (CAN-2004-0835). Another
+    privilege checking bug allowed users to grant rights on a database they had
+    no rights on.
+    </p>
+    <p>
+    Dean Ellis found a defect where multiple threads ALTERing the MERGE tables
+    to change the UNION could cause the server to crash (CAN-2004-0837).
+    Another crash was found in MATCH ... AGAINST() queries with missing closing
+    double quote.
+    </p>
+    <p>
+    Finally, a buffer overrun in the mysql_real_connect function was found by
+    Lukasz Wojtow (CAN-2004-0836).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    The privilege checking issues could be used by remote users to bypass their
+    rights on databases. The two crashes issues could be exploited by a remote
+    user to perform a Denial of Service attack on MySQL server. The buffer
+    overrun issue could also be exploited as a Denial of Service attack, and
+    may allow to execute arbitrary code with the rights of the MySQL daemon
+    (typically, the "mysql" user).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MySQL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=dev-db/mysql-4.0.21"
+    # emerge ">=dev-db/mysql-4.0.21"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0835">CAN-2004-0835</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0836">CAN-2004-0836</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0837">CAN-2004-0837</uri>
+    <uri link="http://bugs.mysql.com/bug.php?id=3933">Privilege granting bug</uri>
+    <uri link="http://bugs.mysql.com/bug.php?id=3870">MATCH ... AGAINST crash bug</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 19 Oct 2004 17:45:22 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 22 Oct 2004 20:06:53 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 23 Oct 2004 08:53:17 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-23.xml b/xml/htdocs/security/en/glsa/glsa-200410-23.xml
new file mode 100644
index 00000000..95d3b701
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-23.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-23">
+  <title>Gaim: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been found in Gaim which could allow a remote
+    attacker to crash the application, or possibly execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">gaim</product>
+  <announced>October 24, 2004</announced>
+  <revised>October 24, 2004: 01</revised>
+  <bug>68271</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/gaim" auto="yes" arch="*">
+      <unaffected range="ge">1.0.2</unaffected>
+      <vulnerable range="lt">1.0.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gaim is a full featured instant messaging client which handls a variety of
+    instant messaging protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    A possible buffer overflow exists in the code processing MSN SLP messages
+    (CAN-2004-0891). memcpy() was used without validating the size of the
+    buffer, and an incorrect buffer was used as destination under certain
+    circumstances. Additionally, memory allocation problems were found in the
+    processing of MSN SLP messages and the receiving of files. These issues
+    could lead Gaim to try to allocate more memory than available, resulting in
+    the crash of the application.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could crash Gaim and possibly execute arbitrary code by
+    exploiting the buffer overflow.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gaim users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-im/gaim-1.0.2"
+    # emerge ">=net-im/gaim-1.0.2"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0891">CAN-2004-0891</uri>
+    <uri link="http://gaim.sourceforge.net/security/">Gaim Security Issues</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 22 Oct 2004 00:52:11 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 22 Oct 2004 08:35:43 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 23 Oct 2004 13:06:09 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-24.xml b/xml/htdocs/security/en/glsa/glsa-200410-24.xml
new file mode 100644
index 00000000..311fe5a6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-24.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-24">
+  <title>MIT krb5: Insecure temporary file use in send-pr.sh</title>
+  <synopsis>
+    The send-pr.sh script, included in the mit-krb5 package, is vulnerable to
+    symlink attacks, potentially allowing a local user to overwrite arbitrary
+    files with the rights of the user running the utility.
+  </synopsis>
+  <product type="ebuild">mit-krb5</product>
+  <announced>October 25, 2004</announced>
+  <revised>January 30, 2005: 02</revised>
+  <bug>66359</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-crypt/mit-krb5" auto="yes" arch="*">
+      <unaffected range="ge">1.3.5-r1</unaffected>
+      <unaffected range="rge">1.3.4-r1</unaffected>
+      <vulnerable range="le">1.3.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MIT krb5 is the free implementation of the Kerberos network
+    authentication protocol written by the Massachusetts Institute of
+    Technology.
+    </p>
+  </background>
+  <description>
+    <p>
+    The send-pr.sh script creates temporary files in world-writeable
+    directories with predictable names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary files
+    directory, pointing to a valid file somewhere on the filesystem. When
+    send-pr.sh is called, this would result in the file being overwritten
+    with the rights of the user running the utility, which could be the
+    root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MIT krb5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+    
+    # emerge -pv &quot;&gt;=app-crypt/mit-krb5-1.3.4-r1&quot;
+    # emerge &quot;&gt;=app-crypt/mit-krb5-1.3.4-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0971">CAN-2004-0971</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 19 Oct 2004 17:38:41 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 25 Oct 2004 13:03:38 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-25.xml b/xml/htdocs/security/en/glsa/glsa-200410-25.xml
new file mode 100644
index 00000000..c0ea862d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-25.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-25">
+  <title>Netatalk: Insecure tempfile handling in etc2ps.sh</title>
+  <synopsis>
+    The etc2ps.sh script, included in the Netatalk package, is vulnerable to
+    symlink attacks, potentially allowing a local user to overwrite arbitrary
+    files with the rights of the user running the utility.
+  </synopsis>
+  <product type="ebuild">Netatalk</product>
+  <announced>October 25, 2004</announced>
+  <revised>October 25, 2004: 01</revised>
+  <bug>66370</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-fs/netatalk" auto="yes" arch="*">
+      <unaffected range="ge">1.6.4-r1</unaffected>
+      <vulnerable range="lt">1.6.4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Netatalk is a kernel level implementation of the AppleTalk Protocol Suite,
+    which allows Unix hosts to act as file, print, and time servers for Apple
+    computers. It includes several script utilities, including etc2ps.sh.
+    </p>
+  </background>
+  <description>
+    <p>
+    The etc2ps.sh script creates temporary files in world-writeable directories
+    with predictable names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary files
+    directory, pointing to a valid file somewhere on the filesystem. When
+    etc2ps.sh is executed, this would result in the file being overwritten with
+    the rights of the user running the utility, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Netatalk users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge sync
+
+    # emerge -pv ">=net-fs/netatalk-1.6.4-r1"
+    # emerge ">=net-fs/netatalk-1.6.4-r1"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0974">CAN-2004-0974</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 10 Oct 2004 22:02:01 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 25 Oct 2004 13:03:51 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-26.xml b/xml/htdocs/security/en/glsa/glsa-200410-26.xml
new file mode 100644
index 00000000..b57a30d0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-26.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-26">
+  <title>socat: Format string vulnerability</title>
+  <synopsis>
+    socat contains a format string vulnerability that can potentially lead to
+    remote or local execution of arbitrary code with the privileges of the
+    socat process.
+  </synopsis>
+  <product type="ebuild">socat</product>
+  <announced>October 25, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>68547</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/socat" auto="yes" arch="*">
+      <unaffected range="ge">1.4.0.3</unaffected>
+      <vulnerable range="lt">1.4.0.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    socat is a multipurpose bidirectional relay, similar to netcat.
+    </p>
+  </background>
+  <description>
+    <p>
+    socat contains a syslog() based format string vulnerablility in the
+    '_msg()' function of 'error.c'. Exploitation of this bug is only
+    possible when socat is run with the '-ly' option, causing it to log
+    messages to syslog.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote exploitation is possible when socat is used as a HTTP proxy
+    client and connects to a malicious server. Local privilege escalation
+    can be achieved when socat listens on a UNIX domain socket. Potential
+    execution of arbitrary code with the privileges of the socat process is
+    possible with both local and remote exploitations.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable logging to syslog by not using the '-ly' option when starting
+    socat.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All socat users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/socat-1.4.0.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.dest-unreach.org/socat/advisory/socat-adv-1.html">socat Security Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1484">CVE-2004-1484</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 23 Oct 2004 13:12:08 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 23 Oct 2004 13:30:23 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 24 Oct 2004 21:38:40 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-27.xml b/xml/htdocs/security/en/glsa/glsa-200410-27.xml
new file mode 100644
index 00000000..4f3aa101
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-27.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-27">
+  <title>mpg123: Buffer overflow vulnerabilities</title>
+  <synopsis>
+    Buffer overflow vulnerabilities have been found in mpg123 which could lead
+    to execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mpg123</product>
+  <announced>October 27, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>68343</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/mpg123" auto="yes" arch="*">
+      <unaffected range="ge">0.59s-r5</unaffected>
+      <vulnerable range="lt">0.59s-r5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    mpg123 is a MPEG Audio Player.
+    </p>
+  </background>
+  <description>
+    <p>
+    Buffer overflow vulnerabilities in the getauthfromURL() and http_open()
+    functions have been reported by Carlos Barros. Additionally, the Gentoo
+    Linux Sound Team fixed additional boundary checks which were found to
+    be lacking.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to open a malicious playlist or URL or making use of
+    a specially-crafted symlink, an attacker could possibly execute
+    arbitrary code with the rights of the user running mpg123.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mpg123 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/mpg123-0.59s-r5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.barrossecurity.com/advisories/mpg123_getauthfromurl_bof_advisory.txt">Security Advisory by Carlos Barros</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0982">CVE-2004-0982</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 22 Oct 2004 21:04:17 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 24 Oct 2004 17:06:55 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 26 Oct 2004 11:02:34 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-28.xml b/xml/htdocs/security/en/glsa/glsa-200410-28.xml
new file mode 100644
index 00000000..786e8b9e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-28.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-28">
+  <title>rssh: Format string vulnerability</title>
+  <synopsis>
+    rssh is vulnerable to a format string vulnerability that allows arbitrary
+    execution of code with the rights of the connected user, thereby bypassing
+    rssh restrictions.
+  </synopsis>
+  <product type="ebuild">rssh</product>
+  <announced>October 27, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>66988</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-shells/rssh" auto="yes" arch="*">
+      <unaffected range="ge">2.2.2</unaffected>
+      <vulnerable range="lt">2.2.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    rssh is a restricted shell, allowing only a few commands like scp or
+    sftp. It is often used as a complement to OpenSSH to provide limited
+    access to users.
+    </p>
+  </background>
+  <description>
+    <p>
+    Florian Schilhabel from the Gentoo Linux Security Audit Team found a
+    format string vulnerability in rssh syslogging of failed commands.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Using a malicious command, it may be possible for a remote
+    authenticated user to execute arbitrary code on the target machine with
+    user rights, effectively bypassing any restriction of rssh.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All rssh users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-shells/rssh-2.2.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.pizzashack.org/rssh/security.shtml">rssh security announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1628">CVE-2004-1628</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 25 Oct 2004 13:31:44 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 25 Oct 2004 13:31:54 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 26 Oct 2004 13:24:10 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-29.xml b/xml/htdocs/security/en/glsa/glsa-200410-29.xml
new file mode 100644
index 00000000..81bf9e64
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-29.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-29">
+  <title>PuTTY: Pre-authentication buffer overflow</title>
+  <synopsis>
+    PuTTY contains a vulnerability allowing an SSH server to execute arbitrary
+    code on the connecting client.
+  </synopsis>
+  <product type="ebuild">putty</product>
+  <announced>October 27, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>69123</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/putty" auto="yes" arch="*">
+      <unaffected range="ge">0.56</unaffected>
+      <vulnerable range="le">0.55</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PuTTY is a free implementation of Telnet and SSH for Win32 and Unix
+    platforms, along with an xterm terminal emulator.
+    </p>
+  </background>
+  <description>
+    <p>
+    PuTTY fails to do proper bounds checking on SSH2_MSG_DEBUG packets. The
+    "stringlen" parameter value is incorrectly checked due to signedness
+    issues. Note that this vulnerability is similar to the one described in
+    GLSA 200408-04 but not the same.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    When PuTTY connects to a server using the SSH2 protocol, an attacker
+    may be able to send specially crafted packets to the client, resulting
+    in the execution of arbitrary code with the permissions of the user
+    running PuTTY. Note that this is possible during the authentication
+    process but before host key verification.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PuTTY users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/putty-0.56&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.idefense.com/application/poi/display?id=155">iDEFENSE Security Advisory 10.27.04</uri>
+    <uri link="http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html">PuTTY ChangeLog</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1008">CVE-2004-1008</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 27 Oct 2004 15:40:45 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 27 Oct 2004 15:40:58 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 27 Oct 2004 16:43:51 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-30.xml b/xml/htdocs/security/en/glsa/glsa-200410-30.xml
new file mode 100644
index 00000000..2a05e645
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-30.xml
@@ -0,0 +1,98 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-30">
+  <title>GPdf, KPDF, KOffice: Vulnerabilities in included xpdf</title>
+  <synopsis>
+    GPdf, KPDF and KOffice all include vulnerable xpdf code to handle PDF
+    files, making them vulnerable to execution of arbitrary code upon viewing a
+    malicious PDF file.
+  </synopsis>
+  <product type="ebuild">GPdf</product>
+  <announced>October 28, 2004</announced>
+  <revised>November 06, 2004: 02</revised>
+  <bug>68558</bug>
+  <bug>68665</bug>
+  <bug>68571</bug>
+  <bug>69936</bug>
+  <bug>69624</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/koffice" auto="yes" arch="*">
+      <unaffected range="ge">1.3.4-r1</unaffected>
+      <unaffected range="rge">1.3.3-r2</unaffected>
+      <vulnerable range="lt">1.3.4-r1</vulnerable>
+    </package>
+    <package name="app-text/gpdf" auto="yes" arch="*">
+      <unaffected range="ge">2.8.0-r2</unaffected>
+      <unaffected range="rge">0.132-r2</unaffected>
+      <vulnerable range="lt">2.8.0-r2</vulnerable>
+    </package>
+    <package name="kde-base/kdegraphics" auto="yes" arch="*">
+      <unaffected range="ge">3.3.1-r2</unaffected>
+      <unaffected range="rge">3.3.0-r2</unaffected>
+      <unaffected range="rge">3.2.3-r2</unaffected>
+      <vulnerable range="lt">3.3.1-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GPdf is a Gnome-based PDF viewer. KPDF, part of the kdegraphics package, is
+    a KDE-based PDF viewer. KOffice is an integrated office suite for KDE.
+    </p>
+  </background>
+  <description>
+    <p>
+    GPdf, KPDF and KOffice all include xpdf code to handle PDF files. xpdf is
+    vulnerable to multiple integer overflows, as described in GLSA 200410-20.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially-crafted PDF file,
+    potentially resulting in execution of arbitrary code with the rights of the
+    user running the affected utility.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GPdf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=app-text/gpdf-0.132-r2"</code>
+    <p>
+    All KDE users should upgrade to the latest version of kdegraphics:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=kde-base/kdegraphics-3.3.0-r2"</code>
+    <p>
+    All KOffice users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=app-office/koffice-1.3.3-r2"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200410-20.xml">GLSA 200410-20</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0888">CAN-2004-0888</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0889">CAN-2004-0889</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 26 Oct 2004 18:40:10 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 27 Oct 2004 10:09:49 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 28 Oct 2004 07:24:07 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200410-31.xml b/xml/htdocs/security/en/glsa/glsa-200410-31.xml
new file mode 100644
index 00000000..004e4949
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200410-31.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200410-31">
+  <title>Archive::Zip: Virus detection evasion</title>
+  <synopsis>
+    Email virus scanning software relying on Archive::Zip can be fooled into
+    thinking a ZIP attachment is empty while it contains a virus, allowing
+    detection evasion.
+  </synopsis>
+  <product type="ebuild">Archive::Zip</product>
+  <announced>October 29, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>68616</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-perl/Archive-Zip" auto="yes" arch="*">
+      <unaffected range="ge">1.14</unaffected>
+      <vulnerable range="lt">1.14</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Archive::Zip is a Perl module containing functions to handle ZIP
+    archives.
+    </p>
+  </background>
+  <description>
+    <p>
+    Archive::Zip can be used by email scanning software (like amavisd-new)
+    to uncompress attachments before virus scanning. By modifying the
+    uncompressed size of archived files in the global header of the ZIP
+    file, it is possible to fool Archive::Zip into thinking some files
+    inside the archive have zero length.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    An attacker could send a carefully crafted ZIP archive containing a
+    virus file and evade detection on some email virus-scanning software
+    relying on Archive::Zip for decompression.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Archive::Zip users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-perl/Archive-Zip-1.14&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.idefense.com/application/poi/display?id=153">iDEFENSE Security Advisory 10.18.04</uri>
+    <uri link="http://rt.cpan.org/NoAuth/Bug.html?id=8077">rt.cpan.org bug #8077</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1096">CVE-2004-1096</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 27 Oct 2004 12:10:39 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 27 Oct 2004 12:10:53 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 29 Oct 2004 12:32:54 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-01.xml b/xml/htdocs/security/en/glsa/glsa-200411-01.xml
new file mode 100644
index 00000000..beb03aaa
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-01.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-01">
+  <title>ppp: No denial of service vulnerability</title>
+  <synopsis>
+    pppd contains a bug that allows an attacker to crash his own connection,
+    but it cannot be used to deny service to other users.
+  </synopsis>
+  <product type="ebuild">ppp</product>
+  <announced>November 01, 2004</announced>
+  <revised>November 02, 2004: 02</revised>
+  <bug>69152</bug>
+  <access>remote</access>
+  <affected>
+  </affected>
+  <background>
+    <p>
+    ppp is a Unix implementation of the Point-to-Point Protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    The pppd server improperly verifies header fields, potentially leading to a
+    crash of the pppd process handling the connection. However, since a
+    separate pppd process handles each ppp connection, this would not affect
+    any other connection, or prevent new connections from being established.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    We incorrectly thought that this bug could be exploited to deny service to
+    all ppp users. It is not the case, this bug has no security impact
+    whatsoever. Many thanks to Paul Mackerras from the Samba team for
+    correcting our mistake.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no need for a workaround.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    ppp users can keep their current versions.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/379450">Incorrect BugTraq Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon,  1 Nov 2004 10:32:16 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon,  1 Nov 2004 10:32:28 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon,  1 Nov 2004 16:53:20 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-02.xml b/xml/htdocs/security/en/glsa/glsa-200411-02.xml
new file mode 100644
index 00000000..8e30e3d5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-02.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-02">
+  <title>Cherokee: Format string vulnerability</title>
+  <synopsis>
+    Cherokee contains a format string vulnerability that could lead to denial
+    of service or the execution of arbitary code.
+  </synopsis>
+  <product type="ebuild">cherokee</product>
+  <announced>November 01, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>67667</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/cherokee" auto="yes" arch="*">
+      <unaffected range="ge">0.4.17.1</unaffected>
+      <vulnerable range="le">0.4.17</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cherokee is an extra-light web server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Florian Schilhabel from the Gentoo Linux Security Audit Team found a
+    format string vulnerability in the cherokee_logger_ncsa_write_string()
+    function.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Using a specially crafted URL when authenticating via auth_pam, a
+    malicious user may be able to crash the server or execute arbitrary
+    code on the target machine with permissions of the user running
+    Cherokee.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cherokee users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/cherokee-0.4.17.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1097">CVE-2004-1097</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon,  1 Nov 2004 10:17:11 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon,  1 Nov 2004 11:49:51 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon,  1 Nov 2004 15:51:07 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-03.xml b/xml/htdocs/security/en/glsa/glsa-200411-03.xml
new file mode 100644
index 00000000..97902726
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-03.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-03">
+  <title>Apache 1.3: Buffer overflow vulnerability in mod_include</title>
+  <synopsis>
+    A buffer overflow vulnerability exists in mod_include which could possibly
+    allow a local attacker to gain escalated privileges.
+  </synopsis>
+  <product type="ebuild">apache</product>
+  <announced>November 02, 2004</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>68564</bug>
+  <access>local</access>
+  <affected>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="ge">1.3.32-r1</unaffected>
+      <vulnerable range="lt">1.3.32-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP server is one of the most popular web servers on the
+    internet. mod_include is an Apache module to handle Server Side Includes
+    (SSI).
+    </p>
+  </background>
+  <description>
+    <p>
+    A possible buffer overflow exists in the get_tag() function of
+    mod_include.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    If Server Side Includes (SSI) are enabled, a local attacker may be able to
+    run arbitrary code with the rights of an httpd child process by making use
+    of a specially-crafted document with malformed SSI.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Apache users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=www-servers/apache-1.3.32-r1"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0940">CAN-2004-0940</uri>
+    <uri link="http://www.apacheweek.com/features/security-13">Security vulnerabilities in Apache httpd 1.3</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 27 Oct 2004 10:11:41 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 29 Oct 2004 12:38:27 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue,  2 Nov 2004 11:16:30 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-04.xml b/xml/htdocs/security/en/glsa/glsa-200411-04.xml
new file mode 100644
index 00000000..215195af
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-04.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-04">
+  <title>Speedtouch USB driver: Privilege escalation vulnerability</title>
+  <synopsis>
+    A vulnerability in the Speedtouch USB driver can be exploited to allow
+    local users to execute arbitrary code with escalated privileges.
+  </synopsis>
+  <product type="ebuild">speedtouch</product>
+  <announced>November 02, 2004</announced>
+  <revised>November 02, 2004: 01</revised>
+  <bug>68436</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-dialup/speedtouch" auto="yes" arch="*">
+      <unaffected range="ge">1.3.1</unaffected>
+      <vulnerable range="lt">1.3.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The speedtouch package contains a driver for the ADSL SpeedTouch USB modem.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Speedtouch USB driver contains multiple format string vulnerabilities
+    in modem_run, pppoa2 and pppoa3. This flaw is due to an improperly made
+    syslog() system call.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A malicious local user could exploit this vulnerability by causing a buffer
+    overflow, and potentially allowing the execution of arbitrary code with
+    escalated privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Speedtouch USB driver users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=net-dialup/speedtouch-1.3.1"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0834">CAN-2004-0834</uri>
+    <uri link="http://speedtouch.sourceforge.net/index.php?/news.en.html">Speedtouch Project News Announcements</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 29 Oct 2004 08:13:35 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 29 Oct 2004 13:15:40 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue,  2 Nov 2004 13:27:33 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-05.xml b/xml/htdocs/security/en/glsa/glsa-200411-05.xml
new file mode 100644
index 00000000..260ac2bc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-05.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-05">
+  <title>libxml2: Remotely exploitable buffer overflow</title>
+  <synopsis>
+    libxml2 contains multiple buffer overflows which could lead to the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">libxml2</product>
+  <announced>November 02, 2004</announced>
+  <revised>November 02, 2004: 01</revised>
+  <bug>69154</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/libxml2" auto="yes" arch="*">
+      <unaffected range="ge">2.6.15</unaffected>
+      <vulnerable range="lt">2.6.15</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libxml2 is an XML parsing library written in C.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple buffer overflows have been detected in the nanoftp and nanohttp
+    modules. These modules are responsible for parsing URLs with ftp
+    information, and resolving names via DNS.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could exploit an application that uses libxml2 by forcing it to
+    parse a specially-crafted XML file, potentially causing remote execution of
+    arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libxml2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.6.15"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/379383">BugTraq Advisory</uri>
+    <uri link="http://www.xmlsoft.org/ChangeLog.html">libxml2 ChangeLog</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0989">CAN-2004-0989</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 30 Oct 2004 16:39:51 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 31 Oct 2004 21:35:49 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon,  1 Nov 2004 23:01:51 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-06.xml b/xml/htdocs/security/en/glsa/glsa-200411-06.xml
new file mode 100644
index 00000000..c5c82bc1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-06.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-06">
+  <title>MIME-tools: Virus detection evasion</title>
+  <synopsis>
+    MIME-tools doesn't handle empty MIME boundaries correctly. This may prevent
+    some virus-scanning programs which use MIME-tools from detecting certain
+    viruses.
+  </synopsis>
+  <product type="ebuild">MIME-tools</product>
+  <announced>November 02, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>69181</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-perl/MIME-tools" auto="yes" arch="*">
+      <unaffected range="ge">5.415</unaffected>
+      <vulnerable range="lt">5.415</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MIME-tools is a Perl module containing functions to handle MIME
+    attachments.
+    </p>
+  </background>
+  <description>
+    <p>
+    MIME-tools doesn't correctly parse attachment boundaries with an empty
+    name (boundary="").
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    An attacker could send a carefully crafted email and evade detection on
+    some email virus-scanning programs using MIME-tools for attachment
+    decoding.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MIME-tools users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-perl/MIME-tools-5.415&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://lists.roaringpenguin.com/pipermail/mimedefang/2004-October/024959.html">MIMEDefang announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1098">CVE-2004-1098</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue,  2 Nov 2004 13:33:38 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue,  2 Nov 2004 13:34:00 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue,  2 Nov 2004 17:50:24 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-07.xml b/xml/htdocs/security/en/glsa/glsa-200411-07.xml
new file mode 100644
index 00000000..b7b2a8ca
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-07.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-07">
+  <title>Proxytunnel: Format string vulnerability</title>
+  <synopsis>
+    Proxytunnel is vulnerable to a format string vulnerability, potentially
+    allowing a remote server to execute arbitrary code with the rights of the
+    Proxytunnel process.
+  </synopsis>
+  <product type="ebuild">Proxytunnel</product>
+  <announced>November 03, 2004</announced>
+  <revised>November 03, 2004: 01</revised>
+  <bug>69379</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/proxytunnel" auto="yes" arch="*">
+      <unaffected range="ge">1.2.3</unaffected>
+      <vulnerable range="lt">1.2.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Proxytunnel is a program that tunnels connections to a remote server
+    through a standard HTTPS proxy.
+    </p>
+  </background>
+  <description>
+    <p>
+    Florian Schilhabel of the Gentoo Linux Security Audit project found a
+    format string vulnerability in Proxytunnel. When the program is started in
+    daemon mode (-a [port]), it improperly logs invalid proxy answers to
+    syslog.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious remote server could send specially-crafted invalid answers to
+    exploit the format string vulnerability, potentially allowing the execution
+    of arbitrary code on the tunnelling host with the rights of the Proxytunnel
+    process.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    You can mitigate the issue by only allowing connections to trusted remote
+    servers.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Proxytunnel users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=net-misc/proxytunnel-1.2.3"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0992">CAN-2004-0992</uri>
+    <uri link="http://proxytunnel.sourceforge.net/news.html">Proxytunnel News</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue,  2 Nov 2004 21:56:56 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed,  3 Nov 2004 09:32:39 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed,  3 Nov 2004 14:02:21 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-08.xml b/xml/htdocs/security/en/glsa/glsa-200411-08.xml
new file mode 100644
index 00000000..cc1a745f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-08.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-08">
+  <title>GD: Integer overflow</title>
+  <synopsis>
+    The PNG image decoding routines in the GD library contain an integer
+    overflow that may allow execution of arbitrary code with the rights of the
+    program decoding a malicious PNG image.
+  </synopsis>
+  <product type="ebuild">GD</product>
+  <announced>November 03, 2004</announced>
+  <revised>November 03, 2004: 01</revised>
+  <bug>69070</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/gd" auto="yes" arch="*">
+      <unaffected range="ge">2.0.32</unaffected>
+      <vulnerable range="lt">2.0.32</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The GD graphics library is an open source library which allows programmers
+    to easily generate PNG, JPEG, GIF and WBMP images from many different
+    programming languages.
+    </p>
+  </background>
+  <description>
+    <p>
+    infamous41md found an integer overflow in the memory allocation procedure
+    of the GD routine that handles loading PNG image files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to load a carefully crafted PNG image
+    file in a GD-powered application, or send a PNG image to a web application
+    which uses GD PNG decoding functions. This could potentially lead to
+    execution of arbitrary code with the rights of the program loading the
+    image.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GD users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=media-libs/gd-2.0.32"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/379382">Original BugTraq advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0990">CAN-2004-0990</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon,  1 Nov 2004 10:23:54 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue,  2 Nov 2004 21:56:13 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed,  3 Nov 2004 20:55:19 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-09.xml b/xml/htdocs/security/en/glsa/glsa-200411-09.xml
new file mode 100644
index 00000000..c96a801b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-09.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-09">
+  <title>shadow: Unauthorized modification of account information</title>
+  <synopsis>
+    A flaw in the chfn and chsh utilities might allow modification of account
+    properties by unauthorized users.
+  </synopsis>
+  <product type="ebuild">shadow</product>
+  <announced>November 04, 2004</announced>
+  <revised>November 05, 2004: 02</revised>
+  <bug>69212</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-apps/shadow" auto="yes" arch="*">
+      <unaffected range="ge">4.0.5-r1</unaffected>
+      <vulnerable range="lt">4.0.5-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    shadow provides a set of utilities to deal with user accounts.
+    </p>
+  </background>
+  <description>
+    <p>
+    Martin Schulze reported a flaw in the passwd_check() function in
+    "libmisc/pwdcheck.c" which is used by chfn and chsh.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A logged-in local user with an expired password may be able to use chfn and
+    chsh to change his standard shell or GECOS information (full name, phone
+    number...) without being required to change his password.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All shadow users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=sys-apps/shadow-4.0.5-r1"</code>
+  </resolution>
+  <references>
+    <uri link="http://ftp.pld.org.pl/software/shadow/NEWS">shadow NEWS file</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1001">CAN-2004-1001</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed,  3 Nov 2004 20:36:10 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed,  3 Nov 2004 20:36:17 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed,  3 Nov 2004 21:01:01 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-10.xml b/xml/htdocs/security/en/glsa/glsa-200411-10.xml
new file mode 100644
index 00000000..ee80ba61
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-10.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-10">
+  <title>Gallery: Cross-site scripting vulnerability</title>
+  <synopsis>
+    Gallery is vulnerable to cross-site scripting attacks.
+  </synopsis>
+  <product type="ebuild">gallery</product>
+  <announced>November 06, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>69904</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/gallery" auto="yes" arch="*">
+      <unaffected range="ge">1.4.4_p4</unaffected>
+      <vulnerable range="lt">1.4.4_p4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gallery is a web application written in PHP which is used to organize
+    and publish photo albums. It allows multiple users to build and
+    maintain their own albums. It also supports the mirroring of images on
+    other servers.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jim Paris has discovered a cross-site scripting vulnerability in
+    Gallery.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By sending a carefully crafted URL, an attacker can inject and execute
+    script code in the victim's browser window, and potentially compromise
+    the users gallery.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gallery users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/gallery-1.4.4_p4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://gallery.menalto.com/modules.php?op=modload&amp;name=News&amp;file=article&amp;sid=142&amp;mode=thread&amp;order=0&amp;thold=0">Gallery Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1106">CVE-2004-1106</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri,  5 Nov 2004 01:49:40 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat,  6 Nov 2004 09:24:41 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-11.xml b/xml/htdocs/security/en/glsa/glsa-200411-11.xml
new file mode 100644
index 00000000..2466c9f1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-11.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-11">
+  <title>ImageMagick: EXIF buffer overflow</title>
+  <synopsis>
+    ImageMagick contains an error in boundary checks when handling EXIF
+    information, which could lead to arbitrary code execution.
+  </synopsis>
+  <product type="ebuild">imagemagick</product>
+  <announced>November 06, 2004</announced>
+  <revised>November 06, 2004: 01</revised>
+  <bug>69825</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/imagemagick" auto="yes" arch="*">
+      <unaffected range="ge">6.1.3.2</unaffected>
+      <vulnerable range="lt">6.1.3.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ImageMagick is a collection of tools to read, write and manipulate images
+    in many formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    ImageMagick fails to do proper bounds checking when handling image files
+    with EXIF information.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could use an image file with specially-crafted EXIF information
+    to cause arbitrary code execution with the permissions of the user running
+    ImageMagick.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ImageMagick users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.1.3.2"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0981">CAN-2004-0981</uri>
+    <uri link="http://www.imagemagick.org/www/Changelog.html">ImageMagick ChangeLog</uri>
+    <uri link="http://secunia.com/advisories/12995/">SA 12995</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri,  5 Nov 2004 13:21:51 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat,  6 Nov 2004 13:00:12 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat,  6 Nov 2004 18:34:28 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-12.xml b/xml/htdocs/security/en/glsa/glsa-200411-12.xml
new file mode 100644
index 00000000..f12f1f83
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-12.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-12">
+  <title>zgv: Multiple buffer overflows</title>
+  <synopsis>
+    zgv contains multiple buffer overflows that can potentially lead to the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">zgv</product>
+  <announced>November 07, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>69150</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/zgv" auto="yes" arch="*">
+      <unaffected range="ge">5.8</unaffected>
+      <vulnerable range="lt">5.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    zgv is a console image viewer based on svgalib.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple arithmetic overflows have been detected in the image
+    processing code of zgv.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially-crafted image file,
+    potentially resulting in execution of arbitrary code with the rights of
+    the user running zgv.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All zgv users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/zgv-5.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/379472">BugTraq Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1095">CVE-2004-1095</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat,  6 Nov 2004 19:26:29 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat,  6 Nov 2004 20:47:51 +0000">
+    lewk
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat,  6 Nov 2004 21:08:18 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-13.xml b/xml/htdocs/security/en/glsa/glsa-200411-13.xml
new file mode 100644
index 00000000..1b699e0f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-13.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-13">
+  <title>Portage, Gentoolkit: Temporary file vulnerabilities</title>
+  <synopsis>
+    dispatch-conf (included in Portage) and qpkg (included in Gentoolkit) are
+    vulnerable to symlink attacks, potentially allowing a local user to
+    overwrite arbitrary files with the rights of the user running the script.
+  </synopsis>
+  <product type="ebuild">portage gentoolkit</product>
+  <announced>November 07, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>68846</bug>
+  <bug>69147</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-apps/portage" auto="yes" arch="*">
+      <unaffected range="ge">2.0.51-r3</unaffected>
+      <vulnerable range="le">2.0.51-r2</vulnerable>
+    </package>
+    <package name="app-portage/gentoolkit" auto="yes" arch="*">
+      <unaffected range="ge">0.2.0_pre10-r1</unaffected>
+      <unaffected range="rge">0.2.0_pre8-r1</unaffected>
+      <vulnerable range="le">0.2.0_pre10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Portage is Gentoo's package management tool. The dispatch-conf utility
+    allows for easy rollback of configuration file changes and automatic
+    updates of configurations files never modified by users. Gentoolkit is
+    a collection of Gentoo specific administration scripts, one of which is
+    the portage querying tool qpkg.
+    </p>
+  </background>
+  <description>
+    <p>
+    dispatch-conf and qpkg use predictable filenames for temporary files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary files
+    directory, pointing to a valid file somewhere on the filesystem. When
+    an affected script is called, this would result in the file to be
+    overwritten with the rights of the user running the dispatch-conf or
+    qpkg, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Portage users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/portage-2.0.51-r3&quot;</code>
+    <p>
+    All Gentoolkit users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-portage/gentoolkit-0.2.0_pre8-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1107">CVE-2004-1107</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1108">CVE-2004-1108</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue,  2 Nov 2004 14:02:06 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue,  2 Nov 2004 17:41:31 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun,  7 Nov 2004 11:16:08 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-14.xml b/xml/htdocs/security/en/glsa/glsa-200411-14.xml
new file mode 100644
index 00000000..960d6d9a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-14.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-14">
+  <title>Kaffeine, gxine: Remotely exploitable buffer overflow</title>
+  <synopsis>
+    Kaffeine and gxine both contain a buffer overflow that can be exploited
+    when accessing content from a malicious HTTP server with specially crafted
+    headers.
+  </synopsis>
+  <product type="ebuild">kaffeine gxine</product>
+  <announced>November 07, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>69663</bug>
+  <bug>70055</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/kaffeine" auto="yes" arch="*">
+      <unaffected range="ge">0.5_rc1-r1</unaffected>
+      <unaffected range="rge">0.4.3b-r1</unaffected>
+      <vulnerable range="lt">0.5_rc1-r1</vulnerable>
+    </package>
+    <package name="media-video/gxine" auto="yes" arch="*">
+      <unaffected range="ge">0.3.3-r1</unaffected>
+      <vulnerable range="lt">0.3.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Kaffeine and gxine are graphical front-ends for xine-lib multimedia
+    library.
+    </p>
+  </background>
+  <description>
+    <p>
+    KF of Secure Network Operations has discovered an overflow that occurs
+    during the Content-Type header processing of Kaffeine. The vulnerable
+    code in Kaffeine is reused from gxine, making gxine vulnerable as well.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could create a specially-crafted Content-type header from a
+    malicious HTTP server, and crash a user's instance of Kaffeine or
+    gxine, potentially allowing the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Kaffeine users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/kaffeine-0.4.3b-r1&quot;</code>
+    <p>
+    All gxine users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/gxine-0.3.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://securitytracker.com/alerts/2004/Oct/1011936.html">SecurityTracker Advisory</uri>
+    <uri link="http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1060299&amp;group_id=9655&amp;atid=109655">gxine Bug Report</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1034">CVE-2004-1034</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed,  3 Nov 2004 13:13:11 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri,  5 Nov 2004 01:34:00 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun,  7 Nov 2004 19:19:00 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-15.xml b/xml/htdocs/security/en/glsa/glsa-200411-15.xml
new file mode 100644
index 00000000..5a56055e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-15.xml
@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-15">
+  <title>OpenSSL, Groff: Insecure tempfile handling</title>
+  <synopsis>
+    groffer, included in the Groff package, and the der_chop script, included
+    in the OpenSSL package, are both vulnerable to symlink attacks, potentially
+    allowing a local user to overwrite arbitrary files with the rights of the
+    user running the utility.
+  </synopsis>
+  <product type="ebuild">OpenSSL</product>
+  <announced>November 08, 2004</announced>
+  <revised>August 23, 2006: 02</revised>
+  <bug>68404</bug>
+  <bug>68407</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-libs/openssl" auto="yes" arch="*">
+      <unaffected range="ge">0.9.7d-r2</unaffected>
+      <vulnerable range="lt">0.9.7d-r2</vulnerable>
+    </package>
+    <package name="sys-apps/groff" auto="yes" arch="*">
+      <unaffected range="ge">1.19.1-r2</unaffected>
+      <unaffected range="rge">1.18.1.1</unaffected>
+      <vulnerable range="lt">1.19.1-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSSL is a toolkit implementing the Secure Sockets Layer and
+    Transport Layer Security protocols as well as a general-purpose
+    cryptography library. It includes the der_chop script, which is used to
+    convert DER-encoded certificates to PEM format. Groff (GNU Troff) is a
+    typesetting package which reads plain text mixed with formatting
+    commands and produces formatted output. It includes groffer, a command
+    used to display groff files and man pages on X and tty.
+    </p>
+  </background>
+  <description>
+    <p>
+    groffer and the der_chop script create temporary files in
+    world-writeable directories with predictable names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary files
+    directory, pointing to a valid file somewhere on the filesystem. When
+    groffer or der_chop is executed, this would result in the file being
+    overwritten with the rights of the user running the utility, which
+    could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Groff users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose sys-apps/groff</code>
+    <p>
+    All OpenSSL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/openssl-0.9.7d-r2&quot;</code>
+    <p>
+    Note: /etc/ssl/misc/der_chop is protected by Portage as a configuration
+    file. Don't forget to use etc-update and overwrite the old version with
+    the new one.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0969">CAN-2004-0969</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0975">CAN-2004-0975</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun,  7 Nov 2004 18:43:48 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun,  7 Nov 2004 18:44:31 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-16.xml b/xml/htdocs/security/en/glsa/glsa-200411-16.xml
new file mode 100644
index 00000000..e6c006bd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-16.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-16">
+  <title>zip: Path name buffer overflow</title>
+  <synopsis>
+    zip contains a buffer overflow when creating a ZIP archive of files with
+    very long path names. This could lead to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">zip</product>
+  <announced>November 09, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>70227</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/zip" auto="yes" arch="*">
+      <unaffected range="ge">2.3-r4</unaffected>
+      <vulnerable range="le">2.3-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    zip is a compression and file packaging utility.
+    </p>
+  </background>
+  <description>
+    <p>
+    zip does not check the resulting path length when doing recursive
+    folder compression.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit this by enticing another user or web
+    application to create an archive including a specially-crafted path
+    name, potentially resulting in the execution of arbitrary code with the
+    permissions of the user running zip.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All zip users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/zip-2.3-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.hexview.com/docs/20041103-1.txt">HexView zip Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1010">CVE-2004-1010</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun,  7 Nov 2004 18:59:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon,  8 Nov 2004 15:14:42 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon,  8 Nov 2004 20:46:08 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-17.xml b/xml/htdocs/security/en/glsa/glsa-200411-17.xml
new file mode 100644
index 00000000..bdd34612
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-17.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-17">
+  <title>mtink: Insecure tempfile handling</title>
+  <synopsis>
+    mtink is vulnerable to symlink attacks, potentially allowing a local user
+    to overwrite arbitrary files with the rights of the user running the
+    utility.
+  </synopsis>
+  <product type="ebuild">mtink</product>
+  <announced>November 09, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>70310</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-print/mtink" auto="yes" arch="*">
+      <unaffected range="ge">1.0.5</unaffected>
+      <vulnerable range="lt">1.0.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    mtink is a status monitor and inkjet cartridge changer for some Epson
+    printers.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy from Gentoo Linux discovered that mtink uses insecure
+    permissions on temporary files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary files
+    directory, pointing to a valid file somewhere on the filesystem. When
+    mtink is executed, this would result in the file being overwritten with
+    the rights of the user running the utility, which could be the root
+    user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mtink users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-print/mtink-1.0.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1110">CVE-2004-1110</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon,  8 Nov 2004 11:16:34 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon,  8 Nov 2004 11:16:46 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon,  8 Nov 2004 21:01:51 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-18.xml b/xml/htdocs/security/en/glsa/glsa-200411-18.xml
new file mode 100644
index 00000000..cd323ca5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-18.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-18">
+  <title>Apache 2.0: Denial of Service by memory consumption</title>
+  <synopsis>
+    A flaw in Apache 2.0 could allow a remote attacker to cause a Denial of
+    Service.
+  </synopsis>
+  <product type="ebuild">apache</product>
+  <announced>November 10, 2004</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>70138</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="ge">2.0.52-r1</unaffected>
+      <unaffected range="lt">2.0</unaffected>
+      <vulnerable range="lt">2.0.52-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP Server is one of the most popular web servers on the Internet.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chintan Trivedi discovered a vulnerability in Apache httpd 2.0 that is caused by improper enforcing of the field length limit in the header-parsing code.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a large amount of specially-crafted HTTP GET requests a remote attacker could cause a Denial of Service of the targeted system.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Apache 2.0 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=www-servers/apache-2.0.52-r1"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0942">CAN-2004-0942</uri>
+    <uri link="http://www.apacheweek.com/features/security-20">Security vulnerabilities in Apache httpd 2.0</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon,  8 Nov 2004 09:58:15 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue,  9 Nov 2004 20:43:00 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-19.xml b/xml/htdocs/security/en/glsa/glsa-200411-19.xml
new file mode 100644
index 00000000..3173207f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-19.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-19">
+  <title>Pavuk: Multiple buffer overflows</title>
+  <synopsis>
+    Pavuk contains multiple buffer overflows that can allow a remote attacker
+    to run arbitrary code.
+  </synopsis>
+  <product type="ebuild">pavuk</product>
+  <announced>November 10, 2004</announced>
+  <revised>November 10, 2004: 01</revised>
+  <bug>70516</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/pavuk" auto="yes" arch="*">
+      <unaffected range="ge">0.9.31</unaffected>
+      <vulnerable range="lt">0.9.31</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Pavuk is web spider and website mirroring tool.
+    </p>
+  </background>
+  <description>
+    <p>
+    Pavuk contains several buffer overflow vulnerabilities in the code handling digest authentication and HTTP header processing. This issue is similar to GLSA 200407-19, but contains more vulnerabilities.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could cause a buffer overflow, leading to arbitrary code execution with the rights of the user running Pavuk.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Pavuk users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=net-misc/pavuk-0.9.31"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200407-19.xml">GLSA-200407-19</uri>
+    <uri link="http://secunia.com/advisories/13120/">SA13120</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0456">CAN-2004-0456</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 10 Nov 2004 07:00:44 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 10 Nov 2004 15:50:02 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 10 Nov 2004 15:51:22 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-20.xml b/xml/htdocs/security/en/glsa/glsa-200411-20.xml
new file mode 100644
index 00000000..838c3d89
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-20.xml
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-20">
+  <title>ez-ipupdate: Format string vulnerability</title>
+  <synopsis>
+    ez-ipupdate contains a format string vulnerability that could lead to
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">ez-ipupdate</product>
+  <announced>November 11, 2004</announced>
+  <revised>November 11, 2004: 01</revised>
+  <bug>69658</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/ez-ipupdate" auto="yes" arch="*">
+      <unaffected range="ge">3.0.11_beta8-r1</unaffected>
+      <vulnerable range="le">3.0.11_beta8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ez-ipupdate is a utility for updating host name information for a large number of dynamic DNS services.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ulf Harnhammar from the Debian Security Audit Project discovered a format string vulnerability in ez-ipupdate.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could exploit this to execute arbitrary code with the permissions of the user running ez-ipupdate, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ez-ipupdate users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=net-dns/ez-ipupdate-3.0.11_beta8-r1"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0980">CAN-2004-0980</uri>
+    <uri link="http://lists.netsys.com/pipermail/full-disclosure/2004-November/028590.html">Full Disclosure Announcement</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue,  9 Nov 2004 20:12:06 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 11 Nov 2004 14:43:17 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-21.xml b/xml/htdocs/security/en/glsa/glsa-200411-21.xml
new file mode 100644
index 00000000..eb612d24
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-21.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-21">
+  <title>Samba: Multiple vulnerabilities</title>
+  <synopsis>
+    Samba is vulnerable to a buffer overflow that could lead to execution of
+    arbitrary code (CAN-2004-0882). Another flaw in Samba may allow a remote
+    attacker to cause a Denial of Service by excessive consumption of CPU
+    cycles (CAN-2004-0930).
+  </synopsis>
+  <product type="ebuild">samba</product>
+  <announced>November 11, 2004</announced>
+  <revised>November 15, 2004: 02</revised>
+  <bug>70429</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-fs/samba" auto="yes" arch="*">
+      <unaffected range="ge">3.0.8</unaffected>
+      <unaffected range="lt">3.0</unaffected>
+      <vulnerable range="lt">3.0.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Samba is a freely available SMB/CIFS implementation which allows
+    seamless interoperability of file and print services to other SMB/CIFS
+    clients.
+    </p>
+  </background>
+  <description>
+    <p>
+    Samba fails to do proper bounds checking when handling
+    TRANSACT2_QFILEPATHINFO replies. Additionally an input validation flaw
+    exists in ms_fnmatch.c when matching filenames that contain wildcards.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker may be able to execute arbitrary code with the permissions
+    of the user running Samba. A remote attacker may also be able to cause
+    an abnormal consumption of CPU resources, resulting in slower
+    performance of the server or even a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Samba users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=net-fs/samba-3.0.8"</code>
+  </resolution>
+  <references>
+    <uri link="http://www.samba.org/samba/security/CAN-2004-0930.html">Samba Security Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0930">CAN-2004-0930</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0882">CAN-2004-0882</uri>
+    <uri link="http://security.e-matters.de/advisories/132004.html">E-Matters Advisory 13/2004</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 10 Nov 2004 10:26:07 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 10 Nov 2004 20:53:51 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 11 Nov 2004 10:18:49 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-22.xml b/xml/htdocs/security/en/glsa/glsa-200411-22.xml
new file mode 100644
index 00000000..5db9dfb0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-22.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-22">
+  <title>Davfs2, lvm-user: Insecure tempfile handling</title>
+  <synopsis>
+    Davfs2 and the lvmcreate_initrd script (included in the lvm-user package)
+    are both vulnerable to symlink attacks, potentially allowing a local user
+    to overwrite arbitrary files with the rights of the user running them.
+  </synopsis>
+  <product type="ebuild">davfs2</product>
+  <announced>November 11, 2004</announced>
+  <revised>November 11, 2004: 01</revised>
+  <bug>68406</bug>
+  <bug>69149</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-fs/davfs2" auto="yes" arch="*">
+      <unaffected range="ge">0.2.2-r1</unaffected>
+      <vulnerable range="lt">0.2.2-r1</vulnerable>
+    </package>
+    <package name="sys-fs/lvm-user" auto="yes" arch="*">
+      <unaffected range="ge">1.0.7-r2</unaffected>
+      <vulnerable range="lt">1.0.7-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Davfs2 is a file system driver that allows you to mount a WebDAV
+    server as a local disk drive. lvm-user is a package providing userland
+    utilities for LVM (Logical Volume Management) 1.x features.
+    </p>
+  </background>
+  <description>
+    <p>
+    Florian Schilhabel from the Gentoo Linux Security Audit Team found
+    that Davfs2 insecurely created .pid files in /tmp. Furthermore, Trustix
+    Secure Linux found that the lvmcreate_initrd script, included in the
+    lvm-user Gentoo package, also creates temporary files in
+    world-writeable directories with predictable names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary
+    files directory, pointing to a valid file somewhere on the filesystem.
+    When Davfs2 or lvmcreate_initrd is called, this would result in the
+    file being overwritten with the rights of the user running the
+    software, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Davfs2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=net-fs/davfs2-0.2.2-r1"</code>
+    <p>
+    All lvm-user users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=sys-fs/lvm-user-1.0.7-r2"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0972">CAN-2004-0972</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 10 Nov 2004 09:15:59 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 11 Nov 2004 20:29:52 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-23.xml b/xml/htdocs/security/en/glsa/glsa-200411-23.xml
new file mode 100644
index 00000000..fcb36703
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-23.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-23">
+  <title>Ruby: Denial of Service issue</title>
+  <synopsis>
+    The CGI module in Ruby can be sent into an infinite loop, resulting in a
+    Denial of Service condition.
+  </synopsis>
+  <product type="ebuild">Ruby</product>
+  <announced>November 16, 2004</announced>
+  <revised>November 16, 2004: 01</revised>
+  <bug>69985</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/ruby" auto="yes" arch="*">
+      <unaffected range="rge">1.6.8-r12</unaffected>
+      <unaffected range="ge">1.8.2_pre3</unaffected>
+      <vulnerable range="lt">1.8.2_pre3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ruby is an interpreted scripting language for quick and easy
+    object-oriented programming. Ruby's CGI module can be used to build web
+    applications.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ruby's developers found and fixed an issue in the CGI module that
+    can be triggered remotely and cause an infinite loop.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could trigger the vulnerability through an
+    exposed Ruby web application and cause the server to use unnecessary
+    CPU resources, potentially resulting in a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ruby 1.6.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=dev-lang/ruby-1.6.8-r12"</code>
+    <p>
+    All Ruby 1.8.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=dev-lang/ruby-1.8.2_pre3"</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0983">CAN-2004-0983</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 15 Nov 2004 10:02:12 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 15 Nov 2004 10:02:22 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 15 Nov 2004 20:10:34 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-24.xml b/xml/htdocs/security/en/glsa/glsa-200411-24.xml
new file mode 100644
index 00000000..f18149b2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-24.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-24">
+  <title>BNC: Buffer overflow vulnerability</title>
+  <synopsis>
+    BNC contains a buffer overflow vulnerability that may lead to Denial of
+    Service and execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">BNC</product>
+  <announced>November 16, 2004</announced>
+  <revised>November 16, 2004: 01</revised>
+  <bug>70674</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-irc/bnc" auto="yes" arch="*">
+      <unaffected range="ge">2.9.1</unaffected>
+      <vulnerable range="lt">2.9.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    BNC (BouNCe) is an IRC proxy server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Leon Juranic discovered that BNC fails to do proper bounds
+    checking when checking server response.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could exploit this to cause a Denial of Service and
+    potentially execute arbitary code with the permissions of the user
+    running BNC.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All BNC users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose ">=net-irc/bnc-2.9.1"</code>
+  </resolution>
+  <references>
+    <uri link="http://gotbnc.com/changes.html">BNC ChangeLog</uri>
+    <uri link="http://security.lss.hr/en/index.php?page=details&amp;ID=LSS-2004-11-03">LSS-2004-11-03</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 11 Nov 2004 20:17:39 +0000">
+    lewk
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 11 Nov 2004 21:49:41 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 12 Nov 2004 23:44:26 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-25.xml b/xml/htdocs/security/en/glsa/glsa-200411-25.xml
new file mode 100644
index 00000000..05174c69
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-25.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-25">
+  <title>SquirrelMail: Encoded text XSS vulnerability</title>
+  <synopsis>
+    Squirrelmail fails to properly sanitize user input, which could lead to a
+    compromise of webmail accounts.
+  </synopsis>
+  <product type="ebuild">SquirrelMail</product>
+  <announced>November 17, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>70739</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/squirrelmail" auto="yes" arch="*">
+      <unaffected range="ge">1.4.3a-r2</unaffected>
+      <vulnerable range="lt">1.4.3a-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SquirrelMail is a webmail package written in PHP. It supports IMAP and
+    SMTP, and can optionally be installed with SQL support.
+    </p>
+  </background>
+  <description>
+    <p>
+    SquirrelMail fails to properly sanitize certain strings when decoding
+    specially-crafted headers.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By enticing a user to read a specially-crafted e-mail, an attacker can
+    execute arbitrary scripts running in the context of the victim's
+    browser. This could lead to a compromise of the user's webmail account,
+    cookie theft, etc.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SquirrelMail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/squirrelmail-1.4.3a-r2&quot;</code>
+    <p>
+    Note: Users with the vhosts USE flag set should manually use
+    webapp-config to finalize the update.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://article.gmane.org/gmane.mail.squirrelmail.user/21169">SquirrelMail Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1036">CVE-2004-1036</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 13 Nov 2004 07:50:02 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 14 Nov 2004 18:02:58 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 14 Nov 2004 18:40:00 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-26.xml b/xml/htdocs/security/en/glsa/glsa-200411-26.xml
new file mode 100644
index 00000000..fbc81a6d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-26.xml
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-26">
+  <title>GIMPS, SETI@home, ChessBrain: Insecure installation</title>
+  <synopsis>
+    Improper file ownership allows user-owned files to be run with root
+    privileges by init scripts.
+  </synopsis>
+  <product type="ebuild">GIMPS,SETI@home,ChessBrain</product>
+  <announced>November 17, 2004</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>69868</bug>
+  <access>local</access>
+  <affected>
+    <package name="sci-misc/gimps" auto="yes" arch="*">
+      <unaffected range="ge">23.9-r1</unaffected>
+      <vulnerable range="le">23.9</vulnerable>
+    </package>
+    <package name="sci-misc/setiathome" auto="yes" arch="*">
+      <unaffected range="ge">3.08-r4</unaffected>
+      <unaffected range="rge">3.03-r2</unaffected>
+      <vulnerable range="le">3.08-r3</vulnerable>
+    </package>
+    <package name="sci-misc/chessbrain" auto="yes" arch="*">
+      <unaffected range="ge">20407-r1</unaffected>
+      <vulnerable range="le">20407</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GIMPS is a client for the distributed Great Internet Mersenne Prime
+    Search. SETI@home is the client for the Search for Extraterrestrial
+    Intelligence (SETI) project. ChessBrain is the client for the
+    distributed chess supercomputer.
+    </p>
+  </background>
+  <description>
+    <p>
+    GIMPS, SETI@home and ChessBrain ebuilds install user-owned binaries and
+    init scripts which are executed with root privileges.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    This could lead to a local privilege escalation or root compromise.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GIMPS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sci-misc/gimps-23.9-r1&quot;</code>
+    <p>
+    All SETI@home users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sci-misc/setiathome-3.03-r2&quot;</code>
+    <p>
+    All ChessBrain users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sci-misc/chessbrain-20407-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1115">CVE-2004-1115</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1116">CVE-2004-1116</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1117">CVE-2004-1117</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 13 Nov 2004 08:00:15 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 14 Nov 2004 18:34:14 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 14 Nov 2004 18:38:42 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-27.xml b/xml/htdocs/security/en/glsa/glsa-200411-27.xml
new file mode 100644
index 00000000..e42743f2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-27.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-27">
+  <title>Fcron: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Fcron can allow a local user to potentially
+    cause a Denial of Service.
+  </synopsis>
+  <product type="ebuild">fcron</product>
+  <announced>November 18, 2004</announced>
+  <revised>November 18, 2004: 01</revised>
+  <bug>71311</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-process/fcron" auto="yes" arch="*">
+      <unaffected range="rge">2.0.2</unaffected>
+      <unaffected range="ge">2.9.5.1</unaffected>
+      <vulnerable range="le">2.9.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Fcron is a command scheduler with extended capabilities over cron
+    and anacron.
+    </p>
+  </background>
+  <description>
+    <p>
+    Due to design errors in the fcronsighup program, Fcron may allow a
+    local user to bypass access restrictions (CAN-2004-1031), view the
+    contents of root owned files (CAN-2004-1030), remove arbitrary files or
+    create empty files (CAN-2004-1032), and send a SIGHUP to any process. A
+    vulnerability also exists in fcrontab which may allow local users to
+    view the contents of fcron.allow and fcron.deny (CAN-2004-1033).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit these vulnerabilities to perform a
+    Denial of Service on the system running Fcron.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Make sure the fcronsighup and fcrontab binaries are only
+    executable by trusted users.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Fcron users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-process/fcron-2.0.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1030">CAN-2004-1030</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1031">CAN-2004-1031</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1032">CAN-2004-1032</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1033">CAN-2004-1033</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 16 Nov 2004 16:18:47 +0000">
+    lewk
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 16 Nov 2004 19:52:12 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 17 Nov 2004 19:04:05 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-28.xml b/xml/htdocs/security/en/glsa/glsa-200411-28.xml
new file mode 100644
index 00000000..dcdf0029
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-28.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-28">
+  <title>X.Org, XFree86: libXpm vulnerabilities</title>
+  <synopsis>
+    libXpm contains several vulnerabilities that could lead to a Denial of
+    Service and arbitrary code execution.
+  </synopsis>
+  <product type="ebuild">X.Org, XFree86</product>
+  <announced>November 19, 2004</announced>
+  <revised>November 19, 2004: 01</revised>
+  <bug>68544</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-base/xorg-x11" auto="yes" arch="*">
+      <unaffected range="ge">6.8.0-r3</unaffected>
+      <unaffected range="rge">6.7.0-r3</unaffected>
+      <vulnerable range="lt">6.8.0-r3</vulnerable>
+    </package>
+    <package name="x11-base/xfree" auto="yes" arch="*">
+      <unaffected range="ge">4.3.0-r8</unaffected>
+      <vulnerable range="lt">4.3.0-r8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libXpm is a pixmap manipulation library for the X Window System,
+    included in both X.Org and XFree86.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several issues were discovered in libXpm, including integer
+    overflows, out-of-bounds memory accesses, insecure path traversal and
+    an endless loop.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could craft a malicious pixmap file and entice a user
+    to use it with an application linked against libXpm. This could lead to
+    Denial of Service or arbitrary code execution.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All X.Org users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-base/xorg-x11-6.7.0-r3&quot;</code>
+    <p>
+    All XFree86 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-base/xfree-x11-4.3.0-r8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0914">CAN-2004-0914</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 17 Nov 2004 20:14:27 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 17 Nov 2004 20:53:59 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 18 Nov 2004 10:05:15 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-29.xml b/xml/htdocs/security/en/glsa/glsa-200411-29.xml
new file mode 100644
index 00000000..1cf979aa
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-29.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-29">
+  <title>unarj: Long filenames buffer overflow and a path traversal vulnerability</title>
+  <synopsis>
+    unarj contains a buffer overflow and a directory traversal vulnerability.
+    This could lead to overwriting of arbitrary files or the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">unarj</product>
+  <announced>November 19, 2004</announced>
+  <revised>November 19, 2004: 01</revised>
+  <bug>70966</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/unarj" auto="yes" arch="*">
+      <unaffected range="ge">2.63a-r2</unaffected>
+      <vulnerable range="lt">2.63a-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    unarj is an ARJ archive decompressor.
+    </p>
+  </background>
+  <description>
+    <p>
+    unarj has a bounds checking vulnerability within the handling of
+    long filenames in archives. It also fails to properly sanitize paths
+    when extracting an archive (if the "x" option is used to preserve
+    paths).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could trigger a buffer overflow or a path traversal by
+    enticing a user to open an archive containing specially-crafted path
+    names, potentially resulting in the overwrite of files or execution of
+    arbitrary code with the permissions of the user running unarj.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All unarj users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/unarj-2.63a-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0947">CAN-2004-0947</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1027">CAN-2004-1027</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 18 Nov 2004 16:42:36 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 18 Nov 2004 16:42:55 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 19 Nov 2004 09:32:28 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-30.xml b/xml/htdocs/security/en/glsa/glsa-200411-30.xml
new file mode 100644
index 00000000..ad6a110a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-30.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-30">
+  <title>pdftohtml: Vulnerabilities in included Xpdf</title>
+  <synopsis>
+    pdftohtml includes vulnerable Xpdf code to handle PDF files, making it
+    vulnerable to execution of arbitrary code upon converting a malicious PDF
+    file.
+  </synopsis>
+  <product type="ebuild">pdftohtml</product>
+  <announced>November 23, 2004</announced>
+  <revised>November 23, 2004: 01</revised>
+  <bug>69019</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/pdftohtml" auto="yes" arch="*">
+      <unaffected range="ge">0.36-r1</unaffected>
+      <vulnerable range="le">0.36</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    pdftohtml is a utility to convert PDF files to HTML or XML
+    formats. It makes use of Xpdf code to decode PDF files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Xpdf is vulnerable to multiple integer overflows, as described in
+    GLSA 200410-20.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to convert a specially-crafted PDF
+    file, potentially resulting in execution of arbitrary code with the
+    rights of the user running pdftohtml.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All pdftohtml users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/pdftohtml-0.36-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200410-20.xml">GLSA 200410-20</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0888">CAN-2004-0888</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 22 Nov 2004 17:05:12 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 22 Nov 2004 17:05:20 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-31.xml b/xml/htdocs/security/en/glsa/glsa-200411-31.xml
new file mode 100644
index 00000000..c410c894
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-31.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-31">
+  <title>ProZilla: Multiple vulnerabilities</title>
+  <synopsis>
+    ProZilla contains several buffer overflow vulnerabilities that can be
+    exploited by a malicious server to execute arbitrary code with the rights
+    of the user running ProZilla.
+  </synopsis>
+  <product type="ebuild">ProZilla</product>
+  <announced>November 23, 2004</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>70090</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/prozilla" auto="yes" arch="*">
+      <vulnerable range="le">1.3.7.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ProZilla is a download accelerator for Linux.
+    </p>
+  </background>
+  <description>
+    <p>
+    ProZilla contains several exploitable buffer overflows in the code
+    handling the network protocols.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could setup a malicious server and entice a user to
+    retrieve files from that server using ProZilla. This could lead to the
+    execution of arbitrary code with the rights of the user running
+    ProZilla.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Currently, there is no released version of ProZilla that contains a fix
+    for these issues. The original author did not respond to our queries,
+    the code contains several other problems and more secure alternatives
+    exist. Therefore, the ProZilla package has been hard-masked prior to
+    complete removal from Portage, and current users are advised to unmerge
+    the package.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1120">CVE-2004-1120</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 22 Nov 2004 17:28:48 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 22 Nov 2004 19:27:08 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 22 Nov 2004 19:46:53 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-32.xml b/xml/htdocs/security/en/glsa/glsa-200411-32.xml
new file mode 100644
index 00000000..993af155
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-32.xml
@@ -0,0 +1,98 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-32">
+  <title>phpBB: Remote command execution</title>
+  <synopsis>
+    phpBB contains a vulnerability which allows a remote attacker to execute
+    arbitrary commands with the rights of the web server user.
+  </synopsis>
+  <product type="ebuild">phpBB</product>
+  <announced>November 24, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>71681</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phpbb" auto="yes" arch="*">
+      <unaffected range="ge">2.0.11</unaffected>
+      <vulnerable range="lt">2.0.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpBB is an Open Source bulletin board package.
+    </p>
+  </background>
+  <description>
+    <p>
+    phpBB contains a vulnerability in the highlighting code and several
+    vulnerabilities in the username handling code.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker can exploit the highlighting vulnerability to access the
+    PHP exec() function without restriction, allowing them to run arbitrary
+    commands with the rights of the web server user (for example the apache
+    user). Furthermore, the username handling vulnerability might be abused
+    to execute SQL statements on the phpBB database.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is a one-line patch which will remediate the remote execution
+    vulnerability.
+    </p>
+    <p>
+    Locate the following block of code in viewtopic.php:
+    </p>
+    <code>
+    //
+    // Was a highlight request part of the URI?
+    //
+    $highlight_match = $highlight = '';
+    if (isset($HTTP_GET_VARS['highlight']))
+    {
+       // Split words and phrases
+       $words = explode(' ', trim(htmlspecialchars(urldecode($HTTP_GET_VARS['highlight']))));
+    
+       for($i = 0; $i &lt; sizeof($words); $i++)
+       {</code>
+    <p>
+    Replace with the following:
+    </p>
+    <code>
+    //
+    // Was a highlight request part of the URI?
+    //
+    $highlight_match = $highlight = '';
+    if (isset($HTTP_GET_VARS['highlight']))
+    {
+       // Split words and phrases
+       $words = explode(' ', trim(htmlspecialchars($HTTP_GET_VARS['highlight'])));
+    
+       for($i = 0; $i &lt; sizeof($words); $i++)
+       {</code>
+  </workaround>
+  <resolution>
+    <p>
+    All phpBB users should upgrade to the latest version to fix all known
+    vulnerabilities:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/phpbb-2.0.11&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.phpbb.com/phpBB/viewtopic.php?t=240513">phpBB.com Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1315">CVE-2004-1315</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 18 Nov 2004 17:31:41 +0000">
+    klieber
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 24 Nov 2004 08:51:46 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-33.xml b/xml/htdocs/security/en/glsa/glsa-200411-33.xml
new file mode 100644
index 00000000..38f1696b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-33.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-33">
+  <title>TWiki: Arbitrary command execution</title>
+  <synopsis>
+    A bug in the TWiki search function allows an attacker to execute arbitrary
+    commands with the permissions of the user running TWiki.
+  </synopsis>
+  <product type="ebuild">www-apps/twiki</product>
+  <announced>November 24, 2004</announced>
+  <revised>September 08, 2006: 02</revised>
+  <bug>71035</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/twiki" auto="yes" arch="*">
+      <unaffected range="ge">20040902 </unaffected>
+      <unaffected range="lt">20000000</unaffected>
+      <vulnerable range="lt">20040902 </vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    TWiki is a Web-based groupware tool based around the concept of wiki
+    pages that can be edited by anybody with a Web browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    The TWiki search function, which uses a shell command executed via the
+    Perl backtick operator, does not properly escape shell metacharacters
+    in the user-provided search string.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker can insert malicious commands into a search request,
+    allowing the execution of arbitrary commands with the privileges of the
+    user running TWiki (usually the Web server user).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All TWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/twiki-20040902&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithSearch">TWiki Security Alert</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1037">CAN-2004-1037</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 22 Nov 2004 17:14:35 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 22 Nov 2004 23:25:58 +0000">
+    dmargoli
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 24 Nov 2004 08:52:40 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-34.xml b/xml/htdocs/security/en/glsa/glsa-200411-34.xml
new file mode 100644
index 00000000..dea4f274
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-34.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-34">
+  <title>Cyrus IMAP Server: Multiple remote vulnerabilities</title>
+  <synopsis>
+    The Cyrus IMAP Server contains multiple vulnerabilities which could lead to
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">cyrus-imapd</product>
+  <announced>November 25, 2004</announced>
+  <revised>November 25, 2004: 01</revised>
+  <bug>72194</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/cyrus-imapd" auto="yes" arch="*">
+      <unaffected range="ge">2.2.10</unaffected>
+      <vulnerable range="lt">2.2.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Cyrus IMAP Server is an efficient, highly-scalable IMAP e-mail
+    server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in the argument
+    parsers of the 'partial' and 'fetch' commands of the Cyrus IMAP Server
+    (CAN-2004-1012, CAN-2004-1013). There are also buffer overflows in the
+    'imap magic plus' code that are vulnerable to exploitation as well
+    (CAN-2004-1011, CAN-2004-1015).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker can exploit these vulnerabilities to execute arbitrary
+    code with the rights of the user running the Cyrus IMAP Server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cyrus-IMAP Server users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/cyrus-imapd-2.2.10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1011">CAN-2004-1011</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1012">CAN-2004-1012</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1013">CAN-2004-1013</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1015">CAN-2004-1015</uri>
+    <uri link="http://security.e-matters.de/advisories/152004.html">e-matters Advisory</uri>
+    <uri link="http://asg.web.cmu.edu/cyrus/download/imapd/changes.html">Cyrus IMAP Server ChangeLog</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 23 Nov 2004 18:38:38 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 23 Nov 2004 22:08:00 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 24 Nov 2004 17:22:57 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-35.xml b/xml/htdocs/security/en/glsa/glsa-200411-35.xml
new file mode 100644
index 00000000..00c07bd8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-35.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-35">
+  <title>phpWebSite: HTTP response splitting vulnerability</title>
+  <synopsis>
+    phpWebSite is vulnerable to possible HTTP response splitting attacks.
+  </synopsis>
+  <product type="ebuild">phpwebsite</product>
+  <announced>November 26, 2004</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>71502</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phpwebsite" auto="yes" arch="*">
+      <unaffected range="ge">0.9.3_p4-r2</unaffected>
+      <vulnerable range="lt">0.9.3_p4-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpWebSite is a web site content management system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Due to lack of proper input validation, phpWebSite has been found to be
+    vulnerable to HTTP response splitting attacks.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A malicious user could inject arbitrary response data, leading to
+    content spoofing, web cache poisoning and other cross-site scripting or
+    HTTP response splitting attacks. This could result in compromising the
+    victim's data or browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpWebSite users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/phpwebsite-0.9.3_p4-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/380894">BugTraq Posting</uri>
+    <uri link="http://phpwebsite.appstate.edu/index.php?module=announce&amp;ANN_user_op=view&amp;ANN_id=863">phpWebSite Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1516">CVE-2004-1516</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 24 Nov 2004 19:21:49 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 25 Nov 2004 09:49:35 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 26 Nov 2004 09:12:53 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-36.xml b/xml/htdocs/security/en/glsa/glsa-200411-36.xml
new file mode 100644
index 00000000..1839174a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-36.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-36">
+  <title>phpMyAdmin: Multiple XSS vulnerabilities</title>
+  <synopsis>
+    phpMyAdmin is vulnerable to cross-site scripting attacks.
+  </synopsis>
+  <product type="ebuild">phpmyadmin</product>
+  <announced>November 27, 2004</announced>
+  <revised>November 27, 2004: 01</revised>
+  <bug>71819</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/phpmyadmin" auto="yes" arch="*">
+      <unaffected range="ge">2.6.0_p3</unaffected>
+      <vulnerable range="lt">2.6.0_p3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpMyAdmin is a tool written in PHP intended to handle the
+    administration of MySQL databases from a web-browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    Cedric Cochin has discovered multiple cross-site scripting
+    vulnerabilities in phpMyAdmin. These vulnerabilities can be exploited
+    through the PmaAbsoluteUri parameter, the zero_rows parameter in
+    read_dump.php, the confirm form, or an error message generated by the
+    internal phpMyAdmin parser.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By sending a specially-crafted request, an attacker can inject and
+    execute malicious script code, potentially compromising the victim's
+    browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpMyAdmin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/phpmyadmin-2.6.0_p3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1055">CAN-2004-1055</uri>
+    <uri link="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-3">PMASA-2004-3</uri>
+    <uri link="http://www.netvigilance.com/html/advisory0005.htm">netVigilance Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 24 Nov 2004 09:03:21 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 26 Nov 2004 10:27:24 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 26 Nov 2004 19:21:36 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-37.xml b/xml/htdocs/security/en/glsa/glsa-200411-37.xml
new file mode 100644
index 00000000..78eca696
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-37.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-37">
+  <title>Open DC Hub: Remote code execution</title>
+  <synopsis>
+    Open DC Hub contains a buffer overflow that can be exploited to allow
+    remote code execution.
+  </synopsis>
+  <product type="ebuild">opendchub</product>
+  <announced>November 28, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>72371</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-p2p/opendchub" auto="yes" arch="*">
+      <unaffected range="ge">0.7.14-r2</unaffected>
+      <vulnerable range="lt">0.7.14-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Open DC Hub is the hub software for the Direct Connect file sharing
+    network.
+    </p>
+  </background>
+  <description>
+    <p>
+    Donato Ferrante discovered a buffer overflow vulnerability in the
+    RedirectAll command of the Open DC Hub.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Upon exploitation, a remote user with administrative privileges can
+    execute arbitrary code on the system running the Open DC Hub.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Only give administrative rights to trusted users.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Open DC Hub users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-p2p/opendchub-0.7.14-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://archives.neohapsis.com/archives/fulldisclosure/2004-11/1115.html">Full-Disclosure Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1127">CVE-2004-1127</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 28 Nov 2004 03:48:46 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 28 Nov 2004 03:49:07 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200411-38.xml b/xml/htdocs/security/en/glsa/glsa-200411-38.xml
new file mode 100644
index 00000000..baeddb85
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200411-38.xml
@@ -0,0 +1,107 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200411-38">
+  <title>Sun and Blackdown Java: Applet privilege escalation</title>
+  <synopsis>
+    The Java plug-in security in Sun and Blackdown Java environments can be
+    bypassed to access arbitrary packages, allowing untrusted Java applets to
+    perform unrestricted actions on the host system.
+  </synopsis>
+  <product type="ebuild">Java</product>
+  <announced>November 29, 2004</announced>
+  <revised>May 31, 2006: 02</revised>
+  <bug>72172</bug>
+  <bug>72221</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/sun-jdk" auto="yes" arch="x86 amd64">
+      <unaffected range="ge">1.4.2.06</unaffected>
+      <vulnerable range="lt">1.4.2.06</vulnerable>
+    </package>
+    <package name="dev-java/sun-jre-bin" auto="yes" arch="x86 amd64">
+      <unaffected range="ge">1.4.2.06</unaffected>
+      <vulnerable range="lt">1.4.2.06</vulnerable>
+    </package>
+    <package name="dev-java/blackdown-jdk" auto="yes" arch="x86 amd64">
+      <unaffected range="ge">1.4.2.01</unaffected>
+      <vulnerable range="lt">1.4.2.01</vulnerable>
+    </package>
+    <package name="dev-java/blackdown-jre" auto="yes" arch="x86 amd64">
+      <unaffected range="ge">1.4.2.01</unaffected>
+      <vulnerable range="lt">1.4.2.01</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Sun and Blackdown both provide implementations of Java Development Kits
+    (JDK) and Java Runtime Environments (JRE). All these implementations
+    provide a Java plug-in that can be used to execute Java applets in a
+    restricted environment for web browsers.
+    </p>
+  </background>
+  <description>
+    <p>
+    All Java plug-ins are subject to a vulnerability allowing unrestricted
+    Java package access.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could embed a malicious Java applet in a web page and
+    entice a victim to view it. This applet can then bypass security
+    restrictions and execute any command or access any file with the rights
+    of the user running the web browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    As a workaround you could disable Java applets on your web browser.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Sun JDK users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jdk-1.4.2.06&quot;</code>
+    <p>
+    All Sun JRE users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jre-bin-1.4.2.06&quot;</code>
+    <p>
+    All Blackdown JDK users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/blackdown-jdk-1.4.2.01&quot;</code>
+    <p>
+    All Blackdown JRE users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/blackdown-jre-1.4.2.01&quot;</code>
+    <p>
+    Note: You should unmerge all vulnerable versions to be fully protected.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://www.idefense.com/application/poi/display?id=158&amp;type=vulnerabilities">iDEFENSE Security Advisory 11.22.04</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1029">CAN-2004-1029</uri>
+    <uri link="http://www.blackdown.org/java-linux/java2-status/security/Blackdown-SA-2004-01.txt">Blackdown Security Advisory 2004-01</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 25 Nov 2004 09:46:01 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 26 Nov 2004 21:58:36 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 29 Nov 2004 21:15:47 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-01.xml b/xml/htdocs/security/en/glsa/glsa-200412-01.xml
new file mode 100644
index 00000000..f5909d83
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-01.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-01">
+  <title>rssh, scponly: Unrestricted command execution</title>
+  <synopsis>
+    rssh and scponly do not filter command-line options that can be exploited
+    to execute any command, thereby allowing a remote user to completely bypass
+    the restricted shell.
+  </synopsis>
+  <product type="ebuild">scponly</product>
+  <announced>December 03, 2004</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>72815</bug>
+  <bug>72816</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/scponly" auto="yes" arch="*">
+      <unaffected range="ge">4.0</unaffected>
+      <vulnerable range="lt">4.0</vulnerable>
+    </package>
+    <package name="app-shells/rssh" auto="yes" arch="*">
+      <unaffected range="ge">2.2.3</unaffected>
+      <vulnerable range="le">2.2.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    rssh and scponly are two restricted shells, allowing only a few
+    predefined commands. They are often used as a complement to OpenSSH to
+    provide access to remote users without providing any remote execution
+    privileges.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jason Wies discovered that when receiving an authorized command from an
+    authorized user, rssh and scponly do not filter command-line options
+    that can be used to execute any command on the target host.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Using a malicious command, it is possible for a remote authenticated
+    user to execute any command (or upload and execute any file) on the
+    target machine with user rights, effectively bypassing any restriction
+    of scponly or rssh.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All scponly users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/scponly-4.0&quot;</code>
+    <p>
+    All rssh users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-shells/rssh/rssh-2.2.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/383046/2004-11-30/2004-12-06/0">BugTraq Posting</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1161">CVE-2004-1161</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1162">CVE-2004-1162</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed,  1 Dec 2004 09:03:59 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu,  2 Dec 2004 13:01:44 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri,  3 Dec 2004 13:57:43 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-02.xml b/xml/htdocs/security/en/glsa/glsa-200412-02.xml
new file mode 100644
index 00000000..bbaec224
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-02.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-02">
+  <title>PDFlib: Multiple overflows in the included TIFF library</title>
+  <synopsis>
+    PDFlib is vulnerable to multiple overflows, which can potentially lead to
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">PDFlib</product>
+  <announced>December 05, 2004</announced>
+  <revised>December 05, 2004: 01</revised>
+  <bug>69043</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/pdflib" auto="yes" arch="*">
+      <unaffected range="ge">5.0.4_p1</unaffected>
+      <vulnerable range="lt">5.0.4_p1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PDFlib is a library providing functions to handle PDF files. It
+    includes a modified TIFF library used to process TIFF images.
+    </p>
+  </background>
+  <description>
+    <p>
+    The TIFF library is subject to several known vulnerabilities (see
+    GLSA 200410-11). Most of these overflows also apply to PDFlib.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or web application to
+    process a carefully crafted PDF file or TIFF image using a
+    PDFlib-powered program. This can potentially lead to the execution of
+    arbitrary code with the rights of the program processing the file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PDFlib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/pdflib-5.0.4_p1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.pdflib.com/products/pdflib/info/PDFlib-5.0.4p1-changes.txt">PDFlib ChangeLog</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0803">CAN-2004-0803</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0804">CAN-2004-0804</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0886">CAN-2004-0886</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200410-11.xml">GLSA 200410-11</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed,  1 Dec 2004 14:14:01 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun,  5 Dec 2004 14:12:37 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-03.xml b/xml/htdocs/security/en/glsa/glsa-200412-03.xml
new file mode 100644
index 00000000..c7f311bd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-03.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-03">
+  <title>imlib: Buffer overflows in image decoding</title>
+  <synopsis>
+    Multiple overflows have been found in the imlib library image decoding
+    routines, potentially allowing execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">imlib</product>
+  <announced>December 06, 2004</announced>
+  <revised>December 06, 2004: 01</revised>
+  <bug>72681</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/imlib" auto="yes" arch="*">
+      <unaffected range="ge">1.9.14-r3</unaffected>
+      <vulnerable range="le">1.9.14-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    imlib is an advanced replacement library for image manipulation
+    libraries like libXpm. It is called by numerous programs, including
+    gkrellm and several window managers, to help in displaying images.
+    </p>
+  </background>
+  <description>
+    <p>
+    Pavel Kankovsky discovered that several overflows found in the
+    libXpm library (see GLSA 200409-34) also applied to imlib. He also
+    fixed a number of other potential flaws.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to view a carefully-crafted
+    image file, which would potentially lead to execution of arbitrary code
+    with the rights of the user viewing the image. This affects any program
+    that makes use of the imlib library.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All imlib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/imlib-1.9.14-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200409-34.xml">GLSA 200409-34</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1026">CAN-2004-1026</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon,  6 Dec 2004 09:59:18 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon,  6 Dec 2004 09:59:29 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-04.xml b/xml/htdocs/security/en/glsa/glsa-200412-04.xml
new file mode 100644
index 00000000..48edb080
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-04.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-04">
+  <title>Perl: Insecure temporary file creation</title>
+  <synopsis>
+    Perl is vulnerable to symlink attacks, potentially allowing a local user to
+    overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">perl</product>
+  <announced>December 07, 2004</announced>
+  <revised>December 07, 2004: 01</revised>
+  <bug>66360</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-lang/perl" auto="yes" arch="*">
+      <unaffected range="rge">5.8.5-r2</unaffected>
+      <unaffected range="ge">5.8.6-r1</unaffected>
+      <vulnerable range="lt">5.8.5-r2</vulnerable>
+      <vulnerable range="eq">5.8.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Perl is a stable, cross-platform programming language created by
+    Larry Wall.
+    </p>
+  </background>
+  <description>
+    <p>
+    Some Perl modules create temporary files in world-writable
+    directories with predictable names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary
+    files directory, pointing to a valid file somewhere on the filesystem.
+    When a Perl script is executed, this would result in the file being
+    overwritten with the rights of the user running the utility, which
+    could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Perl users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=perl-5.8.5-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0976">CAN-2004-0976</uri>
+    <uri link="http://www.trustix.org/errata/2004/0050/">Trustix Advisory #2004-0050</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun,  5 Dec 2004 01:07:23 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon,  6 Dec 2004 21:18:17 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-05.xml b/xml/htdocs/security/en/glsa/glsa-200412-05.xml
new file mode 100644
index 00000000..e1d3e27f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-05.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-05">
+  <title>mirrorselect: Insecure temporary file creation</title>
+  <synopsis>
+    mirrorselect is vulnerable to symlink attacks, potentially allowing a local
+    user to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">mirrorselect</product>
+  <announced>December 07, 2004</announced>
+  <revised>May 22, 2006: 04</revised>
+  <bug>73545</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-portage/mirrorselect" auto="yes" arch="*">
+      <unaffected range="ge">0.89</unaffected>
+      <vulnerable range="lt">0.89</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    mirrorselect is a tool to help select distfiles mirrors for Gentoo.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ervin Nemeth discovered that mirrorselect creates temporary files in
+    world-writable directories with predictable names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary files
+    directory, pointing to a valid file somewhere on the filesystem. When
+    mirrorselect is executed, this would result in the file being
+    overwritten with the rights of the user running the utility, which
+    could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mirrorselect users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-portage/mirrorselect-0.89&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1167">CVE-2004-1167</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon,  6 Dec 2004 21:43:32 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon,  6 Dec 2004 21:51:32 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-06.xml b/xml/htdocs/security/en/glsa/glsa-200412-06.xml
new file mode 100644
index 00000000..67b3e0db
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-06.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-06">
+  <title>PHProjekt: setup.php vulnerability</title>
+  <synopsis>
+    PHProjekt contains a vulnerability in the setup procedure allowing remote
+    users without admin rights to change the configuration.
+  </synopsis>
+  <product type="ebuild">PHProjekt</product>
+  <announced>December 10, 2004</announced>
+  <revised>December 10, 2004: 01</revised>
+  <bug>73021</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phprojekt" auto="yes" arch="*">
+      <unaffected range="ge">4.2-r1</unaffected>
+      <vulnerable range="lt">4.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHProjekt is a modular groupware web application used to
+    coordinate group activities and share files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Martin Muench, from it.sec, found a flaw in the setup.php file.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation of the flaw allows a remote attacker
+    without admin rights to make unauthorized changes to PHProjekt
+    configuration.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    As a workaround, you could replace the existing setup.php file in
+    PHProjekt root directory by the one provided on the PHProjekt Advisory
+    (see References).
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHProjekt users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/phprojekt-4.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.phprojekt.com/modules.php?op=modload&amp;name=News&amp;file=article&amp;sid=189&amp;mode=thread&amp;order=0">PHProjekt Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu,  9 Dec 2004 14:30:29 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu,  9 Dec 2004 16:24:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 10 Dec 2004 17:26:05 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-07.xml b/xml/htdocs/security/en/glsa/glsa-200412-07.xml
new file mode 100644
index 00000000..a710f815
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-07.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-07">
+  <title>file: Arbitrary code execution</title>
+  <synopsis>
+    The code for parsing ELF headers in file contains a flaw which may allow an
+    attacker to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">file</product>
+  <announced>December 13, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>72521</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-apps/file" auto="yes" arch="*">
+      <unaffected range="ge">4.12</unaffected>
+      <vulnerable range="lt">4.12</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    file is a utility used to identify the type of a file.
+    </p>
+  </background>
+  <description>
+    <p>
+    A possible stack overflow has been found in the ELF header parsing code
+    of file.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker may be able to create a specially crafted ELF file which,
+    when processed with file, may allow the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All file users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/file-4.12&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://securitytracker.com/id?1012433">SecurityTracker Alert ID 1012433</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1304">CVE-2004-1304</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 11 Dec 2004 10:27:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 11 Dec 2004 10:27:27 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 12 Dec 2004 20:24:04 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-08.xml b/xml/htdocs/security/en/glsa/glsa-200412-08.xml
new file mode 100644
index 00000000..c56c69d2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-08.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-08">
+  <title>nfs-utils: Multiple remote vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in nfs-utils that could lead
+    to a Denial of Service, or the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">nfs-utils</product>
+  <announced>December 14, 2004</announced>
+  <revised>December 14, 2004: 01</revised>
+  <bug>72113</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-fs/nfs-utils" auto="yes" arch="*">
+      <unaffected range="ge">1.0.6-r6</unaffected>
+      <vulnerable range="lt">1.0.6-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    nfs-utils is a package containing the client and daemon
+    implementations for the NFS protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    Arjan van de Ven has discovered a buffer overflow on 64-bit
+    architectures in 'rquota_server.c' of nfs-utils (CAN-2004-0946). A
+    remotely exploitable flaw on all architectures also exists in the
+    'statd.c' file of nfs-utils (CAN-2004-1014), which can be triggered by
+    a mishandled SIGPIPE.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could potentially cause a Denial of Service, or
+    even execute arbitrary code (64-bit architectures only) on a remote NFS
+    server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All nfs-utils users should upgarde to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-fs/nfs-utils-1.0.6-r6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0946">CAN-2004-0946</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1014">CAN-2004-1014</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun,  5 Dec 2004 18:33:51 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon,  6 Dec 2004 15:50:26 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 11 Dec 2004 10:25:46 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-09.xml b/xml/htdocs/security/en/glsa/glsa-200412-09.xml
new file mode 100644
index 00000000..e61bb740
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-09.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-09">
+  <title>ncpfs: Buffer overflow in ncplogin and ncpmap</title>
+  <synopsis>
+    ncpfs is vulnerable to a buffer overflow that could lead to local execution
+    of arbitrary code with elevated privileges.
+  </synopsis>
+  <product type="ebuild">ncpfs</product>
+  <announced>December 15, 2004</announced>
+  <revised>December 15, 2004: 01</revised>
+  <bug>72820</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-fs/ncpfs" auto="yes" arch="*">
+      <unaffected range="ge">2.2.5</unaffected>
+      <vulnerable range="lt">2.2.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ncpfs is a NCP protocol network filesystem that allows access to
+    Netware services, for example to mount volumes of NetWare servers or
+    print to NetWare print queues.
+    </p>
+  </background>
+  <description>
+    <p>
+    Karol Wiesek discovered a buffer overflow in the handling of the
+    '-T' option in the ncplogin and ncpmap utilities, which are both
+    installed as SUID root by default.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could trigger the buffer overflow by calling one
+    of these utilities with a carefully crafted command line, potentially
+    resulting in execution of arbitrary code with root privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ncpfs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-fs/ncpfs-2.2.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://lists.netsys.com/pipermail/full-disclosure/2004-November/029563.html">Full Disclosure Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1079">CAN-2004-1079</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu,  9 Dec 2004 07:35:34 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 14 Dec 2004 14:41:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 14 Dec 2004 16:10:38 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-10.xml b/xml/htdocs/security/en/glsa/glsa-200412-10.xml
new file mode 100644
index 00000000..46adfbfb
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-10.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-10">
+  <title>Vim, gVim: Vulnerable options in modelines</title>
+  <synopsis>
+    Several vulnerabilities related to the use of options in modelines have
+    been found and fixed in Vim. They could potentially result in a local user
+    escalating privileges.
+  </synopsis>
+  <product type="ebuild">vim</product>
+  <announced>December 15, 2004</announced>
+  <revised>December 15, 2004: 01</revised>
+  <bug>73715</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-editors/vim" auto="yes" arch="*">
+      <unaffected range="ge">6.3-r2</unaffected>
+      <vulnerable range="lt">6.3-r2</vulnerable>
+    </package>
+    <package name="app-editors/gvim" auto="yes" arch="*">
+      <unaffected range="ge">6.3-r2</unaffected>
+      <vulnerable range="lt">6.3-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Vim is an efficient, highly configurable improved version of the
+    classic 'vi' text editor. gVim is the GUI version of Vim.
+    </p>
+  </background>
+  <description>
+    <p>
+    Gentoo's Vim maintainer, Ciaran McCreesh, found several
+    vulnerabilities related to the use of options in Vim modelines. Options
+    like 'termcap', 'printdevice', 'titleold', 'filetype', 'syntax',
+    'backupext', 'keymap', 'patchmode' or 'langmenu' could be abused.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could write a malicious file in a world readable
+    location which, when opened in a modeline-enabled Vim, could trigger
+    arbitrary commands with the rights of the user opening the file,
+    resulting in privilege escalation. Please note that modelines are
+    disabled by default in the /etc/vimrc file provided in Gentoo.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Vim users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-editors/vim-6.3-r2&quot;</code>
+    <p>
+    All gVim users should also upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-editors/gvim-6.3-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1138">CAN-2004-1138</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 10 Dec 2004 22:32:12 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 13 Dec 2004 17:03:31 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 15 Dec 2004 14:00:28 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-11.xml b/xml/htdocs/security/en/glsa/glsa-200412-11.xml
new file mode 100644
index 00000000..67683885
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-11.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-11">
+  <title>Cscope: Insecure creation of temporary files</title>
+  <synopsis>
+    Cscope is vulnerable to symlink attacks, potentially allowing a local user
+    to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">cscope</product>
+  <announced>December 16, 2004</announced>
+  <revised>December 16, 2004: 01</revised>
+  <bug>71595</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-util/cscope" auto="yes" arch="*">
+      <unaffected range="ge">15.5-r2</unaffected>
+      <vulnerable range="lt">15.5-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cscope is a developer utility used to browse and manage source
+    code.
+    </p>
+  </background>
+  <description>
+    <p>
+    Cscope creates temporary files in world-writable directories with
+    predictable names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary
+    files directory, pointing to a valid file somewhere on the filesystem.
+    When Cscope is executed, this would result in the file being
+    overwritten with the rights of the user running the utility, which
+    could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cscope users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-util/cscope-15.5-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0996">CAN-2004-0996</uri>
+    <uri link="http://www.securityfocus.com/archive/1/381443">BugTraq Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 29 Nov 2004 16:19:40 +0000">
+    lewk
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 29 Nov 2004 17:43:04 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 16 Dec 2004 20:27:56 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-12.xml b/xml/htdocs/security/en/glsa/glsa-200412-12.xml
new file mode 100644
index 00000000..0127b832
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-12.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-12">
+  <title>Adobe Acrobat Reader: Buffer overflow vulnerability</title>
+  <synopsis>
+    Adobe Acrobat Reader is vulnerable to a buffer overflow that could lead to
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">acroread</product>
+  <announced>December 16, 2004</announced>
+  <revised>December 16, 2004: 01</revised>
+  <bug>74406</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/acroread" auto="yes" arch="*">
+      <unaffected range="ge">5.10</unaffected>
+      <vulnerable range="lt">5.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Adobe Acrobat Reader is a utility used to view PDF files.
+    </p>
+  </background>
+  <description>
+    <p>
+    A buffer overflow has been discovered in the email processing of
+    Adobe Acrobat Reader. This flaw exists in the mailListIsPdf function,
+    which checks if the input file is an email message containing a PDF
+    file.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send the victim a specially-crafted email
+    and PDF attachment, which would trigger the buffer overflow and
+    possibly lead to the execution of arbitrary code with the permissions
+    of the user running Adobe Acrobat Reader.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Adobe Acrobat Reader users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/acroread-5.10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1152">CAN-2004-1152</uri>
+    <uri link="http://www.adobe.com/support/techdocs/331153.html">Adobe Announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 15 Dec 2004 17:22:59 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 16 Dec 2004 15:18:04 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 16 Dec 2004 17:02:05 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-13.xml b/xml/htdocs/security/en/glsa/glsa-200412-13.xml
new file mode 100644
index 00000000..f1e28e20
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-13.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-13">
+  <title>Samba: Integer overflow</title>
+  <synopsis>
+    Samba contains a bug that could lead to remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Samba</product>
+  <announced>December 17, 2004</announced>
+  <revised>December 17, 2004: 01</revised>
+  <bug>73943</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-fs/samba" auto="yes" arch="*">
+      <unaffected range="ge">3.0.9-r1</unaffected>
+      <vulnerable range="le">3.0.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Samba is a freely available SMB/CIFS implementation which allows
+    seamless interoperability of file and print services to other SMB/CIFS
+    clients.
+    </p>
+  </background>
+  <description>
+    <p>
+    Samba contains a bug when unmarshalling specific MS-RPC requests from
+    clients.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker may be able to execute arbitrary code with the
+    permissions of the user running Samba, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All samba users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-fs/samba-3.0.9-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1154">CAN 2004-1154</uri>
+    <uri link="http://www.samba.org/samba/security/CAN-2004-1154.html">Samba Announcement</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 15 Dec 2004 20:27:23 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 17 Dec 2004 19:53:44 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-14.xml b/xml/htdocs/security/en/glsa/glsa-200412-14.xml
new file mode 100644
index 00000000..ad0784a8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-14.xml
@@ -0,0 +1,114 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-14">
+  <title>PHP: Multiple vulnerabilities</title>
+  <synopsis>
+    Several vulnerabilities were found and fixed in PHP, ranging from an
+    information leak and a safe_mode restriction bypass to a potential remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">PHP</product>
+  <announced>December 19, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>74547</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-php/php" auto="yes" arch="*">
+      <unaffected range="ge">4.3.10</unaffected>
+      <vulnerable range="lt">4.3.10</vulnerable>
+    </package>
+    <package name="dev-php/mod_php" auto="yes" arch="*">
+      <unaffected range="ge">4.3.10</unaffected>
+      <vulnerable range="lt">4.3.10</vulnerable>
+    </package>
+    <package name="dev-php/php-cgi" auto="yes" arch="*">
+      <unaffected range="ge">4.3.10</unaffected>
+      <vulnerable range="lt">4.3.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHP is a general-purpose scripting language widely used to develop
+    web-based applications. It can run inside a web server using the
+    mod_php module or the CGI version of PHP, or can run stand-alone in a
+    CLI.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Esser and Marcus Boerger reported several different issues in
+    the unserialize() function, including serious exploitable bugs in the
+    way it handles negative references (CAN-2004-1019).
+    </p>
+    <p>
+    Stefan Esser also discovered that the pack() and unpack() functions are
+    subject to integer overflows that can lead to a heap buffer overflow
+    and a heap information leak. Finally, he found that the way
+    multithreaded PHP handles safe_mode_exec_dir restrictions can be
+    bypassed, and that various path truncation issues also allow to bypass
+    path and safe_mode restrictions.
+    </p>
+    <p>
+    Ilia Alshanetsky found a stack overflow issue in the exif_read_data()
+    function (CAN-2004-1065). Finally, Daniel Fabian found that addslashes
+    and magic_quotes_gpc do not properly escape null characters and that
+    magic_quotes_gpc contains a bug that could lead to one level directory
+    traversal.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    These issues could be exploited by a remote attacker to retrieve web
+    server heap information, bypass safe_mode or path restrictions and
+    potentially execute arbitrary code with the rights of the web server
+    running a PHP application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-php/php-4.3.10&quot;</code>
+    <p>
+    All mod_php users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-php/mod_php-4.3.10&quot;</code>
+    <p>
+    All php-cgi users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-php/php-cgi-4.3.10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.php.net/release_4_3_10.php">PHP 4.3.10 Release Announcement</uri>
+    <uri link="http://www.hardened-php.net/advisories/012004.txt">Hardened-PHP Security Advisory</uri>
+    <uri link="http://www.securityfocus.com/archive/1/384663/2004-12-15/2004-12-21/0">SEC Consult Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1019">CAN-2004-1019</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1020">CAN-2004-1020</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1063">CVE-2004-1063</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1064">CVE-2004-1064</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1065">CVE-2004-1065</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 16 Dec 2004 10:35:06 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 16 Dec 2004 11:09:01 +0000">
+    Koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 18 Dec 2004 14:09:43 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-15.xml b/xml/htdocs/security/en/glsa/glsa-200412-15.xml
new file mode 100644
index 00000000..7a06c590
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-15.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-15">
+  <title>Ethereal: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities exist in Ethereal, which may allow an attacker to
+    run arbitrary code, crash the program or perform DoS by CPU and disk
+    utilization.
+  </synopsis>
+  <product type="ebuild">Ethereal</product>
+  <announced>December 19, 2004</announced>
+  <revised>December 19, 2004: 01</revised>
+  <bug>74443</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/ethereal" auto="yes" arch="*">
+      <unaffected range="ge">0.10.8</unaffected>
+      <vulnerable range="lt">0.10.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ethereal is a feature rich network protocol analyzer.
+    </p>
+  </background>
+  <description>
+    <p>
+    There are multiple vulnerabilities in versions of Ethereal earlier
+    than 0.10.8, including:
+    </p>
+    <ul>
+    <li>Bug in DICOM dissection
+    discovered by Bing could make Ethereal crash (CAN 2004-1139).</li>
+    <li>An invalid RTP timestamp could make Ethereal hang and create a
+    large temporary file (CAN 2004-1140).</li>
+    <li>The HTTP dissector could
+    access previously-freed memory (CAN 2004-1141).</li>
+    <li>Brian Caswell
+    discovered that an improperly formatted SMB could make Ethereal hang
+    (CAN 2004-1142).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker might be able to use these vulnerabilities to crash
+    Ethereal, perform DoS by CPU and disk space utilization or even execute
+    arbitrary code with the permissions of the user running Ethereal, which
+    could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    For a temporary workaround you can disable all affected protocol
+    dissectors by selecting Analyze->Enabled Protocols... and deselecting
+    them from the list. However, it is strongly recommended to upgrade to
+    the latest stable version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ethereal users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/ethereal-0.10.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.ethereal.com/appnotes/enpa-sa-00016.html">Ethereal enpa-sa-00016</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1139">CAN 2004-1139</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1140">CAN 2004-1140</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1141">CAN 2004-1141</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1142">CAN 2004-1142</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 15 Dec 2004 13:06:28 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 19 Dec 2004 14:01:55 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-16.xml b/xml/htdocs/security/en/glsa/glsa-200412-16.xml
new file mode 100644
index 00000000..ce5a697e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-16.xml
@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-16">
+  <title>kdelibs, kdebase: Multiple vulnerabilities</title>
+  <synopsis>
+    kdelibs and kdebase contain a flaw allowing password disclosure when
+    creating a link to a remote file. Furthermore Konqueror is vulnerable to
+    window injection.
+  </synopsis>
+  <product type="ebuild">KDE</product>
+  <announced>December 19, 2004</announced>
+  <revised>December 19, 2004: 01</revised>
+  <bug>72804</bug>
+  <bug>73869</bug>
+  <access>remote and local</access>
+  <affected>
+    <package name="kde-base/kdelibs" auto="yes" arch="*">
+      <unaffected range="rge">3.2.3-r4</unaffected>
+      <unaffected range="rge">3.3.1-r2</unaffected>
+      <unaffected range="ge">3.3.2-r1</unaffected>
+      <vulnerable range="lt">3.3.2-r1</vulnerable>
+    </package>
+    <package name="kde-base/kdebase" auto="yes" arch="*">
+      <unaffected range="rge">3.2.3-r3</unaffected>
+      <unaffected range="rge">3.3.1-r2</unaffected>
+      <vulnerable range="lt">3.3.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDE is a feature-rich graphical desktop environment for Linux and
+    Unix-like Operating Systems. The KDE core libraries (kdebase and
+    kdelibs) provide native support for many protocols. Konqueror is the
+    KDE web browser and filemanager.
+    </p>
+  </background>
+  <description>
+    <p>
+    Daniel Fabian discovered that the KDE core libraries contain a
+    flaw allowing password disclosure by making a link to a remote file.
+    When creating this link, the resulting URL contains authentication
+    credentials used to access the remote file (CAN 2004-1171).
+    </p>
+    <p>
+    The Konqueror webbrowser allows websites to load webpages into a window
+    or tab currently used by another website (CAN-2004-1158).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious user could have access to the authentication
+    credentials of other users depending on the file permissions.
+    </p>
+    <p>
+    A malicious website could use the window injection vulnerability to
+    load content in a window apparently belonging to another website.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All kdelibs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kdelibs-3.2.3-r4&quot;</code>
+    <p>
+    All kdebase users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kdebase-3.2.3-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.kde.org/info/security/advisory-20041209-1.txt">KDE Security Advisory: plain text password exposure</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1171">CAN 2004-1171</uri>
+    <uri link="http://www.kde.org/info/security/advisory-20041213-1.txt">KDE Security Advisory: Konqueror Window Injection Vulnerability</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1158">CAN 2004-1158</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu,  9 Dec 2004 20:24:54 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 19 Dec 2004 14:04:36 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-17.xml b/xml/htdocs/security/en/glsa/glsa-200412-17.xml
new file mode 100644
index 00000000..df579ad9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-17.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-17">
+  <title>kfax: Multiple overflows in the included TIFF library</title>
+  <synopsis>
+    kfax contains several buffer overflows potentially leading to execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">kfax</product>
+  <announced>December 19, 2004</announced>
+  <revised>January 12, 2005: 04</revised>
+  <bug>73795</bug>
+  <access>remote</access>
+  <affected>
+    <package name="kde-base/kdegraphics" auto="yes" arch="*">
+      <unaffected range="ge">3.3.2</unaffected>
+      <vulnerable range="lt">3.3.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDE is a feature-rich graphical desktop environment for Linux and
+    Unix-like Operating Systems. kfax (part of kdegraphics) is the KDE fax
+    file viewer.
+    </p>
+  </background>
+  <description>
+    <p>
+    Than Ngo discovered that kfax contains a private copy of the TIFF
+    library and is therefore subject to several known vulnerabilities (see
+    References).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to view a carefully-crafted TIFF
+    image file with kfax, which would potentially lead to execution of
+    arbitrary code with the rights of the user running kfax.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    The KDE Team recommends to remove the kfax binary as well as the
+    kfaxpart.la KPart:
+    </p>
+    <code>
+    rm /usr/kde/3.*/lib/kde3/kfaxpart.la
+    rm /usr/kde/3.*/bin/kfax</code>
+    <p>
+    Note: This will render the kfax functionality useless, if kfax
+    functionality is needed you should upgrade to the KDE 3.3.2 which is
+    not stable at the time of this writing.
+    </p>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All kfax users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kdegraphics-3.3.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.kde.org/info/security/advisory-20041209-2.txt">KDE Security Advisory: kfax libtiff vulnerabilities</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200410-11.xml">GLSA 200410-11</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0803">CAN-2004-0803</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0804">CAN-2004-0804</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0886">CAN-2004-0886</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 10 Dec 2004 09:35:12 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 19 Dec 2004 16:51:18 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-18.xml b/xml/htdocs/security/en/glsa/glsa-200412-18.xml
new file mode 100644
index 00000000..d40bc06c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-18.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-18">
+  <title>abcm2ps: Buffer overflow vulnerability</title>
+  <synopsis>
+    abcm2ps is vulnerable to a buffer overflow that could lead to remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">abcm2ps</product>
+  <announced>December 19, 2004</announced>
+  <revised>December 19, 2004: 02</revised>
+  <bug>74702</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/abcm2ps" auto="yes" arch="*">
+      <unaffected range="ge">3.7.21</unaffected>
+      <vulnerable range="lt">3.7.21</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    abcm2ps is a utility used to convert ABC music sheet files into
+    PostScript format.
+    </p>
+  </background>
+  <description>
+    <p>
+    Limin Wang has located a buffer overflow inside the put_words()
+    function in the abcm2ps code.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could convince the victim to download a
+    specially-crafted ABC file. Upon execution, this file would trigger the
+    buffer overflow and lead to the execution of arbitrary code with the
+    permissions of the user running abcm2ps.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All abcm2ps users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/abcm2ps-3.7.21&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://moinejf.free.fr/abcm2ps-3.txt">abcm2ps ChangeLog</uri>
+    <uri link="http://secunia.com/advisories/13523/">Secunia Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 19 Dec 2004 01:45:11 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 19 Dec 2004 14:05:57 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 19 Dec 2004 16:00:19 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-19.xml b/xml/htdocs/security/en/glsa/glsa-200412-19.xml
new file mode 100644
index 00000000..3cc27a35
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-19.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-19">
+  <title>phpMyAdmin: Multiple vulnerabilities</title>
+  <synopsis>
+    phpMyAdmin contains multiple vulnerabilities which could lead to file
+    disclosure or command execution.
+  </synopsis>
+  <product type="ebuild">phpmyadmin</product>
+  <announced>December 19, 2004</announced>
+  <revised>December 19, 2004: 01</revised>
+  <bug>74303</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/phpmyadmin" auto="yes" arch="*">
+      <unaffected range="ge">2.6.1_rc1</unaffected>
+      <vulnerable range="lt">2.6.1_rc1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpMyAdmin is a tool written in PHP intended to handle the
+    administration of MySQL databases from a web-browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    Nicolas Gregoire (exaprobe.com) has discovered two vulnerabilities
+    that exist only on a webserver where PHP safe_mode is off. These
+    vulnerabilities could lead to command execution or file disclosure.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    On a system where external MIME-based transformations are enabled,
+    an attacker can insert offensive values in MySQL, which would start a
+    shell when the data is browsed. On a system where the UploadDir is
+    enabled, read_dump.php could use the unsanitized sql_localfile variable
+    to disclose a file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    You can temporarily enable PHP safe_mode or disable external
+    MIME-based transformation AND disable the UploadDir. But instead, we
+    strongly advise to update your version to 2.6.1_rc1.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpMyAdmin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/phpmyadmin-2.6.1_rc1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1147">CAN-2004-1147</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1148">CAN-2004-1148</uri>
+    <uri link="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4">PHPMyAdmin advisory: PMASA-2004-4</uri>
+    <uri link="http://www.exaprobe.com/labs/advisories/esa-2004-1213.html">Exaprobe.com advisory: esa-2004-1213</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 16 Dec 2004 13:35:32 +0000">
+    SeJo
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 18 Dec 2004 14:47:08 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-20.xml b/xml/htdocs/security/en/glsa/glsa-200412-20.xml
new file mode 100644
index 00000000..686a8812
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-20.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-20">
+  <title>NASM: Buffer overflow vulnerability</title>
+  <synopsis>
+    NASM is vulnerable to a buffer overflow that allows an attacker to execute
+    arbitrary code through the use of a malicious object file.
+  </synopsis>
+  <product type="ebuild">NASM</product>
+  <announced>December 20, 2004</announced>
+  <revised>December 20, 2004: 01</revised>
+  <bug>74477</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/nasm" auto="yes" arch="*">
+      <unaffected range="ge">0.98.38-r1</unaffected>
+      <vulnerable range="le">0.98.38</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    NASM is a 80x86 assembler that has been created for portability
+    and modularity. NASM supports Pentium, P6, SSE MMX, and 3DNow
+    extensions. It also supports a wide range of objects formats (ELF,
+    a.out, COFF, ...), and has its own disassembler.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jonathan Rockway discovered that NASM-0.98.38 has an unprotected
+    vsprintf() to an array in preproc.c. This code vulnerability may lead
+    to a buffer overflow and potential execution of arbitrary code.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft a malicious object file which, when
+    supplied in NASM, would result in the execution of arbitrary code with
+    the rights of the user running NASM.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All NASM users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/nasm-0.98.38-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://sourceforge.net/mailarchive/forum.php?thread_id=6166881&amp;forum_id=4978">Original Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 16 Dec 2004 22:07:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 16 Dec 2004 22:07:54 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 17 Dec 2004 11:34:13 +0000">
+    SeJo
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-21.xml b/xml/htdocs/security/en/glsa/glsa-200412-21.xml
new file mode 100644
index 00000000..bfd5c69c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-21.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-21">
+  <title>MPlayer: Multiple overflows</title>
+  <synopsis>
+    Multiple overflow vulnerabilities have been found in MPlayer, potentially
+    resulting in remote executing of arbitrary code.
+  </synopsis>
+  <product type="ebuild">MPlayer</product>
+  <announced>December 20, 2004</announced>
+  <revised>December 20, 2004: 01</revised>
+  <bug>74473</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/mplayer" auto="yes" arch="*">
+      <unaffected range="ge">1.0_pre5-r5</unaffected>
+      <vulnerable range="le">1.0_pre5-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MPlayer is a media player capable of handling multiple multimedia
+    file formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    iDEFENSE, Ariel Berkman and the MPlayer development team found
+    multiple vulnerabilities in MPlayer. These include potential heap
+    overflows in Real RTSP and pnm streaming code, stack overflows in MMST
+    streaming code and multiple buffer overflows in BMP demuxer and mp3lib
+    code.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft a malicious file or design a
+    malicious streaming server. Using MPlayer to view this file or connect
+    to this server could trigger an overflow and execute
+    attacker-controlled code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MPlayer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/mplayer-1.0_pre5-r5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.idefense.com/application/poi/display?id=168&amp;type=vulnerabilities">iDEFENSE Advisory</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=167&amp;type=vulnerabilities">iDEFENSE Advisory</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=166&amp;type=vulnerabilities">iDEFENSE Advisory</uri>
+    <uri link="http://tigger.uic.edu/~jlongs2/holes/mplayer.txt">Ariel Berkman Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 19 Dec 2004 14:28:01 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 19 Dec 2004 22:01:07 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 20 Dec 2004 09:31:29 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-22.xml b/xml/htdocs/security/en/glsa/glsa-200412-22.xml
new file mode 100644
index 00000000..4ed0057f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-22.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-22">
+  <title>mpg123: Playlist buffer overflow</title>
+  <synopsis>
+    mpg123 is vulnerable to a buffer overflow that allows an attacker to
+    execute arbitrary code through the use of a malicious playlist.
+  </synopsis>
+  <product type="ebuild">mpg123</product>
+  <announced>December 21, 2004</announced>
+  <revised>December 21, 2004: 01</revised>
+  <bug>74692</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/mpg123" auto="yes" arch="*">
+      <unaffected range="ge">0.59s-r8</unaffected>
+      <vulnerable range="lt">0.59s-r8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    mpg123 is a MPEG Audio Player.
+    </p>
+  </background>
+  <description>
+    <p>
+    Bartlomiej Sieka discovered that mpg123 contains an unsafe
+    strcat() to an array in playlist.c. This code vulnerability may lead to
+    a buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft a malicious playlist which, when
+    used, would result in the execution of arbitrary code with the rights
+    of the user running mpg123.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mpg123 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/mpg123-0.59s-r8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://tigger.uic.edu/~jlongs2/holes/mpg123.txt">Original Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1284">CAN-2004-1284</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 20 Dec 2004 14:15:47 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 20 Dec 2004 21:20:26 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 21 Dec 2004 09:35:46 +0000">
+    SeJo
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-23.xml b/xml/htdocs/security/en/glsa/glsa-200412-23.xml
new file mode 100644
index 00000000..b072ff87
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-23.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-23">
+  <title>Zwiki: XSS vulnerability</title>
+  <synopsis>
+    Zwiki is vulnerable to cross-site scripting attacks.
+  </synopsis>
+  <product type="ebuild">zwiki</product>
+  <announced>December 21, 2004</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>72315</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-zope/zwiki" auto="yes" arch="*">
+      <unaffected range="ge">0.36.2-r1</unaffected>
+      <vulnerable range="lt">0.36.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Zwiki is a Zope wiki-clone for easy-to-edit collaborative websites.
+    </p>
+  </background>
+  <description>
+    <p>
+    Due to improper input validation, Zwiki can be exploited to perform
+    cross-site scripting attacks.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By enticing a user to read a specially-crafted wiki entry, an attacker
+    can execute arbitrary script code running in the context of the
+    victim's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Zwiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-zope/zwiki-0.36.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://zwiki.org/925ZwikiXSSVulnerability">Zwiki Bug Report</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1075">CVE-2004-1075</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 21 Dec 2004 16:09:23 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 21 Dec 2004 16:33:56 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 21 Dec 2004 21:14:05 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-24.xml b/xml/htdocs/security/en/glsa/glsa-200412-24.xml
new file mode 100644
index 00000000..23e0627f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-24.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-24">
+  <title>Xpdf, GPdf: New integer overflows</title>
+  <synopsis>
+    New integer overflows were discovered in Xpdf, potentially resulting in the
+    execution of arbitrary code. GPdf includes Xpdf code and therefore is
+    vulnerable to the same issues.
+  </synopsis>
+  <product type="ebuild">Xpdf</product>
+  <announced>December 28, 2004</announced>
+  <revised>December 28, 2004: 01</revised>
+  <bug>75191</bug>
+  <bug>75201</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/xpdf" auto="yes" arch="*">
+      <unaffected range="ge">3.00-r7</unaffected>
+      <vulnerable range="le">3.00-r6</vulnerable>
+    </package>
+    <package name="app-text/gpdf" auto="yes" arch="*">
+      <unaffected range="ge">2.8.1-r1</unaffected>
+      <vulnerable range="le">2.8.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Xpdf is an open source viewer for Portable Document Format (PDF)
+    files. GPdf is a Gnome-based PDF viewer that includes some Xpdf code.
+    </p>
+  </background>
+  <description>
+    <p>
+    A new integer overflow issue was discovered in Xpdf's
+    Gfx::doImage() function.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice an user to open a specially-crafted PDF
+    file, potentially resulting in execution of arbitrary code with the
+    rights of the user running Xpdf or GPdf.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Xpdf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/xpdf-3.00-r7&quot;</code>
+    <p>
+    All GPdf users should also upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/gpdf-2.8.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1125">CAN-2004-1125</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=172&amp;type=vulnerabilities&amp;flashstatus=true">iDEFENSE Advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 28 Dec 2004 09:21:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 28 Dec 2004 09:21:29 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-25.xml b/xml/htdocs/security/en/glsa/glsa-200412-25.xml
new file mode 100644
index 00000000..407d4c86
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-25.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-25">
+  <title>CUPS: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been found in CUPS, ranging from local Denial
+    of Service attacks to the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">CUPS</product>
+  <announced>December 28, 2004</announced>
+  <revised>January 12, 2005: 02</revised>
+  <bug>74479</bug>
+  <bug>75197</bug>
+  <bug>77023</bug>
+  <access>remote and local</access>
+  <affected>
+    <package name="net-print/cups" auto="yes" arch="*">
+      <unaffected range="ge">1.1.23</unaffected>
+      <vulnerable range="lt">1.1.23</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Common UNIX Printing System (CUPS) is a cross-platform print
+    spooler, hpgltops is a CUPS filter handling printing of HPGL files and
+    lppasswd is a program used locally to manage spooler passwords.
+    </p>
+  </background>
+  <description>
+    <p>
+    CUPS makes use of vulnerable Xpdf code to handle PDF files
+    (CAN-2004-1125). Furthermore, Ariel Berkman discovered a buffer
+    overflow in the ParseCommand function in hpgl-input.c in the hpgltops
+    program (CAN-2004-1267). Finally, Bartlomiej Sieka discovered several
+    problems in the lppasswd program: it ignores some write errors
+    (CAN-2004-1268), it can leave the passwd.new file in place
+    (CAN-2004-1269) and it does not verify that passwd.new file is
+    different from STDERR (CAN-2004-1270).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    The Xpdf and hpgltops vulnerabilities may be exploited by a remote
+    attacker to execute arbitrary code by sending specific print jobs to a
+    CUPS spooler. The lppasswd vulnerabilities may be exploited by a local
+    attacker to write data to the CUPS password file or deny further
+    password modifications.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CUPS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-print/cups-1.1.23&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1125">CAN-2004-1125</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1267">CAN-2004-1267</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1268">CAN-2004-1268</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1269">CAN-2004-1269</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1270">CAN-2004-1270</uri>
+    <uri link="http://tigger.uic.edu/~jlongs2/holes/cups.txt">Ariel Berkman Advisory</uri>
+    <uri link="http://tigger.uic.edu/~jlongs2/holes/cups2.txt">Bartlomiej Sieka Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 27 Dec 2004 17:52:31 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 28 Dec 2004 09:42:46 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 28 Dec 2004 12:52:03 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-26.xml b/xml/htdocs/security/en/glsa/glsa-200412-26.xml
new file mode 100644
index 00000000..c8a6fc87
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-26.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-26">
+  <title>ViewCVS: Information leak and XSS vulnerabilities</title>
+  <synopsis>
+    ViewCVS is vulnerable to an information leak and to cross-site scripting
+    (XSS) issues.
+  </synopsis>
+  <product type="ebuild">ViewCVS</product>
+  <announced>December 28, 2004</announced>
+  <revised>December 28, 2004: 01</revised>
+  <bug>72461</bug>
+  <bug>73772</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/viewcvs" auto="yes" arch="*">
+      <unaffected range="ge">0.9.2_p20041207-r1</unaffected>
+      <vulnerable range="le">0.9.2_p20041207</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ViewCVS is a browser interface for viewing CVS and Subversion
+    version control repositories through a web browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    The tar export functions in ViewCVS bypass the 'hide_cvsroot' and
+    'forbidden' settings and therefore expose information that should be
+    kept secret (CAN-2004-0915). Furthermore, some error messages in
+    ViewCVS do not filter user-provided information, making it vulnerable
+    to a cross-site scripting attack (CAN-2004-1062).
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By using the tar export functions, a remote attacker could access
+    information that is configured as restricted. Through the use of a
+    malicious request, an attacker could also inject and execute malicious
+    script code, potentially compromising another user's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ViewCVS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/viewcvs-0.9.2_p20041207-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0915">CAN-2004-0915</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1062">CAN-2004-1062</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 21 Dec 2004 15:31:38 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 28 Dec 2004 14:23:36 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200412-27.xml b/xml/htdocs/security/en/glsa/glsa-200412-27.xml
new file mode 100644
index 00000000..4bb1cfc5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200412-27.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200412-27">
+  <title>PHProjekt: Remote code execution vulnerability</title>
+  <synopsis>
+    PHProjekt contains a vulnerability that allows a remote attacker to execute
+    arbitrary PHP code.
+  </synopsis>
+  <product type="ebuild">PHProjekt</product>
+  <announced>December 30, 2004</announced>
+  <revised>December 30, 2004: 01</revised>
+  <bug>75858</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phprojekt" auto="yes" arch="*">
+      <unaffected range="ge">4.2-r2</unaffected>
+      <vulnerable range="lt">4.2-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHProjekt is a modular groupware web application used to
+    coordinate group activities and share files.
+    </p>
+  </background>
+  <description>
+    <p>
+    cYon discovered that the authform.inc.php script allows a remote
+    user to define the global variable $path_pre.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker can exploit this vulnerability to force
+    authform.inc.php to download and execute arbitrary PHP code with the
+    privileges of the web server user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHProjekt users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/phprojekt-4.2-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.phprojekt.com/modules.php?op=modload&amp;name=News&amp;file=article&amp;sid=193&amp;mode=thread&amp;order=0">PHProjekt Advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 29 Dec 2004 16:45:27 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 29 Dec 2004 16:45:35 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-01.xml b/xml/htdocs/security/en/glsa/glsa-200501-01.xml
new file mode 100644
index 00000000..e4d75028
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-01.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-01">
+  <title>LinPopUp: Buffer overflow in message reply</title>
+  <synopsis>
+    LinPopUp contains a buffer overflow potentially allowing execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">Linpopup</product>
+  <announced>January 04, 2005</announced>
+  <revised>January 04, 2005: 01</revised>
+  <bug>74705</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/linpopup" auto="yes" arch="*">
+      <unaffected range="ge">2.0.4-r1</unaffected>
+      <vulnerable range="lt">2.0.4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    LinPopUp is a graphical application that acts as a frontend to
+    Samba client messaging functions, allowing a Linux desktop to
+    communicate with a Microsoft Windows computer that runs Winpopup.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stephen Dranger discovered that LinPopUp contains a buffer
+    overflow in string.c, triggered when replying to a remote user message.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft a malicious message that, when
+    replied using LinPopUp, would exploit the buffer overflow. This would
+    result in the execution of arbitrary code with the privileges of the
+    user running LinPopUp.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All LinPopUp users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/linpopup-2.0.4-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1282">CAN-2004-1282</uri>
+    <uri link="http://tigger.uic.edu/~jlongs2/holes/linpopup.txt">Stephen Dranger Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 31 Dec 2004 10:20:27 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat,  1 Jan 2005 22:08:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat,  1 Jan 2005 22:15:30 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-02.xml b/xml/htdocs/security/en/glsa/glsa-200501-02.xml
new file mode 100644
index 00000000..980ee245
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-02.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-02">
+  <title>a2ps: Multiple vulnerabilities</title>
+  <synopsis>
+    The fixps and psmandup scripts in the a2ps package are vulnerable to
+    symlink attacks, potentially allowing a local user to overwrite arbitrary
+    files. A vulnerability in a2ps filename handling could also result in
+    arbitrary command execution.
+  </synopsis>
+  <product type="ebuild">a2ps</product>
+  <announced>January 04, 2005</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>75784</bug>
+  <bug>61500</bug>
+  <access>local and remote</access>
+  <affected>
+    <package name="app-text/a2ps" auto="yes" arch="*">
+      <unaffected range="ge">4.13c-r2</unaffected>
+      <vulnerable range="lt">4.13c-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    a2ps is an Any to Postscript filter that can convert to Postscript from
+    many filetypes. fixps is a script that fixes errors in Postscript
+    files. psmandup produces a Postscript file for printing in manual
+    duplex mode.
+    </p>
+  </background>
+  <description>
+    <p>
+    Javier Fernandez-Sanguino Pena discovered that the a2ps package
+    contains two scripts that create insecure temporary files (fixps and
+    psmandup). Furthermore, we fixed in a previous revision a vulnerability
+    in a2ps filename handling (CAN-2004-1170).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary files
+    directory, pointing to a valid file somewhere on the filesystem. When
+    fixps or psmandup is executed, this would result in the file being
+    overwritten with the rights of the user running the utility. By
+    enticing a user or script to run a2ps on a malicious filename, an
+    attacker could execute arbitrary commands on the system with the rights
+    of that user or script.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All a2ps users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/a2ps-4.13c-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://secunia.com/advisories/13641/">Secunia SA13641</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1170">CAN-2004-1170</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1377">CVE-2004-1377</uri>
+    <uri link="http://lists.netsys.com/pipermail/full-disclosure/2004-August/025678.html">Full-Disclosure Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue,  4 Jan 2005 09:44:14 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue,  4 Jan 2005 09:44:22 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue,  4 Jan 2005 11:06:21 +0000">
+    SeJo
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-03.xml b/xml/htdocs/security/en/glsa/glsa-200501-03.xml
new file mode 100644
index 00000000..74d53c8c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-03.xml
@@ -0,0 +1,133 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-03">
+  <title>Mozilla, Firefox, Thunderbird: Various vulnerabilities</title>
+  <synopsis>
+    Various vulnerabilities were found and fixed in Mozilla-based products,
+    ranging from a potential buffer overflow and temporary files disclosure to
+    anti-spoofing issues.
+  </synopsis>
+  <product type="ebuild">Mozilla</product>
+  <announced>January 05, 2005</announced>
+  <revised>December 30, 2007: 03</revised>
+  <bug>76112</bug>
+  <bug>68976</bug>
+  <bug>70749</bug>
+  <access>remote and local</access>
+  <affected>
+    <package name="www-client/mozilla" auto="yes" arch="*">
+      <unaffected range="ge">1.7.5</unaffected>
+      <vulnerable range="lt">1.7.5</vulnerable>
+    </package>
+    <package name="www-client/mozilla-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.7.5</unaffected>
+      <vulnerable range="lt">1.7.5</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">1.0</unaffected>
+      <vulnerable range="lt">1.0</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.0</unaffected>
+      <vulnerable range="lt">1.0</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird" auto="yes" arch="*">
+      <unaffected range="ge">0.9</unaffected>
+      <vulnerable range="lt">0.9</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird-bin" auto="yes" arch="*">
+      <unaffected range="ge">0.9</unaffected>
+      <vulnerable range="lt">0.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla is a popular web browser that includes a mail and newsreader.
+    Mozilla Firefox and Mozilla Thunderbird are respectively the
+    next-generation browser and mail client from the Mozilla project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Maurycy Prodeus from isec.pl found a potentially exploitable buffer
+    overflow in the handling of NNTP URLs. Furthermore, Martin (from
+    ptraced.net) discovered that temporary files in recent versions of
+    Mozilla-based products were sometimes stored world-readable with
+    predictable names. The Mozilla Team also fixed a way of spoofing
+    filenames in Firefox's "What should Firefox do with this file" dialog
+    boxes and a potential information leak about the existence of local
+    filenames.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft a malicious NNTP link and entice a user
+    to click it, potentially resulting in the execution of arbitrary code
+    with the rights of the user running the browser. A local attacker could
+    leverage the temporary file vulnerability to read the contents of
+    another user's attachments or downloads. A remote attacker could also
+    design a malicious web page that would allow to spoof filenames if the
+    user uses the "Open with..." function in Firefox, or retrieve
+    information on the presence of specific files in the local filesystem.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-1.7.5&quot;</code>
+    <p>
+    All Mozilla binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-bin-1.7.5&quot;</code>
+    <p>
+    All Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-1.0&quot;</code>
+    <p>
+    All Firefox binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-1.0&quot;</code>
+    <p>
+    All Thunderbird users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-0.9&quot;</code>
+    <p>
+    All Thunderbird binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-bin-0.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://isec.pl/vulnerabilities/isec-0020-mozilla.txt">isec.pl Advisory</uri>
+    <uri link="http://broadcast.ptraced.net/advisories/008-firefox.thunderbird.txt">Martin (from ptraced.net) Advisory</uri>
+    <uri link="http://secunia.com/advisories/13144/">Secunia Advisory SA13144</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2227">CVE-2004-2227</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2228">CVE-2004-2228</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue,  4 Jan 2005 10:09:38 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue,  4 Jan 2005 10:10:52 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-04.xml b/xml/htdocs/security/en/glsa/glsa-200501-04.xml
new file mode 100644
index 00000000..5fc98d9a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-04.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-04">
+  <title>Shoutcast Server: Remote code execution</title>
+  <synopsis>
+    Shoutcast Server contains a possible buffer overflow that could lead to the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Shoutcast-server-bin</product>
+  <announced>January 05, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>75482</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/shoutcast-server-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.9.5</unaffected>
+      <vulnerable range="le">1.9.4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Shoutcast Server is Nullsoft's streaming audio server. It runs on a
+    variety of platforms, including Linux, and is extremely popular with
+    Internet broadcasters.
+    </p>
+  </background>
+  <description>
+    <p>
+    Part of the Shoutcast Server Linux binary has been found to improperly
+    handle sprintf() parsing.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious attacker could send a formatted URL request to the
+    Shoutcast Server. This formatted URL would cause either the server
+    process to crash, or the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Shoutcast Server users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/shoutcast-server-bin-1.9.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/385350">BugTraq Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1373">CVE-2004-1373</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 29 Dec 2004 14:31:08 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue,  4 Jan 2005 19:23:19 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue,  4 Jan 2005 20:51:10 +0000">
+    chriswhite
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-05.xml b/xml/htdocs/security/en/glsa/glsa-200501-05.xml
new file mode 100644
index 00000000..d528611d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-05.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-05">
+  <title>mit-krb5: Heap overflow in libkadm5srv</title>
+  <synopsis>
+    The MIT Kerberos 5 administration library (libkadm5srv) contains a heap
+    overflow that could lead to execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mit-krb5</product>
+  <announced>January 05, 2005</announced>
+  <revised>January 05, 2005: 01</revised>
+  <bug>75143</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/mit-krb5" auto="yes" arch="*">
+      <unaffected range="ge">1.3.6</unaffected>
+      <vulnerable range="lt">1.3.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MIT krb5 is the free implementation of the Kerberos network
+    authentication protocol by the Massachusetts Institute of Technology.
+    </p>
+  </background>
+  <description>
+    <p>
+    The MIT Kerberos 5 administration library libkadm5srv contains a
+    heap overflow in the code handling password changing.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Under specific circumstances an attacker could execute arbitary
+    code with the permissions of the user running mit-krb5, which could be
+    the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mit-krb5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-crypt/mit-krb5-1.3.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1189">CAN 2004-1189</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 30 Dec 2004 15:16:36 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 30 Dec 2004 19:47:37 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed,  5 Jan 2005 19:34:46 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-06.xml b/xml/htdocs/security/en/glsa/glsa-200501-06.xml
new file mode 100644
index 00000000..f8c1db1e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-06.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-06">
+  <title>tiff: New overflows in image decoding</title>
+  <synopsis>
+    An integer overflow has been found in the TIFF library image decoding
+    routines and the tiffdump utility, potentially allowing arbitrary code
+    execution.
+  </synopsis>
+  <product type="ebuild">tiff</product>
+  <announced>January 05, 2005</announced>
+  <revised>January 05, 2005: 01</revised>
+  <bug>75213</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/tiff" auto="yes" arch="*">
+      <unaffected range="ge">3.7.1-r1</unaffected>
+      <vulnerable range="lt">3.7.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The TIFF library contains encoding and decoding routines for the
+    Tag Image File Format. It is called by numerous programs, including
+    GNOME and KDE applications, to interpret TIFF images.
+    </p>
+  </background>
+  <description>
+    <p>
+    infamous41md found a potential integer overflow in the directory
+    entry count routines of the TIFF library (CAN-2004-1308). Dmitry V.
+    Levin found another similar issue in the tiffdump utility
+    (CAN-2004-1183).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to view a carefully crafted
+    TIFF image file, which would potentially lead to execution of arbitrary
+    code with the rights of the user viewing the image. This affects any
+    program that makes use of the TIFF library, including many web browsers
+    or mail readers.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All TIFF library users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/tiff-3.7.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1183">CAN-2004-1183</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1308">CAN-2004-1308</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=174&amp;type=vulnerabilities">iDEFENSE Advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon,  3 Jan 2005 10:21:55 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue,  4 Jan 2005 14:07:42 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-07.xml b/xml/htdocs/security/en/glsa/glsa-200501-07.xml
new file mode 100644
index 00000000..81ae5353
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-07.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-07">
+  <title>xine-lib: Multiple overflows</title>
+  <synopsis>
+    xine-lib contains multiple overflows potentially allowing execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">xine-lib</product>
+  <announced>January 06, 2005</announced>
+  <revised>January 06, 2005: 01</revised>
+  <bug>74475</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/xine-lib" auto="yes" arch="*">
+      <unaffected range="ge">1_rc8-r1</unaffected>
+      <unaffected range="rge">1_rc6-r1</unaffected>
+      <vulnerable range="lt">1_rc8-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xine-lib is a multimedia library which can be utilized to create
+    multimedia frontends.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ariel Berkman discovered that xine-lib reads specific input data
+    into an array without checking the input size in demux_aiff.c, making
+    it vulnerable to a buffer overflow (CAN-2004-1300) . iDefense
+    discovered that the PNA_TAG handling code in pnm_get_chunk() does not
+    check if the input size is larger than the buffer size (CAN-2004-1187).
+    iDefense also discovered that in this same function, a negative value
+    could be given to an unsigned variable that specifies the read length
+    of input data (CAN-2004-1188).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft a malicious movie or convince a
+    targeted user to connect to a malicious PNM server, which could result
+    in the execution of arbitrary code with the rights of the user running
+    any xine-lib frontend.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xine-lib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose media-libs/xine-lib</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1187">CAN-2004-1187</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1188">CAN-2004-1188</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1300">CAN-2004-1300</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=176&amp;type=vulnerabilities">iDefense Advisory</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=177&amp;type=vulnerabilities">iDefense Advisory</uri>
+    <uri link="http://tigger.uic.edu/~jlongs2/holes/xine-lib.txt">Ariel Berkman Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 21 Dec 2004 14:06:44 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 21 Dec 2004 16:57:50 +0000">
+    SeJo
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu,  6 Jan 2005 08:50:09 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-08.xml b/xml/htdocs/security/en/glsa/glsa-200501-08.xml
new file mode 100644
index 00000000..9675f84d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-08.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-08">
+  <title>phpGroupWare: Various vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in phpGroupWare that could
+    lead to information disclosure or remote compromise.
+  </synopsis>
+  <product type="ebuild">phpgroupware</product>
+  <announced>January 06, 2005</announced>
+  <revised>May 22, 2006: 04</revised>
+  <bug>74487</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phpgroupware" auto="yes" arch="*">
+      <unaffected range="ge">0.9.16.004</unaffected>
+      <vulnerable range="lt">0.9.16.004</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpGroupWare is a web-based suite of group applications including a
+    calendar, todo-list, addressbook, email, wiki, news headlines, and a
+    file manager.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several flaws were discovered in phpGroupWare making it vulnerable to
+    cross-site scripting attacks, SQL injection, and full path disclosure.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    These vulnerabilities could allow an attacker to perform cross-site
+    scripting attacks, execute SQL queries, and disclose the full path of
+    the web directory.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpGroupWare users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/phpgroupware-0.9.16.004&quot;</code>
+    <p>
+    Note: Users with the vhosts USE flag set should manually use
+    webapp-config to finalize the update.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/384492">BugTraq Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1383">CVE-2004-1383</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1384">CVE-2004-1384</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1385">CVE-2004-1385</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu,  6 Jan 2005 08:52:11 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu,  6 Jan 2005 08:52:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu,  6 Jan 2005 13:44:43 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-09.xml b/xml/htdocs/security/en/glsa/glsa-200501-09.xml
new file mode 100644
index 00000000..6555e140
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-09.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-09">
+  <title>xzgv: Multiple overflows</title>
+  <synopsis>
+    xzgv contains multiple overflows that may lead to the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">xzgv</product>
+  <announced>January 06, 2005</announced>
+  <revised>January 06, 2005: 01</revised>
+  <bug>74069</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/xzgv" auto="yes" arch="*">
+      <unaffected range="ge">0.8-r1</unaffected>
+      <vulnerable range="le">0.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xzgv is a picture viewer for X, with a thumbnail-based file
+    selector.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple overflows have been found in the image processing code of
+    xzgv, including an integer overflow in the PRF parsing code
+    (CAN-2004-0994).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open or browse a
+    specially-crafted image file, potentially resulting in the execution of
+    arbitrary code with the rights of the user running xzgv.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xzgv users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/xzgv-0.8-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0994">CAN-2004-0994</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=160&amp;type=vulnerabilities&amp;flashstatus=true">iDEFENSE Advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu,  6 Jan 2005 12:54:06 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu,  6 Jan 2005 12:55:35 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-10.xml b/xml/htdocs/security/en/glsa/glsa-200501-10.xml
new file mode 100644
index 00000000..13f342c7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-10.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-10">
+  <title>Vilistextum: Buffer overflow vulnerability</title>
+  <synopsis>
+    Vilistextum is vulnerable to a buffer overflow that allows an attacker to
+    execute arbitrary code through the use of a malicious webpage.
+  </synopsis>
+  <product type="ebuild">vilistextum</product>
+  <announced>January 06, 2005</announced>
+  <revised>January 06, 2005: 01</revised>
+  <bug>74694</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/vilistextum" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7</unaffected>
+      <vulnerable range="lt">2.6.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Vilistextum is an HTML to text converter.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ariel Berkman discovered that Vilistextum unsafely reads data into
+    an array without checking the length. This code vulnerability may lead
+    to a buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft a malicious webpage which, when
+    converted, would result in the execution of arbitrary code with the
+    rights of the user running Vilistextum.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Vilistextum users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/vilistextum-2.6.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://tigger.uic.edu/~jlongs2/holes/vilistextum.txt">Original Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1299">CAN-2004-1299</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon,  3 Jan 2005 15:34:01 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue,  4 Jan 2005 11:50:53 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu,  6 Jan 2005 13:22:37 +0000">
+    SeJo
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-11.xml b/xml/htdocs/security/en/glsa/glsa-200501-11.xml
new file mode 100644
index 00000000..9abc676e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-11.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-11">
+  <title>Dillo: Format string vulnerability</title>
+  <synopsis>
+    Dillo is vulnerable to a format string bug, which may result in the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Dillo</product>
+  <announced>January 09, 2005</announced>
+  <revised>January 09, 2005: 01</revised>
+  <bug>76665</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/dillo" auto="yes" arch="*">
+      <unaffected range="ge">0.8.3-r4</unaffected>
+      <vulnerable range="lt">0.8.3-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Dillo is a small and fast multi-platform web browser based on
+    GTK+.
+    </p>
+  </background>
+  <description>
+    <p>
+    Gentoo Linux developer Tavis Ormandy found a format string bug in
+    Dillo's handling of messages in a_Interface_msg().
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could craft a malicious web page which, when accessed
+    using Dillo, would trigger the format string vulnerability and
+    potentially execute arbitrary code with the rights of the user running
+    Dillo.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Dillo users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/dillo-0.8.3-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0012">CAN-2005-0012</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri,  7 Jan 2005 15:41:51 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun,  9 Jan 2005 17:56:03 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun,  9 Jan 2005 18:39:04 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-12.xml b/xml/htdocs/security/en/glsa/glsa-200501-12.xml
new file mode 100644
index 00000000..430e56bc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-12.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-12">
+  <title>TikiWiki: Arbitrary command execution</title>
+  <synopsis>
+    A bug in TikiWiki allows certain users to upload and execute malicious PHP
+    scripts.
+  </synopsis>
+  <product type="ebuild">tikiwiki</product>
+  <announced>January 10, 2005</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>75568</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/tikiwiki" auto="yes" arch="*">
+      <unaffected range="ge">1.8.4.1</unaffected>
+      <vulnerable range="lt">1.8.4.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    TikiWiki is a web-based groupware and content management system (CMS),
+    using PHP, ADOdb and Smarty.
+    </p>
+  </background>
+  <description>
+    <p>
+    TikiWiki lacks a check on uploaded images in the Wiki edit page.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A malicious user could run arbitrary commands on the server by
+    uploading and calling a PHP script.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All TikiWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/tikiwiki-1.8.4.1&quot;</code>
+    <p>
+    Note: Users with the vhosts USE flag set should manually use
+    webapp-config to finalize the update.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://tikiwiki.org/tiki-read_article.php?articleId=97">TikiWiki Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1386">CVE-2004-1386</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri,  7 Jan 2005 09:12:58 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri,  7 Jan 2005 09:13:09 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri,  7 Jan 2005 20:49:48 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-13.xml b/xml/htdocs/security/en/glsa/glsa-200501-13.xml
new file mode 100644
index 00000000..83668be8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-13.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-13">
+  <title>pdftohtml: Vulnerabilities in included Xpdf</title>
+  <synopsis>
+    pdftohtml includes vulnerable Xpdf code to handle PDF files, making it
+    vulnerable to execution of arbitrary code upon converting a malicious PDF
+    file.
+  </synopsis>
+  <product type="ebuild">pdftohtml</product>
+  <announced>January 10, 2005</announced>
+  <revised>January 10, 2005: 01</revised>
+  <bug>75200</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/pdftohtml" auto="yes" arch="*">
+      <unaffected range="ge">0.36-r2</unaffected>
+      <vulnerable range="lt">0.36-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    pdftohtml is a utility to convert PDF files to HTML or XML
+    formats. It makes use of Xpdf code to decode PDF files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Xpdf is vulnerable to integer overflows, as described in GLSA
+    200412-24.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to convert a specially-crafted PDF
+    file, potentially resulting in the execution of arbitrary code with the
+    rights of the user running pdftohtml.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All pdftohtml users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/pdftohtml-0.36-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200410-20.xml">GLSA 200412-24</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1125">CAN-2004-1125</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun,  9 Jan 2005 18:15:51 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun,  9 Jan 2005 18:17:10 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-14.xml b/xml/htdocs/security/en/glsa/glsa-200501-14.xml
new file mode 100644
index 00000000..dea99fe1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-14.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-14">
+  <title>mpg123: Buffer overflow</title>
+  <synopsis>
+    An attacker may be able to execute arbitrary code by way of specially
+    crafted MP2 or MP3 files.
+  </synopsis>
+  <product type="ebuild">media-sound/mpg123</product>
+  <announced>January 10, 2005</announced>
+  <revised>January 10, 2005: 01</revised>
+  <bug>76862</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/mpg123" auto="yes" arch="*">
+      <unaffected range="ge">0.59s-r9</unaffected>
+      <vulnerable range="lt">0.59s-r9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    mpg123 is a real-time MPEG audio player.
+    </p>
+  </background>
+  <description>
+    <p>
+    mpg123 improperly parses frame headers in input streams.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By inducing a user to play a malicious file, an attacker may be
+    able to exploit a buffer overflow to execute arbitrary code with the
+    permissions of the user running mpg123.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mpg123 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/mpg123-0.59s-r9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0991">CAN-2004-0991</uri>
+    <uri link="http://www.securityfocus.com/archive/1/374433">Bugtraq Announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri,  7 Jan 2005 13:23:00 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat,  8 Jan 2005 19:52:22 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun,  9 Jan 2005 05:27:09 +0000">
+    dmargoli
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-15.xml b/xml/htdocs/security/en/glsa/glsa-200501-15.xml
new file mode 100644
index 00000000..8bdb253b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-15.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-15">
+  <title>UnRTF: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow in UnRTF allows an attacker to execute arbitrary code by
+    way of a specially crafted RTF file.
+  </synopsis>
+  <product type="ebuild">app-text/unrtf</product>
+  <announced>January 10, 2005</announced>
+  <revised>January 10, 2005: 01</revised>
+  <bug>74480</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/unrtf" auto="yes" arch="*">
+      <unaffected range="ge">0.19.3-r1</unaffected>
+      <vulnerable range="lt">0.19.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    UnRTF is a utility to convert files in the Rich Text Format into
+    other formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    An unchecked strcat() in unrtf may overflow the bounds of a static
+    buffer.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Using a specially crafted file, possibly delivered by e-mail or
+    over the web, an attacker may execute arbitrary code with the
+    permissions of the user running UnRTF.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All unrtf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/unrtf-0.19.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://tigger.uic.edu/~jlongs2/holes/unrtf.txt">Original Announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat,  8 Jan 2005 19:54:59 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat,  8 Jan 2005 19:55:37 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun,  9 Jan 2005 05:15:13 +0000">
+    dmargoli
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-16.xml b/xml/htdocs/security/en/glsa/glsa-200501-16.xml
new file mode 100644
index 00000000..bae40297
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-16.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-16">
+  <title>Konqueror: Java sandbox vulnerabilities</title>
+  <synopsis>
+    The Java sandbox environment in Konqueror can be bypassed to access
+    arbitrary packages, allowing untrusted Java applets to perform unrestricted
+    actions on the host system.
+  </synopsis>
+  <product type="ebuild">Konqueror, kde, kdelibs</product>
+  <announced>January 11, 2005</announced>
+  <revised>January 12, 2005: 02</revised>
+  <bug>72750</bug>
+  <access>remote</access>
+  <affected>
+    <package name="kde-base/kdelibs" auto="yes" arch="*">
+      <unaffected range="ge">3.3.2</unaffected>
+      <vulnerable range="lt">3.3.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDE is a feature-rich graphical desktop environment for Linux and
+    Unix-like Operating Systems. Konqueror is the KDE web browser and file
+    manager.
+    </p>
+  </background>
+  <description>
+    <p>
+    Konqueror contains two errors that allow JavaScript scripts and Java
+    applets to have access to restricted Java classes.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could embed a malicious Java applet in a web page and
+    entice a victim to view it. This applet can then bypass security
+    restrictions and execute any command, or access any file with the
+    rights of the user running Konqueror.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All kdelibs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose kde-base/kdelibs</code>
+  </resolution>
+  <references>
+    <uri link="http://www.kde.org/info/security/advisory-20041220-1.txt">KDE Security Advisory: Konqueror Java Vulnerability</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1145">CAN 2004-1145</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 21 Dec 2004 20:38:36 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 11 Jan 2005 12:36:53 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-17.xml b/xml/htdocs/security/en/glsa/glsa-200501-17.xml
new file mode 100644
index 00000000..f2d5a65a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-17.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-17">
+  <title>KPdf, KOffice: More vulnerabilities in included Xpdf</title>
+  <synopsis>
+    KPdf and KOffice both include vulnerable Xpdf code to handle PDF files,
+    making them vulnerable to the execution of arbitrary code if a user is
+    enticed to view a malicious PDF file.
+  </synopsis>
+  <product type="ebuild">kpdf, koffice</product>
+  <announced>January 11, 2005</announced>
+  <revised>January 12, 2005: 02</revised>
+  <bug>75203</bug>
+  <bug>75204</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/koffice" auto="yes" arch="*">
+      <unaffected range="ge">1.3.5-r1</unaffected>
+      <vulnerable range="lt">1.3.5-r1</vulnerable>
+    </package>
+    <package name="kde-base/kdegraphics" auto="yes" arch="*">
+      <unaffected range="ge">3.3.2-r1</unaffected>
+      <unaffected range="rge">3.2.3-r3</unaffected>
+      <vulnerable range="lt">3.3.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KPdf is a KDE-based PDF viewer included in the kdegraphics package.
+    KOffice is an integrated office suite for KDE.
+    </p>
+  </background>
+  <description>
+    <p>
+    KPdf and KOffice both include Xpdf code to handle PDF files. Xpdf is
+    vulnerable to multiple new integer overflows, as described in GLSA
+    200412-24.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially-crafted PDF file,
+    potentially resulting in the execution of arbitrary code with the
+    rights of the user running the affected utility.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All KPdf users should upgrade to the latest version of kdegraphics:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose kde-base/kdegraphics</code>
+    <p>
+    All KOffice users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose app-office/koffice</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200412-24.xml">GLSA 200412-24</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1125">CAN-2004-1125</uri>
+    <uri link="http://kde.org/info/security/advisory-20041223-1.txt">KDE Security Advisory: kpdf Buffer Overflow Vulnerability</uri>
+    <uri link="http://koffice.kde.org/security/2004_xpdf_integer_overflow_2.php">KOffice XPDF Integer Overflow 2</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed,  5 Jan 2005 17:17:02 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 11 Jan 2005 12:37:24 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-18.xml b/xml/htdocs/security/en/glsa/glsa-200501-18.xml
new file mode 100644
index 00000000..4be9419a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-18.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-18">
+  <title>KDE FTP KIOslave: Command injection</title>
+  <synopsis>
+    The FTP KIOslave contains a bug allowing users to execute arbitrary FTP
+    commands.
+  </synopsis>
+  <product type="ebuild">konqueror</product>
+  <announced>January 11, 2005</announced>
+  <revised>January 12, 2005: 02</revised>
+  <bug>73759</bug>
+  <access>remote</access>
+  <affected>
+    <package name="kde-base/kdelibs" auto="yes" arch="*">
+      <unaffected range="ge">3.3.2-r2</unaffected>
+      <unaffected range="rge">3.2.3-r5</unaffected>
+      <vulnerable range="lt">3.3.2-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDE is a feature-rich graphical desktop environment for Linux and
+    Unix-like Operating Systems. KDE provided KIOslaves for many protocols
+    in the kdelibs package, one of them being FTP. These are used by KDE
+    applications such as Konqueror.
+    </p>
+  </background>
+  <description>
+    <p>
+    The FTP KIOslave fails to properly parse URL-encoded newline
+    characters.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit this to execute arbitrary FTP commands on the
+    server and due to similiarities between the FTP and the SMTP protocol,
+    this vulnerability also allows an attacker to connect to a SMTP server
+    and issue arbitrary commands, for example sending an email.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All kdelibs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose kde-base/kdelibs</code>
+  </resolution>
+  <references>
+    <uri link="http://www.kde.org/info/security/advisory-20050101-1.txt">KDE Security Advisory: ftp kioslave command injection</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1165">CAN-2004-1165</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed,  5 Jan 2005 16:56:23 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 11 Jan 2005 12:39:06 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-19.xml b/xml/htdocs/security/en/glsa/glsa-200501-19.xml
new file mode 100644
index 00000000..bc60f456
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-19.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-19">
+  <title>imlib2: Buffer overflows in image decoding</title>
+  <synopsis>
+    Multiple overflows have been found in the imlib2 library image decoding
+    routines, potentially allowing the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">imlib2</product>
+  <announced>January 11, 2005</announced>
+  <revised>January 11, 2005: 01</revised>
+  <bug>77002</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/imlib2" auto="yes" arch="*">
+      <unaffected range="ge">1.2.0</unaffected>
+      <vulnerable range="lt">1.2.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    imlib2 is an advanced replacement for image manipulation libraries
+    such as libXpm. It is utilized by numerous programs, including gkrellm
+    and several window managers, to display images.
+    </p>
+  </background>
+  <description>
+    <p>
+    Pavel Kankovsky discovered that several buffer overflows found in
+    the libXpm library (see GLSA 200409-34) also apply to imlib (see GLSA
+    200412-03) and imlib2. He also fixed a number of other potential
+    security vulnerabilities.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to view a carefully-crafted
+    image file, which would potentially lead to the execution of arbitrary
+    code with the rights of the user viewing the image. This affects any
+    program that utilizes of the imlib2 library.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All imlib2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/imlib2-1.2.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1026">CAN-2004-1026</uri>
+    <uri link="http://security.gentoo.org/glsa/glsa-200412-03.xml">GLSA 200412-03</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat,  8 Jan 2005 09:59:17 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun,  9 Jan 2005 05:41:55 +0000">
+    dmargoli
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 10 Jan 2005 22:14:19 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-20.xml b/xml/htdocs/security/en/glsa/glsa-200501-20.xml
new file mode 100644
index 00000000..2d34b953
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-20.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-20">
+  <title>o3read: Buffer overflow during file conversion</title>
+  <synopsis>
+    A buffer overflow in o3read allows an attacker to execute arbitrary code by
+    way of a specially crafted XML file.
+  </synopsis>
+  <product type="ebuild">o3read</product>
+  <announced>January 11, 2005</announced>
+  <revised>January 11, 2005: 01</revised>
+  <bug>74478</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/o3read" auto="yes" arch="*">
+      <unaffected range="ge">0.0.4</unaffected>
+      <vulnerable range="le">0.0.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    o3read is a standalone converter for OpenOffice.org files. It
+    allows a user to dump the contents tree (o3read) and convert to plain
+    text (o3totxt) or to HTML (o3tohtml) Writer and Calc files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Wiktor Kopec discovered that the parse_html function in o3read.c
+    copies any number of bytes into a 1024-byte t[] array.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Using a specially crafted file, possibly delivered by e-mail or
+    over the Web, an attacker may execute arbitrary code with the
+    permissions of the user running o3read.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All o3read users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/o3read-0.0.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1288">CAN-2004-1288</uri>
+    <uri link="http://tigger.uic.edu/~jlongs2/holes/o3read.txt">Wiktor Kopec advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 10 Jan 2005 22:12:42 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 10 Jan 2005 22:13:07 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 11 Jan 2005 11:55:34 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-21.xml b/xml/htdocs/security/en/glsa/glsa-200501-21.xml
new file mode 100644
index 00000000..08be642a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-21.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-21">
+  <title>HylaFAX: hfaxd unauthorized login vulnerability</title>
+  <synopsis>
+    HylaFAX is subject to a vulnerability in its username matching code,
+    potentially allowing remote users to bypass access control lists.
+  </synopsis>
+  <product type="ebuild">HylaFAX</product>
+  <announced>January 11, 2005</announced>
+  <revised>January 11, 2005: 01</revised>
+  <bug>75941</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/hylafax" auto="yes" arch="*">
+      <unaffected range="ge">4.2.0-r2</unaffected>
+      <vulnerable range="lt">4.2.0-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    HylaFAX is a software package for sending and receiving facsimile
+    messages.
+    </p>
+  </background>
+  <description>
+    <p>
+    The code used by hfaxd to match a given username and hostname with
+    an entry in the hosts.hfaxd file is insufficiently protected against
+    malicious entries.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    If the HylaFAX installation uses a weak hosts.hfaxd file, a remote
+    attacker could authenticate using a malicious username or hostname and
+    bypass the intended access restrictions.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    As a workaround, administrators may consider adding passwords to
+    all entries in the hosts.hfaxd file.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All HylaFAX users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/hylafax-4.2.0-r2&quot;</code>
+    <p>
+    Note: Due to heightened security, weak entries in the
+    hosts.hfaxd file may no longer work. Please see the HylaFAX
+    documentation for details of accepted syntax in the hosts.hfaxd file.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1182">CAN-2004-1182</uri>
+    <uri link="http://marc.theaimsgroup.com/?l=hylafax&amp;m=110545119911558&amp;w=2">HylaFAX Announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 10 Jan 2005 09:56:02 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 10 Jan 2005 13:48:18 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 11 Jan 2005 16:16:35 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-22.xml b/xml/htdocs/security/en/glsa/glsa-200501-22.xml
new file mode 100644
index 00000000..2bbe656d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-22.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-22">
+  <title>poppassd_pam: Unauthorized password changing</title>
+  <synopsis>
+    poppassd_pam allows anyone to change any user's password without
+    authenticating the user first.
+  </synopsis>
+  <product type="ebuild">poppassd_pam</product>
+  <announced>January 11, 2005</announced>
+  <revised>January 11, 2005: 01</revised>
+  <bug>75820</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/poppassd_ceti" auto="yes" arch="*">
+      <unaffected range="ge">1.8.4</unaffected>
+      <vulnerable range="le">1.0</vulnerable>
+    </package>
+    <package name="net-mail/poppassd_pam" auto="yes" arch="*">
+      <vulnerable range="le">1.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    poppassd_pam is a PAM-enabled server for changing system passwords
+    that can be used to change POP server passwords.
+    </p>
+  </background>
+  <description>
+    <p>
+    Gentoo Linux developer Marcus Hanwell discovered that poppassd_pam
+    did not check that the old password was valid before changing
+    passwords. Our investigation revealed that poppassd_pam did not call
+    pam_authenticate before calling pam_chauthtok.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could change the system password of any user,
+    including root. This leads to a complete compromise of the POP
+    accounts, and may also lead to a complete root compromise of the
+    affected server, if it also provides shell access authenticated using
+    system passwords.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All poppassd_pam users should migrate to the new package called
+    poppassd_ceti:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/poppassd_ceti-1.8.4&quot;</code>
+    <p>
+    Note: Portage will automatically replace the poppassd_pam
+    package by the poppassd_ceti package.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0002">CAN-2005-0002</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 11 Jan 2005 08:56:45 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 11 Jan 2005 12:12:22 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 11 Jan 2005 19:52:14 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-23.xml b/xml/htdocs/security/en/glsa/glsa-200501-23.xml
new file mode 100644
index 00000000..67853b70
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-23.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-23">
+  <title>Exim: Two buffer overflows</title>
+  <synopsis>
+    Buffer overflow vulnerabilities, which could lead to arbitrary code
+    execution, have been found in the handling of IPv6 addresses as well as in
+    the SPA authentication mechanism in Exim.
+  </synopsis>
+  <product type="ebuild">exim</product>
+  <announced>January 12, 2005</announced>
+  <revised>January 12, 2005: 01</revised>
+  <bug>76893</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-mta/exim" auto="yes" arch="*">
+      <unaffected range="ge">4.43-r2</unaffected>
+      <vulnerable range="lt">4.43-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Exim is an highly configurable message transfer agent (MTA)
+    developed at the University of Cambridge.
+    </p>
+  </background>
+  <description>
+    <p>
+    Buffer overflows have been found in the host_aton() function
+    (CAN-2005-0021) as well as in the spa_base64_to_bits() function
+    (CAN-2005-0022), which is part of the SPA authentication code.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could trigger the buffer overflow in host_aton()
+    by supplying an illegal IPv6 address with more than 8 components, using
+    a command line option. The second vulnerability could be remotely
+    exploited during SPA authentication, if it is enabled on the server.
+    Both buffer overflows can potentially lead to the execution of
+    arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Exim users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-mta/exim-4.43-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.exim.org/mail-archives/exim-announce/2005/msg00000.html">Exim Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0021">CAN-2005-0021</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0022">CAN-2005-0022</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 10 Jan 2005 09:24:16 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 10 Jan 2005 10:01:20 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 12 Jan 2005 21:52:22 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-24.xml b/xml/htdocs/security/en/glsa/glsa-200501-24.xml
new file mode 100644
index 00000000..1011c441
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-24.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-24">
+  <title>tnftp: Arbitrary file overwriting</title>
+  <synopsis>
+    tnftp fails to validate filenames when downloading files, making it
+    vulnerable to arbitrary file overwriting.
+  </synopsis>
+  <product type="ebuild">tnftp</product>
+  <announced>January 14, 2005</announced>
+  <revised>January 14, 2005: 01</revised>
+  <bug>74704</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-ftp/tnftp" auto="yes" arch="*">
+      <unaffected range="ge">20050103</unaffected>
+      <vulnerable range="lt">20050103</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    tnftp is a NetBSD FTP client with several advanced features.
+    </p>
+  </background>
+  <description>
+    <p>
+    The 'mget' function in cmds.c lacks validation of the filenames
+    that are supplied by the server.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker running an FTP server could supply clients with
+    malicious filenames, potentially allowing the overwriting of arbitrary
+    files with the permission of the connected user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All tnftp users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-ftp/tnftp-20050103&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1294">CAN-2004-1294</uri>
+    <uri link="http://tigger.uic.edu/~jlongs2/holes/tnftp.txt">Original Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 10 Jan 2005 09:24:54 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 11 Jan 2005 21:44:41 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 12 Jan 2005 23:35:57 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-25.xml b/xml/htdocs/security/en/glsa/glsa-200501-25.xml
new file mode 100644
index 00000000..6e5ea636
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-25.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-25">
+  <title>Squid: Multiple vulnerabilities</title>
+  <synopsis>
+    Squid contains vulnerabilities in the the code handling NTLM (NT Lan
+    Manager), Gopher to HTML, ACLs and WCCP (Web Cache Communication Protocol)
+    which could lead to ACL bypass, denial of service and arbitrary code
+    execution.
+  </synopsis>
+  <product type="ebuild">squid</product>
+  <announced>January 16, 2005</announced>
+  <revised>February 07, 2005: 03</revised>
+  <bug>77934</bug>
+  <bug>77521</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-proxy/squid" auto="yes" arch="*">
+      <unaffected range="ge">2.5.7-r2</unaffected>
+      <vulnerable range="lt">2.5.7-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Squid is a full-featured Web proxy cache designed to run on Unix
+    systems. It supports proxying and caching of HTTP, FTP, and other URLs,
+    as well as SSL support, cache hierarchies, transparent caching, access
+    control lists and many other features.
+    </p>
+  </background>
+  <description>
+    <p>
+    Squid contains a vulnerability in the gopherToHTML function
+    (CAN-2005-0094) and incorrectly checks the 'number of caches' field
+    when parsing WCCP_I_SEE_YOU messages (CAN-2005-0095). Furthermore the
+    NTLM code contains two errors. One is a memory leak in the
+    fakeauth_auth helper (CAN-2005-0096) and the other is a NULL pointer
+    dereferencing error (CAN-2005-0097). Finally Squid also contains an
+    error in the ACL parsing code (CAN-2005-0194).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    With the WCCP issue an attacker could cause denial of service by
+    sending a specially crafted UDP packet. With the Gopher issue an
+    attacker might be able to execute arbitrary code by enticing a user to
+    connect to a malicious Gopher server. The NTLM issues could lead to
+    denial of service by memory consumption or by crashing Squid. The ACL
+    issue could lead to ACL bypass.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Squid users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-proxy/squid-2.5.7-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://secunia.com/advisories/13825/">Secunia Advisory SA13825</uri>
+    <uri link="http://secunia.com/advisories/13789/">Secunia Advisory SA13789</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0094">CAN-2005-0094</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0095">CAN-2005-0095</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0096">CAN-2005-0096</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0097">CAN-2005-0097</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0194">CAN-2005-0194</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 14 Jan 2005 17:51:35 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 14 Jan 2005 17:55:02 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-26.xml b/xml/htdocs/security/en/glsa/glsa-200501-26.xml
new file mode 100644
index 00000000..d98f3205
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-26.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-26">
+  <title>ImageMagick: PSD decoding heap overflow</title>
+  <synopsis>
+    ImageMagick is vulnerable to a heap overflow when decoding Photoshop
+    Document (PSD) files, which could lead to arbitrary code execution.
+  </synopsis>
+  <product type="ebuild">imagemagick</product>
+  <announced>January 20, 2005</announced>
+  <revised>January 20, 2005: 01</revised>
+  <bug>77932</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/imagemagick" auto="yes" arch="*">
+      <unaffected range="ge">6.1.8.8</unaffected>
+      <vulnerable range="lt">6.1.8.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ImageMagick is a collection of tools to read, write and manipulate
+    images in many formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Andrei Nigmatulin discovered that a Photoshop Document (PSD) file
+    with more than 24 layers could trigger a heap overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could potentially design a mailicous PSD image file to
+    cause arbitrary code execution with the permissions of the user running
+    ImageMagick.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ImageMagick users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/imagemagick-6.1.8.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0005">CAN-2005-0005</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=184&amp;type=vulnerabilities">iDEFENSE Advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 18 Jan 2005 13:50:38 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 20 Jan 2005 09:15:57 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-27.xml b/xml/htdocs/security/en/glsa/glsa-200501-27.xml
new file mode 100644
index 00000000..8d37577b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-27.xml
@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-27">
+  <title>Ethereal: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities exist in Ethereal, which may allow an attacker to
+    run arbitrary code, crash the program or perform DoS by CPU and disk
+    utilization.
+  </synopsis>
+  <product type="ebuild">ethereal</product>
+  <announced>January 20, 2005</announced>
+  <revised>January 20, 2005: 01</revised>
+  <bug>78559</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/ethereal" auto="yes" arch="*">
+      <unaffected range="ge">0.10.9</unaffected>
+      <vulnerable range="lt">0.10.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ethereal is a feature rich network protocol analyzer.
+    </p>
+  </background>
+  <description>
+    <p>
+    There are multiple vulnerabilities in versions of Ethereal earlier
+    than 0.10.9, including:
+    </p>
+    <ul>
+    <li>The COPS dissector could go into
+    an infinite loop (CAN-2005-0006).</li>
+    <li>The DLSw dissector could
+    cause an assertion, making Ethereal exit prematurely
+    (CAN-2005-0007).</li>
+    <li>The DNP dissector could cause memory
+    corruption (CAN-2005-0008).</li>
+    <li>The Gnutella dissector could cause
+    an assertion, making Ethereal exit prematurely (CAN-2005-0009).</li>
+    <li>The MMSE dissector could free statically-allocated memory
+    (CAN-2005-0010).</li>
+    <li>The X11 dissector is vulnerable to a string
+    buffer overflow (CAN-2005-0084).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker might be able to use these vulnerabilities to crash
+    Ethereal, perform DoS by CPU and disk space utilization or even execute
+    arbitrary code with the permissions of the user running Ethereal, which
+    could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    For a temporary workaround you can disable all affected protocol
+    dissectors by selecting Analyze->Enabled Protocols... and deselecting
+    them from the list. However, it is strongly recommended to upgrade to
+    the latest stable version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ethereal users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/ethereal-0.10.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0006">CAN-2005-0006</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0007">CAN-2005-0007</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0008">CAN-2005-0008</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0009">CAN-2005-0009</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0010">CAN-2005-0010</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0084">CAN-2005-0084</uri>
+    <uri link="http://www.ethereal.com/news/item_20050120_01.html">Ethereal Release Notes</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 18 Jan 2005 21:23:59 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 20 Jan 2005 22:30:28 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-28.xml b/xml/htdocs/security/en/glsa/glsa-200501-28.xml
new file mode 100644
index 00000000..fbed6d35
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-28.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-28">
+  <title>Xpdf, GPdf: Stack overflow in Decrypt::makeFileKey2</title>
+  <synopsis>
+    A stack overflow was discovered in Xpdf, potentially resulting in the
+    execution of arbitrary code. GPdf includes Xpdf code and therefore is
+    vulnerable to the same issue.
+  </synopsis>
+  <product type="ebuild">Xpdf</product>
+  <announced>January 21, 2005</announced>
+  <revised>January 21, 2005: 01</revised>
+  <bug>77888</bug>
+  <bug>78128</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/xpdf" auto="yes" arch="*">
+      <unaffected range="ge">3.00-r8</unaffected>
+      <vulnerable range="le">3.00-r7</vulnerable>
+    </package>
+    <package name="app-text/gpdf" auto="yes" arch="*">
+      <unaffected range="ge">2.8.2</unaffected>
+      <vulnerable range="lt">2.8.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Xpdf is an open source viewer for Portable Document Format (PDF)
+    files. GPdf is a Gnome-based PDF viewer that includes some Xpdf code.
+    </p>
+  </background>
+  <description>
+    <p>
+    iDEFENSE reports that the Decrypt::makeFileKey2 function in Xpdf's
+    Decrypt.cc insufficiently checks boundaries when processing /Encrypt
+    /Length tags in PDF files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice an user to open a specially-crafted PDF
+    file which would trigger a stack overflow, potentially resulting in
+    execution of arbitrary code with the rights of the user running Xpdf or
+    GPdf.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Xpdf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/xpdf-3.00-r8&quot;</code>
+    <p>
+    All GPdf users should also upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/gpdf-2.8.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0064">CAN-2005-0064</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=186&amp;type=vulnerabilities&amp;flashstatus=true">iDEFENSE Advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 18 Jan 2005 13:34:11 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 21 Jan 2005 20:37:01 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-29.xml b/xml/htdocs/security/en/glsa/glsa-200501-29.xml
new file mode 100644
index 00000000..69814dc3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-29.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-29">
+  <title>Mailman: Cross-site scripting vulnerability</title>
+  <synopsis>
+    Mailman is vulnerable to cross-site scripting attacks.
+  </synopsis>
+  <product type="ebuild">mailman</product>
+  <announced>January 22, 2005</announced>
+  <revised>January 22, 2005: 01</revised>
+  <bug>77524</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/mailman" auto="yes" arch="*">
+      <unaffected range="ge">2.1.5-r3</unaffected>
+      <vulnerable range="lt">2.1.5-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mailman is a Python-based mailing list server with an extensive
+    web interface.
+    </p>
+  </background>
+  <description>
+    <p>
+    Florian Weimer has discovered a cross-site scripting vulnerability
+    in the error messages that are produced by Mailman.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By enticing a user to visiting a specially-crafted URL, an
+    attacker can execute arbitrary script code running in the context of
+    the victim's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mailman users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/mailman-2.1.5-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1177">CAN-2004-1177</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 19 Jan 2005 10:01:17 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 20 Jan 2005 09:22:10 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 21 Jan 2005 16:36:40 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-30.xml b/xml/htdocs/security/en/glsa/glsa-200501-30.xml
new file mode 100644
index 00000000..a4f288c9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-30.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-30">
+  <title>CUPS: Stack overflow in included Xpdf code</title>
+  <synopsis>
+    CUPS includes Xpdf code and therefore is vulnerable to the recent stack
+    overflow issue, potentially resulting in the remote execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">CUPS</product>
+  <announced>January 22, 2005</announced>
+  <revised>January 22, 2005: 01</revised>
+  <bug>78249</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-print/cups" auto="yes" arch="*">
+      <unaffected range="ge">1.1.23-r1</unaffected>
+      <vulnerable range="lt">1.1.23-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Common UNIX Printing System (CUPS) is a cross-platform print
+    spooler. It makes use of Xpdf code to handle PDF files.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Decrypt::makeFileKey2 function in Xpdf's Decrypt.cc
+    insufficiently checks boundaries when processing /Encrypt /Length tags
+    in PDF files (GLSA 200501-28).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    This issue could be exploited by a remote attacker to execute
+    arbitrary code by sending a malicious print job to a CUPS spooler.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CUPS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-print/cups-1.1.23-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0064">CAN-2005-0064</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200501-28.xml">GLSA 200501-28</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 21 Jan 2005 20:52:56 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 21 Jan 2005 20:53:07 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-31.xml b/xml/htdocs/security/en/glsa/glsa-200501-31.xml
new file mode 100644
index 00000000..01e80f12
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-31.xml
@@ -0,0 +1,101 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-31">
+  <title>teTeX, pTeX, CSTeX: Multiple vulnerabilities</title>
+  <synopsis>
+    teTeX, pTeX and CSTeX make use of vulnerable Xpdf code which may allow the
+    remote execution of arbitrary code. Furthermore, the xdvizilla script is
+    vulnerable to temporary file handling issues.
+  </synopsis>
+  <product type="ebuild">teTeX</product>
+  <announced>January 23, 2005</announced>
+  <revised>January 23, 2005: 01</revised>
+  <bug>75801</bug>
+  <access>remote and local</access>
+  <affected>
+    <package name="app-text/tetex" auto="yes" arch="*">
+      <unaffected range="ge">2.0.2-r5</unaffected>
+      <vulnerable range="lt">2.0.2-r5</vulnerable>
+    </package>
+    <package name="app-text/cstetex" auto="yes" arch="*">
+      <unaffected range="ge">2.0.2-r1</unaffected>
+      <vulnerable range="lt">2.0.2-r1</vulnerable>
+    </package>
+    <package name="app-text/ptex" auto="yes" arch="*">
+      <unaffected range="ge">3.1.4-r2</unaffected>
+      <vulnerable range="lt">3.1.4-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    teTeX is a complete and open source TeX distribution. CSTeX is
+    another TeX distribution including Czech and Slovak support. pTeX is
+    another alternative that allows Japanese publishing with TeX. xdvizilla
+    is an auxiliary script used to integrate DVI file viewing in
+    Mozilla-based browsers.
+    </p>
+  </background>
+  <description>
+    <p>
+    teTeX, pTeX and CSTeX all make use of Xpdf code and may therefore
+    be vulnerable to the various overflows that were discovered in Xpdf
+    code (CAN-2004-0888, CAN-2004-0889, CAN-2004-1125 and CAN-2005-0064).
+    Furthermore, Javier Fernandez-Sanguino Pena discovered that the
+    xdvizilla script does not handle temporary files correctly.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could design a malicious input file which, when
+    processed using one of the TeX distributions, could lead to the
+    execution of arbitrary code. Furthermore, a local attacker could create
+    symbolic links in the temporary files directory, pointing to a valid
+    file somewhere on the filesystem. When xdvizilla is called, this would
+    result in the file being overwritten with the rights of the user
+    running the script.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All teTeX users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/tetex-2.0.2-r5&quot;</code>
+    <p>
+    All CSTeX users should also upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/cstetex-2.0.2-r1&quot;</code>
+    <p>
+    Finally, all pTeX users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/ptex-3.1.4-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0888">CAN-2004-0888</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0889">CAN-2004-0889</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1125">CAN-2004-1125</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0064">CAN-2005-0064</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 21 Jan 2005 10:36:38 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 21 Jan 2005 22:41:12 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 23 Jan 2005 12:09:17 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-32.xml b/xml/htdocs/security/en/glsa/glsa-200501-32.xml
new file mode 100644
index 00000000..8564fe51
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-32.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-32">
+  <title>KPdf, KOffice: Stack overflow in included Xpdf code</title>
+  <synopsis>
+    KPdf and KOffice both include vulnerable Xpdf code to handle PDF files,
+    making them vulnerable to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">kpdf, koffice</product>
+  <announced>January 23, 2005</announced>
+  <revised>January 23, 2005: 01</revised>
+  <bug>78619</bug>
+  <bug>78620</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/koffice" auto="yes" arch="*">
+      <unaffected range="ge">1.3.5-r2</unaffected>
+      <vulnerable range="lt">1.3.5-r2</vulnerable>
+    </package>
+    <package name="kde-base/kdegraphics" auto="yes" arch="*">
+      <unaffected range="ge">3.3.2-r2</unaffected>
+      <unaffected range="rge">3.2.3-r4</unaffected>
+      <vulnerable range="lt">3.3.2-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KPdf is a KDE-based PDF viewer included in the kdegraphics
+    package. KOffice is an integrated office suite for KDE.
+    </p>
+  </background>
+  <description>
+    <p>
+    KPdf and KOffice both include Xpdf code to handle PDF files. Xpdf
+    is vulnerable to a new stack overflow, as described in GLSA 200501-28.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially-crafted PDF
+    file, potentially resulting in the execution of arbitrary code with the
+    rights of the user running the affected application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All KPdf users should upgrade to the latest version of
+    kdegraphics:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose kde-base/kdegraphics</code>
+    <p>
+    All KOffice users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose app-office/koffice</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200501-28.xml">GLSA 200501-18</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0064">CAN-2005-0064</uri>
+    <uri link="http://www.kde.org/info/security/advisory-20050119-1.txt">KDE Security Advisory: kpdf Buffer Overflow Vulnerability</uri>
+    <uri link="http://www.kde.org/info/security/advisory-20050120-1.txt">KDE Security Advisory: KOffice PDF Import Filter Vulnerability</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 22 Jan 2005 09:23:04 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 23 Jan 2005 12:21:06 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-33.xml b/xml/htdocs/security/en/glsa/glsa-200501-33.xml
new file mode 100644
index 00000000..6b0d21c0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-33.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-33">
+  <title>MySQL: Insecure temporary file creation</title>
+  <synopsis>
+    MySQL is vulnerable to symlink attacks, potentially allowing a local user
+    to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">mysql</product>
+  <announced>January 23, 2005</announced>
+  <revised>January 23, 2005: 01</revised>
+  <bug>77805</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-db/mysql" auto="yes" arch="*">
+      <unaffected range="ge">4.0.22-r2</unaffected>
+      <vulnerable range="lt">4.0.22-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MySQL is a fast, multi-threaded, multi-user SQL database server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Javier Fernandez-Sanguino Pena from the Debian Security Audit
+    Project discovered that the 'mysqlaccess' script creates temporary
+    files in world-writeable directories with predictable names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary
+    files directory, pointing to a valid file somewhere on the filesystem.
+    When the mysqlaccess script is executed, this would result in the file
+    being overwritten with the rights of the user running the software,
+    which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MySQL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/mysql-4.0.22-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0004">CAN-2005-0004</uri>
+    <uri link="http://secunia.com/advisories/13867/">Secunia Advisory SA13867</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 19 Jan 2005 10:01:33 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 21 Jan 2005 22:17:35 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 22 Jan 2005 01:00:40 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-34.xml b/xml/htdocs/security/en/glsa/glsa-200501-34.xml
new file mode 100644
index 00000000..fc90b8be
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-34.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-34">
+  <title>Konversation: Various vulnerabilities</title>
+  <synopsis>
+    Konversation contains multiple vulnerabilities that could lead to remote
+    command execution or information leaks.
+  </synopsis>
+  <product type="ebuild">konversation</product>
+  <announced>January 24, 2005</announced>
+  <revised>January 24, 2005: 01</revised>
+  <bug>78712</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-irc/konversation" auto="yes" arch="*">
+      <unaffected range="ge">0.15.1</unaffected>
+      <vulnerable range="lt">0.15.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Konversation is a user-friendly IRC client for KDE.
+    </p>
+  </background>
+  <description>
+    <p>
+    Wouter Coekaerts has discovered three vulnerabilites within
+    Konversation:
+    </p>
+    <ul>
+    <li>The Server::parseWildcards function, which
+    is used by the "Quick Buttons", does not properly handle variable
+    expansion (CAN-2005-0129).</li>
+    <li>Perl scripts included with
+    Konversation do not properly escape shell metacharacters
+    (CAN-2005-0130).</li>
+    <li>The 'Nick' and 'Password' fields in the Quick
+    Connect dialog can be easily confused (CAN-2005-0131).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious server could create specially-crafted channels, which
+    would exploit certain flaws in Konversation, potentially leading to the
+    execution of shell commands. A user could also unintentionally input
+    their password into the 'Nick' field in the Quick Connect dialog,
+    exposing his password to IRC users, and log files.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Konversation users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-irc/konversation-0.15.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0129">CAN-2005-0129</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0130">CAN-2005-0130</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0131">CAN-2005-0131</uri>
+    <uri link="http://www.kde.org/info/security/advisory-20050121-1.txt">KDE Security Advisory: Multiple vulnerabilities in Konversation</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 21 Jan 2005 19:25:33 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 21 Jan 2005 21:24:15 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 22 Jan 2005 00:39:45 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-35.xml b/xml/htdocs/security/en/glsa/glsa-200501-35.xml
new file mode 100644
index 00000000..14b94c19
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-35.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-35">
+  <title>Evolution: Integer overflow in camel-lock-helper</title>
+  <synopsis>
+    An overflow in the camel-lock-helper application can be exploited by an
+    attacker to execute arbitrary code with elevated privileges.
+  </synopsis>
+  <product type="ebuild">evolution</product>
+  <announced>January 24, 2005</announced>
+  <revised>January 24, 2005: 01</revised>
+  <bug>79183</bug>
+  <access>local and remote</access>
+  <affected>
+    <package name="mail-client/evolution" auto="yes" arch="*">
+      <unaffected range="ge">2.0.2-r1</unaffected>
+      <vulnerable range="le">2.0.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Evolution is a GNOME groupware application similar to Microsoft
+    Outlook.
+    </p>
+  </background>
+  <description>
+    <p>
+    Max Vozeler discovered an integer overflow in the
+    camel-lock-helper application, which is installed as setgid mail by
+    default.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could exploit this vulnerability to execute
+    malicious code with the privileges of the 'mail' group. A remote
+    attacker could also setup a malicious POP server to execute arbitrary
+    code when an Evolution user connects to it.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Evolution users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/evolution-2.0.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0102">CAN-2005-0102</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 24 Jan 2005 14:31:03 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 24 Jan 2005 21:37:19 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-36.xml b/xml/htdocs/security/en/glsa/glsa-200501-36.xml
new file mode 100644
index 00000000..4306a7aa
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-36.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-36">
+  <title>AWStats: Remote code execution</title>
+  <synopsis>
+    AWStats fails to validate certain input, which could lead to the remote
+    execution of arbitrary code or to the leak of information.
+  </synopsis>
+  <product type="ebuild">awstats</product>
+  <announced>January 25, 2005</announced>
+  <revised>May 28, 2009: 04</revised>
+  <bug>77963</bug>
+  <bug>81775</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-misc/awstats" auto="yes" arch="*">
+      <unaffected range="ge">6.3-r2</unaffected>
+      <vulnerable range="lt">6.3-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    AWStats is an advanced log file analyzer and statistics generator.
+    </p>
+  </background>
+  <description>
+    <p>
+    When 'awstats.pl' is run as a CGI script, it fails to validate specific
+    inputs which are used in a Perl open() function call. Furthermore, a
+    user could read log file content even when plugin rawlog was not
+    enabled.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could supply AWStats malicious input, potentially
+    allowing the execution of arbitrary code with the rights of the web
+    server. He could also access raw log contents.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Making sure that AWStats does not run as a CGI script will avoid the
+    issue, but we recommend that users upgrade to the latest version, which
+    fixes these bugs.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All AWStats users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-misc/awstats-6.3-r2&quot;</code>
+    <p>
+    Note: Users with the vhosts USE flag set should manually use
+    webapp-config to finalize the update.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://awstats.sourceforge.net/docs/awstats_changelog.txt">AWStats ChangeLog</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=185">iDEFENSE Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0116">CAN-2005-0116</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0362">CAN-2005-0362</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0363">CAN-2005-0363</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 18 Jan 2005 13:51:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 22 Jan 2005 01:15:21 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 25 Jan 2005 18:48:59 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-37.xml b/xml/htdocs/security/en/glsa/glsa-200501-37.xml
new file mode 100644
index 00000000..5f79f3e0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-37.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-37">
+  <title>GraphicsMagick: PSD decoding heap overflow</title>
+  <synopsis>
+    GraphicsMagick is vulnerable to a heap overflow when decoding Photoshop
+    Document (PSD) files, which could lead to arbitrary code execution.
+  </synopsis>
+  <product type="ebuild">GraphicsMagick</product>
+  <announced>January 26, 2005</announced>
+  <revised>January 26, 2005: 01</revised>
+  <bug>79336</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/graphicsmagick" auto="yes" arch="*">
+      <unaffected range="ge">1.1.5</unaffected>
+      <vulnerable range="lt">1.1.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GraphicsMagick is a collection of tools to read, write and
+    manipulate images in many formats. GraphicsMagick is originally derived
+    from ImageMagick 5.5.2.
+    </p>
+  </background>
+  <description>
+    <p>
+    Andrei Nigmatulin discovered that handling a Photoshop Document
+    (PSD) file with more than 24 layers in ImageMagick could trigger a heap
+    overflow (GLSA 200501-26). GraphicsMagick is based on the same code and
+    therefore suffers from the same flaw.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could potentially design a malicious PSD image file to
+    cause arbitrary code execution with the permissions of the user running
+    GraphicsMagick.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GraphicsMagick users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/graphicsmagick-1.1.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0005">CAN-2005-0005</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200501-26.xml">GLSA 200501-26</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 26 Jan 2005 12:20:54 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 26 Jan 2005 12:21:35 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-38.xml b/xml/htdocs/security/en/glsa/glsa-200501-38.xml
new file mode 100644
index 00000000..944f107c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-38.xml
@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-38">
+  <title>Perl: rmtree and DBI tmpfile vulnerabilities</title>
+  <synopsis>
+    The Perl DBI library and File::Path::rmtree function are vulnerable to
+    symlink attacks.
+  </synopsis>
+  <product type="ebuild">Perl</product>
+  <announced>January 26, 2005</announced>
+  <revised>March 15, 2005: 03</revised>
+  <bug>75696</bug>
+  <bug>78634</bug>
+  <bug>79685</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-perl/DBI" auto="yes" arch="*">
+      <unaffected range="rge">1.37-r1</unaffected>
+      <unaffected range="ge">1.38-r1</unaffected>
+      <vulnerable range="le">1.38</vulnerable>
+    </package>
+    <package name="dev-lang/perl" auto="yes" arch="*">
+      <unaffected range="ge">5.8.6-r4</unaffected>
+      <unaffected range="rge">5.8.5-r5</unaffected>
+      <unaffected range="rge">5.8.4-r4</unaffected>
+      <unaffected range="rge">5.8.2-r4</unaffected>
+      <vulnerable range="le">5.8.6-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Perl is a cross platform programming language. The DBI is the standard
+    database interface module for Perl.
+    </p>
+  </background>
+  <description>
+    <p>
+    Javier Fernandez-Sanguino Pena discovered that the DBI library creates
+    temporary files in an insecure, predictable way (CAN-2005-0077). Paul
+    Szabo found out that "File::Path::rmtree" is vulnerable to various race
+    conditions (CAN-2004-0452, CAN-2005-0448).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary files
+    directory that point to a valid file somewhere on the filesystem. When
+    the DBI library or File::Path::rmtree is executed, this could be used
+    to overwrite or remove files with the rights of the user calling these
+    functions.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Perl users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-lang/perl</code>
+    <p>
+    All DBI library users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-perl/DBI</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0452">CAN-2004-0452</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0077">CAN-2005-0077</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0448">CAN-2005-0448</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 26 Jan 2005 15:06:53 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 26 Jan 2005 20:14:36 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-39.xml b/xml/htdocs/security/en/glsa/glsa-200501-39.xml
new file mode 100644
index 00000000..6e2a976e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-39.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-39">
+  <title>SquirrelMail: Multiple vulnerabilities</title>
+  <synopsis>
+    SquirrelMail fails to properly sanitize user input, which could lead to
+    arbitrary code execution and compromise webmail accounts.
+  </synopsis>
+  <product type="ebuild">SquirrelMail</product>
+  <announced>January 28, 2005</announced>
+  <revised>January 28, 2005: 01</revised>
+  <bug>78116</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/squirrelmail" auto="yes" arch="*">
+      <unaffected range="ge">1.4.4</unaffected>
+      <vulnerable range="le">1.4.3a-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SquirrelMail is a webmail package written in PHP. It supports IMAP
+    and SMTP and can optionally be installed with SQL support.
+    </p>
+  </background>
+  <description>
+    <p>
+    SquirrelMail fails to properly sanitize certain strings when
+    decoding specially-crafted strings, which can lead to PHP file
+    inclusion and XSS.
+    </p>
+    <ul>
+    <li>Insufficient checking of incoming URLs
+    in prefs.php (CAN-2005-0075) and in webmail.php (CAN-2005-0103).</li>
+    <li>Insufficient escaping of integers in webmail.php
+    (CAN-2005-0104).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    By sending a specially-crafted URL, an attacker can execute
+    arbitrary code from the local system with the permissions of the web
+    server. Furthermore by enticing a user to load a specially-crafted URL,
+    it is possible to display arbitrary remote web pages in Squirrelmail's
+    frameset and execute arbitrary scripts running in the context of the
+    victim's browser. This could lead to a compromise of the user's webmail
+    account, cookie theft, etc.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    The arbitrary code execution is only possible with
+    "register_globals" set to "On". Gentoo ships PHP with
+    "register_globals" set to "Off" by default. There are no known
+    workarounds for the other issues at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SquirrelMail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/squirrelmail-1.4.4&quot;</code>
+    <p>
+    Note: Users with the vhosts USE flag set should manually use
+    webapp-config to finalize the update.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://sourceforge.net/mailarchive/message.php?msg_id=10628451">SquirrelMail Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0075">CAN-2005-0075</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0103">CAN-2005-0103</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0104">CAN-2005-0104</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 25 Jan 2005 17:32:40 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 28 Jan 2005 10:51:51 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-40.xml b/xml/htdocs/security/en/glsa/glsa-200501-40.xml
new file mode 100644
index 00000000..e3478521
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-40.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-40">
+  <title>ngIRCd: Buffer overflow</title>
+  <synopsis>
+    ngIRCd is vulnerable to a buffer overflow that can be used to crash the
+    daemon and possibly execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">ngIRCd</product>
+  <announced>January 28, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>79705</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-irc/ngircd" auto="yes" arch="*">
+      <unaffected range="ge">0.8.2</unaffected>
+      <vulnerable range="lt">0.8.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ngIRCd is a free open source daemon for Internet Relay Chat (IRC).
+    </p>
+  </background>
+  <description>
+    <p>
+    Florian Westphal discovered a buffer overflow caused by an integer
+    underflow in the Lists_MakeMask() function of lists.c.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker can exploit this buffer overflow to crash the ngIRCd
+    daemon and possibly execute arbitrary code with the rights of the
+    ngIRCd daemon process.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ngIRCd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-irc/ngIRCd-0.8.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://arthur.ath.cx/pipermail/ngircd-ml/2005-January/000228.html">ngIRCd Release Annoucement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0199">CVE-2005-0199</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 27 Jan 2005 15:18:35 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 27 Jan 2005 16:04:52 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 27 Jan 2005 16:45:18 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-41.xml b/xml/htdocs/security/en/glsa/glsa-200501-41.xml
new file mode 100644
index 00000000..db34d4ed
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-41.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-41">
+  <title>TikiWiki: Arbitrary command execution</title>
+  <synopsis>
+    A bug in TikiWiki allows certain users to upload and execute malicious PHP
+    scripts.
+  </synopsis>
+  <product type="ebuild">tikiwiki</product>
+  <announced>January 30, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>78944</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/tikiwiki" auto="yes" arch="*">
+      <unaffected range="ge">1.8.5</unaffected>
+      <vulnerable range="lt">1.8.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    TikiWiki is a web-based groupware and content management system (CMS),
+    using PHP, ADOdb and Smarty.
+    </p>
+  </background>
+  <description>
+    <p>
+    TikiWiki does not validate files uploaded to the "temp" directory.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A malicious user could run arbitrary commands on the server by
+    uploading and calling a PHP script.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All TikiWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/tikiwiki-1.8.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://tikiwiki.org/art102">TikiWiki Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0200">CVE-2005-0200</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 28 Jan 2005 00:00:37 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 29 Jan 2005 17:00:21 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-42.xml b/xml/htdocs/security/en/glsa/glsa-200501-42.xml
new file mode 100644
index 00000000..4bea8140
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-42.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-42">
+  <title>VDR: Arbitrary file overwriting issue</title>
+  <synopsis>
+    VDR insecurely accesses files with elevated privileges, which may result in
+    the overwriting of arbitrary files.
+  </synopsis>
+  <product type="ebuild">VDR</product>
+  <announced>January 30, 2005</announced>
+  <revised>January 30, 2005: 01</revised>
+  <bug>78230</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-video/vdr" auto="yes" arch="*">
+      <unaffected range="ge">1.2.6-r1</unaffected>
+      <vulnerable range="lt">1.2.6-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Video Disk Recorder (VDR) is a Linux-based digital video recorder.
+    The VDR program handles the On Screen Menu system that offers complete
+    control over channel settings, timers and recordings.
+    </p>
+  </background>
+  <description>
+    <p>
+    Javier Fernandez-Sanguino Pena from the Debian Security Audit Team
+    discovered that VDR accesses user-controlled files insecurely.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create malicious links and invoke a VDR
+    recording that would overwrite arbitrary files on the system.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All VDR users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/vdr-1.2.6-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0071">CAN-2005-0071</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 29 Jan 2005 10:22:04 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 29 Jan 2005 10:59:05 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 29 Jan 2005 11:54:01 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-43.xml b/xml/htdocs/security/en/glsa/glsa-200501-43.xml
new file mode 100644
index 00000000..262bad25
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-43.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-43">
+  <title>f2c: Insecure temporary file creation</title>
+  <synopsis>
+    f2c is vulnerable to symlink attacks, potentially allowing a local user to
+    overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">f2c</product>
+  <announced>January 30, 2005</announced>
+  <revised>January 30, 2005: 01</revised>
+  <bug>79725</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-lang/f2c" auto="yes" arch="*">
+      <unaffected range="ge">20030320-r1</unaffected>
+      <vulnerable range="le">20030320</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    f2c is a Fortran to C translator. Portage uses this package in
+    some ebuilds to build Fortran sources.
+    </p>
+  </background>
+  <description>
+    <p>
+    Javier Fernandez-Sanguino Pena from the Debian Security Audit Team
+    discovered that f2c creates temporary files in world-writeable
+    directories with predictable names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary
+    files directory, pointing to a valid file somewhere on the filesystem.
+    When f2c is executed, this would result in the file being overwritten
+    with the rights of the user running the software, which could be the
+    root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All f2c users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/f2c-20030320-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0017">CAN-2005-0017</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 29 Jan 2005 12:00:55 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 29 Jan 2005 16:13:04 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-44.xml b/xml/htdocs/security/en/glsa/glsa-200501-44.xml
new file mode 100644
index 00000000..fc1906a3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-44.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-44">
+  <title>ncpfs: Multiple vulnerabilities</title>
+  <synopsis>
+    The ncpfs utilities contain multiple flaws, potentially resulting in the
+    remote execution of arbitrary code or local file access with elevated
+    privileges.
+  </synopsis>
+  <product type="ebuild">ncpfs</product>
+  <announced>January 30, 2005</announced>
+  <revised>January 30, 2005: 01</revised>
+  <bug>77414</bug>
+  <access>remote and local</access>
+  <affected>
+    <package name="net-fs/ncpfs" auto="yes" arch="*">
+      <unaffected range="ge">2.2.6</unaffected>
+      <vulnerable range="lt">2.2.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ncpfs is a NCP protocol network filesystem driver that allows
+    access to NetWare services, to mount volumes of NetWare servers or
+    print to NetWare print queues.
+    </p>
+  </background>
+  <description>
+    <p>
+    Erik Sjolund discovered two vulnerabilities in the programs
+    bundled with ncpfs: there is a potentially exploitable buffer overflow
+    in ncplogin (CAN-2005-0014), and due to a flaw in nwclient.c, utilities
+    using the NetWare client functions insecurely access files with
+    elevated privileges (CAN-2005-0013).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    The buffer overflow might allow a malicious remote NetWare server
+    to execute arbitrary code on the NetWare client. Furthermore, a local
+    attacker may be able to create links and access files with elevated
+    privileges using SUID ncpfs utilities.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ncpfs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-fs/ncpfs-2.2.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0013">CAN-2005-0013</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0014">CAN-2005-0014</uri>
+    <uri link="ftp://platan.vc.cvut.cz/pub/linux/ncpfs/Changes-2.2.6">ncpfs ChangeLog</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 29 Jan 2005 09:02:48 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 29 Jan 2005 11:01:37 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 29 Jan 2005 11:18:51 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-45.xml b/xml/htdocs/security/en/glsa/glsa-200501-45.xml
new file mode 100644
index 00000000..5cf28c2b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-45.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-45">
+  <title>Gallery: Cross-site scripting vulnerability</title>
+  <synopsis>
+    Gallery is vulnerable to cross-site scripting attacks.
+  </synopsis>
+  <product type="ebuild">gallery</product>
+  <announced>January 30, 2005</announced>
+  <revised>May 22, 2006: 04</revised>
+  <bug>78522</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/gallery" auto="yes" arch="*">
+      <unaffected range="ge">1.4.4_p6</unaffected>
+      <vulnerable range="lt">1.4.4_p6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gallery is a web application written in PHP which is used to organize
+    and publish photo albums. It allows multiple users to build and
+    maintain their own albums. It also supports the mirroring of images on
+    other servers.
+    </p>
+  </background>
+  <description>
+    <p>
+    Rafel Ivgi has discovered a cross-site scripting vulnerability where
+    the 'username' parameter is not properly sanitized in 'login.php'.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By sending a carefully crafted URL, an attacker can inject and execute
+    script code in the victim's browser window, and potentially compromise
+    the user's gallery.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gallery users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/gallery-1.4.4_p6&quot;</code>
+    <p>
+    Note: Users with the vhosts USE flag set should manually use
+    webapp-config to finalize the update.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://gallery.menalto.com/modules.php?op=modload&amp;name=News&amp;file=article&amp;sid=149">Gallery Announcement</uri>
+    <uri link="http://secunia.com/advisories/13887/">Secunia Advisory SA13887</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0220">CVE-2005-0220</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 22 Jan 2005 13:17:09 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 30 Jan 2005 18:58:59 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200501-46.xml b/xml/htdocs/security/en/glsa/glsa-200501-46.xml
new file mode 100644
index 00000000..d90e3c9f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200501-46.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200501-46">
+  <title>ClamAV: Multiple issues</title>
+  <synopsis>
+    ClamAV contains two vulnerabilities that could lead to Denial of Service
+    and evasion of virus scanning.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>January 31, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>78656</bug>
+  <bug>79194</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.81</unaffected>
+      <vulnerable range="le">0.80</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ClamAV is an antivirus toolkit. It includes a multi-threaded daemon and
+    a command line scanner.
+    </p>
+  </background>
+  <description>
+    <p>
+    ClamAV fails to properly scan ZIP files with special headers
+    (CAN-2005-0133) and base64 encoded images in URLs.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a base64 encoded image file in a URL an attacker could evade
+    virus scanning. By sending a specially-crafted ZIP file an attacker
+    could cause a Denial of Service by crashing the clamd daemon.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.81&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0133">CAN-2005-0133</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0218">CVE-2005-0218</uri>
+    <uri link="http://sourceforge.net/forum/forum.php?forum_id=440649">ClamAV Release Announcement</uri>
+    <uri link="http://secunia.com/advisories/13900/">Secunia SA13900</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 27 Jan 2005 15:17:33 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 27 Jan 2005 21:31:06 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 Jan 2005 09:07:27 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-01.xml b/xml/htdocs/security/en/glsa/glsa-200502-01.xml
new file mode 100644
index 00000000..886c5410
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-01.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-01">
+  <title>FireHOL: Insecure temporary file creation</title>
+  <synopsis>
+    FireHOL is vulnerable to symlink attacks, potentially allowing a local user
+    to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">FireHOL</product>
+  <announced>February 01, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>79330</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-firewall/firehol" auto="yes" arch="*">
+      <unaffected range="ge">1.224</unaffected>
+      <vulnerable range="lt">1.224</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    FireHOL is an iptables rules generator.
+    </p>
+  </background>
+  <description>
+    <p>
+    FireHOL insecurely creates temporary files with predictable names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create malicious symbolic links to arbitrary
+    system files. When FireHOL is executed, this could lead to these files
+    being overwritten with the rights of the user launching FireHOL,
+    usually the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All FireHOL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-firewall/firehol-1.224&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cvs.sourceforge.net/viewcvs.py/firehol/firehol/firehol.sh">FireHOL CVS log</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0225">CVE-2005-0225</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 28 Jan 2005 10:32:33 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 29 Jan 2005 16:54:50 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 Jan 2005 23:48:34 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-02.xml b/xml/htdocs/security/en/glsa/glsa-200502-02.xml
new file mode 100644
index 00000000..f3ee8e88
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-02.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-02">
+  <title>UW IMAP: CRAM-MD5 authentication bypass</title>
+  <synopsis>
+    UW IMAP contains a vulnerability in the code handling CRAM-MD5
+    authentication allowing authentication bypass.
+  </synopsis>
+  <product type="ebuild">uw-imap</product>
+  <announced>February 02, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>79874</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/uw-imap" auto="yes" arch="*">
+      <unaffected range="ge">2004b</unaffected>
+      <vulnerable range="le">2004a</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    UW IMAP is the University of Washington IMAP toolkit which includes
+    POP3 and IMAP daemons.
+    </p>
+  </background>
+  <description>
+    <p>
+    A logic bug in the code handling CRAM-MD5 authentication incorrectly
+    specifies the condition for successful authentication.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit this vulnerability to authenticate as any
+    mail user on a server with CRAM-MD5 authentication enabled.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable CRAM-MD5 authentication.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All UW IMAP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/uw-imap-2004b&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.kb.cert.org/vuls/id/702777">US-CERT VU#702777</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0198">CVE-2005-0198</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 31 Jan 2005 15:19:50 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 31 Jan 2005 21:25:45 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue,  1 Feb 2005 20:33:12 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-03.xml b/xml/htdocs/security/en/glsa/glsa-200502-03.xml
new file mode 100644
index 00000000..65169f33
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-03.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-03">
+  <title>enscript: Multiple vulnerabilities</title>
+  <synopsis>
+    enscript suffers from vulnerabilities and design flaws, potentially
+    resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">enscript</product>
+  <announced>February 02, 2005</announced>
+  <revised>February 02, 2005: 01</revised>
+  <bug>77408</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/enscript" auto="yes" arch="*">
+      <unaffected range="ge">1.6.3-r3</unaffected>
+      <vulnerable range="lt">1.6.3-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    enscript is a powerful ASCII to PostScript file converter.
+    </p>
+  </background>
+  <description>
+    <p>
+    Erik Sjolund discovered several issues in enscript: it suffers
+    from several buffer overflows (CAN-2004-1186), quotes and shell escape
+    characters are insufficiently sanitized in filenames (CAN-2004-1185),
+    and it supported taking input from an arbitrary command pipe, with
+    unwanted side effects (CAN-2004-1184).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could design malicious files or input data which, once
+    feeded into enscript, would trigger the execution of arbitrary code
+    with the rights of the user running enscript.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All enscript users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/enscript-1.6.3-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1184">CAN-2004-1184</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1185">CAN-2004-1185</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1186">CAN-2004-1186</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 28 Jan 2005 10:31:54 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue,  1 Feb 2005 17:01:52 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue,  1 Feb 2005 21:40:35 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-04.xml b/xml/htdocs/security/en/glsa/glsa-200502-04.xml
new file mode 100644
index 00000000..01095742
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-04.xml
@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-04">
+  <title>Squid: Multiple vulnerabilities</title>
+  <synopsis>
+    Squid contains vulnerabilities in the code handling WCCP, HTTP and LDAP
+    which could lead to Denial of Service, access control bypass, web cache and
+    log poisoning.
+  </synopsis>
+  <product type="ebuild">squid</product>
+  <announced>February 02, 2005</announced>
+  <revised>February 02, 2005: 02</revised>
+  <bug>79495</bug>
+  <bug>78776</bug>
+  <bug>80201</bug>
+  <bug>80341</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-proxy/squid" auto="yes" arch="*">
+      <unaffected range="ge">2.5.7-r5</unaffected>
+      <vulnerable range="lt">2.5.7-r5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Squid is a full-featured Web proxy cache designed to run on Unix
+    systems. It supports proxying and caching of HTTP, FTP, and other
+    protocols, as well as SSL support, cache hierarchies, transparent
+    caching, access control lists and many other features.
+    </p>
+  </background>
+  <description>
+    <p>
+    Squid contains several vulnerabilities:
+    </p>
+    <ul>
+    <li>Buffer overflow when handling WCCP recvfrom()
+    (CAN-2005-0211).</li>
+    <li>Loose checking of HTTP headers (CAN-2005-0173 and
+    CAN-2005-0174).</li>
+    <li>Incorrect handling of LDAP login names with spaces
+    (CAN-2005-0175).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit:
+    </p>
+    <ul>
+    <li>the WCCP buffer overflow to cause Denial of Service.</li>
+    <li>the HTTP header parsing vulnerabilities to inject arbitrary
+    response data, potentially leading to content spoofing, web cache
+    poisoning and other cross-site scripting or HTTP response splitting
+    attacks.</li>
+    <li>the LDAP issue to login with several variations of the same login
+    name, leading to log poisoning.</li>
+    </ul>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Squid users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-proxy/squid-2.5.7-r5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0173">CAN-2005-0173</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0174">CAN-2005-0174</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0175">CAN-2005-0175</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0211">CAN-2005-0211</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 30 Jan 2005 20:28:30 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed,  2 Feb 2005 12:30:09 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-05.xml b/xml/htdocs/security/en/glsa/glsa-200502-05.xml
new file mode 100644
index 00000000..354b6612
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-05.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-05">
+  <title>Newspost: Buffer overflow vulnerability</title>
+  <synopsis>
+    A buffer overflow can be exploited to crash Newspost remotely and
+    potentially execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">newspost</product>
+  <announced>February 03, 2005</announced>
+  <revised>February 21, 2005: 02</revised>
+  <bug>78530</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-nntp/newspost" auto="yes" arch="*">
+      <unaffected range="rge">2.0-r1</unaffected>
+      <unaffected range="ge">2.1.1-r1</unaffected>
+      <vulnerable range="lt">2.1.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Newspost is a Usenet News binary autoposter.
+    </p>
+  </background>
+  <description>
+    <p>
+    Niels Heinen has discovered a buffer overflow in the socket_getline()
+    function of Newspost, which can be triggered by providing long strings
+    that do not end with a newline character.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could setup a malicious NNTP server and entice a
+    Newspost user to post to it, leading to the crash of the Newspost
+    process and potentially the execution of arbitrary code with the rights
+    of the Newspost user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Newspost users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-nntp/newspost-2.0-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0101">CAN-2005-0101</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed,  2 Feb 2005 15:47:51 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed,  2 Feb 2005 17:29:13 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-06.xml b/xml/htdocs/security/en/glsa/glsa-200502-06.xml
new file mode 100644
index 00000000..539f32af
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-06.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-06">
+  <title>LessTif: Multiple vulnerabilities in libXpm</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in libXpm, which is included
+    in LessTif, that can potentially lead to remote code execution.
+  </synopsis>
+  <product type="ebuild">lesstif</product>
+  <announced>February 06, 2005</announced>
+  <revised>February 06, 2005: 01</revised>
+  <bug>78483</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-libs/lesstif" auto="yes" arch="*">
+      <unaffected range="ge">0.94.0</unaffected>
+      <vulnerable range="lt">0.94.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    LessTif is a clone of OSF/Motif, which is a standard user
+    interface toolkit available on Unix and Linux.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities, including buffer overflows, out of
+    bounds memory access and directory traversals, have been discovered in
+    libXpm, which is shipped as a part of the X Window System. LessTif, an
+    application that includes libXpm, suffers from the same issues.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A carefully-crafted XPM file could crash applications making use
+    of the LessTif toolkit, potentially allowing the execution of arbitrary
+    code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All LessTif users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/lesstif-0.94.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0914">CAN-2004-0914</uri>
+    <uri link="http://www.lesstif.org/ReleaseNotes.html">LessTif Release Notes</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed,  2 Feb 2005 16:13:30 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun,  6 Feb 2005 17:18:21 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-07.xml b/xml/htdocs/security/en/glsa/glsa-200502-07.xml
new file mode 100644
index 00000000..45fb9927
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-07.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-07">
+  <title>OpenMotif: Multiple vulnerabilities in libXpm</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in libXpm, which is included
+    in OpenMotif, that can potentially lead to remote code execution.
+  </synopsis>
+  <product type="ebuild">openmotif</product>
+  <announced>February 07, 2005</announced>
+  <revised>February 25, 2005: 03</revised>
+  <bug>78111</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-libs/openmotif" auto="yes" arch="*">
+      <unaffected range="ge">2.2.3-r1</unaffected>
+      <unaffected range="rge">2.1.30-r7</unaffected>
+      <vulnerable range="lt">2.2.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenMotif provides a free version of the Motif toolkit for open source
+    applications.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities, such as buffer overflows, out of bounds
+    memory access or directory traversals, have been discovered in libXpm
+    that is shipped as a part of the X Window System (see GLSA 200409-34
+    and 200411-28). OpenMotif, an application that includes this library,
+    suffers from the same issues.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A carefully-crafted XPM file could crash applications making use of the
+    OpenMotif toolkit, potentially allowing the execution of arbitrary code
+    with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenMotif users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose x11-libs/openmotif</code>
+    <p>
+    Note: You should run 'revdep-rebuild' to ensure that all applications
+    linked to OpenMotif are properly rebuilt.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0687">CAN-2004-0687</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0688">CAN-2004-0688</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0914">CAN-2004-0914</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200409-34.xml">GLSA 200409-34</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200411-28.xml">GLSA 200411-28</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed,  2 Feb 2005 18:02:43 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed,  2 Feb 2005 19:11:27 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun,  6 Feb 2005 17:15:42 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-08.xml b/xml/htdocs/security/en/glsa/glsa-200502-08.xml
new file mode 100644
index 00000000..7f65dedb
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-08.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-08">
+  <title>PostgreSQL: Multiple vulnerabilities</title>
+  <synopsis>
+    PostgreSQL contains several vulnerabilities which could lead to execution
+    of arbitrary code, Denial of Service and security bypass.
+  </synopsis>
+  <product type="ebuild">postgresql</product>
+  <announced>February 07, 2005</announced>
+  <revised>June 26, 2007: 06</revised>
+  <bug>80342</bug>
+  <access>remote and local</access>
+  <affected>
+    <package name="dev-db/postgresql" auto="yes" arch="*">
+      <unaffected range="eq">7.3*</unaffected>
+      <unaffected range="eq">7.4*</unaffected>
+      <unaffected range="ge">8.0.1</unaffected>
+      <vulnerable range="lt">7.3.10</vulnerable>
+      <vulnerable range="lt">7.4.7</vulnerable>
+      <vulnerable range="lt">8.0.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PostgreSQL is a SQL compliant, open source object-relational database
+    management system.
+    </p>
+  </background>
+  <description>
+    <p>
+    PostgreSQL's contains several vulnerabilities:
+    </p>
+    <ul>
+    <li>John Heasman discovered that the LOAD extension is vulnerable to
+    local privilege escalation (CAN-2005-0227).</li>
+    <li>It is possible to bypass the EXECUTE permission check for functions
+    (CAN-2005-0244).</li>
+    <li>The PL/PgSQL parser is vulnerable to heap-based buffer overflow
+    (CAN-2005-0244).</li>
+    <li>The intagg contrib module is vulnerable to a Denial of Service
+    (CAN-2005-0246).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit this to execute arbitrary code with the
+    privileges of the PostgreSQL server, bypass security restrictions and
+    crash the server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no know workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PostgreSQL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-db/postgresql</code>
+  </resolution>
+  <references>
+    <uri link="http://archives.postgresql.org/pgsql-announce/2005-02/msg00000.php">PostgreSQL Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0227">CAN-2005-0227</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0244">CAN-2005-0244</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0245">CAN-2005-0245</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0246">CAN-2005-0246</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed,  2 Feb 2005 18:15:02 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed,  2 Feb 2005 18:50:22 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun,  6 Feb 2005 17:27:47 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-09.xml b/xml/htdocs/security/en/glsa/glsa-200502-09.xml
new file mode 100644
index 00000000..41ccfd31
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-09.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-09">
+  <title>Python: Arbitrary code execution through SimpleXMLRPCServer</title>
+  <synopsis>
+    Python-based XML-RPC servers may be vulnerable to remote execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">Python</product>
+  <announced>February 08, 2005</announced>
+  <revised>February 08, 2005: 01</revised>
+  <bug>80592</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/python" auto="yes" arch="*">
+      <unaffected range="ge">2.3.4-r1</unaffected>
+      <unaffected range="rge">2.3.3-r2</unaffected>
+      <unaffected range="rge">2.2.3-r6</unaffected>
+      <vulnerable range="le">2.3.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Python is an interpreted, interactive, object-oriented,
+    cross-platform programming language.
+    </p>
+  </background>
+  <description>
+    <p>
+    Graham Dumpleton discovered that XML-RPC servers making use of the
+    SimpleXMLRPCServer library that use the register_instance() method to
+    register an object without a _dispatch() method are vulnerable to a
+    flaw allowing to read or modify globals of the associated module.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker may be able to exploit the flaw in such XML-RPC
+    servers to execute arbitrary code on the server host with the rights of
+    the XML-RPC server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Python users that don't make use of any SimpleXMLRPCServer-based
+    XML-RPC servers, or making use of servers using only the
+    register_function() method are not affected.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Python users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-lang/python</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0089">CAN-2005-0089</uri>
+    <uri link="http://www.python.org/security/PSF-2005-001/">Python PSF-2005-001</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri,  4 Feb 2005 14:45:11 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon,  7 Feb 2005 08:31:41 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue,  8 Feb 2005 19:35:29 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-10.xml b/xml/htdocs/security/en/glsa/glsa-200502-10.xml
new file mode 100644
index 00000000..b9eca76c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-10.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-10">
+  <title>pdftohtml: Vulnerabilities in included Xpdf</title>
+  <synopsis>
+    pdftohtml includes vulnerable Xpdf code to handle PDF files, making it
+    vulnerable to execution of arbitrary code upon converting a malicious PDF
+    file.
+  </synopsis>
+  <product type="ebuild">pdftohtml</product>
+  <announced>February 09, 2005</announced>
+  <revised>February 09, 2005: 01</revised>
+  <bug>78629</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/pdftohtml" auto="yes" arch="*">
+      <unaffected range="ge">0.36-r3</unaffected>
+      <vulnerable range="lt">0.36-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    pdftohtml is a utility to convert PDF files to HTML or XML
+    formats. It makes use of Xpdf code to decode PDF files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Xpdf is vulnerable to a buffer overflow, as described in GLSA
+    200501-28.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to convert a specially-crafted PDF
+    file, potentially resulting in the execution of arbitrary code with the
+    rights of the user running pdftohtml.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All pdftohtml users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/pdftohtml-0.36-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200501-28.xml">GLSA 200501-28</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0064">CAN-2005-0064</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat,  5 Feb 2005 20:35:14 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed,  9 Feb 2005 15:54:21 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-11.xml b/xml/htdocs/security/en/glsa/glsa-200502-11.xml
new file mode 100644
index 00000000..666d5c03
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-11.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-11">
+  <title>Mailman: Directory traversal vulnerability</title>
+  <synopsis>
+    Mailman fails to properly sanitize input, leading to information
+    disclosure.
+  </synopsis>
+  <product type="ebuild">mailman</product>
+  <announced>February 10, 2005</announced>
+  <revised>February 10, 2005: 01</revised>
+  <bug>81109</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/mailman" auto="yes" arch="*">
+      <unaffected range="ge">2.1.5-r4</unaffected>
+      <vulnerable range="lt">2.1.5-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mailman is a Python-based mailing list server with an extensive
+    web interface.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mailman contains an error in private.py which fails to properly
+    sanitize input paths.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit this flaw to obtain arbitrary files on
+    the web server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mailman users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/mailman-2.1.5-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://lists.netsys.com/pipermail/full-disclosure/2005-February/031562.html">Full Disclosure Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0202">CAN-2005-0202</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed,  9 Feb 2005 21:12:44 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed,  9 Feb 2005 21:59:02 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 10 Feb 2005 16:41:33 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-12.xml b/xml/htdocs/security/en/glsa/glsa-200502-12.xml
new file mode 100644
index 00000000..5d34ca45
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-12.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-12">
+  <title>Webmin: Information leak in Gentoo binary package</title>
+  <synopsis>
+    Portage-built Webmin binary packages accidentally include a file containing
+    the local encrypted root password.
+  </synopsis>
+  <product type="ebuild">Webmin</product>
+  <announced>February 11, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>77731</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-admin/webmin" auto="yes" arch="*">
+      <unaffected range="ge">1.170-r3</unaffected>
+      <vulnerable range="lt">1.170-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Webmin is a web-based system administration console allowing an
+    administrator to easily configure servers and other features. Using the
+    'buildpkg' FEATURE, or the -b/-B emerge options, Portage can build
+    reusable binary packages for any of the packages available through the
+    Portage tree.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Audit Team discovered that
+    the Webmin ebuild contains a design flaw. It imports the encrypted
+    local root password into the miniserv.users file before building binary
+    packages that include this file.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could retrieve Portage-built Webmin binary packages
+    and recover the encrypted root password from the build host.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Users who never built or shared a Webmin binary package are unaffected
+    by this.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Webmin users should delete any old shared Webmin binary package as soon
+    as possible. They should also consider their buildhost root password
+    potentially exposed and follow proper audit procedures.
+    </p>
+    <p>
+    If you plan to build binary packages, you should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/webmin-1.170-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0427">CVE-2005-0427</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 10 Feb 2005 15:50:39 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 10 Feb 2005 15:50:49 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-13.xml b/xml/htdocs/security/en/glsa/glsa-200502-13.xml
new file mode 100644
index 00000000..de74750f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-13.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-13">
+  <title>Perl: Vulnerabilities in perl-suid wrapper</title>
+  <synopsis>
+    Vulnerabilities leading to file overwriting and code execution with
+    elevated privileges have been discovered in the perl-suid wrapper.
+  </synopsis>
+  <product type="ebuild">Perl</product>
+  <announced>February 11, 2005</announced>
+  <revised>February 11, 2005: 01</revised>
+  <bug>80460</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-lang/perl" auto="yes" arch="*">
+      <unaffected range="ge">5.8.6-r3</unaffected>
+      <unaffected range="rge">5.8.5-r4</unaffected>
+      <unaffected range="rge">5.8.4-r3</unaffected>
+      <unaffected range="rge">5.8.2-r3</unaffected>
+      <vulnerable range="lt">5.8.6-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Perl is a stable, cross-platform programming language created by
+    Larry Wall. The perl-suid wrapper allows the use of setuid perl
+    scripts, i.e. user-callable Perl scripts which have elevated
+    privileges. This function is enabled only if you have the perlsuid USE
+    flag set.
+    </p>
+  </background>
+  <description>
+    <p>
+    perl-suid scripts honor the PERLIO_DEBUG environment variable and
+    write to that file with elevated privileges (CAN-2005-0155).
+    Furthermore, calling a perl-suid script with a very long path while
+    PERLIO_DEBUG is set could trigger a buffer overflow (CAN-2005-0156).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could set the PERLIO_DEBUG environment variable
+    and call existing perl-suid scripts, resulting in file overwriting and
+    potentially the execution of arbitrary code with root privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    You are not vulnerable if you do not have the perlsuid USE flag
+    set or do not use perl-suid scripts.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Perl users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-lang/perl</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0155">CAN-2005-0155</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0156">CAN-2005-0156</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri,  4 Feb 2005 14:45:58 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 11 Feb 2005 15:34:36 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 11 Feb 2005 16:11:49 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-14.xml b/xml/htdocs/security/en/glsa/glsa-200502-14.xml
new file mode 100644
index 00000000..284aa72c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-14.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-14">
+  <title>mod_python: Publisher Handler vulnerability</title>
+  <synopsis>
+    mod_python contains a vulnerability in the Publisher Handler potentially
+    leading to information disclosure.
+  </synopsis>
+  <product type="ebuild">mod_python</product>
+  <announced>February 13, 2005</announced>
+  <revised>December 30, 2007: 03</revised>
+  <bug>80109</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apache/mod_python" auto="yes" arch="*">
+      <unaffected range="ge">3.1.3-r1</unaffected>
+      <unaffected range="rge">2.7.11</unaffected>
+      <vulnerable range="lt">3.1.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    mod_python is an Apache module that embeds the Python interpreter
+    within the server allowing Python-based web-applications to be created.
+    </p>
+  </background>
+  <description>
+    <p>
+    Graham Dumpleton discovered a vulnerability in mod_python's Publisher
+    Handler.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By requesting a specially crafted URL for a published module page, an
+    attacker could obtain information about restricted variables.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mod_python users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose www-apache/mod_python</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0088">CAN-2005-0088</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 11 Feb 2005 20:01:25 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 11 Feb 2005 20:10:55 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 11 Feb 2005 20:41:24 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-15.xml b/xml/htdocs/security/en/glsa/glsa-200502-15.xml
new file mode 100644
index 00000000..03eccf8c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-15.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-15">
+  <title>PowerDNS: Denial of Service vulnerability</title>
+  <synopsis>
+    A vulnerability in PowerDNS could lead to a temporary Denial of Service.
+  </synopsis>
+  <product type="ebuild">PowerDNS</product>
+  <announced>February 13, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>80713</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/pdns" auto="yes" arch="*">
+      <unaffected range="ge">2.9.17</unaffected>
+      <vulnerable range="lt">2.9.17</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The PowerDNS Nameserver is an authoritative-only nameserver which uses
+    a flexible backend architecture.
+    </p>
+  </background>
+  <description>
+    <p>
+    A vulnerability has been reported in the DNSPacket::expand method of
+    dnspacket.cc.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could cause a temporary Denial of Service by sending a
+    random stream of bytes to the PowerDNS Daemon.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PowerDNS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/pdns-2.9.17&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://doc.powerdns.com/changelog.html#CHANGELOG-2-9-17">PowerDNS Release Notes</uri>
+    <uri link="http://ds9a.nl/cgi-bin/cvstrac/pdns/tktview?tn=21">PowerDNS Ticket #21</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0428">CVE-2005-0428</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 13 Feb 2005 17:12:23 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 13 Feb 2005 17:14:58 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-16.xml b/xml/htdocs/security/en/glsa/glsa-200502-16.xml
new file mode 100644
index 00000000..4c45bb68
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-16.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-16">
+  <title>ht://Dig: Cross-site scripting vulnerability</title>
+  <synopsis>
+    ht://Dig is vulnerable to cross-site scripting attacks.
+  </synopsis>
+  <product type="ebuild">htdig</product>
+  <announced>February 13, 2005</announced>
+  <revised>February 13, 2005: 01</revised>
+  <bug>80602</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-misc/htdig" auto="yes" arch="*">
+      <unaffected range="ge">3.1.6-r7</unaffected>
+      <vulnerable range="lt">3.1.6-r7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ht://Dig is an HTTP/HTML indexing and searching system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Michael Krax discovered that ht://Dig fails to validate the
+    'config' parameter before displaying an error message containing the
+    parameter. This flaw could allow an attacker to conduct cross-site
+    scripting attacks.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By sending a carefully crafted message, an attacker can inject and
+    execute script code in the victim's browser window. This allows to
+    modify the behaviour of ht://Dig, and/or leak session information such
+    as cookies to the attacker.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ht://Dig users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-misc/htdig-3.1.6-r7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0085">CAN-2005-0085</uri>
+    <uri link="http://securitytracker.com/alerts/2005/Feb/1013078.html">SecurityTracker #1013078</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 13 Feb 2005 17:17:57 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 13 Feb 2005 17:19:04 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 13 Feb 2005 20:15:40 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-17.xml b/xml/htdocs/security/en/glsa/glsa-200502-17.xml
new file mode 100644
index 00000000..6cbc7dae
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-17.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-17">
+  <title>Opera: Multiple vulnerabilities</title>
+  <synopsis>
+    Opera is vulnerable to several vulnerabilities which could result in
+    information disclosure and facilitate execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Opera</product>
+  <announced>February 14, 2005</announced>
+  <revised>December 30, 2007: 03</revised>
+  <bug>73871</bug>
+  <bug>74076</bug>
+  <bug>74321</bug>
+  <bug>81747</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/opera" auto="yes" arch="*">
+      <unaffected range="ge">7.54-r3</unaffected>
+      <vulnerable range="lt">7.54-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Opera is a multi-platform web browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    Opera contains several vulnerabilities:
+    </p>
+    <ul>
+    <li>fails to properly validate Content-Type and filename.</li>
+    <li>fails to properly validate date: URIs.</li>
+    <li>uses kfmclient exec as the Default Application to handle downloaded
+    files when integrated with KDE.</li>
+    <li>fails to properly control frames.</li>
+    <li>uses Sun Java packages insecurely.</li>
+    <li>searches an insecure path for plugins.</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit these vulnerabilities to:
+    </p>
+    <ul>
+    <li>execute arbitrary code.</li>
+    <li>load a malicious frame in the context of another browser
+    session.</li>
+    <li>leak information.</li>
+    </ul>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Opera users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/opera-7.54-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.opera.com/linux/changelogs/754u1/">Opera Changelog for 7.54u1</uri>
+    <uri link="http://www.opera.com/linux/changelogs/754u2/">Opera Changelog for 7.54u2</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1157">CVE-2004-1157</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1489">CVE-2004-1489</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1490">CVE-2004-1490</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1491">CVE-2004-1491</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0456">CVE-2005-0456</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0457">CVE-2005-0457</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 10 Feb 2005 15:51:32 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 11 Feb 2005 11:21:17 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-18.xml b/xml/htdocs/security/en/glsa/glsa-200502-18.xml
new file mode 100644
index 00000000..4b586e11
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-18.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-18">
+  <title>VMware Workstation: Untrusted library search path</title>
+  <synopsis>
+    VMware may load shared libraries from an untrusted, world-writable
+    directory, resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">VMware</product>
+  <announced>February 14, 2005</announced>
+  <revised>May 25, 2006: 03</revised>
+  <bug>81344</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-emulation/vmware-workstation" auto="yes" arch="*">
+      <unaffected range="ge">4.5.2.8848-r5</unaffected>
+      <unaffected range="rge">3.2.1.2242-r4</unaffected>
+      <vulnerable range="lt">4.5.2.8848-r5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    VMware Workstation is a powerful virtual machine for developers and
+    system administrators.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Audit Team has discovered
+    that VMware Workstation searches for gdk-pixbuf loadable modules in an
+    untrusted, world-writable directory.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create a malicious shared object that would be
+    loaded by VMware, resulting in the execution of arbitrary code with the
+    privileges of the user running VMware.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    The system administrator may create the file /tmp/rrdharan to prevent
+    malicious users from creating a directory at that location:
+    </p>
+    <code>
+    # touch /tmp/rrdharan</code>
+  </workaround>
+  <resolution>
+    <p>
+    All VMware Workstation users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/vmware-workstation-3.2.1.2242-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0444">CVE-2005-0444</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 12 Feb 2005 12:53:09 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 12 Feb 2005 12:53:31 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 13 Feb 2005 19:36:17 +0000">
+    taviso
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-19.xml b/xml/htdocs/security/en/glsa/glsa-200502-19.xml
new file mode 100644
index 00000000..1eb8528b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-19.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-19">
+  <title>PostgreSQL: Buffer overflows in PL/PgSQL parser</title>
+  <synopsis>
+    PostgreSQL is vulnerable to several buffer overflows in the PL/PgSQL parser
+    leading to execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">postgresql</product>
+  <announced>February 14, 2005</announced>
+  <revised>June 26, 2007: 04</revised>
+  <bug>81350</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/postgresql" auto="yes" arch="*">
+      <unaffected range="eq">7.3*</unaffected>
+      <unaffected range="eq">7.4*</unaffected>
+      <unaffected range="ge">8.0.1-r1</unaffected>
+      <vulnerable range="lt">7.3.9-r1</vulnerable>
+      <vulnerable range="lt">7.4.13</vulnerable>
+      <vulnerable range="lt">8.0.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PostgreSQL is a SQL compliant, open source object-relational database
+    management system.
+    </p>
+  </background>
+  <description>
+    <p>
+    PostgreSQL is vulnerable to several buffer overflows in the PL/PgSQL
+    parser.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send a malicious query resulting in the
+    execution of arbitrary code with the permissions of the user running
+    PostgreSQL.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PostgreSQL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-db/postgresql</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0247">CAN-2005-0247</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 11 Feb 2005 15:37:29 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 11 Feb 2005 20:39:12 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 14 Feb 2005 20:03:42 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-20.xml b/xml/htdocs/security/en/glsa/glsa-200502-20.xml
new file mode 100644
index 00000000..23356905
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-20.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-20">
+  <title>Emacs, XEmacs: Format string vulnerabilities in movemail</title>
+  <synopsis>
+    The movemail utility shipped with Emacs and XEmacs contains several format
+    string vulnerabilities, potentially leading to the execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">Emacs</product>
+  <announced>February 15, 2005</announced>
+  <revised>July 23, 2006: 02</revised>
+  <bug>79686</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-editors/emacs" auto="yes" arch="*">
+      <unaffected range="ge">21.4</unaffected>
+      <unaffected range="lt">19</unaffected>
+      <vulnerable range="lt">21.4</vulnerable>
+    </package>
+    <package name="app-editors/xemacs" auto="yes" arch="*">
+      <unaffected range="ge">21.4.15-r3</unaffected>
+      <vulnerable range="lt">21.4.15-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GNU Emacs and XEmacs are highly extensible and customizable text
+    editors. movemail is an Emacs utility that can fetch mail on remote
+    mail servers.
+    </p>
+  </background>
+  <description>
+    <p>
+    Max Vozeler discovered that the movemail utility contains several
+    format string errors.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could set up a malicious POP server and entice a user to
+    connect to it using movemail, resulting in the execution of arbitrary
+    code with the rights of the victim user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Emacs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-editors/emacs-21.4&quot;</code>
+    <p>
+    All XEmacs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-editors/xemacs-21.4.15-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0100">CAN-2005-0100</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 11 Feb 2005 15:36:27 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 15 Feb 2005 16:06:08 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 15 Feb 2005 16:06:17 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-21.xml b/xml/htdocs/security/en/glsa/glsa-200502-21.xml
new file mode 100644
index 00000000..dff9d18d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-21.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-21">
+  <title>lighttpd: Script source disclosure</title>
+  <synopsis>
+    An attacker can trick lighttpd into revealing the source of scripts that
+    should be executed as CGI or FastCGI applications.
+  </synopsis>
+  <product type="ebuild">lighttpd</product>
+  <announced>February 15, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>81776</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/lighttpd" auto="yes" arch="*">
+      <unaffected range="ge">1.3.10-r1</unaffected>
+      <vulnerable range="lt">1.3.10-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    lighttpd is a small-footprint, fast, compliant and very flexible
+    web-server which is optimized for high-performance environments.
+    </p>
+  </background>
+  <description>
+    <p>
+    lighttpd uses file extensions to determine which elements are programs
+    that should be executed and which are static pages that should be sent
+    as-is. By appending %00 to the filename, you can evade the extension
+    detection mechanism while still accessing the file.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker could send specific queries and access the source of
+    scripts that should have been executed as CGI or FastCGI applications.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All lighttpd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/lighttpd-1.3.10-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://article.gmane.org/gmane.comp.web.lighttpd/1171">lighttpd-announce Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0453">CVE-2005-0453</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 14 Feb 2005 12:34:31 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 14 Feb 2005 20:13:10 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 14 Feb 2005 20:53:12 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-22.xml b/xml/htdocs/security/en/glsa/glsa-200502-22.xml
new file mode 100644
index 00000000..e87ef06f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-22.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-22">
+  <title>wpa_supplicant: Buffer overflow vulnerability</title>
+  <synopsis>
+    wpa_supplicant contains a buffer overflow that could lead to a Denial of
+    Service.
+  </synopsis>
+  <product type="ebuild">wpa_supplicant</product>
+  <announced>February 16, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>81993</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-wireless/wpa_supplicant" auto="yes" arch="*">
+      <unaffected range="ge">0.2.7</unaffected>
+      <vulnerable range="lt">0.2.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    wpa_supplicant is a WPA Supplicant with support for WPA and WPA2 (IEEE
+    802.11i / RSN).
+    </p>
+  </background>
+  <description>
+    <p>
+    wpa_supplicant contains a possible buffer overflow due to the lacking
+    validation of received EAPOL-Key frames.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could cause the crash of wpa_supplicant using a specially
+    crafted packet.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All wpa_supplicant users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-wireless/wpa_supplicant-0.2.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://lists.shmoo.com/pipermail/hostap/2005-February/009465.html">wpa_supplicant Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0470">CVE-2005-0470</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 14 Feb 2005 18:34:56 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 14 Feb 2005 20:11:49 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 14 Feb 2005 21:06:18 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-23.xml b/xml/htdocs/security/en/glsa/glsa-200502-23.xml
new file mode 100644
index 00000000..46356d48
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-23.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-23">
+  <title>KStars: Buffer overflow in fliccd</title>
+  <synopsis>
+    KStars is vulnerable to a buffer overflow that could lead to arbitrary code
+    execution with elevated privileges.
+  </synopsis>
+  <product type="ebuild">kstars</product>
+  <announced>February 16, 2005</announced>
+  <revised>February 16, 2005: 01</revised>
+  <bug>79585</bug>
+  <access>remote and local</access>
+  <affected>
+    <package name="kde-base/kdeedu" auto="yes" arch="*">
+      <unaffected range="ge">3.3.2-r1</unaffected>
+      <vulnerable range="lt">3.3.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDE is a feature-rich graphical desktop environment for Linux and
+    Unix-like Operating Systems. KStars is a desktop planetarium for KDE.
+    It includes support for the Instrument Neutral Distributed Interface
+    (INDI).
+    </p>
+  </background>
+  <description>
+    <p>
+    Erik Sjolund discovered a buffer overflow in fliccd which is part
+    of the INDI support in KStars.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could exploit this vulnerability to execute code with
+    elevated privileges. If fliccd does not run as daemon remote
+    exploitation of this vulnerability is not possible. KDE as shipped by
+    Gentoo does not start the daemon in the default installation.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All KStars users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kdeedu-3.3.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0011">CAN-2005-0011</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 15 Feb 2005 06:01:05 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 16 Feb 2005 20:27:57 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-24.xml b/xml/htdocs/security/en/glsa/glsa-200502-24.xml
new file mode 100644
index 00000000..095031d9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-24.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-24">
+  <title>Midnight Commander: Multiple vulnerabilities</title>
+  <synopsis>
+    Midnight Commander contains several format string errors, buffer overflows
+    and one buffer underflow leading to execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mc</product>
+  <announced>February 17, 2005</announced>
+  <revised>February 17, 2005: 01</revised>
+  <bug>77992</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-misc/mc" auto="yes" arch="*">
+      <unaffected range="ge">4.6.0-r13</unaffected>
+      <vulnerable range="lt">4.6.0-r13</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Midnight Commander is a visual console file manager.
+    </p>
+  </background>
+  <description>
+    <p>
+    Midnight Commander contains several format string vulnerabilities
+    (CAN-2004-1004), buffer overflows (CAN-2004-1005), a memory
+    deallocation error (CAN-2004-1092) and a buffer underflow
+    (CAN-2004-1176).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit these vulnerabilities to execute
+    arbitrary code with the permissions of the user running Midnight
+    Commander or cause Denial of Service by freeing unallocated memory.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Midnight Commander users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-misc/mc-4.6.0-r13&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1004">CAN-2004-1004</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1005">CAN-2004-1005</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1092">CAN-2004-1092</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1176">CAN-2004-1176</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 14 Feb 2005 20:35:43 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 15 Feb 2005 16:08:08 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 15 Feb 2005 20:09:31 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-25.xml b/xml/htdocs/security/en/glsa/glsa-200502-25.xml
new file mode 100644
index 00000000..eec272b0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-25.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-25">
+  <title>Squid: Denial of Service through DNS responses</title>
+  <synopsis>
+    Squid contains a bug in the handling of certain DNS responses resulting in
+    a Denial of Service.
+  </synopsis>
+  <product type="ebuild">Squid</product>
+  <announced>February 18, 2005</announced>
+  <revised>February 18, 2005: 01</revised>
+  <bug>81997</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-proxy/squid" auto="yes" arch="*">
+      <unaffected range="ge">2.5.8</unaffected>
+      <vulnerable range="lt">2.5.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Squid is a full-featured Web proxy cache designed to run on
+    Unix-like systems. It supports proxying and caching of HTTP, FTP, and
+    other protocols, as well as SSL support, cache hierarchies, transparent
+    caching, access control lists and many other features.
+    </p>
+  </background>
+  <description>
+    <p>
+    Handling of certain DNS responses trigger assertion failures.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By returning a specially crafted DNS response an attacker could
+    cause Squid to crash by triggering an assertion failure.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Squid users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-proxy/squid-2.5.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0446">CAN-2005-0446</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 17 Feb 2005 20:33:19 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 17 Feb 2005 21:28:52 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 18 Feb 2005 09:26:51 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-26.xml b/xml/htdocs/security/en/glsa/glsa-200502-26.xml
new file mode 100644
index 00000000..ae2ae8e0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-26.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-26">
+  <title>GProFTPD: gprostats format string vulnerability</title>
+  <synopsis>
+    gprostats, distributed with GProFTPD, is vulnerable to a format string
+    vulnerability, potentially leading to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">GProFTPD</product>
+  <announced>February 18, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>81894</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-ftp/gproftpd" auto="yes" arch="*">
+      <unaffected range="ge">8.1.9</unaffected>
+      <vulnerable range="lt">8.1.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GProFTPD is a GTK+ administration tool for the ProFTPD server. GProFTPD
+    is distributed with gprostats, a utility to parse ProFTPD transfer
+    logs.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Audit Team has identified a
+    format string vulnerability in the gprostats utility.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit the vulnerability by performing a specially
+    crafted FTP transfer, the resulting ProFTPD transfer log could
+    potentially trigger the execution of arbitrary code when parsed by
+    GProFTPD.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GProFTPD users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-ftp/gproftpd-8.1.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0484">CVE-2005-0484</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 16 Feb 2005 19:27:51 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 17 Feb 2005 00:01:48 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 18 Feb 2005 09:37:53 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-27.xml b/xml/htdocs/security/en/glsa/glsa-200502-27.xml
new file mode 100644
index 00000000..cde9d261
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-27.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-27">
+  <title>gFTP: Directory traversal vulnerability</title>
+  <synopsis>
+    gFTP is vulnerable to directory traversal attacks, possibly leading to the
+    creation or overwriting of arbitrary files.
+  </synopsis>
+  <product type="ebuild">gFTP</product>
+  <announced>February 19, 2005</announced>
+  <revised>February 19, 2005: 01</revised>
+  <bug>81994</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-ftp/gftp" auto="yes" arch="*">
+      <unaffected range="ge">2.0.18-r1</unaffected>
+      <vulnerable range="lt">2.0.18-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    gFTP is a GNOME based, multi-threaded file transfer client.
+    </p>
+  </background>
+  <description>
+    <p>
+    gFTP lacks input validation of filenames received by remote
+    servers.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to connect to a malicious FTP
+    server and conduct a directory traversal attack by making use of
+    specially crafted filenames. This could lead to arbitrary files being
+    created or overwritten.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All gFTP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-ftp/gftp-2.0.18-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://archives.seul.org/gftp/announce/Feb-2005/msg00000.html">gFTP Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0372">CAN-2005-0372</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 16 Feb 2005 19:28:38 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 17 Feb 2005 20:30:31 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 19 Feb 2005 10:43:51 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-28.xml b/xml/htdocs/security/en/glsa/glsa-200502-28.xml
new file mode 100644
index 00000000..76ea1e1a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-28.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-28">
+  <title>PuTTY: Remote code execution</title>
+  <synopsis>
+    PuTTY was found to contain vulnerabilities that can allow a malicious SFTP
+    server to execute arbitrary code on unsuspecting PSCP and PSFTP clients.
+  </synopsis>
+  <product type="ebuild">Putty</product>
+  <announced>February 21, 2005</announced>
+  <revised>February 21, 2005: 01</revised>
+  <bug>82753</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/putty" auto="yes" arch="*">
+      <unaffected range="ge">0.57</unaffected>
+      <vulnerable range="lt">0.57</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PuTTY is a popular SSH client, PSCP is a secure copy
+    implementation, and PSFTP is a SSH File Transfer Protocol client.
+    </p>
+  </background>
+  <description>
+    <p>
+    Two vulnerabilities have been discovered in the PSCP and PSFTP
+    clients, which can be triggered by the SFTP server itself. These issues
+    are caused by the improper handling of the FXP_READDIR response, along
+    with other string fields.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker can setup a malicious SFTP server that would send
+    these malformed responses to a client, potentially allowing the
+    execution of arbitrary code on their system.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PuTTY users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/putty-0.57&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html">PuTTY vulnerability vuln-sftp-readdir</uri>
+    <uri link="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html">PuTTY vulnerability vuln-sftp-string</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0467">CAN-2005-0467</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=201&amp;type=vulnerabilities">iDEFENSE Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 21 Feb 2005 09:51:17 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 21 Feb 2005 09:52:44 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 21 Feb 2005 13:42:55 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-29.xml b/xml/htdocs/security/en/glsa/glsa-200502-29.xml
new file mode 100644
index 00000000..79af3a18
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-29.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-29">
+  <title>Cyrus IMAP Server: Multiple overflow vulnerabilities</title>
+  <synopsis>
+    The Cyrus IMAP Server is affected by several overflow vulnerabilities which
+    could potentially lead to the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">cyrus-imapd</product>
+  <announced>February 23, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>82404</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/cyrus-imapd" auto="yes" arch="*">
+      <unaffected range="ge">2.2.12</unaffected>
+      <vulnerable range="lt">2.2.12</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Cyrus IMAP Server is an efficient, highly-scalable IMAP e-mail
+    server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Possible single byte overflows have been found in the imapd annotate
+    extension and mailbox handling code. Furthermore stack buffer overflows
+    have been found in fetchnews, the backend and imapd.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker, who could be an authenticated user or an admin of a
+    peering news server, could exploit these vulnerabilities to execute
+    arbitrary code with the rights of the user running the Cyrus IMAP
+    Server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cyrus IMAP Server users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/cyrus-imapd-2.2.12&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://asg.web.cmu.edu/archive/message.php?mailbox=archive.info-cyrus&amp;msg=33723">Cyrus IMAP Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0546">CVE-2005-0546</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 18 Feb 2005 10:42:26 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 19 Feb 2005 20:45:06 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 23 Feb 2005 12:49:07 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-30.xml b/xml/htdocs/security/en/glsa/glsa-200502-30.xml
new file mode 100644
index 00000000..cbf3d073
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-30.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-30">
+  <title>cmd5checkpw: Local password leak vulnerability</title>
+  <synopsis>
+    cmd5checkpw contains a flaw allowing local users to access other users
+    cmd5checkpw passwords.
+  </synopsis>
+  <product type="ebuild">cmd5checkpw</product>
+  <announced>February 25, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>78256</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-mail/cmd5checkpw" auto="yes" arch="*">
+      <unaffected range="ge">0.22-r2</unaffected>
+      <vulnerable range="le">0.22-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    cmd5checkpw is a checkpassword compatible authentication program that
+    uses CRAM-MD5 authentication mode.
+    </p>
+  </background>
+  <description>
+    <p>
+    Florian Westphal discovered that cmd5checkpw is installed setuid
+    cmd5checkpw but does not drop privileges before calling execvp(), so
+    the invoked program retains the cmd5checkpw euid.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    Local users that know at least one valid /etc/poppasswd user/password
+    combination can read the /etc/poppasswd file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All cmd5checkpw users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync 
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/cmd5checkpw-0.22-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0580">CVE-2005-0580</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 24 Feb 2005 11:26:13 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 25 Feb 2005 09:22:33 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 25 Feb 2005 09:25:07 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-31.xml b/xml/htdocs/security/en/glsa/glsa-200502-31.xml
new file mode 100644
index 00000000..531a5950
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-31.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-31">
+  <title>uim: Privilege escalation vulnerability</title>
+  <synopsis>
+    Under certain conditions, applications linked against uim suffer from a
+    privilege escalation vulnerability.
+  </synopsis>
+  <product type="ebuild">uim</product>
+  <announced>February 28, 2005</announced>
+  <revised>February 28, 2005: 01</revised>
+  <bug>82678</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-i18n/uim" auto="yes" arch="*">
+      <unaffected range="ge">0.4.5.1</unaffected>
+      <vulnerable range="lt">0.4.5.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    uim is a simple, secure and flexible input method library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Takumi Asaki discovered that uim insufficiently checks environment
+    variables. setuid/setgid applications linked against libuim could end
+    up executing arbitrary code. This vulnerability only affects
+    immodule-enabled Qt (if you build Qt 3.3.2 or later versions with
+    USE="immqt" or USE="immqt-bc").
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious local user could exploit this vulnerability to execute
+    arbitrary code with escalated privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All uim users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-i18n/uim-0.4.5.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0503">CAN-2005-0503</uri>
+    <uri link="http://lists.freedesktop.org/archives/uim/2005-February/000996.html">uim announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 25 Feb 2005 09:53:35 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 27 Feb 2005 12:40:49 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 28 Feb 2005 08:59:25 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-32.xml b/xml/htdocs/security/en/glsa/glsa-200502-32.xml
new file mode 100644
index 00000000..5ed247df
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-32.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-32">
+  <title>UnAce: Buffer overflow and directory traversal vulnerabilities</title>
+  <synopsis>
+    UnAce is vulnerable to several buffer overflow and directory traversal
+    attacks.
+  </synopsis>
+  <product type="ebuild">unace</product>
+  <announced>February 28, 2005</announced>
+  <revised>February 28, 2005: 01</revised>
+  <bug>81958</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/unace" auto="yes" arch="*">
+      <unaffected range="rge">1.2b-r1</unaffected>
+      <vulnerable range="le">1.2b</vulnerable>
+      <vulnerable range="ge">2.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    UnAce is an utility to extract, view and test the contents of an
+    ACE archive.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ulf Harnhammar discovered that UnAce suffers from buffer overflows
+    when testing, unpacking or listing specially crafted ACE archives
+    (CAN-2005-0160). He also found out that UnAce is vulnerable to
+    directory traversal attacks, if an archive contains "./.." sequences or
+    absolute filenames (CAN-2005-0161).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit the buffer overflows to execute
+    malicious code or the directory traversals to overwrite arbitrary
+    files.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All UnAce users should upgrade to the latest available 1.2
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/unace-1.2b-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0160">CAN-2005-0160</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0161">CAN-2005-0161</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 27 Feb 2005 14:45:09 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 27 Feb 2005 15:41:01 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 28 Feb 2005 15:45:17 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200502-33.xml b/xml/htdocs/security/en/glsa/glsa-200502-33.xml
new file mode 100644
index 00000000..76c36cb1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200502-33.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200502-33">
+  <title>MediaWiki: Multiple vulnerabilities</title>
+  <synopsis>
+    MediaWiki is vulnerable to cross-site scripting, data manipulation and
+    security bypass attacks.
+  </synopsis>
+  <product type="ebuild">mediawiki</product>
+  <announced>February 28, 2005</announced>
+  <revised>February 28, 2005: 01</revised>
+  <bug>80729</bug>
+  <bug>82954</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/mediawiki" auto="yes" arch="*">
+      <unaffected range="ge">1.3.11</unaffected>
+      <vulnerable range="lt">1.3.11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MediaWiki is a collaborative editing software, used by big
+    projects like Wikipedia.
+    </p>
+  </background>
+  <description>
+    <p>
+    A security audit of the MediaWiki project discovered that
+    MediaWiki is vulnerable to several cross-site scripting and cross-site
+    request forgery attacks, and that the image deletion code does not
+    sufficiently sanitize input parameters.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By tricking a user to load a carefully crafted URL, a remote
+    attacker could hijack sessions and authentication cookies to inject
+    malicious script code that will be executed in a user's browser session
+    in context of the vulnerable site, or use JavaScript submitted forms to
+    perform restricted actions. Using the image deletion flaw, it is also
+    possible for authenticated administrators to delete arbitrary files via
+    directory traversal.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MediaWiki users should upgrade to the latest available
+    version:
+    </p>
+    <code>
+    # emerge --sync 
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/mediawiki-1.3.11&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://secunia.com/advisories/14125/">Secunia Advisory SA14125</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0534">CAN-2005-0534</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0535">CAN-2005-0535</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0536">CAN-2005-0536</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 24 Feb 2005 11:32:05 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 25 Feb 2005 09:25:41 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 27 Feb 2005 16:48:17 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-01.xml b/xml/htdocs/security/en/glsa/glsa-200503-01.xml
new file mode 100644
index 00000000..129dc08e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-01.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-01">
+  <title>Qt: Untrusted library search path</title>
+  <synopsis>
+    Qt may load shared libraries from an untrusted, world-writable directory,
+    resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">qt</product>
+  <announced>March 01, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>75181</bug>
+  <access>local</access>
+  <affected>
+    <package name="x11-libs/qt" auto="yes" arch="*">
+      <unaffected range="ge">3.3.4-r2</unaffected>
+      <vulnerable range="lt">3.3.4-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Qt is a cross-platform GUI toolkit used by KDE.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Audit Team has discovered
+    that Qt searches for shared libraries in an untrusted, world-writable
+    directory.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create a malicious shared object that would be
+    loaded by Qt, resulting in the execution of arbitrary code with the
+    privileges of the Qt application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Qt users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/qt-3.3.4-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0627">CVE-2005-0627</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 15 Feb 2005 06:13:07 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue,  1 Mar 2005 12:59:58 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-02.xml b/xml/htdocs/security/en/glsa/glsa-200503-02.xml
new file mode 100644
index 00000000..fd9cfc3d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-02.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-02">
+  <title>phpBB: Multiple vulnerabilities</title>
+  <synopsis>
+    Several vulnerabilities allow remote attackers to gain phpBB administrator
+    rights or expose and manipulate sensitive data.
+  </synopsis>
+  <product type="ebuild">phpbb</product>
+  <announced>March 01, 2005</announced>
+  <revised>March 01, 2005: 01</revised>
+  <bug>82955</bug>
+  <access>local and remote</access>
+  <affected>
+    <package name="www-apps/phpBB" auto="yes" arch="*">
+      <unaffected range="ge">2.0.13</unaffected>
+      <vulnerable range="lt">2.0.13</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpBB is an Open Source bulletin board package.
+    </p>
+  </background>
+  <description>
+    <p>
+    It was discovered that phpBB contains a flaw in the session
+    handling code and a path disclosure bug. AnthraX101 discovered that
+    phpBB allows local users to read arbitrary files, if the "Enable remote
+    avatars" and "Enable avatar uploading" options are set (CAN-2005-0259).
+    He also found out that incorrect input validation in
+    "usercp_avatar.php" and "usercp_register.php" makes phpBB vulnerable to
+    directory traversal attacks, if the "Gallery avatars" setting is
+    enabled (CAN-2005-0258).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote attackers can exploit the session handling flaw to gain
+    phpBB administrator rights. By providing a local and a remote location
+    for an avatar and setting the "Upload Avatar from a URL:" field to
+    point to the target file, a malicious local user can read arbitrary
+    local files. By inserting "/../" sequences into the "avatarselect"
+    parameter, a remote attacker can exploit the directory traversal
+    vulnerability to delete arbitrary files. A flaw in the "viewtopic.php"
+    script can be exploited to expose the full path of PHP scripts.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpBB users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/phpBB-2.0.13&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0258">CAN-2005-0258</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0259">CAN-2005-0259</uri>
+    <uri link="http://www.phpbb.com/phpBB/viewtopic.php?f=14&amp;t=267563">phpBB announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 28 Feb 2005 14:35:23 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 28 Feb 2005 15:10:08 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue,  1 Mar 2005 18:22:22 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-03.xml b/xml/htdocs/security/en/glsa/glsa-200503-03.xml
new file mode 100644
index 00000000..3c110ced
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-03.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-03">
+  <title>Gaim: Multiple Denial of Service issues</title>
+  <synopsis>
+    Multiple vulnerabilities have been found in Gaim which could allow a remote
+    attacker to crash the application.
+  </synopsis>
+  <product type="ebuild">gaim</product>
+  <announced>March 01, 2005</announced>
+  <revised>March 01, 2005: 01</revised>
+  <bug>83253</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/gaim" auto="yes" arch="*">
+      <unaffected range="ge">1.1.4</unaffected>
+      <vulnerable range="lt">1.1.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gaim is a full featured instant messaging client which handles a
+    variety of instant messaging protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    Specially crafted SNAC packets sent by other instant-messaging
+    users can cause Gaim to loop endlessly (CAN-2005-0472). Malformed HTML
+    code could lead to invalid memory accesses (CAN-2005-0208 and
+    CAN-2005-0473).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote attackers could exploit these issues, resulting in a Denial
+    of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gaim users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/gaim-1.1.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0208">CAN-2005-0208</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0472">CAN-2005-0472</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0473">CAN-2005-0473</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 25 Feb 2005 09:54:05 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 25 Feb 2005 10:52:36 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue,  1 Mar 2005 08:51:34 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-04.xml b/xml/htdocs/security/en/glsa/glsa-200503-04.xml
new file mode 100644
index 00000000..8b70d276
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-04.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-04">
+  <title>phpWebSite: Arbitrary PHP execution and path disclosure</title>
+  <synopsis>
+    Remote attackers can upload and execute arbitrary PHP scripts, another flaw
+    reveals the full path of scripts.
+  </synopsis>
+  <product type="ebuild">phpwebsite</product>
+  <announced>March 01, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>83297</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phpwebsite" auto="yes" arch="*">
+      <unaffected range="ge">0.10.0-r2</unaffected>
+      <vulnerable range="lt">0.10.0-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpWebSite provides a complete web site content management system.
+    </p>
+  </background>
+  <description>
+    <p>
+    NST discovered that, when submitting an announcement, uploaded files
+    aren't correctly checked for malicious code. They also found out that
+    phpWebSite is vulnerable to a path disclosure.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker can exploit this issue to upload files to a directory
+    within the web root. By calling the uploaded script the attacker could
+    then execute arbitrary PHP code with the rights of the web server. By
+    passing specially crafted requests to the search module, remote
+    attackers can also find out the full path of PHP scripts.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpWebSite users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync 
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/phpwebsite-0.10.0-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://secunia.com/advisories/14399/">Secunia Advisory SA14399</uri>
+    <uri link="http://phpwebsite.appstate.edu/index.php?module=announce&amp;ANN_id=922&amp;ANN_user_op=view">phpWebSite announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0565">CVE-2005-0565</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0572">CVE-2005-0572</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 25 Feb 2005 21:23:09 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 27 Feb 2005 12:09:41 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-05.xml b/xml/htdocs/security/en/glsa/glsa-200503-05.xml
new file mode 100644
index 00000000..a7defff6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-05.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-05">
+  <title>xli, xloadimage: Multiple vulnerabilities</title>
+  <synopsis>
+    xli and xloadimage are vulnerable to multiple issues, potentially leading
+    to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">xli</product>
+  <announced>March 02, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>79762</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/xloadimage" auto="yes" arch="*">
+      <unaffected range="ge">4.1-r2</unaffected>
+      <vulnerable range="lt">4.1-r2</vulnerable>
+    </package>
+    <package name="media-gfx/xli" auto="yes" arch="*">
+      <unaffected range="ge">1.17.0-r1</unaffected>
+      <vulnerable range="lt">1.17.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xli and xloadimage are X11 utilities for displaying and manipulating a
+    wide range of image formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Audit Team has reported that
+    xli and xloadimage contain a flaw in the handling of compressed images,
+    where shell meta-characters are not adequately escaped. Rob Holland of
+    the Gentoo Linux Security Audit Team has reported that an xloadimage
+    vulnerability in the handling of Faces Project images discovered by
+    zen-parse in 2001 remained unpatched in xli. Additionally, it has been
+    reported that insufficient validation of image properties in xli could
+    potentially result in buffer management errors.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation would permit a remote attacker to execute
+    arbitrary shell commands, or arbitrary code with the privileges of the
+    xloadimage or xli user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xli users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/xli-1.17.0-r1&quot;</code>
+    <p>
+    All xloadimage users should also upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/xloadimage-4.1-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0775">CAN-2001-0775</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0638">CVE-2005-0638</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0639">CVE-2005-0639</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 28 Feb 2005 21:34:13 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 28 Feb 2005 22:05:32 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed,  2 Mar 2005 16:53:18 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-06.xml b/xml/htdocs/security/en/glsa/glsa-200503-06.xml
new file mode 100644
index 00000000..eec4b0ec
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-06.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-06">
+  <title>BidWatcher: Format string vulnerability</title>
+  <synopsis>
+    BidWatcher is vulnerable to a format string vulnerability, potentially
+    allowing arbitrary code execution.
+  </synopsis>
+  <product type="ebuild">bidwatcher</product>
+  <announced>March 03, 2005</announced>
+  <revised>March 03, 2005: 01</revised>
+  <bug>82460</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/bidwatcher" auto="yes" arch="*">
+      <unaffected range="ge">1.3.17</unaffected>
+      <vulnerable range="lt">1.3.17</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    BidWatcher is a free auction tool for eBay users to keep track of
+    their auctions.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ulf Harnhammar discovered a format string vulnerability in
+    "netstuff.cpp".
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote attackers can potentially exploit this vulnerability by
+    sending specially crafted responses via an eBay HTTP server or a
+    man-in-the-middle attack to execute arbitrary malicious code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All BidWatcher users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/bidwatcher-1.13.17&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0158">CAN-2005-0158</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue,  1 Mar 2005 08:44:34 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue,  1 Mar 2005 15:30:43 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed,  2 Mar 2005 20:11:39 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-07.xml b/xml/htdocs/security/en/glsa/glsa-200503-07.xml
new file mode 100644
index 00000000..6b4e54cf
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-07.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-07">
+  <title>phpMyAdmin: Multiple vulnerabilities</title>
+  <synopsis>
+    phpMyAdmin contains multiple vulnerabilities that could lead to command
+    execution, XSS issues and bypass of security restrictions.
+  </synopsis>
+  <product type="ebuild">phpMyAdmin</product>
+  <announced>March 03, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>83190</bug>
+  <bug>83792</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/phpmyadmin" auto="yes" arch="*">
+      <unaffected range="ge">2.6.1_p2-r1</unaffected>
+      <vulnerable range="lt">2.6.1_p2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpMyAdmin is a tool written in PHP intended to handle the
+    administration of MySQL databases from a web-browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    phpMyAdmin contains several security issues:
+    </p>
+    <ul>
+    <li>Maksymilian Arciemowicz has discovered multiple variable injection
+    vulnerabilities that can be exploited through "$cfg" and "GLOBALS"
+    variables and localized strings</li>
+    <li>It is possible to force phpMyAdmin to disclose information in error
+    messages</li>
+    <li>Failure to correctly escape special characters</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a specially-crafted request, an attacker can include and
+    execute arbitrary PHP code or cause path information disclosure.
+    Furthermore the XSS issue allows an attacker to inject malicious script
+    code, potentially compromising the victim's browser. Lastly the
+    improper escaping of special characters results in unintended privilege
+    settings for MySQL.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpMyAdmin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/phpmyadmin-2.6.1_p2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1">PMASA-2005-1</uri>
+    <uri link="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-2">PMASA-2005-2</uri>
+    <uri link="http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1113788&amp;group_id=23067&amp;atid=377408">phpMyAdmin bug 1113788</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0543">CVE-2005-0543</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0544">CVE-2005-0544</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0653">CVE-2005-0653</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed,  2 Mar 2005 21:38:30 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed,  2 Mar 2005 22:39:01 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu,  3 Mar 2005 15:44:32 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-08.xml b/xml/htdocs/security/en/glsa/glsa-200503-08.xml
new file mode 100644
index 00000000..d51300e8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-08.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-08">
+  <title>OpenMotif, LessTif: New libXpm buffer overflows</title>
+  <synopsis>
+    A new vulnerability has been discovered in libXpm, which is included in
+    OpenMotif and LessTif, that can potentially lead to remote code execution.
+  </synopsis>
+  <product type="ebuild">openmotif</product>
+  <announced>March 04, 2005</announced>
+  <revised>March 04, 2005: 01</revised>
+  <bug>83655</bug>
+  <bug>83656</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-libs/openmotif" auto="yes" arch="*">
+      <unaffected range="ge">2.2.3-r3</unaffected>
+      <unaffected range="rge">2.1.30-r9</unaffected>
+      <vulnerable range="lt">2.2.3-r3</vulnerable>
+    </package>
+    <package name="x11-libs/lesstif" auto="yes" arch="*">
+      <unaffected range="ge">0.94.0-r2</unaffected>
+      <vulnerable range="lt">0.94.0-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    LessTif is a clone of OSF/Motif, which is a standard user
+    interface toolkit available on Unix and Linux. OpenMotif also provides
+    a free version of the Motif toolkit for open source applications.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Gilbert discovered potentially exploitable buffer overflow
+    cases in libXpm that weren't fixed in previous libXpm security
+    advisories.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A carefully-crafted XPM file could crash applications making use
+    of the OpenMotif or LessTif toolkits, potentially allowing the
+    execution of arbitrary code with the privileges of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenMotif users should upgrade to an unaffected version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose x11-libs/openmotif</code>
+    <p>
+    All LessTif users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/lesstif-0.94.0-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0605">CAN-2005-0605</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed,  2 Mar 2005 21:43:36 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu,  3 Mar 2005 09:21:40 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu,  3 Mar 2005 21:47:17 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-09.xml b/xml/htdocs/security/en/glsa/glsa-200503-09.xml
new file mode 100644
index 00000000..8cf107bb
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-09.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-09">
+  <title>xv: Filename handling vulnerability</title>
+  <synopsis>
+    xv contains a format string vulnerability, potentially resulting in the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">xv</product>
+  <announced>March 04, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>83686</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/xv" auto="yes" arch="*">
+      <unaffected range="ge">3.10a-r10</unaffected>
+      <vulnerable range="lt">3.10a-r10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xv is an interactive image manipulation package for X11.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Audit Team identified a flaw
+    in the handling of image filenames by xv.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation would require a victim to process a specially
+    crafted image with a malformed filename, potentially resulting in the
+    execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xv users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/xv-3.10a-r10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0665">CVE-2005-0665</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed,  2 Mar 2005 21:42:57 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed,  2 Mar 2005 22:55:00 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu,  3 Mar 2005 21:51:14 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-10.xml b/xml/htdocs/security/en/glsa/glsa-200503-10.xml
new file mode 100644
index 00000000..09165f36
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-10.xml
@@ -0,0 +1,141 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-10">
+  <title>Mozilla Firefox: Various vulnerabilities</title>
+  <synopsis>
+    Mozilla Firefox is vulnerable to a local file deletion issue and to various
+    issues allowing to trick the user into trusting fake web sites or
+    interacting with privileged content.
+  </synopsis>
+  <product type="ebuild">Firefox</product>
+  <announced>March 04, 2005</announced>
+  <revised>March 04, 2005: 01</revised>
+  <bug>83267</bug>
+  <access>remote and local</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">1.0.1</unaffected>
+      <vulnerable range="lt">1.0.1</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.0.1</unaffected>
+      <vulnerable range="lt">1.0.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Firefox is the popular next-generation browser from the
+    Mozilla project.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were found and fixed in Mozilla
+    Firefox:
+    </p>
+    <ul>
+    <li>Michael Krax reported that plugins can be used
+    to load privileged content and trick the user to interact with it
+    (CAN-2005-0232, CAN-2005-0527)</li>
+    <li>Michael Krax also reported
+    potential spoofing or cross-site-scripting issues through overlapping
+    windows, image drag-and-drop, and by dropping javascript: links on tabs
+    (CAN-2005-0230, CAN-2005-0231, CAN-2005-0591)</li>
+    <li>Daniel de Wildt
+    and Gael Delalleau discovered a memory overwrite in a string library
+    (CAN-2005-0255)</li>
+    <li>Wind Li discovered a possible heap overflow in
+    UTF8 to Unicode conversion (CAN-2005-0592)</li>
+    <li>Eric Johanson
+    reported that Internationalized Domain Name (IDN) features allow
+    homograph attacks (CAN-2005-0233)</li>
+    <li>Mook, Doug Turner, Kohei
+    Yoshino and M. Deaudelin reported various ways of spoofing the SSL
+    "secure site" indicator (CAN-2005-0593)</li>
+    <li>Matt Brubeck reported
+    a possible Autocomplete data leak (CAN-2005-0589)</li>
+    <li>Georgi
+    Guninski discovered that XSLT can include stylesheets from arbitrary
+    hosts (CAN-2005-0588)</li>
+    <li>Secunia discovered a way of injecting
+    content into a popup opened by another website (CAN-2004-1156)</li>
+    <li>Phil Ringnalda reported a possible way to spoof Install source with
+    user:pass@host (CAN-2005-0590)</li>
+    <li>Jakob Balle from Secunia
+    discovered a possible way of spoofing the Download dialog source
+    (CAN-2005-0585)</li>
+    <li>Christian Schmidt reported a potential
+    spoofing issue in HTTP auth prompt tab (CAN-2005-0584)</li>
+    <li>Andreas
+    Sanblad from Secunia discovered a possible way of spoofing the Download
+    dialog using the Content-Disposition header (CAN-2005-0586)</li>
+    <li>Finally, Tavis Ormandy of the Gentoo Linux Security Audit Team
+    discovered that Firefox insecurely creates temporary filenames in
+    /tmp/plugtmp (CAN-2005-0578)</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <ul>
+    <li>By setting up malicious websites and convincing users to
+    follow untrusted links or obey very specific drag-and-drop or download
+    instructions, attackers may leverage the various spoofing issues to
+    fake other websites to get access to confidential information, push
+    users to download malicious files or make them interact with their
+    browser preferences.</li>
+    <li>The temporary directory issue allows
+    local attackers to overwrite arbitrary files with the rights of another
+    local user.</li>
+    <li>The overflow issues, while not thought to be
+    exploitable, may allow a malicious downloaded page to execute arbitrary
+    code with the rights of the user viewing the page.</li>
+    </ul>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-1.0.1&quot;</code>
+    <p>
+    All Firefox binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-1.0.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1156">CAN-2004-1156</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0230">CAN-2005-0230</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0231">CAN-2005-0231</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0232">CAN-2005-0232</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0233">CAN-2005-0233</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0255">CAN-2005-0255</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0527">CAN-2005-0527</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0578">CAN-2005-0578</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0584">CAN-2005-0584</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0585">CAN-2005-0585</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0586">CAN-2005-0586</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0588">CAN-2005-0588</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0589">CAN-2005-0589</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0590">CAN-2005-0590</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0591">CAN-2005-0591</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0592">CAN-2005-0592</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0593">CAN-2005-0593</uri>
+    <uri link="http://www.mozilla.org/projects/security/known-vulnerabilities.html">Mozilla Security Advisories</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri,  4 Mar 2005 10:53:24 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri,  4 Mar 2005 12:44:33 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-11.xml b/xml/htdocs/security/en/glsa/glsa-200503-11.xml
new file mode 100644
index 00000000..469e3865
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-11.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-11">
+  <title>ImageMagick: Filename handling vulnerability</title>
+  <synopsis>
+    A format string vulnerability exists in ImageMagick that may allow an
+    attacker to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">ImageMagick</product>
+  <announced>March 06, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>83542</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/imagemagick" auto="yes" arch="*">
+      <unaffected range="ge">6.2.0.4</unaffected>
+      <vulnerable range="lt">6.2.0.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ImageMagick is a collection of tools and libraries for manipulating a
+    wide variety of image formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Audit Team has identified a
+    flaw in the handling of filenames by the ImageMagick utilities.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation may disrupt web applications that depend on
+    ImageMagick for image processing, potentially executing arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ImageMagick users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/imagemagick-6.2.0.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0397">CVE-2005-0397</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed,  2 Mar 2005 21:44:33 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed,  2 Mar 2005 22:24:40 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun,  6 Mar 2005 13:03:12 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-12.xml b/xml/htdocs/security/en/glsa/glsa-200503-12.xml
new file mode 100644
index 00000000..339c99e0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-12.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-12">
+  <title>Hashcash: Format string vulnerability</title>
+  <synopsis>
+    A format string vulnerability in the Hashcash utility could allow an
+    attacker to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">Hashcash</product>
+  <announced>March 06, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>83541</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/hashcash" auto="yes" arch="*">
+      <unaffected range="ge">1.16-r1</unaffected>
+      <vulnerable range="lt">1.16-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Hashcash is a utility for generating Hashcash tokens, a proof-of-work
+    system to reduce the impact of spam.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Audit Team identified a flaw
+    in the Hashcash utility that an attacker could expose by specifying a
+    malformed reply address.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation would permit an attacker to disrupt Hashcash
+    users, and potentially execute arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Hashcash users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/hashcash-1.16-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0687">CVE-2005-0687</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed,  2 Mar 2005 21:44:06 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed,  2 Mar 2005 22:42:04 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun,  6 Mar 2005 10:00:09 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-13.xml b/xml/htdocs/security/en/glsa/glsa-200503-13.xml
new file mode 100644
index 00000000..574616c9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-13.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-13">
+  <title>mlterm: Integer overflow vulnerability</title>
+  <synopsis>
+    mlterm is vulnerable to an integer overflow, which could potentially allow
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mlterm</product>
+  <announced>March 07, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>84174</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-terms/mlterm" auto="yes" arch="*">
+      <unaffected range="ge">2.9.2</unaffected>
+      <vulnerable range="lt">2.9.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    mlterm is a multi-lingual terminal emulator.
+    </p>
+  </background>
+  <description>
+    <p>
+    mlterm is vulnerable to an integer overflow that can be triggered by
+    specifying a large image file as a background. This only effects users
+    that have compiled mlterm with the 'gtk' USE flag, which enables
+    gdk-pixbuf support.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker can create a specially-crafted image file which, when used
+    as a background by the victim, can lead to the execution of arbitrary
+    code with the privileges of the user running mlterm.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Re-compile mlterm without the 'gtk' USE flag.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mlterm users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-terms/mlterm-2.9.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="https://sourceforge.net/project/shownotes.php?release_id=310416">mlterm ChangeLog</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0686">CVE-2005-0686</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat,  5 Mar 2005 16:23:09 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun,  6 Mar 2005 10:05:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon,  7 Mar 2005 01:52:03 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-14.xml b/xml/htdocs/security/en/glsa/glsa-200503-14.xml
new file mode 100644
index 00000000..f7588ac1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-14.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-14">
+  <title>KDE dcopidlng: Insecure temporary file creation</title>
+  <synopsis>
+    The dcopidlng script is vulnerable to symlink attacks, potentially allowing
+    a local user to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">dcopidlng</product>
+  <announced>March 07, 2005</announced>
+  <revised>March 07, 2005: 01</revised>
+  <bug>81652</bug>
+  <access>local</access>
+  <affected>
+    <package name="kde-base/kdelibs" auto="yes" arch="*">
+      <unaffected range="ge">3.3.2-r5</unaffected>
+      <unaffected range="rge">3.2.3-r7</unaffected>
+      <vulnerable range="lt">3.3.2-r5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDE is a feature-rich graphical desktop environment for Linux and
+    Unix-like Operating Systems. DCOP is KDE's simple IPC/RPC mechanism.
+    dcopidlng is a DCOP helper script.
+    </p>
+  </background>
+  <description>
+    <p>
+    Davide Madrisan has discovered that the dcopidlng script creates
+    temporary files in a world-writable directory with predictable names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary
+    files directory, pointing to a valid file somewhere on the filesystem.
+    When dcopidlng is executed, this would result in the file being
+    overwritten with the rights of the user running the utility, which
+    could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All kdelibs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose kde-base/kdelibs</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0365">CAN-2005-0365</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu,  3 Mar 2005 21:01:57 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun,  6 Mar 2005 09:59:12 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-15.xml b/xml/htdocs/security/en/glsa/glsa-200503-15.xml
new file mode 100644
index 00000000..3cfa1c03
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-15.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-15">
+  <title>X.org: libXpm vulnerability</title>
+  <synopsis>
+    A new vulnerability has been discovered in libXpm, which is included in
+    X.org, that can potentially lead to remote code execution.
+  </synopsis>
+  <product type="ebuild">X.org</product>
+  <announced>March 12, 2005</announced>
+  <revised>March 12, 2005: 02</revised>
+  <bug>83598</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-base/xorg-x11" auto="yes" arch="*">
+      <unaffected range="rge">6.8.0-r5</unaffected>
+      <unaffected range="ge">6.8.2-r1</unaffected>
+      <vulnerable range="lt">6.8.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libXpm is a pixmap manipulation library for the X Window System,
+    included in X.org.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Gilbert has discovered potentially exploitable buffer overflow
+    cases in libXpm that weren't fixed in previous libXpm versions.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A carefully-crafted XPM file could crash X.org, potentially allowing
+    the execution of arbitrary code with the privileges of the user running
+    the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All X.org users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose x11-base/xorg-x11</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0605">CAN-2005-0605</uri>
+    <uri link="https://bugs.freedesktop.org/show_bug.cgi?id=1920">Freedesktop bug</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun,  6 Mar 2005 13:19:18 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon,  7 Mar 2005 11:11:00 +0000">
+    SeJo
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 11 Mar 2005 13:22:24 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-16.xml b/xml/htdocs/security/en/glsa/glsa-200503-16.xml
new file mode 100644
index 00000000..997e18ad
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-16.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-16">
+  <title>Ethereal: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities exist in Ethereal, which may allow an attacker to
+    run arbitrary code or crash the program.
+  </synopsis>
+  <product type="ebuild">ethereal</product>
+  <announced>March 12, 2005</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>84547</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/ethereal" auto="yes" arch="*">
+      <unaffected range="ge">0.10.10</unaffected>
+      <vulnerable range="lt">0.10.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ethereal is a feature rich network protocol analyzer.
+    </p>
+  </background>
+  <description>
+    <p>
+    There are multiple vulnerabilities in versions of Ethereal earlier than
+    0.10.10, including:
+    </p>
+    <ul>
+    <li>The Etheric, 3GPP2 A11 and IAPP dissectors are vulnerable to buffer
+    overflows (CAN-2005-0704, CAN-2005-0699 and CAN-2005-0739).</li>
+    <li>The GPRS-LLC could crash when the "ignore cipher bit" option is
+    enabled (CAN-2005-0705).</li>
+    <li>Various vulnerabilities in JXTA and sFlow dissectors.</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker might be able to use these vulnerabilities to crash
+    Ethereal and execute arbitrary code with the permissions of the user
+    running Ethereal, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    For a temporary workaround you can disable all affected protocol
+    dissectors. However, it is strongly recommended that you upgrade to the
+    latest stable version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ethereal users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/ethereal-0.10.10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0699">CAN-2005-0699</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0704">CAN-2005-0704</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0705">CAN-2005-0705</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0739">CAN-2005-0739</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0765">CVE-2005-0765</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0766">CVE-2005-0766</uri>
+    <uri link="http://www.ethereal.com/appnotes/enpa-sa-00018.html">Ethereal enpa-sa-00018</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed,  9 Mar 2005 13:39:26 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 12 Mar 2005 15:50:23 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-17.xml b/xml/htdocs/security/en/glsa/glsa-200503-17.xml
new file mode 100644
index 00000000..1ca48ac6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-17.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-17">
+  <title>libexif: Buffer overflow vulnerability</title>
+  <synopsis>
+    libexif fails to validate certain inputs, making it vulnerable to buffer
+    overflows.
+  </synopsis>
+  <product type="ebuild">libexif</product>
+  <announced>March 12, 2005</announced>
+  <revised>March 12, 2005: 01</revised>
+  <bug>84076</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libexif" auto="yes" arch="*">
+      <unaffected range="ge">0.5.12-r1</unaffected>
+      <vulnerable range="lt">0.5.12-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libexif is a library for parsing, editing and saving EXIF data.
+    </p>
+  </background>
+  <description>
+    <p>
+    libexif contains a buffer overflow vulnerability in the EXIF tag
+    validation code. When opening an image with a specially crafted EXIF
+    tag, the lack of validation can cause applications linked to libexif to
+    crash.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A specially crafted EXIF file could crash applications making use
+    of libexif, potentially allowing the execution of arbitrary code with
+    the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libexif users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libexif-0.5.12-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0664">CAN-2005-0664</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 12 Mar 2005 16:28:06 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 12 Mar 2005 17:56:45 +0000">
+    lewk
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 12 Mar 2005 18:48:27 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-18.xml b/xml/htdocs/security/en/glsa/glsa-200503-18.xml
new file mode 100644
index 00000000..d35ceadf
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-18.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-18">
+  <title>Ringtone Tools: Buffer overflow vulnerability</title>
+  <synopsis>
+    The Ringtone Tools utilities contain a buffer overflow vulnerability,
+    potentially leading to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">ringtonetools</product>
+  <announced>March 15, 2005</announced>
+  <revised>March 15, 2005: 01</revised>
+  <bug>74700</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-mobilephone/ringtonetools" auto="yes" arch="*">
+      <unaffected range="ge">2.23</unaffected>
+      <vulnerable range="lt">2.23</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ringtone Tools is a program for creating ringtones and logos for
+    mobile phones.
+    </p>
+  </background>
+  <description>
+    <p>
+    Qiao Zhang has discovered a buffer overflow vulnerability in the
+    'parse_emelody' function in 'parse_emelody.c'.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a Ringtone Tools user to open a
+    specially crafted eMelody file, which would potentially lead to the
+    execution of arbitrary code with the rights of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ringtone Tools users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-mobilephone/ringtonetools-2.23&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1292">CAN-2004-1292</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 15 Mar 2005 02:28:50 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 15 Mar 2005 09:56:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 15 Mar 2005 14:11:25 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-19.xml b/xml/htdocs/security/en/glsa/glsa-200503-19.xml
new file mode 100644
index 00000000..e21f5bcd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-19.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-19">
+  <title>MySQL: Multiple vulnerabilities</title>
+  <synopsis>
+    MySQL contains several vulnerabilities potentially leading to the
+    overwriting of local files or to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mysql</product>
+  <announced>March 16, 2005</announced>
+  <revised>March 16, 2005: 02</revised>
+  <bug>84819</bug>
+  <access>remote and local</access>
+  <affected>
+    <package name="dev-db/mysql" auto="yes" arch="*">
+      <unaffected range="ge">4.0.24</unaffected>
+      <vulnerable range="lt">4.0.24</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MySQL is a fast, multi-threaded, multi-user SQL database server.
+    </p>
+  </background>
+  <description>
+    <p>
+    MySQL fails to properly validate input for authenticated users with
+    INSERT and DELETE privileges (CAN-2005-0709 and CAN-2005-0710).
+    Furthermore MySQL uses predictable filenames when creating temporary
+    files with CREATE TEMPORARY TABLE (CAN-2005-0711).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker with INSERT and DELETE privileges could exploit this to
+    manipulate the mysql table or accessing libc calls, potentially leading
+    to the execution of arbitrary code with the permissions of the user
+    running MySQL. An attacker with CREATE TEMPORARY TABLE privileges could
+    exploit this to overwrite arbitrary files via a symlink attack.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MySQL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/mysql-4.0.24&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0709">CAN-2005-0709</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0710">CAN-2005-0710</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0711">CAN-2005-0711</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 14 Mar 2005 05:33:03 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 15 Mar 2005 06:04:30 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 15 Mar 2005 15:41:11 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-20.xml b/xml/htdocs/security/en/glsa/glsa-200503-20.xml
new file mode 100644
index 00000000..cb837b14
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-20.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-20">
+  <title>curl: NTLM response buffer overflow</title>
+  <synopsis>
+    curl is vulnerable to a buffer overflow which could lead to the execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">curl</product>
+  <announced>March 16, 2005</announced>
+  <revised>March 16, 2005: 01</revised>
+  <bug>82534</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/curl" auto="yes" arch="*">
+      <unaffected range="ge">7.13.1</unaffected>
+      <vulnerable range="lt">7.13.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    curl is a command line tool for transferring files via many
+    different protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    curl fails to properly check boundaries when handling NTLM
+    authentication.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    With a malicious server an attacker could send a carefully crafted
+    NTLM response to a connecting client leading to the execution of
+    arbitrary code with the permissions of the user running curl.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable NTLM authentication by not using the --anyauth or --ntlm
+    options.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All curl users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/curl-7.13.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0490">CAN-2005-0490</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 12 Mar 2005 16:36:42 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 12 Mar 2005 17:56:09 +0000">
+    lewk
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 14 Mar 2005 05:48:14 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-21.xml b/xml/htdocs/security/en/glsa/glsa-200503-21.xml
new file mode 100644
index 00000000..85940d48
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-21.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-21">
+  <title>Grip: CDDB response overflow</title>
+  <synopsis>
+    Grip contains a buffer overflow that can be triggered by a large CDDB
+    response, potentially allowing the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">grip</product>
+  <announced>March 17, 2005</announced>
+  <revised>March 17, 2005: 01</revised>
+  <bug>84704</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/grip" auto="yes" arch="*">
+      <unaffected range="ge">3.3.0</unaffected>
+      <vulnerable range="lt">3.3.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Grip is a GTK+ based audio CD player/ripper.
+    </p>
+  </background>
+  <description>
+    <p>
+    Joseph VanAndel has discovered a buffer overflow in Grip when
+    processing large CDDB results.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious CDDB server could cause Grip to crash by returning
+    more then 16 matches, potentially allowing the execution of arbitrary
+    code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable automatic CDDB queries, but we highly encourage users to
+    upgrade to 3.3.0.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Grip users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/grip-3.3.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0706">CAN-2005-0706</uri>
+    <uri link="http://sourceforge.net/tracker/?group_id=3714&amp;atid=103714&amp;func=detail&amp;aid=834724">Original Bug Report</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 14 Mar 2005 20:06:50 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 15 Mar 2005 23:47:13 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 17 Mar 2005 10:03:26 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-22.xml b/xml/htdocs/security/en/glsa/glsa-200503-22.xml
new file mode 100644
index 00000000..dd0a6d59
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-22.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-22">
+  <title>KDE: Local Denial of Service</title>
+  <synopsis>
+    KDE is vulnerable to a local Denial of Service attack.
+  </synopsis>
+  <product type="ebuild">kde, dcopserver</product>
+  <announced>March 19, 2005</announced>
+  <revised>March 19, 2005: 01</revised>
+  <bug>83814</bug>
+  <access>local</access>
+  <affected>
+    <package name="kde-base/kdelibs" auto="yes" arch="*">
+      <unaffected range="ge">3.3.2-r7</unaffected>
+      <unaffected range="rge">3.2.3-r8</unaffected>
+      <vulnerable range="lt">3.3.2-r7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDE is a feature-rich graphical desktop environment for Linux and
+    Unix-like Operating Systems. DCOP is KDE's simple IPC/RPC mechanism.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sebastian Krahmer discovered that it is possible to stall the
+    dcopserver of other users.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit this to cause a local Denial of Service
+    by stalling the dcopserver in the authentication process. As a result
+    all desktop functionality relying on DCOP will cease to function.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All kdelibs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose kde-base/kdelibs</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0396">CAN-2005-0396</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 14 Mar 2005 06:00:10 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 19 Mar 2005 07:23:43 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-23.xml b/xml/htdocs/security/en/glsa/glsa-200503-23.xml
new file mode 100644
index 00000000..2fdcf3e1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-23.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-23">
+  <title>rxvt-unicode: Buffer overflow</title>
+  <synopsis>
+    rxvt-unicode is vulnerable to a buffer overflow that could lead to the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">rxvt-unicode</product>
+  <announced>March 20, 2005</announced>
+  <revised>March 20, 2005: 01</revised>
+  <bug>84680</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-terms/rxvt-unicode" auto="yes" arch="*">
+      <unaffected range="ge">5.3</unaffected>
+      <unaffected range="lt">4.8</unaffected>
+      <vulnerable range="lt">5.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    rxvt-unicode is a clone of the well known terminal emulator rxvt.
+    </p>
+  </background>
+  <description>
+    <p>
+    Rob Holland of the Gentoo Linux Security Audit Team discovered
+    that rxvt-unicode fails to properly check input length.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation would allow an attacker to execute
+    arbitrary code with the permissions of the user running rxvt-unicode.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All rxvt-unicode users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-terms/rxvt-unicode-5.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0764">CAN-2005-0764</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 15 Mar 2005 14:52:07 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 15 Mar 2005 23:51:13 +0000">
+    lewk
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 20 Mar 2005 16:52:52 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-24.xml b/xml/htdocs/security/en/glsa/glsa-200503-24.xml
new file mode 100644
index 00000000..9d7b495b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-24.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-24">
+  <title>LTris: Buffer overflow</title>
+  <synopsis>
+    LTris is vulnerable to a buffer overflow which could lead to the execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">LTris</product>
+  <announced>March 20, 2005</announced>
+  <revised>March 20, 2005: 01</revised>
+  <bug>85770</bug>
+  <access>local</access>
+  <affected>
+    <package name="games-puzzle/ltris" auto="yes" arch="*">
+      <unaffected range="ge">1.0.10</unaffected>
+      <vulnerable range="lt">1.0.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    LTris is a Tetris clone.
+    </p>
+  </background>
+  <description>
+    <p>
+    LTris is vulnerable to a buffer overflow when reading the global
+    highscores file.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By modifying the global highscores file a malicious user could
+    trick another user to execute arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All LTris users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-puzzle/ltris-1.0.10&quot;</code>
+  </resolution>
+  <references/>
+  <metadata tag="requester" timestamp="Fri, 18 Mar 2005 18:14:03 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 20 Mar 2005 14:43:57 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 20 Mar 2005 17:00:38 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-25.xml b/xml/htdocs/security/en/glsa/glsa-200503-25.xml
new file mode 100644
index 00000000..5e2d7ff1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-25.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-25">
+  <title>OpenSLP: Multiple buffer overflows</title>
+  <synopsis>
+    Multiple buffer overflows have been found in OpenSLP, which could lead to
+    the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">OpenSLP</product>
+  <announced>March 20, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>85347</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-libs/openslp" auto="yes" arch="*">
+      <unaffected range="ge">1.2.1</unaffected>
+      <vulnerable range="lt">1.2.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSLP is an open-source implementation of Service Location Protocol
+    (SLP).
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple buffer overflows have been found in OpenSLP, when handling
+    malformed SLP packets.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By sending specially crafted SLP packets, a remote attacker could
+    potentially execute arbitrary code with the rights of the OpenSLP
+    daemon.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenSLP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/openslp-1.2.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.novell.com/linux/security/advisories/2005_15_openslp.html">SUSE Security Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0769">CVE-2005-0769</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 16 Mar 2005 22:37:07 +0000">
+    lewk
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 17 Mar 2005 14:53:57 +0000">
+    formula7
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 20 Mar 2005 20:02:39 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-26.xml b/xml/htdocs/security/en/glsa/glsa-200503-26.xml
new file mode 100644
index 00000000..bb90e1a4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-26.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-26">
+  <title>Sylpheed, Sylpheed-claws: Message reply overflow</title>
+  <synopsis>
+    Sylpheed and Sylpheed-claws contain a vulnerability that can be triggered
+    when replying to specially crafted messages.
+  </synopsis>
+  <product type="ebuild">sylpheed sylpheed-claws</product>
+  <announced>March 20, 2005</announced>
+  <revised>March 20, 2005: 01</revised>
+  <bug>84056</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/sylpheed" auto="yes" arch="*">
+      <unaffected range="ge">1.0.3</unaffected>
+      <vulnerable range="lt">1.0.3</vulnerable>
+    </package>
+    <package name="mail-client/sylpheed-claws" auto="yes" arch="*">
+      <unaffected range="ge">1.0.3</unaffected>
+      <vulnerable range="lt">1.0.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Sylpheed is a lightweight email client and newsreader.
+    Sylpheed-claws is a 'bleeding edge' version of Sylpheed.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sylpheed and Sylpheed-claws fail to properly handle non-ASCII
+    characters in email headers when composing reply messages.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker can send an email containing a malicious non-ASCII
+    header which, when replied to, would cause the program to crash,
+    potentially allowing the execution of arbitrary code with the
+    privileges of the user running the software.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Sylpheed users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/sylpheed-1.0.3&quot;</code>
+    <p>
+    All Sylpheed-claws users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/sylpheed-claws-1.0.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://sylpheed.good-day.net/#changes">Sylpheed ChangeLog</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0667">CAN-2005-0667</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 14 Mar 2005 20:05:52 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 15 Mar 2005 14:35:33 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 20 Mar 2005 22:41:22 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-27.xml b/xml/htdocs/security/en/glsa/glsa-200503-27.xml
new file mode 100644
index 00000000..27657f95
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-27.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-27">
+  <title>Xzabite dyndnsupdate: Multiple vulnerabilities</title>
+  <synopsis>
+    Xzabite's dyndnsupdate software suffers from multiple vulnerabilities,
+    potentially resulting in the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">dyndnsupdate</product>
+  <announced>March 21, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>84659</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/dyndnsupdate" auto="yes" arch="*">
+      <vulnerable range="le">0.6.15</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    dyndnsupdate is a dyndns.org data updater written by Fredrik "xzabite"
+    Haglund.
+    </p>
+  </background>
+  <description>
+    <p>
+    Toby Dickenson discovered that dyndnsupdate suffers from multiple
+    overflows.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker, posing as a dyndns.org server, could execute
+    arbitrary code with the rights of the user running dyndnsupdate.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Currently, there is no released version of dyndnsupdate that contains a
+    fix for these issues. The original xzabite.org distribution site is
+    dead, the code contains several other problems and more secure
+    alternatives exist, such as the net-dns/ddclient package. Therefore,
+    the dyndnsupdate package has been hard-masked prior to complete removal
+    from Portage, and current users are advised to unmerge the package:
+    </p>
+    <code>
+    # emerge --unmerge net-misc/dyndnsupdate</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0830">CVE-2005-0830</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 21 Mar 2005 09:32:52 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 21 Mar 2005 14:30:08 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-28.xml b/xml/htdocs/security/en/glsa/glsa-200503-28.xml
new file mode 100644
index 00000000..3d6a8d81
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-28.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-28">
+  <title>Sun Java: Web Start argument injection vulnerability</title>
+  <synopsis>
+    Java Web Start JNLP files can be abused to evade sandbox restriction and
+    execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">Java</product>
+  <announced>March 24, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>85804</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/sun-jdk" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2.07</unaffected>
+      <unaffected range="lt">1.4.2</unaffected>
+      <vulnerable range="lt">1.4.2.07</vulnerable>
+    </package>
+    <package name="dev-java/sun-jre-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2.07</unaffected>
+      <unaffected range="lt">1.4.2</unaffected>
+      <vulnerable range="lt">1.4.2.07</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Sun provides implementations of Java Development Kits (JDK) and Java
+    Runtime Environments (JRE). These implementations provide the Java Web
+    Start technology that can be used for easy client-side deployment of
+    Java applications.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jouko Pynnonen discovered that Java Web Start contains a vulnerability
+    in the way it handles property tags in JNLP files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to open a malicious JNLP file, a remote attacker
+    could pass command line arguments to the Java Virtual machine, which
+    can be used to bypass the Java "sandbox" and to execute arbitrary code
+    with the permissions of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Sun JDK users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jdk-1.4.2.07&quot;</code>
+    <p>
+    All Sun JRE users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jre-bin-1.4.2.07&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://jouko.iki.fi/adv/ws.html">Jouko Pynnonen advisory</uri>
+    <uri link="http://sunsolve.sun.com/search/document.do?assetkey=1-26-57740-1">Sun Microsystems Alert Notification</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0836">CVE-2005-0836</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 20 Mar 2005 21:40:30 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 20 Mar 2005 21:41:41 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 23 Mar 2005 15:33:09 +0000">
+    formula7
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-29.xml b/xml/htdocs/security/en/glsa/glsa-200503-29.xml
new file mode 100644
index 00000000..e912b503
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-29.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-29">
+  <title>GnuPG: OpenPGP protocol attack</title>
+  <synopsis>
+    Automated systems using GnuPG may leak plaintext portions of an encrypted
+    message.
+  </synopsis>
+  <product type="ebuild">GnuPG</product>
+  <announced>March 24, 2005</announced>
+  <revised>March 24, 2005: 01</revised>
+  <bug>85547</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/gnupg" auto="yes" arch="*">
+      <unaffected range="ge">1.4.1</unaffected>
+      <vulnerable range="lt">1.4.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GnuPG is complete and free replacement for PGP, a tool for secure
+    communication and data storage.
+    </p>
+  </background>
+  <description>
+    <p>
+    A flaw has been identified in an integrity checking mechanism of
+    the OpenPGP protocol.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    An automated system using GnuPG that allows an attacker to
+    repeatedly discover the outcome of an integrity check (perhaps by
+    observing the time required to return a response, or via overly verbose
+    error messages) could theoretically reveal a small portion of
+    plaintext.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GnuPG users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-crypt/gnupg-1.4.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.kb.cert.org/vuls/id/303094">CERT VU#303094</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0366">CAN-2005-0366</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 23 Mar 2005 17:12:46 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 24 Mar 2005 12:34:11 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 24 Mar 2005 21:44:14 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-30.xml b/xml/htdocs/security/en/glsa/glsa-200503-30.xml
new file mode 100644
index 00000000..432af8db
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-30.xml
@@ -0,0 +1,140 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-30">
+  <title>Mozilla Suite: Multiple vulnerabilities</title>
+  <synopsis>
+    The Mozilla Suite is vulnerable to multiple issues ranging from the remote
+    execution of arbitrary code to various issues allowing to trick the user
+    into trusting fake web sites or interacting with privileged content.
+  </synopsis>
+  <product type="ebuild">Mozilla</product>
+  <announced>March 25, 2005</announced>
+  <revised>March 25, 2005: 01</revised>
+  <bug>84074</bug>
+  <access>remote and local</access>
+  <affected>
+    <package name="www-client/mozilla" auto="yes" arch="*">
+      <unaffected range="ge">1.7.6</unaffected>
+      <vulnerable range="lt">1.7.6</vulnerable>
+    </package>
+    <package name="www-client/mozilla-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.7.6</unaffected>
+      <vulnerable range="lt">1.7.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Mozilla Suite is a popular all-in-one web browser that
+    includes a mail and news reader.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were found and fixed in the Mozilla
+    Suite:
+    </p>
+    <ul>
+    <li>Mark Dowd from ISS X-Force reported an exploitable
+    heap overrun in the GIF processing of obsolete Netscape extension 2
+    (CAN-2005-0399)</li>
+    <li>Michael Krax reported that plugins can be used
+    to load privileged content and trick the user to interact with it
+    (CAN-2005-0232, CAN-2005-0527)</li>
+    <li>Michael Krax also reported
+    potential spoofing or cross-site-scripting issues through overlapping
+    windows, image or scrollbar drag-and-drop, and by dropping javascript:
+    links on tabs (CAN-2005-0230, CAN-2005-0231, CAN-2005-0401,
+    CAN-2005-0591)</li>
+    <li>Daniel de Wildt and Gael Delalleau discovered a
+    memory overwrite in a string library (CAN-2005-0255)</li>
+    <li>Wind Li
+    discovered a possible heap overflow in UTF8 to Unicode conversion
+    (CAN-2005-0592)</li>
+    <li>Eric Johanson reported that Internationalized
+    Domain Name (IDN) features allow homograph attacks (CAN-2005-0233)</li>
+    <li>Mook, Doug Turner, Kohei Yoshino and M. Deaudelin reported various
+    ways of spoofing the SSL "secure site" indicator (CAN-2005-0593)</li>
+    <li>Georgi Guninski discovered that XSLT can include stylesheets from
+    arbitrary hosts (CAN-2005-0588)</li>
+    <li>Secunia discovered a way of
+    injecting content into a popup opened by another website
+    (CAN-2004-1156)</li>
+    <li>Phil Ringnalda reported a possible way to
+    spoof Install source with user:pass@host (CAN-2005-0590)</li>
+    <li>Jakob
+    Balle from Secunia discovered a possible way of spoofing the Download
+    dialog source (CAN-2005-0585)</li>
+    <li>Christian Schmidt reported a
+    potential spoofing issue in HTTP auth prompt tab (CAN-2005-0584)</li>
+    <li>Finally, Tavis Ormandy of the Gentoo Linux Security Audit Team
+    discovered that Mozilla insecurely creates temporary filenames in
+    /tmp/plugtmp (CAN-2005-0578)</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <ul>
+    <li>The GIF heap overflow could be triggered by a malicious GIF
+    image that would end up executing arbitrary code with the rights of the
+    user running Mozilla. The other overflow issues, while not thought to
+    be exploitable, would have the same impact</li>
+    <li>By setting up
+    malicious websites and convincing users to follow untrusted links or
+    obey very specific drag-and-drop or download instructions, attackers
+    may leverage the various spoofing issues to fake other websites to get
+    access to confidential information, push users to download malicious
+    files or make them interact with their browser preferences</li>
+    <li>The
+    temporary directory issue allows local attackers to overwrite arbitrary
+    files with the rights of another local user</li>
+    </ul>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Suite users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-1.7.6&quot;</code>
+    <p>
+    All Mozilla Suite binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-bin-1.7.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1156">CAN-2004-1156</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0230">CAN-2005-0230</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0231">CAN-2005-0231</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0232">CAN-2005-0232</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0233">CAN-2005-0233</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0255">CAN-2005-0255</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0399">CAN-2005-0399</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0401">CAN-2005-0401</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0527">CAN-2005-0527</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0578">CAN-2005-0578</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0584">CAN-2005-0584</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0585">CAN-2005-0585</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0588">CAN-2005-0588</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0590">CAN-2005-0590</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0591">CAN-2005-0591</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0592">CAN-2005-0592</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0593">CAN-2005-0593</uri>
+    <uri link="http://www.mozilla.org/projects/security/known-vulnerabilities.html">Mozilla Security Advisories</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 22 Mar 2005 09:19:22 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 25 Mar 2005 12:49:52 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-31.xml b/xml/htdocs/security/en/glsa/glsa-200503-31.xml
new file mode 100644
index 00000000..507fafb8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-31.xml
@@ -0,0 +1,99 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-31">
+  <title>Mozilla Firefox: Multiple vulnerabilities</title>
+  <synopsis>
+    Mozilla Firefox 1.0.2 fixes new security vulnerabilities, including the
+    remote execution of arbitrary code through malicious GIF images or
+    sidebars.
+  </synopsis>
+  <product type="ebuild">Firefox</product>
+  <announced>March 25, 2005</announced>
+  <revised>March 25, 2005: 01</revised>
+  <bug>86148</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">1.0.2</unaffected>
+      <vulnerable range="lt">1.0.2</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.0.2</unaffected>
+      <vulnerable range="lt">1.0.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Firefox is the popular next-generation browser from the
+    Mozilla project.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were found and fixed in Mozilla
+    Firefox:
+    </p>
+    <ul>
+    <li>Mark Dowd from ISS X-Force reported an
+    exploitable heap overrun in the GIF processing of obsolete Netscape
+    extension 2 (CAN-2005-0399)</li>
+    <li>Kohei Yoshino discovered that a
+    page bookmarked as a sidebar could bypass privileges control
+    (CAN-2005-0402)</li>
+    <li>Michael Krax reported a new way to bypass XUL
+    security restrictions through drag-and-drop of items like scrollbars
+    (CAN-2005-0401)</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <ul>
+    <li>The GIF heap overflow could be triggered by a malicious GIF
+    image that would end up executing arbitrary code with the rights of the
+    user running Firefox</li>
+    <li>By tricking the user into bookmarking a
+    malicious page as a Sidebar, a remote attacker could potentially
+    execute arbitrary code with the rights of the user running the
+    browser</li>
+    <li>By setting up a malicious website and convincing users
+    to obey very specific drag-and-drop instructions, attackers may
+    leverage drag-and-drop features to bypass XUL security restrictions,
+    which could be used as a stepping stone to exploit other
+    vulnerabilities</li>
+    </ul>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-1.0.2&quot;</code>
+    <p>
+    All Mozilla Firefox binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-1.0.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0399">CAN-2005-0399</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0401">CAN-2005-0401</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0402">CAN-2005-0402</uri>
+    <uri link="http://www.mozilla.org/projects/security/known-vulnerabilities.html">Mozilla Security Advisories</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 22 Mar 2005 09:29:52 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 25 Mar 2005 12:27:17 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-32.xml b/xml/htdocs/security/en/glsa/glsa-200503-32.xml
new file mode 100644
index 00000000..b7db2ae7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-32.xml
@@ -0,0 +1,95 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-32">
+  <title>Mozilla Thunderbird: Multiple vulnerabilities</title>
+  <synopsis>
+    Mozilla Thunderbird is vulnerable to multiple issues, including the remote
+    execution of arbitrary code through malicious GIF images.
+  </synopsis>
+  <product type="ebuild">Thunderbird</product>
+  <announced>March 25, 2005</announced>
+  <revised>March 25, 2005: 01</revised>
+  <bug>84075</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/mozilla-thunderbird" auto="yes" arch="*">
+      <unaffected range="ge">1.0.2</unaffected>
+      <vulnerable range="lt">1.0.2</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.0.2</unaffected>
+      <vulnerable range="lt">1.0.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Thunderbird is the next-generation mail client from the
+    Mozilla project.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were found and fixed in Mozilla
+    Thunderbird:
+    </p>
+    <ul>
+    <li>Mark Dowd from ISS X-Force reported an
+    exploitable heap overrun in the GIF processing of obsolete Netscape
+    extension 2 (CAN-2005-0399)</li>
+    <li>Daniel de Wildt and Gael Delalleau
+    discovered a memory overwrite in a string library (CAN-2005-0255)</li>
+    <li>Wind Li discovered a possible heap overflow in UTF8 to Unicode
+    conversion (CAN-2005-0592)</li>
+    <li>Phil Ringnalda reported a possible
+    way to spoof Install source with user:pass@host (CAN-2005-0590)</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    The GIF heap overflow could be triggered by a malicious GIF image
+    that would end up executing arbitrary code with the rights of the user
+    running Thunderbird. The other overflow issues, while not thought to be
+    exploitable, would have the same impact. Furthermore, by setting up
+    malicious websites and convincing users to follow untrusted links,
+    attackers may leverage the spoofing issue to trick user into installing
+    malicious extensions.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Thunderbird users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-1.0.2&quot;</code>
+    <p>
+    All Mozilla Thunderbird binary users should upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-bin-1.0.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0255">CAN-2005-0255</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0399">CAN-2005-0399</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0590">CAN-2005-0590</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0592">CAN-2005-0592</uri>
+    <uri link="http://www.mozilla.org/projects/security/known-vulnerabilities.html">Mozilla Security Advisories</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 22 Mar 2005 10:54:32 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 25 Mar 2005 08:41:58 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-33.xml b/xml/htdocs/security/en/glsa/glsa-200503-33.xml
new file mode 100644
index 00000000..ab867d39
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-33.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-33">
+  <title>IPsec-Tools: racoon Denial of Service</title>
+  <synopsis>
+    IPsec-Tools' racoon is affected by a remote Denial of Service vulnerability.
+  </synopsis>
+  <product type="ebuild">IPsec-Tools</product>
+  <announced>March 25, 2005</announced>
+  <revised>March 25, 2005: 01</revised>
+  <bug>84479</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-firewall/ipsec-tools" auto="yes" arch="*">
+      <unaffected range="rge">0.4-r1</unaffected>
+      <unaffected range="ge">0.5-r1</unaffected>
+      <vulnerable range="lt">0.5-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    IPsec-Tools is a port of KAME's implementation of the IPsec
+    utilities. It contains a collection of network monitoring tools,
+    including racoon, ping, and ping6.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sebastian Krahmer has reported a potential remote Denial of
+    Service vulnerability in the ISAKMP header parsing code of racoon.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could possibly cause a Denial of Service of racoon
+    using a specially crafted ISAKMP packet.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All IPsec-Tools users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-firewall/ipsec-tools-0.4-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0398">CAN-2005-0398</uri>
+    <uri link="http://sourceforge.net/mailarchive/forum.php?thread_id=6787713&amp;forum_id=32000">ipsec-tools-devel posting</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 23 Mar 2005 16:03:41 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 24 Mar 2005 09:50:17 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 24 Mar 2005 21:24:17 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-34.xml b/xml/htdocs/security/en/glsa/glsa-200503-34.xml
new file mode 100644
index 00000000..e5a80789
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-34.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-34">
+  <title>mpg321: Format string vulnerability</title>
+  <synopsis>
+    A flaw in the processing of ID3 tags in mpg321 could potentially lead to
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mpg321</product>
+  <announced>March 28, 2005</announced>
+  <revised>March 28, 2005: 01</revised>
+  <bug>86033</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/mpg321" auto="yes" arch="*">
+      <unaffected range="ge">0.2.10-r2</unaffected>
+      <vulnerable range="lt">0.2.10-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    mpg321 is a GPL replacement for mpg123, a command line audio
+    player with support for ID3. ID3 is a tagging system that allows
+    metadata to be embedded within media files.
+    </p>
+  </background>
+  <description>
+    <p>
+    A routine security audit of the mpg321 package revealed a known
+    security issue remained unpatched. The vulnerability is a result of
+    mpg321 printing embedded ID3 data to the console in an unsafe manner.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation would require a victim to play a specially
+    crafted audio file using mpg321, potentially resulting in the execution
+    of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mpg321 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/mpg321-0.2.10-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0969">CVE-2003-0969</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 23 Mar 2005 14:50:18 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 24 Mar 2005 12:50:11 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 27 Mar 2005 10:18:10 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-35.xml b/xml/htdocs/security/en/glsa/glsa-200503-35.xml
new file mode 100644
index 00000000..7979683f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-35.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-35">
+  <title>Smarty: Template vulnerability</title>
+  <synopsis>
+    Smarty's "Template security" feature can be bypassed, potentially allowing
+    a remote attacker to execute arbitrary PHP code.
+  </synopsis>
+  <product type="ebuild">smarty</product>
+  <announced>March 30, 2005</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>86488</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-php/smarty" auto="yes" arch="*">
+      <unaffected range="ge">2.6.9</unaffected>
+      <vulnerable range="lt">2.6.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Smarty is a template engine for PHP. The "template security" feature of
+    Smarty is designed to help reduce the risk of a system compromise when
+    you have untrusted parties editing templates.
+    </p>
+  </background>
+  <description>
+    <p>
+    A vulnerability has been discovered within the regex_replace modifier
+    of the Smarty templates when allowing access to untrusted users.
+    Furthermore, it was possible to call functions from {if} statements and
+    {math} functions.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    These issues may allow a remote attacker to bypass the "template
+    security" feature of Smarty, and execute arbitrary PHP code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not grant template access to untrusted users.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Smarty users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-php/smarty-2.6.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://smarty.php.net/misc/NEWS">Smarty ChangeLog</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0913">CVE-2005-0913</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 24 Mar 2005 17:18:18 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 28 Mar 2005 13:11:35 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 28 Mar 2005 13:23:33 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-36.xml b/xml/htdocs/security/en/glsa/glsa-200503-36.xml
new file mode 100644
index 00000000..aa843928
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-36.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-36">
+  <title>netkit-telnetd: Buffer overflow</title>
+  <synopsis>
+    The netkit-telnetd telnet client is vulnerable to a buffer overflow, which
+    could allow a malicious telnet server operator to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">netkit-telnetd</product>
+  <announced>March 31, 2005</announced>
+  <revised>March 31, 2005: 01</revised>
+  <bug>87211</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/netkit-telnetd" auto="yes" arch="*">
+      <unaffected range="ge">0.17-r6</unaffected>
+      <vulnerable range="lt">0.17-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    netkit-telnetd provides standard Linux telnet client and server.
+    </p>
+  </background>
+  <description>
+    <p>
+    A buffer overflow has been identified in the slc_add_reply()
+    function of netkit-telnetd client, where a large number of SLC commands
+    can overflow a fixed size buffer.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful explotation would require a vulnerable user to connect
+    to an attacker-controlled host using telnet, potentially executing
+    arbitrary code with the permissions of the telnet user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All netkit-telnetd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/netkit-telnetd-0.17-r6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0469">CAN-2005-0469</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=220&amp;type=vulnerabilities">iDEFENSE Advisory 03-28-05</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 30 Mar 2005 08:13:45 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 30 Mar 2005 13:44:36 +0000">
+    formula7
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 30 Mar 2005 19:43:01 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200503-37.xml b/xml/htdocs/security/en/glsa/glsa-200503-37.xml
new file mode 100644
index 00000000..e90b5bde
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200503-37.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200503-37">
+  <title>LimeWire: Disclosure of sensitive information</title>
+  <synopsis>
+    Two vulnerabilities in LimeWire can be exploited to disclose sensitive
+    information.
+  </synopsis>
+  <product type="ebuild">LimeWire</product>
+  <announced>March 31, 2005</announced>
+  <revised>March 31, 2005: 01</revised>
+  <bug>85380</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-p2p/limewire" auto="yes" arch="*">
+      <unaffected range="ge">4.8.1</unaffected>
+      <vulnerable range="lt">4.8.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    LimeWire is a Java peer-to-peer client compatible with the
+    Gnutella file-sharing protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    Two input validation errors were found in the handling of Gnutella
+    GET requests (CAN-2005-0788) and magnet requests (CAN-2005-0789).
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker can craft a specific Gnutella GET request or use
+    directory traversal on magnet requests to read arbitrary files on the
+    system with the rights of the user running LimeWire.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All LimeWire users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-p2p/limewire-4.8.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0788">CAN-2005-0788</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0789">CAN-2005-0789</uri>
+    <uri link="http://secunia.com/advisories/14555/">Secunia Advisory SA14555</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 30 Mar 2005 14:57:35 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 30 Mar 2005 14:58:13 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 30 Mar 2005 16:12:57 +0000">
+    formula7
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-01.xml b/xml/htdocs/security/en/glsa/glsa-200504-01.xml
new file mode 100644
index 00000000..965f3802
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-01.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-01">
+  <title>telnet-bsd: Multiple buffer overflows</title>
+  <synopsis>
+    The telnet-bsd telnet client is vulnerable to two buffer overflows, which
+    could allow a malicious telnet server operator to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">telnet</product>
+  <announced>April 01, 2005</announced>
+  <revised>April 01, 2005: 01</revised>
+  <bug>87019</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/telnet-bsd" auto="yes" arch="*">
+      <unaffected range="ge">1.0-r1</unaffected>
+      <vulnerable range="lt">1.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    telnet-bsd provides a command line telnet client which is used for
+    remote login using the telnet protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    A buffer overflow has been identified in the env_opt_add()
+    function of telnet-bsd, where a response requiring excessive escaping
+    can cause a heap-based buffer overflow. Another issue has been
+    identified in the slc_add_reply() function, where a large number of SLC
+    commands can overflow a fixed size buffer.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation would require a vulnerable user to connect
+    to an attacker-controlled host using telnet, potentially executing
+    arbitrary code with the permissions of the telnet user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All telnet-bsd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/telnet-bsd-1.0-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0468">CAN-2005-0468</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=221&amp;type=vulnerabilities">IDEF0867</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0469">CAN-2005-0469</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=220&amp;type=vulnerabilities">IDEF0866</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 29 Mar 2005 16:15:13 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 29 Mar 2005 17:09:56 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 31 Mar 2005 06:01:07 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-02.xml b/xml/htdocs/security/en/glsa/glsa-200504-02.xml
new file mode 100644
index 00000000..3064cc7e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-02.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-02">
+  <title>Sylpheed, Sylpheed-claws: Buffer overflow on message display</title>
+  <synopsis>
+    Sylpheed and Sylpheed-claws contain a vulnerability that can be triggered
+    when displaying messages with specially crafted attachments.
+  </synopsis>
+  <product type="ebuild">sylpheed</product>
+  <announced>April 02, 2005</announced>
+  <revised>April 02, 2005: 01</revised>
+  <bug>86541</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/sylpheed" auto="yes" arch="*">
+      <unaffected range="ge">1.0.4</unaffected>
+      <vulnerable range="lt">1.0.4</vulnerable>
+    </package>
+    <package name="mail-client/sylpheed-claws" auto="yes" arch="*">
+      <unaffected range="ge">1.0.4</unaffected>
+      <vulnerable range="lt">1.0.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Sylpheed is a lightweight email client and newsreader.
+    Sylpheed-claws is a 'bleeding edge' version of Sylpheed.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sylpheed and Sylpheed-claws fail to properly handle messages
+    containing attachments with MIME-encoded filenames.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker can send a malicious email message which, when
+    displayed, would cause the program to crash, potentially allowing the
+    execution of arbitrary code with the privileges of the user running the
+    software.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Sylpheed users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/sylpheed-1.0.4&quot;</code>
+    <p>
+    All Sylpheed-claws users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/sylpheed-claws-1.0.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://sylpheed.good-day.net/#changes">Sylpheed ChangeLog</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 31 Mar 2005 08:06:56 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 31 Mar 2005 08:07:15 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-03.xml b/xml/htdocs/security/en/glsa/glsa-200504-03.xml
new file mode 100644
index 00000000..124868bc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-03.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-03">
+  <title>Dnsmasq: Poisoning and Denial of Service vulnerabilities</title>
+  <synopsis>
+    Dnsmasq is vulnerable to DNS cache poisoning attacks and a potential Denial
+    of Service from the local network.
+  </synopsis>
+  <product type="ebuild">Dnsmasq</product>
+  <announced>April 04, 2005</announced>
+  <revised>April 04, 2005: 01</revised>
+  <bug>86718</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/dnsmasq" auto="yes" arch="*">
+      <unaffected range="ge">2.22</unaffected>
+      <vulnerable range="lt">2.22</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Dnsmasq is a lightweight and easily-configurable DNS forwarder and
+    DHCP server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dnsmasq does not properly detect that DNS replies received do not
+    correspond to any DNS query that was sent. Rob Holland of the Gentoo
+    Linux Security Audit team also discovered two off-by-one buffer
+    overflows that could crash DHCP lease files parsing.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker could send malicious answers to insert arbitrary
+    DNS data into the Dnsmasq cache. These attacks would in turn help an
+    attacker to perform man-in-the-middle and site impersonation attacks.
+    The buffer overflows might allow an attacker on the local network to
+    crash Dnsmasq upon restart.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Dnsmasq users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/dnsmasq-2.22&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.thekelleys.org.uk/dnsmasq/CHANGELOG">Dnsmasq Changelog</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 28 Mar 2005 07:00:46 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 28 Mar 2005 13:54:22 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon,  4 Apr 2005 11:10:45 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-04.xml b/xml/htdocs/security/en/glsa/glsa-200504-04.xml
new file mode 100644
index 00000000..a9cf3065
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-04.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-04">
+  <title>mit-krb5: Multiple buffer overflows in telnet client</title>
+  <synopsis>
+    The mit-krb5 telnet client is vulnerable to two buffer overflows, which
+    could allow a malicious telnet server operator to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">telnet</product>
+  <announced>April 06, 2005</announced>
+  <revised>April 06, 2005: 01</revised>
+  <bug>87145</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/mit-krb5" auto="yes" arch="*">
+      <unaffected range="ge">1.3.6-r2</unaffected>
+      <vulnerable range="lt">1.3.6-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The MIT Kerberos 5 implementation provides a command line telnet
+    client which is used for remote login via the telnet protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    A buffer overflow has been identified in the env_opt_add()
+    function, where a response requiring excessive escaping can cause a
+    heap-based buffer overflow. Another issue has been identified in the
+    slc_add_reply() function, where a large number of SLC commands can
+    overflow a fixed size buffer.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation would require a vulnerable user to connect
+    to an attacker-controlled telnet host, potentially executing arbitrary
+    code with the permissions of the telnet user on the client.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mit-krb5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-crypt/mit-krb5-1.3.6-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0468">CAN-2005-0468</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0469">CAN-2005-0469</uri>
+    <uri link="http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2005-001-telnet.txt">MITKRB5-SA-2005-001</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri,  1 Apr 2005 09:42:26 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed,  6 Apr 2005 09:05:02 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-05.xml b/xml/htdocs/security/en/glsa/glsa-200504-05.xml
new file mode 100644
index 00000000..77b2cd07
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-05.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-05">
+  <title>Gaim: Denial of Service issues</title>
+  <synopsis>
+    Gaim contains multiple vulnerabilities that can lead to a Denial of
+    Service.
+  </synopsis>
+  <product type="ebuild">Gaim</product>
+  <announced>April 06, 2005</announced>
+  <revised>April 06, 2005: 03</revised>
+  <bug>87903</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/gaim" auto="yes" arch="*">
+      <unaffected range="ge">1.2.1</unaffected>
+      <vulnerable range="lt">1.2.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gaim is a full featured instant messaging client which handles a
+    variety of instant messaging protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been addressed in the latest release of
+    Gaim:
+    </p>
+    <ul><li>A buffer overread in the gaim_markup_strip_html() function,
+    which is used when logging conversations (CAN-2005-0965).</li>
+    <li>Markup tags are improperly escaped using Gaim's IRC plugin
+    (CAN-2005-0966).</li>
+    <li>Sending a specially crafted file transfer request to a Gaim Jabber
+    user can trigger a crash (CAN-2005-0967).</li>
+    </ul>
+  </description>
+  <impact type="low">
+    <p>
+    An attacker could possibly cause a Denial of Service by exploiting any
+    of these vulnerabilities.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gaim users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/gaim-1.2.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0967">CAN-2005-0967</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0966">CAN-2005-0966</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0965">CAN-2005-0965</uri>
+    <uri link="http://gaim.sourceforge.net/security/">Gaim Vulnerability Index</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon,  4 Apr 2005 16:07:52 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon,  4 Apr 2005 16:59:15 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed,  6 Apr 2005 11:01:53 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-06.xml b/xml/htdocs/security/en/glsa/glsa-200504-06.xml
new file mode 100644
index 00000000..95b23ebe
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-06.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-06">
+  <title>sharutils: Insecure temporary file creation</title>
+  <synopsis>
+    The unshar utility is vulnerable to symlink attacks, potentially allowing a
+    local user to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">sharutils</product>
+  <announced>April 06, 2005</announced>
+  <revised>April 06, 2005: 01</revised>
+  <bug>87939</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-arch/sharutils" auto="yes" arch="*">
+      <unaffected range="ge">4.2.1-r11</unaffected>
+      <vulnerable range="lt">4.2.1-r11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    sharutils is a collection of tools to deal with shar archives.
+    </p>
+  </background>
+  <description>
+    <p>
+    Joey Hess has discovered that the program unshar, which is a part
+    of sharutils, creates temporary files in a world-writable directory
+    with predictable names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary
+    files directory, pointing to a valid file somewhere on the filesystem.
+    When unshar is executed, this would result in the file being
+    overwritten with the rights of the user running the utility, which
+    could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All sharutils users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/sharutils-4.2.1-r11&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.ubuntulinux.org/support/documentation/usn/usn-104-1">Ubuntu Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue,  5 Apr 2005 07:42:03 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue,  5 Apr 2005 13:07:06 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed,  6 Apr 2005 20:15:09 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-07.xml b/xml/htdocs/security/en/glsa/glsa-200504-07.xml
new file mode 100644
index 00000000..8c7b385b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-07.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-07">
+  <title>GnomeVFS, libcdaudio: CDDB response overflow</title>
+  <synopsis>
+    The GnomeVFS and libcdaudio libraries contain a buffer overflow that can be
+    triggered by a large CDDB response, potentially allowing the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">GnomeVFS</product>
+  <announced>April 08, 2005</announced>
+  <revised>April 13, 2005: 02</revised>
+  <bug>84936</bug>
+  <access>remote</access>
+  <affected>
+    <package name="gnome-base/gnome-vfs" auto="yes" arch="*">
+      <unaffected range="ge">2.8.4-r1</unaffected>
+      <unaffected range="rge">1.0.5-r4</unaffected>
+      <vulnerable range="lt">2.8.4-r1</vulnerable>
+    </package>
+    <package name="media-libs/libcdaudio" auto="yes" arch="*">
+      <unaffected range="ge">0.99.10-r1</unaffected>
+      <vulnerable range="lt">0.99.10-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GnomeVFS is a filesystem abstraction library for the GNOME desktop
+    environment. libcdaudio is a multi-platform CD player development
+    library. They both include code to query CDDB servers to get Audio CD
+    track titles.
+    </p>
+  </background>
+  <description>
+    <p>
+    Joseph VanAndel has discovered a buffer overflow in Grip when
+    processing large CDDB results (see GLSA 200503-21). The same overflow
+    is present in GnomeVFS and libcdaudio code.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious CDDB server could cause applications making use of GnomeVFS
+    or libcdaudio libraries to crash, potentially allowing the execution of
+    arbitrary code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GnomeVFS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose gnome-base/gnome-vfs</code>
+    <p>
+    All libcdaudio users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libcdaudio-0.99.10-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0706">CAN-2005-0706</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200503-21.xml">GLSA 200503-21</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue,  5 Apr 2005 09:35:13 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri,  8 Apr 2005 11:17:13 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-08.xml b/xml/htdocs/security/en/glsa/glsa-200504-08.xml
new file mode 100644
index 00000000..cac48fc4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-08.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-08">
+  <title>phpMyAdmin: Cross-site scripting vulnerability</title>
+  <synopsis>
+    phpMyAdmin is vulnerable to a cross-site scripting attack.
+  </synopsis>
+  <product type="ebuild">phpMyAdmin</product>
+  <announced>April 11, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>87952</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/phpmyadmin" auto="yes" arch="*">
+      <unaffected range="ge">2.6.2_rc1</unaffected>
+      <vulnerable range="lt">2.6.2_rc1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpMyAdmin is a tool written in PHP intended to handle the
+    administration of MySQL databases from a web-browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    Oriol Torrent Santiago has discovered that phpMyAdmin fails to validate
+    input to the "convcharset" variable, rendering it vulnerable to
+    cross-site scripting attacks.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By sending a specially-crafted request, an attacker can inject and
+    execute malicious script code, potentially compromising the victim's
+    browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpMyAdmin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/phpmyadmin-2.6.2_rc1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3">PMASA-2005-3</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0992">CVE-2005-0992</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 10 Apr 2005 23:16:29 +0000">
+    lewk
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 11 Apr 2005 00:34:48 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 11 Apr 2005 00:35:39 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-09.xml b/xml/htdocs/security/en/glsa/glsa-200504-09.xml
new file mode 100644
index 00000000..0f95f1d5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-09.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-09">
+  <title>Axel: Vulnerability in HTTP redirection handling</title>
+  <synopsis>
+    A buffer overflow vulnerability has been found in Axel which could lead to
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Axel</product>
+  <announced>April 12, 2005</announced>
+  <revised>April 12, 2005: 01</revised>
+  <bug>88264</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/axel" auto="yes" arch="*">
+      <unaffected range="ge">1.0b</unaffected>
+      <vulnerable range="lt">1.0b</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Axel is a console-based FTP/HTTP download accelerator.
+    </p>
+  </background>
+  <description>
+    <p>
+    A possible buffer overflow has been reported in the HTTP
+    redirection handling code in conn.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit this vulnerability by setting up a
+    malicious site and enticing a user to connect to it. This could
+    possibly lead to the execution of arbitrary code with the permissions
+    of the user running Axel.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Axel users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/axel-1.0b&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0390">CAN-2005-0390</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 11 Apr 2005 18:36:13 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 11 Apr 2005 19:29:05 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 12 Apr 2005 11:48:11 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-10.xml b/xml/htdocs/security/en/glsa/glsa-200504-10.xml
new file mode 100644
index 00000000..3d422a9e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-10.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-10">
+  <title>Gld: Remote execution of arbitrary code</title>
+  <synopsis>
+    Gld contains several serious vulnerabilities, potentially resulting in the
+    execution of arbitrary code as the root user.
+  </synopsis>
+  <product type="ebuild">Gld</product>
+  <announced>April 13, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>88904</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-filter/gld" auto="yes" arch="*">
+      <unaffected range="ge">1.5</unaffected>
+      <vulnerable range="le">1.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gld is a standalone greylisting server for Postfix.
+    </p>
+  </background>
+  <description>
+    <p>
+    dong-hun discovered several buffer overflows in server.c, as well as
+    several format string vulnerabilities in cnf.c.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could exploit this vulnerability to execute arbitrary code
+    with the permissions of the user running Gld, the default user being
+    root.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gld users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-filter/gld-1.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://securitytracker.com/alerts/2005/Apr/1013678.html">SecurityTracker ID 1013678</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1099">CVE-2005-1099</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1100">CVE-2005-1100</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 13 Apr 2005 10:26:52 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 13 Apr 2005 12:04:44 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-11.xml b/xml/htdocs/security/en/glsa/glsa-200504-11.xml
new file mode 100644
index 00000000..7a0e4ce6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-11.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-11">
+  <title>JunkBuster: Multiple vulnerabilities</title>
+  <synopsis>
+    JunkBuster is vulnerable to a heap corruption vulnerability, and under
+    certain configurations may allow an attacker to modify settings.
+  </synopsis>
+  <product type="ebuild">junkbuster</product>
+  <announced>April 13, 2005</announced>
+  <revised>April 21, 2005: 02</revised>
+  <bug>88537</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-proxy/junkbuster" auto="yes" arch="*">
+      <unaffected range="ge">2.0.2-r3</unaffected>
+      <vulnerable range="lt">2.0.2-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    JunkBuster is a filtering HTTP proxy, designed to enhance privacy and
+    remove unwanted content.
+    </p>
+  </background>
+  <description>
+    <p>
+    James Ranson reported a vulnerability when JunkBuster is configured to
+    run in single-threaded mode, an attacker can modify the referrer
+    setting by getting a victim to request a specially crafted URL
+    (CAN-2005-1108). Tavis Ormandy of the Gentoo Linux Security Audit Team
+    identified a heap corruption issue in the filtering of URLs
+    (CAN-2005-1109).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    If JunkBuster has been configured to run in single-threaded mode, an
+    attacker can disable or modify the filtering of Referrer: HTTP headers,
+    potentially compromising the privacy of users. The heap corruption
+    vulnerability could crash or disrupt the operation of the proxy,
+    potentially executing arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All JunkBuster users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-proxy/junkbuster-2.0.2-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1108">CAN-2005-1108</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1109">CAN-2005-1109</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 12 Apr 2005 20:24:12 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 12 Apr 2005 21:28:36 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 13 Apr 2005 08:43:25 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-12.xml b/xml/htdocs/security/en/glsa/glsa-200504-12.xml
new file mode 100644
index 00000000..2d10a790
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-12.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-12">
+  <title>rsnapshot: Local privilege escalation</title>
+  <synopsis>
+    rsnapshot allows a local user to take ownership of local files, resulting
+    in privilege escalation.
+  </synopsis>
+  <product type="ebuild">rsnapshot</product>
+  <announced>April 13, 2005</announced>
+  <revised>December 30, 2007: 05</revised>
+  <bug>88681</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-backup/rsnapshot" auto="yes" arch="*">
+      <unaffected range="ge">1.2.1</unaffected>
+      <unaffected range="rge">1.1.7</unaffected>
+      <vulnerable range="lt">1.2.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    rsnapshot is a filesystem snapshot utility based on rsync, allowing
+    local and remote systems backups.
+    </p>
+  </background>
+  <description>
+    <p>
+    The copy_symlink() subroutine in rsnapshot follows symlinks when
+    changing file ownership, instead of changing the ownership of the
+    symlink itself.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Under certain circumstances, local attackers can exploit this
+    vulnerability to take ownership of arbitrary files, resulting in local
+    privilege escalation.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    The copy_symlink() subroutine is not called if the cmd_cp parameter has
+    been enabled.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All rsnapshot users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose app-backup/rsnapshot</code>
+  </resolution>
+  <references>
+    <uri link="http://www.rsnapshot.org/security/2005/001.html">rsnapshot Security Advisory 001</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1064">CVE-2005-1064</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 11 Apr 2005 07:57:07 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 11 Apr 2005 21:22:40 +0000">
+    lewk
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 13 Apr 2005 08:59:16 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-13.xml b/xml/htdocs/security/en/glsa/glsa-200504-13.xml
new file mode 100644
index 00000000..5418c862
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-13.xml
@@ -0,0 +1,102 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-13">
+  <title>OpenOffice.Org: DOC document Heap Overflow</title>
+  <synopsis>
+    OpenOffice.Org is vulnerable to a heap overflow when processing DOC
+    documents, which could lead to arbitrary code execution.
+  </synopsis>
+  <product type="ebuild">OpenOffice</product>
+  <announced>April 15, 2005</announced>
+  <revised>May 08, 2005: 02</revised>
+  <bug>88863</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/openoffice" auto="yes" arch="*">
+      <unaffected range="ge">1.1.4-r1</unaffected>
+      <vulnerable range="lt">1.1.4-r1</vulnerable>
+    </package>
+    <package name="app-office/openoffice-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.1.4-r1</unaffected>
+      <vulnerable range="lt">1.1.4-r1</vulnerable>
+    </package>
+    <package name="app-office/openoffice-ximian" auto="yes" arch="*">
+      <unaffected range="ge">1.3.9-r1</unaffected>
+      <unaffected range="rge">1.3.6-r1</unaffected>
+      <unaffected range="rge">1.3.7-r1</unaffected>
+      <vulnerable range="lt">1.3.9-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenOffice.org is an office productivity suite, including word
+    processing, spreadsheets, presentations, drawings, data charting,
+    formula editing, and file conversion facilities.
+    </p>
+  </background>
+  <description>
+    <p>
+    AD-LAB has discovered a heap overflow in the "StgCompObjStream::Load()"
+    function when processing DOC documents.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could design a malicious DOC document containing a
+    specially crafted header which, when processed by OpenOffice.Org, would
+    result in the execution of arbitrary code with the rights of the user
+    running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenOffice.Org users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-1.1.4-r1&quot;</code>
+    <p>
+    All OpenOffice.Org binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-bin-1.1.4-r1&quot;</code>
+    <p>
+    All OpenOffice.Org Ximian users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose app-office/openoffice-ximian</code>
+    <p>
+    Note to PPC users: There is no stable OpenOffice.Org fixed version for
+    the PPC architecture. Affected users should switch to the latest
+    OpenOffice.Org Ximian version.
+    </p>
+    <p>
+    Note to SPARC users: There is no stable OpenOffice.Org fixed version
+    for the SPARC architecture. Affected users should switch to the latest
+    OpenOffice.Org Ximian version.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://www.openoffice.org/issues/show_bug.cgi?id=46388">OpenOffice.Org Issue 46388</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0941">CAN-2005-0941</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 13 Apr 2005 09:08:22 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 14 Apr 2005 15:46:07 +0000">
+    formula7
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 15 Apr 2005 07:51:32 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-14.xml b/xml/htdocs/security/en/glsa/glsa-200504-14.xml
new file mode 100644
index 00000000..56df3467
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-14.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-14">
+  <title>monkeyd: Multiple vulnerabilities</title>
+  <synopsis>
+    Format string and Denial of Service vulnerabilities have been discovered in
+    the monkeyd HTTP server, potentially resulting in the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">monkeyd</product>
+  <announced>April 15, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>87916</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/monkeyd" auto="yes" arch="*">
+      <unaffected range="ge">0.9.1</unaffected>
+      <vulnerable range="lt">0.9.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    monkeyd is a fast, efficient, small and easy to configure web server
+    for Linux.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a
+    double expansion error in monkeyd, resulting in a format string
+    vulnerability. Ciaran McCreesh of Gentoo Linux discovered a Denial of
+    Service vulnerability, a syntax error caused monkeyd to zero out
+    unallocated memory should a zero byte file be requested.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    The format string vulnerability could allow an attacker to send a
+    specially crafted request to the monkeyd server, resulting in the
+    execution of arbitrary code with the permissions of the user running
+    monkeyd. The DoS vulnerability could allow an attacker to disrupt the
+    operation of the web server, should a zero byte file be accessible.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All monkeyd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/monkeyd-0.9.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1122">CVE-2005-1122</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1123">CVE-2005-1123</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 14 Apr 2005 15:11:45 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 14 Apr 2005 20:09:53 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 15 Apr 2005 16:10:15 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-15.xml b/xml/htdocs/security/en/glsa/glsa-200504-15.xml
new file mode 100644
index 00000000..389eaa23
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-15.xml
@@ -0,0 +1,97 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-15">
+  <title>PHP: Multiple vulnerabilities</title>
+  <synopsis>
+    Several vulnerabilities were found and fixed in PHP image handling
+    functions, potentially resulting in Denial of Service conditions or the
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">PHP</product>
+  <announced>April 18, 2005</announced>
+  <revised>April 18, 2005: 01</revised>
+  <bug>87517</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-php/php" auto="yes" arch="*">
+      <unaffected range="ge">4.3.11</unaffected>
+      <vulnerable range="lt">4.3.11</vulnerable>
+    </package>
+    <package name="dev-php/mod_php" auto="yes" arch="*">
+      <unaffected range="ge">4.3.11</unaffected>
+      <vulnerable range="lt">4.3.11</vulnerable>
+    </package>
+    <package name="dev-php/php-cgi" auto="yes" arch="*">
+      <unaffected range="ge">4.3.11</unaffected>
+      <vulnerable range="lt">4.3.11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHP is a general-purpose scripting language widely used to develop
+    web-based applications. It can run inside a web server using the
+    mod_php module or the CGI version of PHP, or can run stand-alone in a
+    CLI.
+    </p>
+  </background>
+  <description>
+    <p>
+    An integer overflow and an unbound recursion were discovered in
+    the processing of Image File Directory tags in PHP's EXIF module
+    (CAN-2005-1042, CAN-2005-1043). Furthermore, two infinite loops have
+    been discovered in the getimagesize() function when processing IFF or
+    JPEG images (CAN-2005-0524, CAN-2005-0525).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could craft an image file with a malicious EXIF
+    IFD tag, a large IFD nesting level or invalid size parameters and send
+    it to a web application that would process this user-provided image
+    using one of the affected functions. This could result in denying
+    service on the attacked server and potentially executing arbitrary code
+    with the rights of the web server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-php/php-4.3.11&quot;</code>
+    <p>
+    All mod_php users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-php/mod_php-4.3.11&quot;</code>
+    <p>
+    All php-cgi users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-php/php-cgi-4.3.11&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.php.net/release_4_3_11.php">PHP 4.3.11 Release Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0524">CAN-2005-0524</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0525">CAN-2005-0525</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1042">CAN-2005-1042</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1043">CAN-2005-1043</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 17 Apr 2005 16:51:49 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 17 Apr 2005 16:51:59 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-16.xml b/xml/htdocs/security/en/glsa/glsa-200504-16.xml
new file mode 100644
index 00000000..8260ae6f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-16.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-16">
+  <title>CVS: Multiple vulnerabilities</title>
+  <synopsis>
+    Several serious vulnerabilities have been found in CVS, which may allow an
+    attacker to remotely compromise a CVS server or cause a DoS.
+  </synopsis>
+  <product type="ebuild">CVS</product>
+  <announced>April 18, 2005</announced>
+  <revised>April 22, 2005: 03</revised>
+  <bug>86476</bug>
+  <bug>89579</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-util/cvs" auto="yes" arch="*">
+      <unaffected range="ge">1.11.20</unaffected>
+      <vulnerable range="lt">1.11.20</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CVS (Concurrent Versions System) is an open-source network-transparent
+    version control system. It contains both a client utility and a server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Alen Zukich has discovered several serious security issues in CVS,
+    including at least one buffer overflow (CAN-2005-0753), memory leaks
+    and a NULL pointer dereferencing error. Furthermore when launching
+    trigger scripts CVS includes a user controlled directory.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could exploit these vulnerabilities to cause a Denial of
+    Service or execute arbitrary code with the permissions of the CVS
+    pserver or the authenticated user (depending on the connection method
+    used).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CVS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-util/cvs-1.11.20&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0753">CAN-2005-0753</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 12 Apr 2005 18:45:36 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 18 Apr 2005 20:37:28 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-17.xml b/xml/htdocs/security/en/glsa/glsa-200504-17.xml
new file mode 100644
index 00000000..4df93fac
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-17.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-17">
+  <title>XV: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in XV, potentially resulting
+    in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">xv</product>
+  <announced>April 19, 2005</announced>
+  <revised>April 19, 2005: 01</revised>
+  <bug>88742</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/xv" auto="yes" arch="*">
+      <unaffected range="ge">3.10a-r11</unaffected>
+      <vulnerable range="lt">3.10a-r11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    XV is an interactive image manipulation program for the X Window
+    System.
+    </p>
+  </background>
+  <description>
+    <p>
+    Greg Roelofs has reported multiple input validation errors in XV
+    image decoders. Tavis Ormandy of the Gentoo Linux Security Audit Team
+    has reported insufficient validation in the PDS (Planetary Data System)
+    image decoder, format string vulnerabilities in the TIFF and PDS
+    decoders, and insufficient protection from shell meta-characters in
+    malformed filenames.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation would require a victim to view a specially
+    created image file using XV, potentially resulting in the execution of
+    arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All XV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/xv-3.10a-r11&quot;</code>
+  </resolution>
+  <references/>
+  <metadata tag="requester" timestamp="Fri, 15 Apr 2005 12:13:29 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 15 Apr 2005 13:15:45 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 19 Apr 2005 04:58:52 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-18.xml b/xml/htdocs/security/en/glsa/glsa-200504-18.xml
new file mode 100644
index 00000000..54f324ad
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-18.xml
@@ -0,0 +1,137 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-18">
+  <title>Mozilla Firefox, Mozilla Suite: Multiple vulnerabilities</title>
+  <synopsis>
+    New Mozilla Firefox and Mozilla Suite releases fix new security
+    vulnerabilities, including memory disclosure and various ways of executing
+    JavaScript code with elevated privileges.
+  </synopsis>
+  <product type="ebuild">Mozilla</product>
+  <announced>April 19, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>89303</bug>
+  <bug>89305</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">1.0.3</unaffected>
+      <vulnerable range="lt">1.0.3</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.0.3</unaffected>
+      <vulnerable range="lt">1.0.3</vulnerable>
+    </package>
+    <package name="www-client/mozilla" auto="yes" arch="*">
+      <unaffected range="ge">1.7.7</unaffected>
+      <vulnerable range="lt">1.7.7</vulnerable>
+    </package>
+    <package name="www-client/mozilla-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.7.7</unaffected>
+      <vulnerable range="lt">1.7.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Mozilla Suite is a popular all-in-one web browser that includes a
+    mail and news reader. Mozilla Firefox is the next-generation browser
+    from the Mozilla project.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were found and fixed in the Mozilla Suite
+    and Mozilla Firefox:
+    </p>
+    <ul>
+    <li>Vladimir V. Perepelitsa reported a memory disclosure bug in
+    JavaScript's regular expression string replacement when using an
+    anonymous function as the replacement argument (CAN-2005-0989).</li>
+    <li>moz_bug_r_a4 discovered that Chrome UI code was overly trusting DOM
+    nodes from the content window, allowing privilege escalation via DOM
+    property overrides.</li>
+    <li>Michael Krax reported a possibility to run JavaScript code with
+    elevated privileges through the use of javascript: favicons.</li>
+    <li>Michael Krax also discovered that malicious Search plugins could
+    run JavaScript in the context of the displayed page or stealthily
+    replace existing search plugins.</li>
+    <li>shutdown discovered a technique to pollute the global scope of a
+    window in a way that persists from page to page.</li>
+    <li>Doron Rosenberg discovered a possibility to run JavaScript with
+    elevated privileges when the user asks to "Show" a blocked popup that
+    contains a JavaScript URL.</li>
+    <li>Finally, Georgi Guninski reported missing Install object instance
+    checks in the native implementations of XPInstall-related JavaScript
+    objects.</li>
+    </ul>
+    <p>
+    The following Firefox-specific vulnerabilities have also been
+    discovered:
+    </p>
+    <ul>
+    <li>Kohei Yoshino discovered a new way to abuse the sidebar panel to
+    execute JavaScript with elevated privileges.</li>
+    <li>Omar Khan reported that the Plugin Finder Service can be tricked to
+    open javascript: URLs with elevated privileges.</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    The various JavaScript execution with elevated privileges issues can be
+    exploited by a remote attacker to install malicious code or steal data.
+    The memory disclosure issue can be used to reveal potentially sensitive
+    information. Finally, the cache pollution issue and search plugin abuse
+    can be leveraged in cross-site-scripting attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-1.0.3&quot;</code>
+    <p>
+    All Mozilla Firefox binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-1.0.3&quot;</code>
+    <p>
+    All Mozilla Suite users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-1.7.7&quot;</code>
+    <p>
+    All Mozilla Suite binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-bin-1.7.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.mozilla.org/projects/security/known-vulnerabilities.html">Mozilla Security Advisories</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0989">CAN-2005-0989</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1153">CVE-2005-1153</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1154">CVE-2005-1154</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1155">CVE-2005-1155</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1156">CVE-2005-1156</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1159">CVE-2005-1159</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1160">CVE-2005-1160</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 18 Apr 2005 08:55:50 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 19 Apr 2005 05:17:09 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-19.xml b/xml/htdocs/security/en/glsa/glsa-200504-19.xml
new file mode 100644
index 00000000..c0ec32c4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-19.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-19">
+  <title>MPlayer: Two heap overflow vulnerabilities</title>
+  <synopsis>
+    Two vulnerabilities have been found in MPlayer which could lead to the
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">MPlayer</product>
+  <announced>April 20, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>89277</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/mplayer" auto="yes" arch="*">
+      <unaffected range="ge">1.0_pre6-r4</unaffected>
+      <vulnerable range="lt">1.0_pre6-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MPlayer is a media player capable of handling multiple multimedia file
+    formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Heap overflows have been found in the code handling RealMedia RTSP and
+    Microsoft Media Services streams over TCP (MMST).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By setting up a malicious server and enticing a user to use its
+    streaming data, a remote attacker could possibly execute arbitrary code
+    on the client computer with the permissions of the user running
+    MPlayer.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MPlayer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/mplayer-1.0_pre6-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.mplayerhq.hu/homepage/design7/news.html#vuln10">MPlayer News: Real RTSP heap overflow</uri>
+    <uri link="http://www.mplayerhq.hu/homepage/design7/news.html#vuln11">MPlayer News: MMST heap overflow</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1195">CVE-2005-1195</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 16 Apr 2005 16:59:51 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 18 Apr 2005 09:17:55 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 19 Apr 2005 07:28:03 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-20.xml b/xml/htdocs/security/en/glsa/glsa-200504-20.xml
new file mode 100644
index 00000000..9f870828
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-20.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-20">
+  <title>openMosixview: Insecure temporary file creation</title>
+  <synopsis>
+    openMosixview and the openMosixcollector daemon are vulnerable to symlink
+    attacks, potentially allowing a local user to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">openMosixview</product>
+  <announced>April 21, 2005</announced>
+  <revised>April 21, 2005: 01</revised>
+  <bug>86686</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-cluster/openmosixview" auto="yes" arch="*">
+      <unaffected range="ge">1.5-r1</unaffected>
+      <vulnerable range="lt">1.5-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The openMosixview package contains several tools used to manage
+    openMosix clusters, including openMosixview (the main monitoring and
+    administration application) and openMosixcollector (a daemon collecting
+    cluster and node information).
+    </p>
+  </background>
+  <description>
+    <p>
+    Gangstuck and Psirac from Rexotec discovered that openMosixview
+    insecurely creates several temporary files with predictable filenames.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary
+    files directory, pointing to a valid file somewhere on the filesystem.
+    When openMosixView or the openMosixcollector daemon runs, this would
+    result in the file being overwritten with the rights of the user
+    running the utility, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All openMosixview users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-cluster/openmosixview-1.5-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0894">CAN-2005-0894</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 20 Apr 2005 11:45:51 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 20 Apr 2005 11:46:46 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-21.xml b/xml/htdocs/security/en/glsa/glsa-200504-21.xml
new file mode 100644
index 00000000..ab90f871
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-21.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-21">
+  <title>RealPlayer, Helix Player: Buffer overflow vulnerability</title>
+  <synopsis>
+    RealPlayer and Helix Player are vulnerable to a buffer overflow that could
+    lead to remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">RealPlayer</product>
+  <announced>April 22, 2005</announced>
+  <revised>April 22, 2005: 01</revised>
+  <bug>89862</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/realplayer" auto="yes" arch="*">
+      <unaffected range="ge">10.0.4</unaffected>
+      <vulnerable range="lt">10.0.4</vulnerable>
+    </package>
+    <package name="media-video/helixplayer" auto="yes" arch="*">
+      <unaffected range="ge">1.0.4</unaffected>
+      <vulnerable range="lt">1.0.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    RealPlayer is a multimedia player capable of handling multiple
+    multimedia file formats. Helix Player is the Open Source version of
+    RealPlayer.
+    </p>
+  </background>
+  <description>
+    <p>
+    Piotr Bania has discovered a buffer overflow vulnerability in
+    RealPlayer and Helix Player when processing malicious RAM files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to play a specially crafted RAM file an
+    attacker could execute arbitrary code with the permissions of the user
+    running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All RealPlayer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/realplayer-10.0.4&quot;</code>
+    <p>
+    All Helix Player users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/helixplayer-1.0.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0755">CAN-2005-0755</uri>
+    <uri link="http://service.real.com/help/faq/security/050419_player/EN/">RealNetworks Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 21 Apr 2005 08:25:50 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 21 Apr 2005 21:28:38 +0000">
+    formula7
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 22 Apr 2005 07:59:29 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-22.xml b/xml/htdocs/security/en/glsa/glsa-200504-22.xml
new file mode 100644
index 00000000..8055fbff
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-22.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-22">
+  <title>KDE kimgio: PCX handling buffer overflow</title>
+  <synopsis>
+    KDE fails to properly validate input when handling PCX images, potentially
+    resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">KDE</product>
+  <announced>April 22, 2005</announced>
+  <revised>April 22, 2005: 01</revised>
+  <bug>88862</bug>
+  <access>remote</access>
+  <affected>
+    <package name="kde-base/kdelibs" auto="yes" arch="*">
+      <unaffected range="rge">3.2.3-r9</unaffected>
+      <unaffected range="ge">3.3.2-r8</unaffected>
+      <vulnerable range="lt">3.3.2-r8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDE is a feature-rich graphical desktop environment for Linux and
+    Unix-like Operating Systems. kimgio is the KDE image handler provided
+    by kdelibs.
+    </p>
+  </background>
+  <description>
+    <p>
+    kimgio fails to properly validate input when handling PCX files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to load a specially-crafted PCX image in a KDE
+    application, an attacker could execute arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All kdelibs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose kde-base/kdelibs</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1046">CAN-2005-1046</uri>
+    <uri link="http://www.kde.org/info/security/advisory-20050421-1.txt">KDE Security Advisory: kimgio input validation errors</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 22 Apr 2005 06:44:43 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 22 Apr 2005 11:51:44 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-23.xml b/xml/htdocs/security/en/glsa/glsa-200504-23.xml
new file mode 100644
index 00000000..51eb660f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-23.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-23">
+  <title>Kommander: Insecure remote script execution</title>
+  <synopsis>
+    Kommander executes remote scripts without confirmation, potentially
+    resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Kommander</product>
+  <announced>April 22, 2005</announced>
+  <revised>May 20, 2005: 02</revised>
+  <bug>89092</bug>
+  <access>remote</access>
+  <affected>
+    <package name="kde-base/kdewebdev" auto="yes" arch="*">
+      <unaffected range="ge">3.3.2-r2</unaffected>
+      <vulnerable range="lt">3.3.2-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDE is a feature-rich graphical desktop environment for Linux and
+    Unix-like Operating Systems. Kommander is a visual dialog editor and
+    interpreter for KDE applications, part of the kdewebdev package.
+    </p>
+  </background>
+  <description>
+    <p>
+    Kommander executes data files from possibly untrusted locations without
+    user confirmation.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit this to execute arbitrary code with the
+    permissions of the user running Kommander.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All kdewebdev users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kdewebdev-3.3.2-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0754">CAN-2005-0754</uri>
+    <uri link="http://www.kde.org/info/security/advisory-20050420-1.txt">KDE Security Advisory: Kommander untrusted code execution</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 22 Apr 2005 06:18:02 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 22 Apr 2005 06:48:56 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-24.xml b/xml/htdocs/security/en/glsa/glsa-200504-24.xml
new file mode 100644
index 00000000..7da0ec76
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-24.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-24">
+  <title>eGroupWare: XSS and SQL injection vulnerabilities</title>
+  <synopsis>
+    eGroupWare is affected by several SQL injection and cross-site scripting
+    (XSS) vulnerabilities.
+  </synopsis>
+  <product type="ebuild">eGroupWare</product>
+  <announced>April 25, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>89517</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/egroupware" auto="yes" arch="*">
+      <unaffected range="ge">1.0.0.007</unaffected>
+      <vulnerable range="lt">1.0.0.007</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    eGroupWare is a suite of web-based group applications including
+    calendar, address book, messenger and email.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple SQL injection and cross-site scripting vulnerabilities have
+    been found in several eGroupWare modules.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could possibly use the SQL injection vulnerabilites to gain
+    information from the database. Furthermore the cross-site scripting
+    issues give an attacker the ability to inject and execute malicious
+    script code or to steal cookie based authentication credentials,
+    potentially compromising the victim's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All eGroupWare users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/egroupware-1.0.0.007&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gulftech.org/?node=research&amp;article_id=00069-04202005">GulfTech Security Research Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1202">CVE-2005-1202</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1203">CVE-2005-1203</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 23 Apr 2005 09:15:46 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 24 Apr 2005 18:41:06 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 25 Apr 2005 09:36:49 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-25.xml b/xml/htdocs/security/en/glsa/glsa-200504-25.xml
new file mode 100644
index 00000000..201341b2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-25.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-25">
+  <title>Rootkit Hunter: Insecure temporary file creation</title>
+  <synopsis>
+    Rootkit Hunter is vulnerable to symlink attacks, potentially allowing a
+    local user to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">rkhunter</product>
+  <announced>April 26, 2005</announced>
+  <revised>April 26, 2005: 01</revised>
+  <bug>90007</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-forensics/rkhunter" auto="yes" arch="*">
+      <unaffected range="ge">1.2.3-r1</unaffected>
+      <vulnerable range="lt">1.2.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Rootkit Hunter is a scanning tool to detect rootkits, backdoors
+    and local exploits on a local machine. Rootkit Hunter uses downloaded
+    data files to check file integrity. These files are updated via the
+    check_update.sh script.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sune Kloppenborg Jeppesen and Tavis Ormandy of the Gentoo Linux
+    Security Team have reported that the check_update.sh script and the
+    main rkhunter script insecurely creates several temporary files with
+    predictable filenames.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary
+    files directory, pointing to a valid file somewhere on the filesystem.
+    When rkhunter or the check_update.sh script runs, this would result in
+    the file being overwritten with the rights of the user running the
+    utility, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Rootkit Hunter users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-forensics/rkhunter-1.2.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1270">CAN-2005-1270</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 26 Apr 2005 06:10:01 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 26 Apr 2005 18:37:38 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-26.xml b/xml/htdocs/security/en/glsa/glsa-200504-26.xml
new file mode 100644
index 00000000..02a24ed0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-26.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-26">
+  <title>Convert-UUlib: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow has been reported in Convert-UUlib, potentially resulting
+    in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Convert-UUlib</product>
+  <announced>April 26, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>89501</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-perl/Convert-UUlib" auto="yes" arch="*">
+      <unaffected range="ge">1.051</unaffected>
+      <vulnerable range="lt">1.051</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Convert-UUlib provides a Perl interface to the uulib library, allowing
+    Perl applications to access data encoded in a variety of formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    A vulnerability has been reported in Convert-UUlib where a malformed
+    parameter can be provided by an attacker allowing a read operation to
+    overflow a buffer. The vendor credits Mark Martinec and Robert Lewis
+    with the discovery.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation would permit an attacker to run arbitrary code
+    with the privileges of the user running the Perl application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Convert-UUlib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-perl/Convert-UUlib-1.051&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1349">CVE-2005-1349</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 19 Apr 2005 16:17:03 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 21 Apr 2005 08:24:58 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 25 Apr 2005 20:37:01 +0000">
+    taviso
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-27.xml b/xml/htdocs/security/en/glsa/glsa-200504-27.xml
new file mode 100644
index 00000000..0c0df02d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-27.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-27">
+  <title>xine-lib: Two heap overflow vulnerabilities</title>
+  <synopsis>
+    Two vulnerabilities have been found in xine-lib which could lead to the
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">xine-lib</product>
+  <announced>April 26, 2005</announced>
+  <revised>April 26, 2005: 01</revised>
+  <bug>89976</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/xine-lib" auto="yes" arch="*">
+      <unaffected range="ge">1.0-r2</unaffected>
+      <unaffected range="rge">1_rc6-r2</unaffected>
+      <vulnerable range="lt">1.0-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xine-lib is a multimedia library which can be utilized to create
+    multimedia frontends.
+    </p>
+  </background>
+  <description>
+    <p>
+    Heap overflows have been found in the code handling RealMedia RTSP
+    and Microsoft Media Services streams over TCP (MMST).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By setting up a malicious server and enticing a user to use its
+    streaming data, a remote attacker could possibly execute arbitrary code
+    on the client computer with the permissions of the user running any
+    multimedia frontend making use of the xine-lib library.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xine-lib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose media-libs/xine-lib</code>
+  </resolution>
+  <references>
+    <uri link="http://xinehq.de/index.php/security/XSA-2004-8">Xine Advisory XSA-2004-8</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 22 Apr 2005 08:22:32 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 26 Apr 2005 20:44:06 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-28.xml b/xml/htdocs/security/en/glsa/glsa-200504-28.xml
new file mode 100644
index 00000000..dd83edfc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-28.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-28">
+  <title>Heimdal: Buffer overflow vulnerabilities</title>
+  <synopsis>
+    Buffer overflow vulnerabilities have been found in the telnet client in
+    Heimdal which could lead to execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Heimdal</product>
+  <announced>April 28, 2005</announced>
+  <revised>April 28, 2005: 01</revised>
+  <bug>89861</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/heimdal" auto="yes" arch="*">
+      <unaffected range="ge">0.6.4</unaffected>
+      <vulnerable range="lt">0.6.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Heimdal is a free implementation of Kerberos 5 that includes a
+    telnet client program.
+    </p>
+  </background>
+  <description>
+    <p>
+    Buffer overflow vulnerabilities in the slc_add_reply() and
+    env_opt_add() functions have been discovered by Gael Delalleau in the
+    telnet client in Heimdal.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation would require a vulnerable user to connect
+    to an attacker-controlled host using the telnet client, potentially
+    executing arbitrary code with the permissions of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Heimdal users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-crypt/heimdal-0.6.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0468">CAN-2005-0468</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0469">CAN-2005-0469</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 26 Apr 2005 20:42:17 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 27 Apr 2005 00:18:43 +0000">
+    formula7
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 28 Apr 2005 08:35:57 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-29.xml b/xml/htdocs/security/en/glsa/glsa-200504-29.xml
new file mode 100644
index 00000000..64f7a615
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-29.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-29">
+  <title>Pound: Buffer overflow vulnerability</title>
+  <synopsis>
+    Pound is vulnerable to a buffer overflow that could lead to the remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Pound</product>
+  <announced>April 30, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>90851</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/pound" auto="yes" arch="*">
+      <unaffected range="ge">1.8.3</unaffected>
+      <vulnerable range="lt">1.8.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Pound is a reverse proxy, load balancer and HTTPS front-end.
+    </p>
+  </background>
+  <description>
+    <p>
+    Steven Van Acker has discovered a buffer overflow vulnerability in the
+    "add_port()" function in Pound.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send a request for an overly long hostname
+    parameter, which could lead to the remote execution of arbitrary code
+    with the rights of the Pound daemon process (by default, Gentoo uses
+    the "nobody" user to run the Pound daemon).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Pound users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/pound-1.8.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.apsis.ch/pound/pound_list/archive/2005/2005-04/1114516112000">Original announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1391">CVE-2005-1391</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 29 Apr 2005 17:01:33 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 29 Apr 2005 20:39:56 +0000">
+    formula7
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 30 Apr 2005 08:11:33 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200504-30.xml b/xml/htdocs/security/en/glsa/glsa-200504-30.xml
new file mode 100644
index 00000000..c6f68102
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200504-30.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200504-30">
+  <title>phpMyAdmin: Insecure SQL script installation</title>
+  <synopsis>
+    phpMyAdmin leaves the SQL install script with insecure permissions,
+    potentially leading to a database compromise.
+  </synopsis>
+  <product type="ebuild">phpmyadmin</product>
+  <announced>April 30, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>88831</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-db/phpmyadmin" auto="yes" arch="*">
+      <unaffected range="ge">2.6.2-r1</unaffected>
+      <vulnerable range="lt">2.6.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpMyAdmin is a tool written in PHP intended to handle the
+    administration of MySQL databases from a web-browser. phpMyAdmin uses a
+    pma MySQL user to control the linked-tables infrastructure. The SQL
+    install script sets the initial password for the pma user.
+    </p>
+  </background>
+  <description>
+    <p>
+    The phpMyAdmin installation process leaves the SQL install script with
+    insecure permissions.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit this vulnerability to obtain the initial
+    phpMyAdmin password and from there obtain information about databases
+    accessible by phpMyAdmin.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Change the password for the phpMyAdmin MySQL user (pma):
+    </p>
+    <code>
+    mysql -u root -p
+    SET PASSWORD FOR 'pma'@'localhost' = PASSWORD('MyNewPassword');</code>
+    <p>
+    Update your phpMyAdmin config.inc.php:
+    </p>
+    <code>
+    $cfg['Servers'][$i]['controlpass']   = 'MyNewPassword';</code>
+  </workaround>
+  <resolution>
+    <p>
+    All phpMyAdmin users should change password for the pma user as
+    described above and upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/phpmyadmin-2.6.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1392">CVE-2005-1392</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 29 Apr 2005 08:17:12 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 29 Apr 2005 18:24:53 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-01.xml b/xml/htdocs/security/en/glsa/glsa-200505-01.xml
new file mode 100644
index 00000000..4d69c34c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-01.xml
@@ -0,0 +1,167 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-01">
+  <title>Horde Framework: Multiple XSS vulnerabilities</title>
+  <synopsis>
+    Various modules of the Horde Framework are vulnerable to multiple
+    cross-site scripting (XSS) vulnerabilities.
+  </synopsis>
+  <product type="ebuild">Horde</product>
+  <announced>May 01, 2005</announced>
+  <revised>May 01, 2005: 01</revised>
+  <bug>90365</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/horde-vacation" auto="yes" arch="*">
+      <unaffected range="ge">2.2.2</unaffected>
+      <vulnerable range="lt">2.2.2</vulnerable>
+    </package>
+    <package name="www-apps/horde-turba" auto="yes" arch="*">
+      <unaffected range="ge">1.2.5</unaffected>
+      <vulnerable range="lt">1.2.5</vulnerable>
+    </package>
+    <package name="www-apps/horde-passwd" auto="yes" arch="*">
+      <unaffected range="ge">2.2.2</unaffected>
+      <vulnerable range="lt">2.2.2</vulnerable>
+    </package>
+    <package name="www-apps/horde-nag" auto="yes" arch="*">
+      <unaffected range="ge">1.1.3</unaffected>
+      <vulnerable range="lt">1.1.3</vulnerable>
+    </package>
+    <package name="www-apps/horde-mnemo" auto="yes" arch="*">
+      <unaffected range="ge">1.1.4</unaffected>
+      <vulnerable range="lt">1.1.4</vulnerable>
+    </package>
+    <package name="www-apps/horde-kronolith" auto="yes" arch="*">
+      <unaffected range="ge">1.1.4</unaffected>
+      <vulnerable range="lt">1.1.4</vulnerable>
+    </package>
+    <package name="www-apps/horde-imp" auto="yes" arch="*">
+      <unaffected range="ge">3.2.8</unaffected>
+      <vulnerable range="lt">3.2.8</vulnerable>
+    </package>
+    <package name="www-apps/horde-accounts" auto="yes" arch="*">
+      <unaffected range="ge">2.1.2</unaffected>
+      <vulnerable range="lt">2.1.2</vulnerable>
+    </package>
+    <package name="www-apps/horde-forwards" auto="yes" arch="*">
+      <unaffected range="ge">2.2.2</unaffected>
+      <vulnerable range="lt">2.2.2</vulnerable>
+    </package>
+    <package name="www-apps/horde-chora" auto="yes" arch="*">
+      <unaffected range="ge">1.2.3</unaffected>
+      <vulnerable range="lt">1.2.3</vulnerable>
+    </package>
+    <package name="www-apps/horde" auto="yes" arch="*">
+      <unaffected range="ge">2.2.8</unaffected>
+      <vulnerable range="lt">2.2.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Horde Framework is a PHP based framework for building web
+    applications. It provides many modules including calendar, address
+    book, CVS viewer and Internet Messaging Program.
+    </p>
+  </background>
+  <description>
+    <p>
+    Cross-site scripting vulnerabilities have been discovered in
+    various modules of the Horde Framework.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    These vulnerabilities could be exploited by an attacker to execute
+    arbitrary HTML and script code in context of the victim's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Horde users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-2.2.8&quot;</code>
+    <p>
+    All Horde Vacation users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-vacation-2.2.2&quot;</code>
+    <p>
+    All Horde Turba users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-turba-1.2.5&quot;</code>
+    <p>
+    All Horde Passwd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-passwd-2.2.2&quot;</code>
+    <p>
+    All Horde Nag users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-nag-1.1.3&quot;</code>
+    <p>
+    All Horde Mnemo users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-mnemo-1.1.4&quot;</code>
+    <p>
+    All Horde Kronolith users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-kronolith-1.1.4&quot;</code>
+    <p>
+    All Horde IMP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-imp-3.2.8&quot;</code>
+    <p>
+    All Horde Accounts users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-accounts-2.1.2&quot;</code>
+    <p>
+    All Horde Forwards users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-forwards-2.2.2&quot;</code>
+    <p>
+    All Horde Chora users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-chora-1.2.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://marc.theaimsgroup.com/?l=horde-announce&amp;r=1&amp;b=200504&amp;w=2">Horde Announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 29 Apr 2005 18:22:59 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 29 Apr 2005 18:24:07 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 30 Apr 2005 20:44:12 +0000">
+    formula7
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-02.xml b/xml/htdocs/security/en/glsa/glsa-200505-02.xml
new file mode 100644
index 00000000..f052a770
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-02.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-02">
+  <title>Oops!: Remote code execution</title>
+  <synopsis>
+    The Oops! proxy server contains a remotely exploitable format string
+    vulnerability, which could potentially lead to the execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">oops</product>
+  <announced>May 05, 2005</announced>
+  <revised>May 05, 2005: 02</revised>
+  <bug>91303</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-proxy/oops" auto="yes" arch="*">
+      <unaffected range="ge">1.5.24_pre20050503</unaffected>
+      <vulnerable range="lt">1.5.24_pre20050503</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Oops! is an advanced, multithreaded caching web proxy.
+    </p>
+  </background>
+  <description>
+    <p>
+    A format string flaw has been detected in the my_xlog() function of the
+    Oops! proxy, which is called by the passwd_mysql and passwd_pgsql
+    module's auth() functions.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send a specially crafted HTTP request to the
+    Oops! proxy, potentially triggering this vulnerability and leading to
+    the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Oops! users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-proxy/oops-1.5.24_pre20050503&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1121">CAN-2005-1121</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 04 May 2005 15:38:53 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 04 May 2005 15:39:06 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 05 May 2005 13:38:44 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-03.xml b/xml/htdocs/security/en/glsa/glsa-200505-03.xml
new file mode 100644
index 00000000..ab06b409
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-03.xml
@@ -0,0 +1,103 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-03">
+  <title>Ethereal: Numerous vulnerabilities</title>
+  <synopsis>
+    Ethereal is vulnerable to numerous vulnerabilities potentially resulting in
+    the execution of arbitrary code or abnormal termination.
+  </synopsis>
+  <product type="ebuild">Ethereal</product>
+  <announced>May 06, 2005</announced>
+  <revised>May 06, 2005: 01</revised>
+  <bug>90539</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/ethereal" auto="yes" arch="*">
+      <unaffected range="ge">0.10.11</unaffected>
+      <vulnerable range="lt">0.10.11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ethereal is a feature rich network protocol analyzer.
+    </p>
+  </background>
+  <description>
+    <p>
+    There are numerous vulnerabilities in versions of Ethereal prior
+    to 0.10.11, including:
+    </p>
+    <ul>
+    <li>The ANSI A and DHCP dissectors are
+    vulnerable to format string vulnerabilities.</li>
+    <li>The DISTCC,
+    FCELS, SIP, ISIS, CMIP, CMP, CMS, CRMF, ESS, OCSP, PKIX1Explitit, PKIX
+    Qualified, X.509, Q.931, MEGACO, NCP, ISUP, TCAP and Presentation
+    dissectors are vulnerable to buffer overflows.</li>
+    <li>The KINK, WSP,
+    SMB Mailslot, H.245, MGCP, Q.931, RPC, GSM and SMB NETLOGON dissectors
+    are vulnerable to pointer handling errors.</li>
+    <li>The LMP, KINK,
+    MGCP, RSVP, SRVLOC, EIGRP, MEGACO, DLSw, NCP and L2TP dissectors are
+    vulnerable to looping problems.</li>
+    <li>The Telnet and DHCP dissectors
+    could abort.</li>
+    <li>The TZSP, Bittorrent, SMB, MGCP and ISUP
+    dissectors could cause a segmentation fault.</li>
+    <li>The WSP, 802.3
+    Slow protocols, BER, SMB Mailslot, SMB, NDPS, IAX2, RADIUS, SMB PIPE,
+    MRDISC and TCAP dissectors could throw assertions.</li>
+    <li>The DICOM,
+    NDPS and ICEP dissectors are vulnerable to memory handling errors.</li>
+    <li>The GSM MAP, AIM, Fibre Channel,SRVLOC, NDPS, LDAP and NTLMSSP
+    dissectors could terminate abnormallly.</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker might be able to use these vulnerabilities to crash
+    Ethereal and execute arbitrary code with the permissions of the user
+    running Ethereal, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ethereal users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/ethereal-0.10.11&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.ethereal.com/appnotes/enpa-sa-00019.html">Ethereal enpa-sa-00019</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1456">CAN-2005-1456</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1457">CAN-2005-1457</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1458">CAN-2005-1458</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1459">CAN-2005-1459</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1460">CAN-2005-1460</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1461">CAN-2005-1461</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1462">CAN-2005-1462</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1463">CAN-2005-1463</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1464">CAN-2005-1464</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1465">CAN-2005-1465</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1466">CAN-2005-1466</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1467">CAN-2005-1467</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1468">CAN-2005-1468</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1469">CAN-2005-1469</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1470">CAN-2005-1470</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 05 May 2005 19:56:33 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 06 May 2005 17:24:39 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-04.xml b/xml/htdocs/security/en/glsa/glsa-200505-04.xml
new file mode 100644
index 00000000..ecdf6633
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-04.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-04">
+  <title>GnuTLS: Denial of Service vulnerability</title>
+  <synopsis>
+    The GnuTLS library is vulnerable to Denial of Service attacks.
+  </synopsis>
+  <product type="ebuild">GnuTLS</product>
+  <announced>May 09, 2005</announced>
+  <revised>May 09, 2005: 01</revised>
+  <bug>90726</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-libs/gnutls" auto="yes" arch="*">
+      <unaffected range="ge">1.2.3</unaffected>
+      <unaffected range="rge">1.0.25</unaffected>
+      <vulnerable range="lt">1.2.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GnuTLS is a free TLS 1.0 and SSL 3.0 implementation for the GNU
+    project.
+    </p>
+  </background>
+  <description>
+    <p>
+    A vulnerability has been discovered in the record packet parsing
+    in the GnuTLS library. Additionally, a flaw was also found in the RSA
+    key export functionality.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit this vulnerability and cause a
+    Denial of Service to any application that utilizes the GnuTLS library.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GnuTLS users should remove the existing installation and
+    upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --unmerge gnutls
+    # emerge --ask --oneshot --verbose net-libs/gnutls</code>
+    <p>
+    Due to small API changes with the previous version, please do
+    the following to ensure your applications are using the latest GnuTLS
+    that you just emerged.
+    </p>
+    <code>
+    # revdep-rebuild --soname-regexp libgnutls.so.1[0-1]</code>
+    <p>
+    Previously exported RSA keys can be fixed by executing the
+    following command on the key files:
+    </p>
+    <code>
+    # certtool -k infile outfile</code>
+  </resolution>
+  <references>
+    <uri link="http://lists.gnupg.org/pipermail/gnutls-dev/2005-April/000858.html">GnuTLS Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1431">CAN-2005-1431</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 29 Apr 2005 18:20:03 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 30 Apr 2005 14:44:07 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 30 Apr 2005 16:35:11 +0000">
+    lewk
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-05.xml b/xml/htdocs/security/en/glsa/glsa-200505-05.xml
new file mode 100644
index 00000000..b840f42d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-05.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-05">
+  <title>gzip: Multiple vulnerabilities</title>
+  <synopsis>
+    gzip contains multiple vulnerabilities potentially allowing an attacker to
+    execute arbitrary commands.
+  </synopsis>
+  <product type="ebuild">gzip</product>
+  <announced>May 09, 2005</announced>
+  <revised>May 09, 2005: 01</revised>
+  <bug>89946</bug>
+  <bug>90626</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-arch/gzip" auto="yes" arch="*">
+      <unaffected range="ge">1.3.5-r6</unaffected>
+      <vulnerable range="lt">1.3.5-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    gzip (GNU zip) is a popular compression program. The included
+    zgrep utility allows you to grep gzipped files in place.
+    </p>
+  </background>
+  <description>
+    <p>
+    The gzip and gunzip programs are vulnerable to a race condition
+    when setting file permissions (CAN-2005-0988), as well as improper
+    handling of filename restoration (CAN-2005-1228). The zgrep utility
+    improperly sanitizes arguments, which may come from an untrusted source
+    (CAN-2005-0758).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    These vulnerabilities could allow arbitrary command execution,
+    changing the permissions of arbitrary files, and installation of files
+    to an aribitrary location in the filesystem.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All gzip users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/gzip-1.3.5-r6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0758">CAN-2005-0758</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0988">CAN-2005-0988</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1228">CAN-2005-1228</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 06 May 2005 19:23:26 +0000">
+    r2d2
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 09 May 2005 05:30:13 +0000">
+    r2d2
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-06.xml b/xml/htdocs/security/en/glsa/glsa-200505-06.xml
new file mode 100644
index 00000000..ec3abaa1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-06.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-06">
+  <title>TCPDump: Decoding routines Denial of Service vulnerability</title>
+  <synopsis>
+    A flaw in the decoding of network packets renders TCPDump vulnerable to a
+    remote Denial of Service attack.
+  </synopsis>
+  <product type="ebuild">tcpdump</product>
+  <announced>May 09, 2005</announced>
+  <revised>June 12, 2005: 02</revised>
+  <bug>90541</bug>
+  <bug>95349</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/tcpdump" auto="yes" arch="*">
+      <unaffected range="ge">3.8.3-r3</unaffected>
+      <vulnerable range="lt">3.8.3-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    TCPDump is a tool for network monitoring and data acquisition.
+    </p>
+  </background>
+  <description>
+    <p>
+    TCPDump improperly handles and decodes ISIS (CAN-2005-1278), BGP
+    (CAN-2005-1267, CAN-2005-1279), LDP (CAN-2005-1279) and RSVP
+    (CAN-2005-1280) packets. TCPDump might loop endlessly after receiving
+    malformed packets.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious remote attacker can exploit the decoding issues for a
+    Denial of Service attack by sending specially crafted packets, possibly
+    causing TCPDump to loop endlessly.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All TCPDump users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/tcpdump-3.8.3-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2005-1267">CAN-2005-1267</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2005-1278">CAN-2005-1278</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2005-1279">CAN-2005-1279</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2005-1280">CAN-2005-1280</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 08 May 2005 15:18:02 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 08 May 2005 15:56:20 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 09 May 2005 19:22:22 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-07.xml b/xml/htdocs/security/en/glsa/glsa-200505-07.xml
new file mode 100644
index 00000000..daf14b5b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-07.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-07">
+  <title>libTIFF: Buffer overflow</title>
+  <synopsis>
+    The libTIFF library is vulnerable to a buffer overflow, potentially
+    resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">tiff</product>
+  <announced>May 10, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>91584</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/tiff" auto="yes" arch="*">
+      <unaffected range="ge">3.7.2</unaffected>
+      <vulnerable range="lt">3.7.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libTIFF provides support for reading and manipulating TIFF (Tag Image
+    File Format) images.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a
+    stack based buffer overflow in the libTIFF library when reading a TIFF
+    image with a malformed BitsPerSample tag.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation would require the victim to open a specially
+    crafted TIFF image, resulting in the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libTIFF users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/tiff-3.7.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://bugzilla.remotesensing.org/show_bug.cgi?id=843">LIBTIFF BUG#863</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1544">CVE-2005-1544</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 09 May 2005 18:55:28 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 10 May 2005 20:03:29 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-08.xml b/xml/htdocs/security/en/glsa/glsa-200505-08.xml
new file mode 100644
index 00000000..0a954661
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-08.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-08">
+  <title>HT Editor: Multiple buffer overflows</title>
+  <synopsis>
+    Two vulnerabilities have been discovered in HT Editor, potentially leading
+    to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">hteditor</product>
+  <announced>May 10, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>91569</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-editors/hteditor" auto="yes" arch="*">
+      <unaffected range="ge">0.8.0-r2</unaffected>
+      <vulnerable range="lt">0.8.0-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    HT is a hex editor, designed to help analyse and modify executable
+    files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Team discovered an integer
+    overflow in the ELF parser, leading to a heap-based buffer overflow.
+    The vendor has reported that an unrelated buffer overflow has been
+    discovered in the PE parser.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation would require the victim to open a specially
+    crafted file using HT, potentially permitting an attacker to execute
+    arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All hteditor users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-editors/hteditor-0.8.0-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1545">CVE-2005-1545</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1546">CVE-2005-1546</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 05 May 2005 15:16:28 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 05 May 2005 17:28:17 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 10 May 2005 20:04:14 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-09.xml b/xml/htdocs/security/en/glsa/glsa-200505-09.xml
new file mode 100644
index 00000000..5e75daab
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-09.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-09">
+  <title>Gaim: Denial of Service and buffer overflow vulnerabilties</title>
+  <synopsis>
+    Gaim contains two vulnerabilities, potentially resulting in the execution
+    of arbitrary code or Denial of Service.
+  </synopsis>
+  <product type="ebuild">gaim</product>
+  <announced>May 12, 2005</announced>
+  <revised>May 12, 2005: 01</revised>
+  <bug>91862</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/gaim" auto="yes" arch="*">
+      <unaffected range="ge">1.3.0</unaffected>
+      <vulnerable range="lt">1.3.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gaim is a full featured instant messaging client which handles a
+    variety of instant messaging protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stu Tomlinson discovered that Gaim is vulnerable to a remote stack
+    based buffer overflow when receiving messages in certain protocols,
+    like Jabber and SILC, with a very long URL (CAN-2005-1261). Siebe
+    Tolsma discovered that Gaim is also vulnerable to a remote Denial of
+    Service attack when receiving a specially crafted MSN message
+    (CAN-2005-1262).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could cause a buffer overflow by sending an
+    instant message with a very long URL, potentially leading to the
+    execution of malicious code. By sending a SLP message with an empty
+    body, a remote attacker could cause a Denial of Service or crash of the
+    Gaim client.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gaim users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/gaim-1.3.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1261">CAN-2005-1261</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1262">CAN-2005-1262</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 11 May 2005 11:51:15 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 12 May 2005 04:18:52 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-10.xml b/xml/htdocs/security/en/glsa/glsa-200505-10.xml
new file mode 100644
index 00000000..eaf7fdae
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-10.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-10">
+  <title>phpBB: Cross-Site Scripting Vulnerability</title>
+  <synopsis>
+    phpBB is vulnerable to a cross-site scripting attack that could allow
+    arbitrary scripting code execution.
+  </synopsis>
+  <product type="ebuild">phpBB</product>
+  <announced>May 14, 2005</announced>
+  <revised>May 14, 2005: 01</revised>
+  <bug>90213</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phpBB" auto="yes" arch="*">
+      <unaffected range="ge">2.0.15</unaffected>
+      <vulnerable range="lt">2.0.15</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpBB is an Open Source bulletin board package.
+    </p>
+  </background>
+  <description>
+    <p>
+    phpBB is vulnerable to a cross-site scripting vulnerability due to
+    improper sanitization of user supplied input. Coupled with poor
+    validation of BBCode URLs which may be included in a forum post, an
+    unsuspecting user may follow a posted link triggering the
+    vulnerability.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation of the vulnerability could cause arbitrary
+    scripting code to be executed in the browser of a user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpBB users should upgrade to the latest version:
+    </p>
+    <code>
+    emerge --sync
+    emerge --ask --oneshot --verbose &quot;&gt;=www-apps/phpBB-2.0.15&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/bid/13344/info/">BugTraq ID 13344</uri>
+    <uri link="http://securitytracker.com/id?1013918">SecurityTracker ID 1013918</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 13 May 2005 08:29:22 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 13 May 2005 08:29:44 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 13 May 2005 19:13:15 +0000">
+    r2d2
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-11.xml b/xml/htdocs/security/en/glsa/glsa-200505-11.xml
new file mode 100644
index 00000000..42e44807
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-11.xml
@@ -0,0 +1,118 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-11">
+  <title>Mozilla Suite, Mozilla Firefox: Remote compromise</title>
+  <synopsis>
+    Several vulnerabilities in the Mozilla Suite and Firefox allow an attacker
+    to conduct cross-site scripting attacks or to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">mozilla</product>
+  <announced>May 15, 2005</announced>
+  <revised>May 15, 2005: 01</revised>
+  <bug>91859</bug>
+  <bug>92393</bug>
+  <bug>92394</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">1.0.4</unaffected>
+      <vulnerable range="lt">1.0.4</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.0.4</unaffected>
+      <vulnerable range="lt">1.0.4</vulnerable>
+    </package>
+    <package name="www-client/mozilla" auto="yes" arch="*">
+      <unaffected range="ge">1.7.8</unaffected>
+      <vulnerable range="lt">1.7.8</vulnerable>
+    </package>
+    <package name="www-client/mozilla-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.7.8</unaffected>
+      <vulnerable range="lt">1.7.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Mozilla Suite is a popular all-in-one web browser that
+    includes a mail and news reader. Mozilla Firefox is the next-generation
+    browser from the Mozilla project.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Mozilla Suite and Firefox do not properly protect "IFRAME"
+    JavaScript URLs from being executed in context of another URL in the
+    history list (CAN-2005-1476). The Mozilla Suite and Firefox also fail
+    to verify the "IconURL" parameter of the "InstallTrigger.install()"
+    function (CAN-2005-1477). Michael Krax and Georgi Guninski discovered
+    that it is possible to bypass JavaScript-injection security checks by
+    wrapping the javascript: URL within the view-source: or jar:
+    pseudo-protocols (MFSA2005-43).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious remote attacker could use the "IFRAME" issue to
+    execute arbitrary JavaScript code within the context of another
+    website, allowing to steal cookies or other sensitive data. By
+    supplying a javascript: URL as the "IconURL" parameter of the
+    "InstallTrigger.Install()" function, a remote attacker could also
+    execute arbitrary JavaScript code. Combining both vulnerabilities with
+    a website which is allowed to install software or wrapping javascript:
+    URLs within the view-source: or jar: pseudo-protocols could possibly
+    lead to the execution of arbitrary code with user privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Affected systems can be protected by disabling JavaScript.
+    However, we encourage Mozilla Suite or Mozilla Firefox users to upgrade
+    to the latest available version.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-1.0.4&quot;</code>
+    <p>
+    All Mozilla Firefox binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-1.0.4&quot;</code>
+    <p>
+    All Mozilla Suite users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-1.7.8&quot;</code>
+    <p>
+    All Mozilla Suite binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-bin-1.7.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1476">CAN-2005-1476</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1477">CAN-2005-1477</uri>
+    <uri link="http://www.mozilla.org/security/announce/mfsa2005-43.html">Mozilla Foundation Security Advisory 2005-43</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 12 May 2005 04:49:53 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 12 May 2005 08:27:49 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 15 May 2005 08:10:06 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-12.xml b/xml/htdocs/security/en/glsa/glsa-200505-12.xml
new file mode 100644
index 00000000..35b90dcc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-12.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-12">
+  <title>PostgreSQL: Multiple vulnerabilities</title>
+  <synopsis>
+    PostgreSQL is vulnerable to Denial of Service attacks and possibly allows
+    unprivileged users to gain administrator rights.
+  </synopsis>
+  <product type="ebuild">postgresql</product>
+  <announced>May 15, 2005</announced>
+  <revised>June 26, 2007: 04</revised>
+  <bug>91231</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/postgresql" auto="yes" arch="*">
+      <unaffected range="eq">7.3*</unaffected>
+      <unaffected range="eq">7.4*</unaffected>
+      <unaffected range="rge">8.0.1-r3</unaffected>
+      <unaffected range="ge">8.0.2-r1</unaffected>
+      <vulnerable range="lt">7.3.10</vulnerable>
+      <vulnerable range="lt">7.4.7-r2</vulnerable>
+      <vulnerable range="lt">8.0.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PostgreSQL is a SQL compliant, open source object-relational database
+    management system.
+    </p>
+  </background>
+  <description>
+    <p>
+    PostgreSQL gives public EXECUTE access to a number of character
+    conversion routines, but doesn't validate the given arguments
+    (CAN-2005-1409). It has also been reported that the contrib/tsearch2
+    module of PostgreSQL misdeclares the return value of some functions as
+    "internal" (CAN-2005-1410).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could call the character conversion routines with specially
+    setup arguments to crash the backend process of PostgreSQL or to
+    potentially gain administrator rights. A malicious user could also call
+    the misdeclared functions of the contrib/tsearch2 module, resulting in
+    a Denial of Service or other, yet uninvestigated, impacts.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PostgreSQL users should update to the latest available version and
+    follow the guide at <uri
+    link="http://www.postgresql.org/about/news.315">http://www.postgresql.o
+    rg/about/news.315</uri>
+    </p>
+    
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-db/postgresql</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2005-1409">CAN-2005-1409</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2005-1410">CAN-2005-1410</uri>
+    <uri link="http://www.postgresql.org/about/news.315">PostgreSQL Announcement</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 11 May 2005 15:07:25 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 15 May 2005 09:19:16 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-13.xml b/xml/htdocs/security/en/glsa/glsa-200505-13.xml
new file mode 100644
index 00000000..eaecafde
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-13.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-13">
+  <title>FreeRADIUS: SQL injection and Denial of Service vulnerability</title>
+  <synopsis>
+    The FreeRADIUS server is vulnerable to an SQL injection attack and a buffer
+    overflow, possibly resulting in disclosure and modification of data and
+    Denial of Service.
+  </synopsis>
+  <product type="ebuild">freeradius</product>
+  <announced>May 17, 2005</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>91736</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dialup/freeradius" auto="yes" arch="*">
+      <unaffected range="ge">1.0.2-r4</unaffected>
+      <vulnerable range="lt">1.0.2-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    FreeRADIUS is an open source RADIUS authentication server
+    implementation.
+    </p>
+  </background>
+  <description>
+    <p>
+    Primoz Bratanic discovered that the sql_escape_func function of
+    FreeRADIUS may be vulnerable to a buffer overflow (BID 13541). He also
+    discovered that FreeRADIUS fails to sanitize user-input before using it
+    in a SQL query, possibly allowing SQL command injection (BID 13540).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By supplying carefully crafted input, a malicious user could cause an
+    SQL injection or a buffer overflow, possibly leading to the disclosure
+    and the modification of sensitive data or Denial of Service by crashing
+    the server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All FreeRADIUS users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dialup/freeradius-1.0.2-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/bid/13540/">BugTraq ID 13540</uri>
+    <uri link="http://www.securityfocus.com/bid/13541/">BugTraq ID 13541</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1454">CVE-2005-1454</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1455">CVE-2005-1455</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 12 May 2005 12:54:33 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 12 May 2005 13:46:19 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 17 May 2005 13:01:45 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-14.xml b/xml/htdocs/security/en/glsa/glsa-200505-14.xml
new file mode 100644
index 00000000..615774fb
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-14.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-14">
+  <title>Cheetah: Untrusted module search path</title>
+  <synopsis>
+    Cheetah contains a vulnerability in the module importing code that can
+    allow a local user to gain escalated privileges.
+  </synopsis>
+  <product type="ebuild">Cheetah</product>
+  <announced>May 19, 2005</announced>
+  <revised>May 17, 2006: 02</revised>
+  <bug>92926</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-python/cheetah" auto="yes" arch="*">
+      <unaffected range="ge">0.9.17_rc1</unaffected>
+      <vulnerable range="lt">0.9.17_rc1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cheetah is a Python powered template engine and code generator.
+    </p>
+  </background>
+  <description>
+    <p>
+    Brian Bird discovered that Cheetah searches for modules in the
+    world-writable /tmp directory.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious local user could place a module containing arbitrary code
+    in /tmp, which when imported would run with escalated privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cheetah users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-python/cheetah-0.9.17_rc1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://secunia.com/advisories/15386/">Secunia Advisory SA15386</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 17 May 2005 21:18:59 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 17 May 2005 21:38:15 +0000">
+    r2d2
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 18 May 2005 11:47:34 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-15.xml b/xml/htdocs/security/en/glsa/glsa-200505-15.xml
new file mode 100644
index 00000000..1888b2c3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-15.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-15">
+  <title>gdb: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in the GNU debugger,
+    potentially allowing the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">gdb</product>
+  <announced>May 20, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>88398</bug>
+  <bug>91398</bug>
+  <bug>91654</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-devel/gdb" auto="yes" arch="*">
+      <unaffected range="ge">6.3-r3</unaffected>
+      <vulnerable range="lt">6.3-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    gdb is the GNU project's debugger, facilitating the analysis and
+    debugging of applications. The BFD library provides a uniform method of
+    accessing a variety of object file formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Audit Team discovered an
+    integer overflow in the BFD library, resulting in a heap overflow. A
+    review also showed that by default, gdb insecurely sources
+    initialisation files from the working directory.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation would result in the execution of arbitrary code
+    on loading a specially crafted object file or the execution of
+    arbitrary commands.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All gdb users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-devel/gdb-6.3-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1704">CVE-2005-1704</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1705">CVE-2005-1705</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 06 May 2005 21:52:10 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 07 May 2005 04:11:43 +0000">
+    r2d2
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 20 May 2005 12:36:18 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-16.xml b/xml/htdocs/security/en/glsa/glsa-200505-16.xml
new file mode 100644
index 00000000..28c5e1d2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-16.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-16">
+  <title>ImageMagick, GraphicsMagick: Denial of Service vulnerability</title>
+  <synopsis>
+    ImageMagick and GraphicsMagick utilities can be abused to perform a Denial
+    of Service attack.
+  </synopsis>
+  <product type="ebuild">ImageMagick</product>
+  <announced>May 21, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>90423</bug>
+  <bug>90595</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/imagemagick" auto="yes" arch="*">
+      <unaffected range="ge">6.2.2.3</unaffected>
+      <vulnerable range="lt">6.2.2.3</vulnerable>
+    </package>
+    <package name="media-gfx/graphicsmagick" auto="yes" arch="*">
+      <unaffected range="ge">1.1.6-r1</unaffected>
+      <vulnerable range="lt">1.1.6-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Both ImageMagick and GraphicsMagick are collection of tools to read,
+    write and manipulate images in many formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a
+    Denial of Service vulnerability in the XWD decoder of ImageMagick and
+    GraphicsMagick when setting a color mask to zero.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could submit a specially crafted image to a user or
+    an automated system making use of an affected utility, resulting in a
+    Denial of Service by consumption of CPU time.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ImageMagick users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/imagemagick-6.2.2.3&quot;</code>
+    <p>
+    All GraphicsMagick users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/graphicsmagick-1.1.6-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1739">CVE-2005-1739</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 04 May 2005 05:18:30 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 05 May 2005 19:34:27 +0000">
+    formula7
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 21 May 2005 14:59:55 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-17.xml b/xml/htdocs/security/en/glsa/glsa-200505-17.xml
new file mode 100644
index 00000000..42448f4f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-17.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-17">
+  <title>Qpopper: Multiple Vulnerabilities</title>
+  <synopsis>
+    Qpopper contains two vulnerabilities allowing an attacker to overwrite
+    arbitrary files and create files with insecure permissions.
+  </synopsis>
+  <product type="ebuild">qpopper</product>
+  <announced>May 23, 2005</announced>
+  <revised>May 23, 2005: 01</revised>
+  <bug>90622</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-mail/qpopper" auto="yes" arch="*">
+      <unaffected range="ge">4.0.5-r3</unaffected>
+      <vulnerable range="lt">4.0.5-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Qpopper is a widely used server for the POP3 protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jens Steube discovered that Qpopper doesn't drop privileges to
+    process local files from normal users (CAN-2005-1151). The upstream
+    developers discovered that Qpopper can be forced to create group or
+    world writeable files (CAN-2005-1152).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious local attacker could exploit Qpopper to overwrite
+    arbitrary files as root or create new files which are group or world
+    writeable.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Qpopper users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/qpopper-4.0.5-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1151">CAN-2005-1151</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1152">CAN-2005-1152</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 10 May 2005 16:31:30 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 23 May 2005 19:25:37 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-18.xml b/xml/htdocs/security/en/glsa/glsa-200505-18.xml
new file mode 100644
index 00000000..0bec838f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-18.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-18">
+  <title>Net-SNMP: fixproc insecure temporary file creation</title>
+  <synopsis>
+    Net-SNMP creates temporary files in an insecure manner, possibly allowing
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">net-snmp</product>
+  <announced>May 23, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>91792</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-analyzer/net-snmp" auto="yes" arch="*">
+      <unaffected range="ge">5.2.1-r1</unaffected>
+      <vulnerable range="lt">5.2.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Net-SNMP is a suite of applications used to implement the Simple
+    Network Management Protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    The fixproc application of Net-SNMP creates temporary files with
+    predictable filenames.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious local attacker could exploit a race condition to change the
+    content of the temporary files before they are executed by fixproc,
+    possibly leading to the execution of arbitrary code. A local attacker
+    could also create symbolic links in the temporary files directory,
+    pointing to a valid file somewhere on the filesystem. When fixproc is
+    executed, this would result in the file being overwritten.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Net-SNMP users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/net-snmp-5.2.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1740">CVE-2005-1740</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 22 May 2005 14:27:59 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 22 May 2005 15:33:11 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 22 May 2005 23:22:24 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-19.xml b/xml/htdocs/security/en/glsa/glsa-200505-19.xml
new file mode 100644
index 00000000..665ec40b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-19.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-19">
+  <title>gxine: Format string vulnerability</title>
+  <synopsis>
+    A format string vulnerability in gxine could allow a remote attacker to
+    execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">gxine</product>
+  <announced>May 26, 2005</announced>
+  <revised>May 26, 2005: 01</revised>
+  <bug>93532</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/gxine" auto="yes" arch="*">
+      <unaffected range="rge">0.3.3-r2</unaffected>
+      <unaffected range="rge">0.4.1-r1</unaffected>
+      <unaffected range="ge">0.4.4</unaffected>
+      <vulnerable range="lt">0.4.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    gxine is a GTK+ and xine-lib based media player.
+    </p>
+  </background>
+  <description>
+    <p>
+    Exworm discovered that gxine insecurely implements formatted
+    printing in the hostname decoding function.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a carefully crafted
+    file with gxine, possibly leading to the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All gxine users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose media-video/gxine</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1692">CAN-2005-1692</uri>
+    <uri link="http://www.securityfocus.com/bid/13707">Bugtraq ID 13707</uri>
+    <uri link="http://www.0xbadexworm.org/adv/gxinefmt.txt">Original Advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 24 May 2005 14:37:48 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 26 May 2005 11:13:38 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200505-20.xml b/xml/htdocs/security/en/glsa/glsa-200505-20.xml
new file mode 100644
index 00000000..53aafd04
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200505-20.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200505-20">
+  <title>Mailutils: Multiple vulnerabilities in imap4d and mail</title>
+  <synopsis>
+    The imap4d server and the mail utility from GNU Mailutils contain multiple
+    vulnerabilities, potentially allowing a remote attacker to execute
+    arbitrary code with root privileges.
+  </synopsis>
+  <product type="ebuild">mailutils</product>
+  <announced>May 27, 2005</announced>
+  <revised>May 27, 2005: 01</revised>
+  <bug>94053</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/mailutils" auto="yes" arch="*">
+      <unaffected range="ge">0.6-r1</unaffected>
+      <vulnerable range="lt">0.6-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GNU Mailutils is a collection of mail-related utilities, including
+    an IMAP4 server (imap4d) and a Mail User Agent (mail).
+    </p>
+  </background>
+  <description>
+    <p>
+    infamous41d discovered several vulnerabilities in GNU Mailutils.
+    imap4d does not correctly implement formatted printing of command tags
+    (CAN-2005-1523), fails to validate the range sequence of the "FETCH"
+    command (CAN-2005-1522), and contains an integer overflow in the
+    "fetch_io" routine (CAN-2005-1521). mail contains a buffer overflow in
+    "header_get_field_name()" (CAN-2005-1520).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker can exploit the format string and integer
+    overflow in imap4d to execute arbitrary code as the imap4d user, which
+    is usually root. By sending a specially crafted email message, a remote
+    attacker could exploit the buffer overflow in the "mail" utility to
+    execute arbitrary code with the rights of the user running mail.
+    Finally, a remote attacker can also trigger a Denial of Service by
+    sending a malicious FETCH command to an affected imap4d, causing
+    excessive resource consumption.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GNU Mailutils users should upgrade to the latest available
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/mailutils-0.6-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1520">CAN-2005-1520</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1521">CAN-2005-1521</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1522">CAN-2005-1522</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1523">CAN-2005-1523</uri>
+    <uri link="http://www.idefense.com/application/poi/display?type=vulnerabilities&amp;showYear=2005">iDEFENSE 05.25.05 advisories</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 26 May 2005 13:21:14 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 27 May 2005 07:50:06 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-01.xml b/xml/htdocs/security/en/glsa/glsa-200506-01.xml
new file mode 100644
index 00000000..9c736061
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-01.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-01">
+  <title>Binutils, elfutils: Buffer overflow</title>
+  <synopsis>
+    Various utilities from the GNU Binutils and elfutils packages are
+    vulnerable to a heap based buffer overflow, potentially resulting in the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">binutils</product>
+  <announced>June 01, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>91398</bug>
+  <bug>91817</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/elfutils" auto="yes" arch="*">
+      <unaffected range="ge">0.108</unaffected>
+      <vulnerable range="lt">0.108</vulnerable>
+    </package>
+    <package name="sys-devel/binutils" auto="yes" arch="*">
+      <unaffected range="rge">2.14.90.0.8-r3</unaffected>
+      <unaffected range="rge">2.15.90.0.1.1-r5</unaffected>
+      <unaffected range="rge">2.15.90.0.3-r5</unaffected>
+      <unaffected range="rge">2.15.91.0.2-r2</unaffected>
+      <unaffected range="rge">2.15.92.0.2-r10</unaffected>
+      <unaffected range="ge">2.16-r1</unaffected>
+      <vulnerable range="lt">2.16-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The GNU Binutils are a collection of tools to create, modify and
+    analyse binary files. Many of the files use BFD, the Binary File
+    Descriptor library, to do low-level manipulation. Elfutils provides a
+    library and utilities to access, modify and analyse ELF objects.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy and Ned Ludd of the Gentoo Linux Security Audit Team
+    discovered an integer overflow in the BFD library and elfutils,
+    resulting in a heap based buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation would require a user to access a specially
+    crafted binary file, resulting in the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GNU Binutils users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose sys-devel/binutils</code>
+    <p>
+    All elfutils users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/elfutils-0.108&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1704">CVE-2005-1704</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 12 May 2005 20:12:23 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 01 Jun 2005 15:04:54 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-02.xml b/xml/htdocs/security/en/glsa/glsa-200506-02.xml
new file mode 100644
index 00000000..e363ed64
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-02.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-02">
+  <title>Mailutils: SQL Injection</title>
+  <synopsis>
+    GNU Mailutils is vulnerable to SQL command injection attacks.
+  </synopsis>
+  <product type="ebuild">mailutils</product>
+  <announced>June 06, 2005</announced>
+  <revised>June 06, 2005: 01</revised>
+  <bug>94824</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/mailutils" auto="yes" arch="*">
+      <unaffected range="ge">0.6-r1</unaffected>
+      <vulnerable range="lt">0.6-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GNU Mailutils is a collection of mail-related utilities.
+    </p>
+  </background>
+  <description>
+    <p>
+    When GNU Mailutils is built with the "mysql" or "postgres" USE
+    flag, the sql_escape_string function of the authentication module fails
+    to properly escape the "\" character, rendering it vulnerable to a SQL
+    command injection.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious remote user could exploit this vulnerability to inject
+    SQL commands to the underlying database.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GNU Mailutils users should upgrade to the latest available
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/mailutils-0.6-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1824">CAN-2005-1824</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 05 Jun 2005 13:35:06 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 05 Jun 2005 17:42:35 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 06 Jun 2005 11:45:10 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-03.xml b/xml/htdocs/security/en/glsa/glsa-200506-03.xml
new file mode 100644
index 00000000..e6886393
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-03.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-03">
+  <title>Dzip: Directory traversal vulnerability</title>
+  <synopsis>
+    Dzip is vulnerable to a directory traversal attack.
+  </synopsis>
+  <product type="ebuild">dzip</product>
+  <announced>June 06, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>93079</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-util/dzip" auto="yes" arch="*">
+      <unaffected range="ge">2.9-r1</unaffected>
+      <vulnerable range="lt">2.9-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Dzip is a compressor and uncompressor especially made for demo
+    recordings of id's Quake.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dzip is vulnerable to a directory traversal attack when extracting
+    archives.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit this vulnerability by creating a specially
+    crafted archive to extract files to arbitrary locations.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Dzip users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-utils/dzip-2.9-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1874">CVE-2005-1874</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 30 May 2005 13:58:23 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 30 May 2005 13:59:50 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 05 Jun 2005 17:58:43 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-04.xml b/xml/htdocs/security/en/glsa/glsa-200506-04.xml
new file mode 100644
index 00000000..ccfc5d26
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-04.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-04">
+  <title>Wordpress: Multiple vulnerabilities</title>
+  <synopsis>
+    Wordpress contains SQL injection and XSS vulnerabilities.
+  </synopsis>
+  <product type="ebuild">Wordpress</product>
+  <announced>June 06, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>88926</bug>
+  <bug>94512</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/wordpress" auto="yes" arch="*">
+      <unaffected range="ge">1.5.1.2</unaffected>
+      <vulnerable range="lt">1.5.1.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    WordPress is a PHP and MySQL based content management and publishing
+    system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Due to a lack of input validation, WordPress is vulnerable to SQL
+    injection and XSS attacks.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could use the SQL injection vulnerabilites to gain
+    information from the database. Furthermore the cross-site scripting
+    issues give an attacker the ability to inject and execute malicious
+    script code or to steal cookie-based authentication credentials,
+    potentially compromising the victim's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Wordpress users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/wordpress-1.5.1.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1102">CVE-2005-1102</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1687">CVE-2005-1687</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1810">CVE-2005-1810</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 01 Jun 2005 07:49:47 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 01 Jun 2005 07:49:57 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 06 Jun 2005 05:09:09 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-05.xml b/xml/htdocs/security/en/glsa/glsa-200506-05.xml
new file mode 100644
index 00000000..2ac4a13d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-05.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-05">
+  <title>SilverCity: Insecure file permissions</title>
+  <synopsis>
+    Executable files with insecure permissions can be modified causing an
+    unsuspecting user to run arbitrary code.
+  </synopsis>
+  <product type="ebuild">silvercity</product>
+  <announced>June 08, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>93558</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-text/silvercity" auto="yes" arch="*">
+      <unaffected range="ge">0.9.5-r1</unaffected>
+      <vulnerable range="lt">0.9.5-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SilverCity provides lexical analysis for over 20 programming and markup
+    languages.
+    </p>
+  </background>
+  <description>
+    <p>
+    The SilverCity package installs three executable files with insecure
+    permissions.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could modify the executable files, causing arbitrary
+    code to be executed with the permissions of an unsuspecting SilverCity
+    user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SilverCity users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/silvercity-0.9.5-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1941">CVE-2005-1941</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 06 Jun 2005 18:24:23 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 06 Jun 2005 18:24:47 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 07 Jun 2005 01:08:04 +0000">
+    r2d2
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-06.xml b/xml/htdocs/security/en/glsa/glsa-200506-06.xml
new file mode 100644
index 00000000..9fade7f4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-06.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-06">
+  <title>libextractor: Multiple overflow vulnerabilities</title>
+  <synopsis>
+    libextractor is affected by several overflow vulnerabilities in the PDF,
+    Real and PNG extractors, making it vulnerable to execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">libextractor</product>
+  <announced>June 09, 2005</announced>
+  <revised>June 09, 2005: 01</revised>
+  <bug>79704</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libextractor" auto="yes" arch="*">
+      <unaffected range="ge">0.5.0</unaffected>
+      <vulnerable range="lt">0.5.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libextractor is a library used to extract meta-data from files. It
+    makes use of Xpdf code to extract information from PDF files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Xpdf is vulnerable to multiple overflows, as described in GLSA
+    200501-28. Also, integer overflows were discovered in Real and PNG
+    extractors.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could design malicious PDF, PNG or Real files which,
+    when processed by an application making use of libextractor, would
+    result in the execution of arbitrary code with the rights of the user
+    running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libextractor users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libextractor-0.5.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0064">CAN-2005-0064</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200501-28.xml">GLSA 200501-28</uri>
+    <uri link="http://gnunet.org/libextractor/">libextractor security announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue,  1 Mar 2005 11:13:31 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu,  3 Mar 2005 15:44:04 +0000">
+    formula7
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 08 Jun 2005 11:34:48 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-07.xml b/xml/htdocs/security/en/glsa/glsa-200506-07.xml
new file mode 100644
index 00000000..213793f2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-07.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-07">
+  <title>Ettercap: Format string vulnerability</title>
+  <synopsis>
+    A format string vulnerability in Ettercap could allow a remote attacker to
+    execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">ettercap</product>
+  <announced>June 11, 2005</announced>
+  <revised>June 11, 2005: 01</revised>
+  <bug>94474</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/ettercap" auto="yes" arch="*">
+      <unaffected range="ge">0.7.3</unaffected>
+      <vulnerable range="lt">0.7.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ettercap is a suite of tools for content filtering, sniffing and
+    man in the middle attacks on a LAN.
+    </p>
+  </background>
+  <description>
+    <p>
+    The curses_msg function of Ettercap's Ncurses-based user interface
+    insecurely implements formatted printing.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could craft a malicious network flow that would
+    result in executing arbitrary code with the rights of the user running
+    the Ettercap tool, which is often root.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ettercap users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/ettercap-0.7.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1796">CAN-2005-1796</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 08 Jun 2005 08:05:23 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 08 Jun 2005 16:01:35 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 11 Jun 2005 08:22:41 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-08.xml b/xml/htdocs/security/en/glsa/glsa-200506-08.xml
new file mode 100644
index 00000000..9953f9d1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-08.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-08">
+  <title>GNU shtool, ocaml-mysql: Insecure temporary file creation</title>
+  <synopsis>
+    GNU shtool and ocaml-mysql are vulnerable to symlink attacks, potentially
+    allowing a local user to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">GNU shtool</product>
+  <announced>June 11, 2005</announced>
+  <revised>June 11, 2005: 01</revised>
+  <bug>93782</bug>
+  <bug>93784</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-util/shtool" auto="yes" arch="*">
+      <unaffected range="ge">2.0.1-r2</unaffected>
+      <vulnerable range="lt">2.0.1-r2</vulnerable>
+    </package>
+    <package name="dev-ml/ocaml-mysql" auto="yes" arch="*">
+      <unaffected range="ge">1.0.3-r1</unaffected>
+      <vulnerable range="lt">1.0.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GNU shtool is a compilation of small shell scripts into a single
+    shell tool. The ocaml-mysql package includes the GNU shtool code.
+    </p>
+  </background>
+  <description>
+    <p>
+    Eric Romang has discovered that GNU shtool insecurely creates
+    temporary files with predictable filenames (CAN-2005-1751). On closer
+    inspection, Gentoo Security discovered that the shtool temporary file,
+    once created, was being reused insecurely (CAN-2005-1759).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary
+    files directory, pointing to a valid file somewhere on the filesystem.
+    When a GNU shtool script is executed, this would result in the file
+    being overwritten with the rights of the user running the script, which
+    could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GNU shtool users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-util/shtool-2.0.1-r2&quot;</code>
+    <p>
+    All ocaml-mysql users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-ml/ocaml-mysql-1.0.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1751">CAN-2005-1751</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1759">CAN-2005-1759</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 27 May 2005 16:05:53 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 28 May 2005 21:16:10 +0000">
+    formula7
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 10 Jun 2005 15:51:35 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-09.xml b/xml/htdocs/security/en/glsa/glsa-200506-09.xml
new file mode 100644
index 00000000..83f87cc8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-09.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-09">
+  <title>gedit: Format string vulnerability</title>
+  <synopsis>
+    gedit suffers from a format string vulnerability that could allow arbitrary
+    code execution.
+  </synopsis>
+  <product type="ebuild">gedit</product>
+  <announced>June 11, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>93352</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-editors/gedit" auto="yes" arch="*">
+      <unaffected range="ge">2.10.3</unaffected>
+      <vulnerable range="lt">2.10.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    gedit is the official text editor of the GNOME desktop environement.
+    </p>
+  </background>
+  <description>
+    <p>
+    A format string vulnerability exists when opening files with names
+    containing format specifiers.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A specially crafted file with format specifiers in the filename can
+    cause arbitrary code execution.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All gedit users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-editors/gedit-2.10.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/bid/13699">BugTraq ID 13699</uri>
+    <uri link="http://mail.gnome.org/archives/gnome-announce-list/2005-June/msg00006.html">gedit 10.3 Release Notes</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1686">CVE-2005-1686</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 10 Jun 2005 14:36:10 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 10 Jun 2005 17:36:40 +0000">
+    r2d2
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 11 Jun 2005 11:59:18 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-10.xml b/xml/htdocs/security/en/glsa/glsa-200506-10.xml
new file mode 100644
index 00000000..2c0f7066
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-10.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-10">
+  <title>LutelWall: Insecure temporary file creation</title>
+  <synopsis>
+    LutelWall is vulnerable to symlink attacks, potentially allowing a local
+    user to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">LutelWall</product>
+  <announced>June 11, 2005</announced>
+  <revised>June 11, 2005: 01</revised>
+  <bug>95378</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-firewall/lutelwall" auto="yes" arch="*">
+      <unaffected range="ge">0.98</unaffected>
+      <vulnerable range="lt">0.98</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    LutelWall is a high-level Linux firewall configuration tool.
+    </p>
+  </background>
+  <description>
+    <p>
+    Eric Romang has discovered that the new_version_check() function
+    in LutelWall insecurely creates a temporary file when updating to a new
+    version.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary file
+    directory, pointing to a valid file somewhere on the filesystem. When
+    the update script is executed (usually by the root user), this would
+    result in the file being overwritten with the rights of this user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All LutelWall users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-firewall/lutelwall-0.98&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1879">CAN-2005-1879</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 10 Jun 2005 12:14:36 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 10 Jun 2005 13:37:17 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 10 Jun 2005 15:27:13 +0000">
+    formula7
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-11.xml b/xml/htdocs/security/en/glsa/glsa-200506-11.xml
new file mode 100644
index 00000000..e719d2c1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-11.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-11">
+  <title>Gaim: Denial of Service vulnerabilities</title>
+  <synopsis>
+    Gaim contains two remote Denial of Service vulnerabilities.
+  </synopsis>
+  <product type="ebuild">gaim</product>
+  <announced>June 12, 2005</announced>
+  <revised>June 12, 2005: 01</revised>
+  <bug>95347</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/gaim" auto="yes" arch="*">
+      <unaffected range="ge">1.3.1</unaffected>
+      <vulnerable range="lt">1.3.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gaim is a full featured instant messaging client which handles a
+    variety of instant messaging protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jacopo Ottaviani discovered a vulnerability in the Yahoo! file
+    transfer code when being offered files with names containing non-ASCII
+    characters (CAN-2005-1269).
+    </p>
+    <p>
+    Hugo de Bokkenrijder discovered a
+    vulnerability when receiving malformed MSN messages (CAN-2005-1934).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Both vulnerabilities cause Gaim to crash, resulting in a Denial of
+    Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gaim users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/gaim-1.3.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://gaim.sourceforge.net/security/?id=18">Gaim Vulnerability: Remote Yahoo! crash</uri>
+    <uri link="http://gaim.sourceforge.net/security/?id=19">Gaim Vulnerability: MSN Remote DoS</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1269">CAN-2005-1269</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1934">CAN-2005-1934</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 10 Jun 2005 08:03:05 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 10 Jun 2005 08:44:05 +0000">
+    r2d2
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 12 Jun 2005 13:55:53 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-12.xml b/xml/htdocs/security/en/glsa/glsa-200506-12.xml
new file mode 100644
index 00000000..0bc6d304
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-12.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-12">
+  <title>MediaWiki: Cross-site scripting vulnerability</title>
+  <synopsis>
+    MediaWiki is vulnerable to a cross-site scripting attack that could allow
+    arbitrary scripting code execution.
+  </synopsis>
+  <product type="ebuild">mediawiki</product>
+  <announced>June 13, 2005</announced>
+  <revised>June 13, 2005: 01</revised>
+  <bug>95255</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/mediawiki" auto="yes" arch="*">
+      <unaffected range="ge">1.4.5</unaffected>
+      <unaffected range="rge">1.3.13</unaffected>
+      <vulnerable range="lt">1.4.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MediaWiki is a collaborative editing software, used by big
+    projects like Wikipedia.
+    </p>
+  </background>
+  <description>
+    <p>
+    MediaWiki incorrectly handles page template inclusions, rendering
+    it vulnerable to cross-site scripting attacks.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker could exploit this vulnerability to inject
+    malicious script code that will be executed in a user's browser session
+    in the context of the vulnerable site.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MediaWiki users should upgrade to the latest available
+    versions:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose www-apps/mediawiki</code>
+  </resolution>
+  <references>
+    <uri link="http://sourceforge.net/project/shownotes.php?release_id=332231">MediaWiki 1.4.5 Release Notes</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 10 Jun 2005 11:34:01 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 10 Jun 2005 11:34:36 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 11 Jun 2005 12:24:08 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-13.xml b/xml/htdocs/security/en/glsa/glsa-200506-13.xml
new file mode 100644
index 00000000..642bcaa9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-13.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-13">
+  <title>webapp-config: Insecure temporary file handling</title>
+  <synopsis>
+    The webapp-config utility insecurely creates temporary files in a world
+    writable directory, potentially allowing the execution of arbitrary
+    commands.
+  </synopsis>
+  <product type="ebuild">webapp-config</product>
+  <announced>June 17, 2005</announced>
+  <revised>December 30, 2007: 03</revised>
+  <bug>91785</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-admin/webapp-config" auto="yes" arch="*">
+      <unaffected range="ge">1.11</unaffected>
+      <vulnerable range="lt">1.11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    webapp-config is a Gentoo Linux utility to help manage the installation
+    of web-based applications.
+    </p>
+  </background>
+  <description>
+    <p>
+    Eric Romang discovered webapp-config uses a predictable temporary
+    filename while processing certain options, resulting in a race
+    condition.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation of the race condition would allow an attacker
+    to disrupt the operation of webapp-config, or execute arbitrary shell
+    commands with the privileges of the user running webapp-config. A local
+    attacker could use a symlink attack to create or overwrite files with
+    the permissions of the user running webapp-config.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All webapp-config users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/webapp-config-1.11&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1707">CVE-2005-1707</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 10 May 2005 15:08:15 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 10 May 2005 15:49:46 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 17 Jun 2005 08:32:12 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-14.xml b/xml/htdocs/security/en/glsa/glsa-200506-14.xml
new file mode 100644
index 00000000..8fab8197
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-14.xml
@@ -0,0 +1,105 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-14">
+  <title>Sun and Blackdown Java: Applet privilege escalation</title>
+  <synopsis>
+    Sun's and Blackdown's JDK or JRE may allow untrusted applets to elevate
+    their privileges.
+  </synopsis>
+  <product type="ebuild">sun-jdk sun-jre-bin blackdown-jre blackdown-jdk</product>
+  <announced>June 19, 2005</announced>
+  <revised>June 19, 2005: 01</revised>
+  <bug>96092</bug>
+  <bug>96229</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/sun-jdk" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2.08</unaffected>
+      <vulnerable range="lt">1.4.2.08</vulnerable>
+    </package>
+    <package name="dev-java/sun-jre-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2.08</unaffected>
+      <vulnerable range="lt">1.4.2.08</vulnerable>
+    </package>
+    <package name="dev-java/blackdown-jdk" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2.02</unaffected>
+      <vulnerable range="lt">1.4.2.02</vulnerable>
+    </package>
+    <package name="dev-java/blackdown-jre" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2.02</unaffected>
+      <vulnerable range="lt">1.4.2.02</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Sun and Blackdown both provide implementations of the Java
+    Development Kit (JDK) and Java Runtime Environment (JRE).
+    </p>
+  </background>
+  <description>
+    <p>
+    Both Sun's and Blackdown's JDK and JRE may allow untrusted applets
+    to elevate privileges.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could embed a malicious Java applet in a web
+    page and entice a victim to view it. This applet can then bypass
+    security restrictions and execute any command or access any file with
+    the rights of the user running the web browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Sun JDK users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jdk-1.4.2.08&quot;</code>
+    <p>
+    All Sun JRE users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jre-bin-1.4.2.08&quot;</code>
+    <p>
+    All Blackdown JDK users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/blackdown-jdk-1.4.2.02&quot;</code>
+    <p>
+    All Blackdown JRE users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/blackdown-jre-1.4.2.02&quot;</code>
+    <p>
+    Note to SPARC users: There is no stable secure Blackdown Java
+    for the SPARC architecture. Affected users should remove the package
+    until a SPARC package is released.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://sunsolve.sun.com/search/document.do?assetkey=1-26-101749-1">Sun Security Alert ID 101749</uri>
+    <uri link="http://www.blackdown.org/java-linux/java2-status/security/Blackdown-SA-2005-02.txt">Blackdown Java Security Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 16 Jun 2005 16:05:50 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 16 Jun 2005 17:03:44 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 17 Jun 2005 10:34:14 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-15.xml b/xml/htdocs/security/en/glsa/glsa-200506-15.xml
new file mode 100644
index 00000000..b34d27c6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-15.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-15">
+  <title>PeerCast: Format string vulnerability</title>
+  <synopsis>
+    PeerCast suffers from a format string vulnerability that could allow
+    arbitrary code execution.
+  </synopsis>
+  <product type="ebuild">peercast</product>
+  <announced>June 19, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>96199</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/peercast" auto="yes" arch="*">
+      <unaffected range="ge">0.1212</unaffected>
+      <vulnerable range="lt">0.1212</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PeerCast is a media streaming system based on P2P technology.
+    </p>
+  </background>
+  <description>
+    <p>
+    James Bercegay of the GulfTech Security Research Team discovered that
+    PeerCast insecurely implements formatted printing when receiving a
+    request with a malformed URL.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this vulnerability by sending a request
+    with a specially crafted URL to a PeerCast server to execute arbitrary
+    code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PeerCast users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/peercast-0.1212&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gulftech.org/?node=research&amp;article_id=00077-05282005">GulfTech Advisory</uri>
+    <uri link="http://www.peercast.org/forum/viewtopic.php?p=11596">PeerCast Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1806">CVE-2005-1806</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 15 Jun 2005 19:02:57 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 15 Jun 2005 19:42:18 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 19 Jun 2005 19:09:07 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-16.xml b/xml/htdocs/security/en/glsa/glsa-200506-16.xml
new file mode 100644
index 00000000..b27b972f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-16.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-16">
+  <title>cpio: Directory traversal vulnerability</title>
+  <synopsis>
+    cpio contains a flaw which may allow a specially crafted cpio archive to
+    extract files to an arbitrary directory.
+  </synopsis>
+  <product type="ebuild">cpio</product>
+  <announced>June 20, 2005</announced>
+  <revised>June 20, 2005: 01</revised>
+  <bug>90619</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-arch/cpio" auto="yes" arch="*">
+      <unaffected range="ge">2.6-r3</unaffected>
+      <vulnerable range="lt">2.6-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    cpio is a file archival tool which can also read and write tar
+    files.
+    </p>
+  </background>
+  <description>
+    <p>
+    A vulnerability has been found in cpio that can potentially allow
+    a cpio archive to extract its files to an arbitrary directory of the
+    creator's choice.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could create a malicious cpio archive which would
+    create files in arbitrary locations on the victim's system. This issue
+    could also be used in conjunction with a previous race condition
+    vulnerability (CAN-2005-1111) to change permissions on files owned by
+    the victim.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All cpio users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/cpio-2.6-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/396429">Original Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1111">CAN-2005-1111</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 03 May 2005 21:22:45 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 05 May 2005 15:24:08 +0000">
+    lewk
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 19 Jun 2005 20:39:43 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-17.xml b/xml/htdocs/security/en/glsa/glsa-200506-17.xml
new file mode 100644
index 00000000..c7a81228
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-17.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-17">
+  <title>SpamAssassin 3, Vipul's Razor: Denial of Service vulnerability</title>
+  <synopsis>
+    SpamAssassin and Vipul's Razor are vulnerable to a Denial of Service attack
+    when handling certain malformed messages.
+  </synopsis>
+  <product type="ebuild">SpamAssassin, Vipul's Razor</product>
+  <announced>June 21, 2005</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>94722</bug>
+  <bug>95492</bug>
+  <bug>96776</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-filter/spamassassin" auto="yes" arch="*">
+      <unaffected range="ge">3.0.4</unaffected>
+      <unaffected range="lt">3.0.1</unaffected>
+      <vulnerable range="lt">3.0.4</vulnerable>
+    </package>
+    <package name="mail-filter/razor" auto="yes" arch="*">
+      <unaffected range="ge">2.74</unaffected>
+      <vulnerable range="lt">2.74</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SpamAssassin is an extensible email filter which is used to identify
+    junk email. Vipul's Razor is a client for a distributed, collaborative
+    spam detection and filtering network.
+    </p>
+  </background>
+  <description>
+    <p>
+    SpamAssassin and Vipul's Razor contain a Denial of Service
+    vulnerability when handling special misformatted long message headers.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a specially crafted message an attacker could cause a Denial
+    of Service attack against the SpamAssassin/Vipul's Razor server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SpamAssassin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-filter/spamassassin-3.0.4&quot;</code>
+    <p>
+    All Vipul's Razor users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-filter/razor-2.74&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1266">CAN-2005-1266</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2024">CVE-2005-2024</uri>
+    <uri link="http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e">SpamAssassin Announcement</uri>
+    <uri link="http://sourceforge.net/mailarchive/forum.php?thread_id=7520323&amp;forum_id=4259">Vipul's Razor Announcement</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 08 Jun 2005 05:05:05 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 20 Jun 2005 04:49:42 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-18.xml b/xml/htdocs/security/en/glsa/glsa-200506-18.xml
new file mode 100644
index 00000000..99767367
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-18.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-18">
+  <title>Tor: Information disclosure</title>
+  <synopsis>
+    A flaw in Tor may allow the disclosure of arbitrary memory portions.
+  </synopsis>
+  <product type="ebuild">tor</product>
+  <announced>June 21, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>96320</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/tor" auto="yes" arch="*">
+      <unaffected range="ge">0.0.9.10</unaffected>
+      <vulnerable range="lt">0.0.9.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Tor is an implementation of second generation Onion Routing, a
+    connection-oriented anonymizing communication service.
+    </p>
+  </background>
+  <description>
+    <p>
+    A bug in Tor allows attackers to view arbitrary memory contents from an
+    exit server's process space.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker could exploit the memory disclosure to gain sensitive
+    information and possibly even private keys.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Tor users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/tor-0.0.9.10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://archives.seul.org/or/announce/Jun-2005/msg00001.html">Tor Security Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2050">CVE-2005-2050</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 20 Jun 2005 07:51:28 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 20 Jun 2005 13:31:02 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 21 Jun 2005 08:50:44 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-19.xml b/xml/htdocs/security/en/glsa/glsa-200506-19.xml
new file mode 100644
index 00000000..16d06c88
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-19.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-19">
+  <title>SquirrelMail: Several XSS vulnerabilities</title>
+  <synopsis>
+    Squirrelmail is vulnerable to several cross-site scripting vulnerabilities
+    which could lead to a compromise of webmail accounts.
+  </synopsis>
+  <product type="ebuild">SquirrelMail</product>
+  <announced>June 21, 2005</announced>
+  <revised>June 21, 2005: 01</revised>
+  <bug>95937</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/squirrelmail" auto="yes" arch="*">
+      <unaffected range="ge">1.4.4</unaffected>
+      <unaffected range="lt">1.4.0</unaffected>
+      <vulnerable range="lt">1.4.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SquirrelMail is a webmail package written in PHP. It supports IMAP
+    and SMTP protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    SquirrelMail is vulnerable to several cross-site scripting issues,
+    most reported by Martijn Brinkers.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By enticing a user to read a specially-crafted e-mail or using a
+    manipulated URL, an attacker can execute arbitrary scripts running in
+    the context of the victim's browser. This could lead to a compromise of
+    the user's webmail account, cookie theft, etc.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SquirrelMail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/squirrelmail-1.4.4&quot;</code>
+    <p>
+    Note: Users with the vhosts USE flag set should manually use
+    webapp-config to finalize the update.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://www.squirrelmail.org/security/issue/2005-06-15">SquirrelMail Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1769">CAN-2005-1769</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 19 Jun 2005 19:26:13 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 20 Jun 2005 17:48:27 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-20.xml b/xml/htdocs/security/en/glsa/glsa-200506-20.xml
new file mode 100644
index 00000000..12569753
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-20.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-20">
+  <title>Cacti: Several vulnerabilities</title>
+  <synopsis>
+    Cacti is vulnerable to several SQL injection, authentication bypass and
+    file inclusion vulnerabilities.
+  </synopsis>
+  <product type="ebuild">cacti</product>
+  <announced>June 22, 2005</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>96243</bug>
+  <bug>97475</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/cacti" auto="yes" arch="*">
+      <unaffected range="ge">0.8.6f</unaffected>
+      <vulnerable range="lt">0.8.6f</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cacti is a complete web-based frontend to rrdtool.
+    </p>
+  </background>
+  <description>
+    <p>
+    Cacti fails to properly sanitize input which can lead to SQL injection,
+    authentication bypass as well as PHP file inclusion.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could potentially exploit the file inclusion to execute
+    arbitrary code with the permissions of the web server. An attacker
+    could exploit these vulnerabilities to bypass authentication or inject
+    SQL queries to gain information from the database. Only systems with
+    register_globals set to "On" are affected by the file inclusion and
+    authentication bypass vulnerabilities. Gentoo Linux ships with
+    register_globals set to "Off" by default.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cacti users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/cacti-0.8.6f&quot;</code>
+    <p>
+    Note: Users with the vhosts USE flag set should manually use
+    webapp-config to finalize the update.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://www.cacti.net/release_notes_0_8_6e.php">Cacti Release Notes - 0.8.6e</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=267&amp;type=vulnerabilities&amp;flashstatus=false">iDEFENSE SQL injection advisory</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=266&amp;type=vulnerabilities&amp;flashstatus=false">iDEFENSE config_settings advisory</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=265&amp;type=vulnerabilities&amp;flashstatus=false">iDEFENSE remote file inclusion advisory</uri>
+    <uri link="http://www.cacti.net/release_notes_0_8_6f.php">Cacti  Release Notes - 0.8.6f</uri>
+    <uri link="http://www.hardened-php.net/advisory-032005.php">Hardened - PHP Project Cacti Multiple SQL Injection Vulnerabilities</uri>
+    <uri link="http://www.hardened-php.net/advisory-042005.php">Hardened - PHP Project Cacti Remote Command Execution Vulnerability</uri>
+    <uri link="http://www.hardened-php.net/advisory-052005.php">Hardened - PHP Project Cacti Authentification/Addslashes Bypass Vulnerability</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1524">CVE-2005-1524</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1525">CVE-2005-1525</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1526">CVE-2005-1526</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 21 Jun 2005 20:41:03 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 22 Jun 2005 08:16:34 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-21.xml b/xml/htdocs/security/en/glsa/glsa-200506-21.xml
new file mode 100644
index 00000000..1583ec1d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-21.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-21">
+  <title>Trac: File upload vulnerability</title>
+  <synopsis>
+    Trac may allow remote attackers to upload files, possibly leading to the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">trac</product>
+  <announced>June 22, 2005</announced>
+  <revised>June 22, 2005: 01</revised>
+  <bug>96572</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/trac" auto="yes" arch="*">
+      <unaffected range="ge">0.8.4</unaffected>
+      <vulnerable range="lt">0.8.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Trac is a minimalistic web-based project management, wiki and bug
+    tracking system including a Subversion interface.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Esser of the Hardened-PHP project discovered that Trac
+    fails to validate the "id" parameter when uploading attachments to the
+    wiki or the bug tracking system.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit the vulnerability to upload
+    arbitrary files to a directory where the webserver has write access to,
+    possibly leading to the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Trac users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/trac-0.8.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.hardened-php.net/advisory-012005.php">Hardened PHP Advisory 012005</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 21 Jun 2005 20:04:48 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 22 Jun 2005 01:36:58 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 22 Jun 2005 08:15:34 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-22.xml b/xml/htdocs/security/en/glsa/glsa-200506-22.xml
new file mode 100644
index 00000000..495ed057
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-22.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-22">
+  <title>sudo: Arbitrary command execution</title>
+  <synopsis>
+    A vulnerability in sudo may allow local users to elevate privileges.
+  </synopsis>
+  <product type="ebuild">sudo</product>
+  <announced>June 23, 2005</announced>
+  <revised>June 23, 2005: 01</revised>
+  <bug>96618</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-admin/sudo" auto="yes" arch="*">
+      <unaffected range="ge">1.6.8_p9</unaffected>
+      <vulnerable range="lt">1.6.8_p9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    sudo allows a system administrator to give users the ability to
+    run commands as other users.
+    </p>
+  </background>
+  <description>
+    <p>
+    The sudoers file is used to define the actions sudo users are
+    permitted to perform. Charles Morris discovered that a specific layout
+    of the sudoers file could cause the results of an internal check to be
+    clobbered, leaving sudo vulnerable to a race condition.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Successful exploitation would permit a local sudo user to execute
+    arbitrary commands as another user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Reorder the sudoers file using the visudo utility to ensure the
+    'ALL' pseudo-command precedes other command definitions.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All sudo users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/sudo-1.6.8_p9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.sudo.ws/sudo/alerts/path_race.html">Sudo Announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 21 Jun 2005 20:05:11 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 22 Jun 2005 15:18:20 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 23 Jun 2005 06:48:01 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-23.xml b/xml/htdocs/security/en/glsa/glsa-200506-23.xml
new file mode 100644
index 00000000..6f3a6fbf
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-23.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-23">
+  <title>Clam AntiVirus: Denial of Service vulnerability</title>
+  <synopsis>
+    Clam AntiVirus is vulnerable to a Denial of Service attack when processing
+    certain Quantum archives.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>June 27, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>96960</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.86.1</unaffected>
+      <vulnerable range="lt">0.86.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Clam AntiVirus is a GPL anti-virus toolkit, designed for integration
+    with mail servers to perform attachment scanning. Clam AntiVirus also
+    provides a command line scanner and a tool for fetching updates of the
+    virus database.
+    </p>
+  </background>
+  <description>
+    <p>
+    Andrew Toller and Stefan Kanthak discovered that a flaw in libmspack's
+    Quantum archive decompressor renders Clam AntiVirus vulnerable to a
+    Denial of Service attack.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit this vulnerability to cause a Denial of
+    Service by sending a specially crafted Quantum archive to the server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Clam AntiVirus users should upgrade to the latest available
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.86.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://sourceforge.net/project/shownotes.php?release_id=337279">Clam AntiVirus Release Notes</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2056">CVE-2005-2056</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 24 Jun 2005 22:27:44 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 24 Jun 2005 23:09:26 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 26 Jun 2005 16:53:15 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200506-24.xml b/xml/htdocs/security/en/glsa/glsa-200506-24.xml
new file mode 100644
index 00000000..a948b1c6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200506-24.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200506-24">
+  <title>Heimdal: Buffer overflow vulnerabilities</title>
+  <synopsis>
+    Multiple buffer overflow vulnerabilities in Heimdal's telnetd server could
+    allow the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">heimdal</product>
+  <announced>June 29, 2005</announced>
+  <revised>June 29, 2005: 01</revised>
+  <bug>96727</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/heimdal" auto="yes" arch="*">
+      <unaffected range="ge">0.6.5</unaffected>
+      <vulnerable range="lt">0.6.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Heimdal is a free implementation of Kerberos 5 that includes a
+    telnetd server.
+    </p>
+  </background>
+  <description>
+    <p>
+    It has been reported that the "getterminaltype" function of
+    Heimdal's telnetd server is vulnerable to buffer overflows.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could exploit this vulnerability to execute arbitrary
+    code with the permission of the telnetd server program.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-crypt/heimdal-0.6.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2040">CAN-2005-2040</uri>
+    <uri link="http://www.pdc.kth.se/heimdal/advisory/2005-06-20/">Heimdal Advisory 2005-06-20</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 23 Jun 2005 11:06:31 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 23 Jun 2005 12:58:46 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 29 Jun 2005 07:29:29 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-01.xml b/xml/htdocs/security/en/glsa/glsa-200507-01.xml
new file mode 100644
index 00000000..8899f349
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-01.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-01">
+  <title>PEAR XML-RPC, phpxmlrpc: PHP script injection vulnerability</title>
+  <synopsis>
+    The PEAR XML-RPC and phpxmlrpc libraries allow remote attackers to execute
+    arbitrary PHP script commands.
+  </synopsis>
+  <product type="ebuild">pear-xml_rpc phpxmlrpc</product>
+  <announced>July 03, 2005</announced>
+  <revised>July 03, 2005: 01</revised>
+  <bug>97399</bug>
+  <bug>97629</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-php/PEAR-XML_RPC" auto="yes" arch="*">
+      <unaffected range="ge">1.3.1</unaffected>
+      <vulnerable range="lt">1.3.1</vulnerable>
+    </package>
+    <package name="dev-php/phpxmlrpc" auto="yes" arch="*">
+      <unaffected range="ge">1.1.1</unaffected>
+      <vulnerable range="lt">1.1.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The PEAR XML-RPC and phpxmlrpc libraries are both PHP
+    implementations of the XML-RPC protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    James Bercegay of GulfTech Security Research discovered that the
+    PEAR XML-RPC and phpxmlrpc libraries fail to sanatize input sent using
+    the "POST" method.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this vulnerability to execute
+    arbitrary PHP script code by sending a specially crafted XML document
+    to web applications making use of these libraries.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PEAR-XML_RPC users should upgrade to the latest available
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-php/PEAR-XML_RPC-1.3.1&quot;</code>
+    <p>
+    All phpxmlrpc users should upgrade to the latest available
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-php/phpxmlrpc-1.1.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1921">CAN-2005-1921</uri>
+    <uri link="http://www.gulftech.org/?node=research&amp;article_id=00088-07022005">GulfTech Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 01 Jul 2005 16:53:39 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 02 Jul 2005 09:41:01 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 02 Jul 2005 09:55:08 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-02.xml b/xml/htdocs/security/en/glsa/glsa-200507-02.xml
new file mode 100644
index 00000000..d6ae95fe
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-02.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-02">
+  <title>WordPress: Multiple vulnerabilities</title>
+  <synopsis>
+    WordPress contains PHP script injection, cross-site scripting and path
+    disclosure vulnerabilities.
+  </synopsis>
+  <product type="ebuild">wordpress</product>
+  <announced>July 04, 2005</announced>
+  <revised>July 04, 2005: 01</revised>
+  <bug>97374</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/wordpress" auto="yes" arch="*">
+      <unaffected range="ge">1.5.1.3</unaffected>
+      <vulnerable range="lt">1.5.1.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    WordPress is a PHP and MySQL based content management and
+    publishing system.
+    </p>
+  </background>
+  <description>
+    <p>
+    James Bercegay of the GulfTech Security Research Team discovered
+    that WordPress insufficiently checks data passed to the XML-RPC server.
+    He also discovered that WordPress has several cross-site scripting and
+    full path disclosure vulnerabilities.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could use the PHP script injection vulnerabilities to
+    execute arbitrary PHP script commands. Furthermore the cross-site
+    scripting vulnerabilities could be exploited to execute arbitrary
+    script code in a user's browser session in context of a vulnerable
+    site.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All WordPress users should upgrade to the latest available
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/wordpress-1.5.1.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1921">CAN-2005-1921</uri>
+    <uri link="http://www.gulftech.org/?node=research&amp;article_id=00085-06282005">GulfTech Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 30 Jun 2005 16:03:34 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 30 Jun 2005 17:49:02 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 04 Jul 2005 09:45:20 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-03.xml b/xml/htdocs/security/en/glsa/glsa-200507-03.xml
new file mode 100644
index 00000000..68436d2e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-03.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-03">
+  <title>phpBB: Arbitrary command execution</title>
+  <synopsis>
+    A vulnerability in phpBB allows a remote attacker to execute arbitrary
+    commands with the rights of the web server.
+  </synopsis>
+  <product type="ebuild">phpBB</product>
+  <announced>July 04, 2005</announced>
+  <revised>September 03, 2005: 03</revised>
+  <bug>97278</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phpBB" auto="yes" arch="*">
+      <unaffected range="ge">2.0.16</unaffected>
+      <vulnerable range="lt">2.0.16</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpBB is an Open Source bulletin board package.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ron van Daal discovered that phpBB contains a vulnerability in the
+    highlighting code.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Successful exploitation would grant an attacker unrestricted access to
+    the PHP exec() or system() functions, allowing the execution of
+    arbitrary commands with the rights of the web server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Please follow the instructions given in the phpBB announcement.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    The phpBB package is no longer supported by Gentoo Linux and has been
+    masked in the Portage repository, no further announcements will be
+    issued regarding phpBB updates. Users who wish to continue using phpBB
+    are advised to monitor and refer to www.phpbb.com for more information.
+    </p>
+    <p>
+    To continue using the Gentoo-provided phpBB package, please refer to
+    the Portage documentation on unmasking packages and upgrade to 2.0.16.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2086">CAN-2005-2086</uri>
+    <uri link="http://www.phpbb.com/phpBB/viewtopic.php?f=14&amp;t=302011">phpBB Announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 29 Jun 2005 13:31:49 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 29 Jun 2005 14:18:11 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 02 Jul 2005 09:31:28 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-04.xml b/xml/htdocs/security/en/glsa/glsa-200507-04.xml
new file mode 100644
index 00000000..ce8dc8bd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-04.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-04">
+  <title>RealPlayer: Heap overflow vulnerability</title>
+  <synopsis>
+    RealPlayer is vulnerable to a heap overflow that could lead to remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">realplayer</product>
+  <announced>July 06, 2005</announced>
+  <revised>July 06, 2005: 01</revised>
+  <bug>96923</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/realplayer" auto="yes" arch="*">
+      <unaffected range="ge">10.0.5</unaffected>
+      <vulnerable range="lt">10.0.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    RealPlayer is a multimedia player capable of handling multiple
+    multimedia file formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    RealPlayer is vulnerable to a heap overflow when opening RealMedia
+    files which make use of RealText.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to play a specially crafted RealMedia file an
+    attacker could execute arbitrary code with the permissions of the user
+    running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All RealPlayer users should upgrade to the latest available
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/realplayer-10.0.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://service.real.com/help/faq/security/050623_player/EN/">RealNetworks Security Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1766">CAN-2005-1766</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 26 Jun 2005 18:08:55 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 26 Jun 2005 18:38:32 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 06 Jul 2005 12:36:44 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-05.xml b/xml/htdocs/security/en/glsa/glsa-200507-05.xml
new file mode 100644
index 00000000..d24a779f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-05.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-05">
+  <title>zlib: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow has been discovered in zlib, potentially resulting in the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">zlib</product>
+  <announced>July 06, 2005</announced>
+  <revised>July 06, 2005: 01</revised>
+  <bug>98121</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-libs/zlib" auto="yes" arch="*">
+      <unaffected range="ge">1.2.2-r1</unaffected>
+      <vulnerable range="lt">1.2.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    zlib is a widely used free and patent unencumbered data
+    compression library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a
+    buffer overflow in zlib. A bounds checking operation failed to take
+    invalid data into account, allowing a specifically malformed deflate
+    data stream to overrun a buffer.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could construct a malformed data stream, embedding it
+    within network communication or an application file format, potentially
+    resulting in the execution of arbitrary code when decoded by the
+    application using the zlib library.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All zlib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-libs/zlib-1.2.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2096">CAN-2005-2096</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 04 Jul 2005 06:51:26 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 06 Jul 2005 14:21:00 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-06.xml b/xml/htdocs/security/en/glsa/glsa-200507-06.xml
new file mode 100644
index 00000000..dab53ec4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-06.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-06">
+  <title>TikiWiki: Arbitrary command execution through XML-RPC</title>
+  <synopsis>
+    TikiWiki includes PHP XML-RPC code, making it vulnerable to arbitrary
+    command execution.
+  </synopsis>
+  <product type="ebuild">Tikiwiki</product>
+  <announced>July 06, 2005</announced>
+  <revised>July 06, 2005: 01</revised>
+  <bug>97648</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/tikiwiki" auto="yes" arch="*">
+      <unaffected range="ge">1.8.5-r1</unaffected>
+      <vulnerable range="lt">1.8.5-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    TikiWiki is a web-based groupware and content management system
+    (CMS), using PHP, ADOdb and Smarty. TikiWiki includes vulnerable PHP
+    XML-RPC code.
+    </p>
+  </background>
+  <description>
+    <p>
+    TikiWiki is vulnerable to arbitrary command execution as described
+    in GLSA 200507-01.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this vulnerability to execute
+    arbitrary PHP code by sending specially crafted XML data.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All TikiWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/tikiwiki-1.8.5-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://security.gentoo.org/glsa/glsa-200507-01.xml">GLSA 200507-01</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1921">CAN-2005-1921</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 06 Jul 2005 08:27:19 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 06 Jul 2005 08:27:44 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 06 Jul 2005 11:56:52 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-07.xml b/xml/htdocs/security/en/glsa/glsa-200507-07.xml
new file mode 100644
index 00000000..577ffc22
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-07.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-07">
+  <title>phpWebSite: Multiple vulnerabilities</title>
+  <synopsis>
+    phpWebSite is vulnerable to the remote execution of arbitrary PHP script
+    code and to other, yet undisclosed, vulnerabilities.
+  </synopsis>
+  <product type="ebuild">phpwebsite</product>
+  <announced>July 10, 2005</announced>
+  <revised>July 10, 2005: 01</revised>
+  <bug>97461</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phpwebsite" auto="yes" arch="*">
+      <unaffected range="ge">0.10.1-r1</unaffected>
+      <vulnerable range="lt">0.10.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpWebSite is a content management system written in PHP.
+    </p>
+  </background>
+  <description>
+    <p>
+    phpWebSite fails to sanitize input sent to the XML-RPC server
+    using the "POST" method. Other unspecified vulnerabilities have been
+    discovered by Diabolic Crab of Hackers Center.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit the XML-RPC vulnerability to
+    execute arbitrary PHP script code by sending specially crafted XML data
+    to phpWebSite. The undisclosed vulnerabilities do have an unknown
+    impact.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpWebSite users should upgrade to the latest available
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-app/phpwebsite-0.10.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1921">CAN-2005-1921</uri>
+    <uri link="http://phpwebsite.appstate.edu/index.php?module=announce&amp;ANN_user_op=view&amp;ANN_id=989">phpWebSite announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 06 Jul 2005 12:51:16 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 06 Jul 2005 14:39:13 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 09 Jul 2005 22:50:54 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-08.xml b/xml/htdocs/security/en/glsa/glsa-200507-08.xml
new file mode 100644
index 00000000..5ffe8c9b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-08.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-08">
+  <title>phpGroupWare, eGroupWare: PHP script injection vulnerability</title>
+  <synopsis>
+    phpGroupWare and eGroupWare include an XML-RPC implementation which allows
+    remote attackers to execute arbitrary PHP script commands.
+  </synopsis>
+  <product type="ebuild">phpgroupware egroupware</product>
+  <announced>July 10, 2005</announced>
+  <revised>July 10, 2005: 01</revised>
+  <bug>97460</bug>
+  <bug>97651</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phpgroupware" auto="yes" arch="*">
+      <unaffected range="ge">0.9.16.006</unaffected>
+      <vulnerable range="lt">0.9.16.006</vulnerable>
+    </package>
+    <package name="www-apps/egroupware" auto="yes" arch="*">
+      <unaffected range="ge">1.0.0.008</unaffected>
+      <vulnerable range="lt">1.0.0.008</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpGroupWare and eGroupWare are web based collaboration software
+    suites.
+    </p>
+  </background>
+  <description>
+    <p>
+    The XML-RPC implementations of phpGroupWare and eGroupWare fail to
+    sanitize input sent to the XML-RPC server using the "POST" method.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit the XML-RPC vulnerability to
+    execute arbitrary PHP script code by sending specially crafted XML data
+    to the XML-RPC servers of phpGroupWare or eGroupWare.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpGroupWare users should upgrade to the latest available
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-app/phpgroupware-0.9.16.006&quot;</code>
+    <p>
+    All eGroupWare users should upgrade to the latest available
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-app/egroupware-1.0.0.008&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1921">CAN-2005-1921</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 06 Jul 2005 12:50:50 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 06 Jul 2005 15:06:09 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 10 Jul 2005 19:07:48 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-09.xml b/xml/htdocs/security/en/glsa/glsa-200507-09.xml
new file mode 100644
index 00000000..9b4aa779
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-09.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-09">
+  <title>Adobe Acrobat Reader: Buffer overflow vulnerability</title>
+  <synopsis>
+    Adobe Acrobat Reader is vulnerable to a buffer overflow that could lead to
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">acroread</product>
+  <announced>July 11, 2005</announced>
+  <revised>July 11, 2005: 01</revised>
+  <bug>98101</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/acroread" auto="yes" arch="*">
+      <unaffected range="ge">7.0</unaffected>
+      <vulnerable range="le">5.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Adobe Acrobat Reader is a utility used to view PDF files.
+    </p>
+  </background>
+  <description>
+    <p>
+    A buffer overflow has been discovered in the
+    UnixAppOpenFilePerform() function, which is called when Adobe Acrobat
+    Reader tries to open a file with the "\Filespec" tag.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to open a specially crafted PDF document, a
+    remote attacker could exploit this vulnerability to execute arbitrary
+    code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Since Adobe will most likely not update the 5.0 series of Adobe
+    Acrobat Reader for Linux, all users should upgrade to the latest
+    available version of the 7.0 series:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/acroread-7.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1625">CAN-2005-1625</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=279&amp;type=vulnerabilities&amp;flashstatus=true">iDEFENSE Security Advisory</uri>
+    <uri link="http://www.adobe.com/support/techdocs/329083.html">Adobe Security Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 08 Jul 2005 08:39:08 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 08 Jul 2005 15:11:50 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 09 Jul 2005 18:37:26 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-10.xml b/xml/htdocs/security/en/glsa/glsa-200507-10.xml
new file mode 100644
index 00000000..b4a77564
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-10.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-10">
+  <title>Ruby: Arbitrary command execution through XML-RPC</title>
+  <synopsis>
+    A vulnerability in XMLRPC.iPIMethods allows remote attackers to execute
+    arbitrary commands.
+  </synopsis>
+  <product type="ebuild">ruby</product>
+  <announced>July 11, 2005</announced>
+  <revised>July 11, 2005: 01</revised>
+  <bug>96784</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/ruby" auto="yes" arch="*">
+      <unaffected range="ge">1.8.2-r2</unaffected>
+      <vulnerable range="lt">1.8.2-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ruby is an interpreted scripting language for quick and easy
+    object-oriented programming. XML-RPC is a remote procedure call
+    protocol encoded in XML.
+    </p>
+  </background>
+  <description>
+    <p>
+    Nobuhiro IMAI reported that an invalid default value in "utils.rb"
+    causes the security protections of the XML-RPC server to fail.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this vulnerability to execute
+    arbitrary commands.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ruby users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/ruby-1.8.2-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1992">CAN-2005-1992</uri>
+    <uri link="http://www.ruby-lang.org/en/20050701.html">Ruby Security Announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 09 Jul 2005 18:51:00 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 09 Jul 2005 19:20:33 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 11 Jul 2005 12:47:35 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-11.xml b/xml/htdocs/security/en/glsa/glsa-200507-11.xml
new file mode 100644
index 00000000..503153dc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-11.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-11">
+  <title>MIT Kerberos 5: Multiple vulnerabilities</title>
+  <synopsis>
+    MIT Kerberos 5 is vulnerable to a Denial of Service attack and remote
+    execution of arbitrary code, possibly leading to the compromise of the
+    entire Kerberos realm.
+  </synopsis>
+  <product type="ebuild">mit-krb5</product>
+  <announced>July 12, 2005</announced>
+  <revised>July 12, 2005: 01</revised>
+  <bug>98799</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/mit-krb5" auto="yes" arch="*">
+      <unaffected range="ge">1.4.1-r1</unaffected>
+      <vulnerable range="lt">1.4.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MIT Kerberos 5 is the free implementation of the Kerberos network
+    authentication protocol by the Massachusetts Institute of Technology.
+    </p>
+  </background>
+  <description>
+    <p>
+    Daniel Wachdorf discovered that MIT Kerberos 5 could corrupt the
+    heap by freeing unallocated memory when receiving a special TCP request
+    (CAN-2005-1174). He also discovered that the same request could lead to
+    a single-byte heap overflow (CAN-2005-1175). Magnus Hagander discovered
+    that krb5_recvauth() function of MIT Kerberos 5 might try to
+    double-free memory (CAN-2005-1689).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Although exploitation is considered difficult, a remote attacker
+    could exploit the single-byte heap overflow and the double-free
+    vulnerability to execute arbitrary code, which could lead to the
+    compromise of the whole Kerberos realm. A remote attacker could also
+    use the heap corruption to cause a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MIT Kerberos 5 users should upgrade to the latest available
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-crypt/mit-krb5-1.4.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1174">CAN-2005-1174</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1175">CAN-2005-1175</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1689">CAN-2005-1689</uri>
+    <uri link="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2005-002-kdc.txt">MITKRB5-SA-2005-002</uri>
+    <uri link="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2005-003-recvauth.txt">MITKRB5-SA-2005-003</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 08 Jul 2005 08:49:39 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 08 Jul 2005 14:57:37 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 12 Jul 2005 19:05:46 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-12.xml b/xml/htdocs/security/en/glsa/glsa-200507-12.xml
new file mode 100644
index 00000000..8149cac4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-12.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-12">
+  <title>Bugzilla: Unauthorized access and information disclosure</title>
+  <synopsis>
+    Multiple vulnerabilities in Bugzilla could allow remote users to modify bug
+    flags or gain sensitive information.
+  </synopsis>
+  <product type="ebuild">bugzilla</product>
+  <announced>July 13, 2005</announced>
+  <revised>July 13, 2005: 01</revised>
+  <bug>98348</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/bugzilla" auto="yes" arch="*">
+      <unaffected range="ge">2.18.3</unaffected>
+      <vulnerable range="lt">2.18.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Bugzilla is a web-based bug-tracking system used by many projects.
+    </p>
+  </background>
+  <description>
+    <p>
+    Bugzilla allows any user to modify the flags of any bug
+    (CAN-2005-2173). Bugzilla inserts bugs into the database before marking
+    them as private, in connection with MySQL replication this could lead
+    to a race condition (CAN-2005-2174).
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By manually changing the URL to process_bug.cgi, a remote attacker
+    could modify the flags of any given bug, which could trigger an email
+    including the bug summary to be sent to the attacker. The race
+    condition when using Bugzilla with MySQL replication could lead to a
+    short timespan (usually less than a second) where the summary of
+    private bugs is exposed to all users.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Bugzilla users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/bugzilla-2.18.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2173">CAN-2005-2173</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2174">CAN-2005-2174</uri>
+    <uri link="http://www.bugzilla.org/security/2.18.1/">Bugzilla Security Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 12 Jul 2005 07:49:18 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 12 Jul 2005 08:01:09 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 12 Jul 2005 08:53:54 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-13.xml b/xml/htdocs/security/en/glsa/glsa-200507-13.xml
new file mode 100644
index 00000000..7acf469d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-13.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-13">
+  <title>pam_ldap and nss_ldap: Plain text authentication leak</title>
+  <synopsis>
+    pam_ldap and nss_ldap fail to restart TLS when following a referral,
+    possibly leading to credentials being sent in plain text.
+  </synopsis>
+  <product type="ebuild">pam_ldap nss_ldap</product>
+  <announced>July 14, 2005</announced>
+  <revised>July 14, 2005: 01</revised>
+  <bug>96767</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-auth/nss_ldap" auto="yes" arch="*">
+      <unaffected range="ge">239-r1</unaffected>
+      <unaffected range="rge">226-r1</unaffected>
+      <vulnerable range="lt">239-r1</vulnerable>
+    </package>
+    <package name="sys-auth/pam_ldap" auto="yes" arch="*">
+      <unaffected range="ge">178-r1</unaffected>
+      <vulnerable range="lt">178-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    pam_ldap is a Pluggable Authentication Module which allows
+    authentication against an LDAP directory. nss_ldap is a Name Service
+    Switch module which allows 'passwd', 'group' and 'host' database
+    information to be pulled from LDAP. TLS is Transport Layer Security, a
+    protocol that allows encryption of network communications.
+    </p>
+  </background>
+  <description>
+    <p>
+    Rob Holland of the Gentoo Security Audit Team discovered that
+    pam_ldap and nss_ldap fail to use TLS for referred connections if they
+    are referred to a master after connecting to a slave, regardless of the
+    "ssl start_tls" ldap.conf setting.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could sniff passwords or other sensitive information
+    as the communication is not encrypted.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    pam_ldap and nss_ldap can be set to force the use of SSL instead
+    of TLS.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All pam_ldap users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-auth/pam_ldap-178-r1&quot;</code>
+    <p>
+    All nss_ldap users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose sys-auth/nss_ldap</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2069">CAN-2005-2069</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 04 Jul 2005 08:55:26 +0000">
+    tigger
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 04 Jul 2005 14:18:57 +0000">
+    tigger
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 14 Jul 2005 09:08:58 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-14.xml b/xml/htdocs/security/en/glsa/glsa-200507-14.xml
new file mode 100644
index 00000000..27fc1c7e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-14.xml
@@ -0,0 +1,100 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-14">
+  <title>Mozilla Firefox: Multiple vulnerabilities</title>
+  <synopsis>
+    Several vulnerabilities in Mozilla Firefox allow attacks ranging from
+    execution of script code with elevated privileges to information leak.
+  </synopsis>
+  <product type="ebuild">mozilla</product>
+  <announced>July 15, 2005</announced>
+  <revised>July 15, 2005: 01</revised>
+  <bug>95199</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">1.0.5</unaffected>
+      <vulnerable range="lt">1.0.5</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.0.5</unaffected>
+      <vulnerable range="lt">1.0.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Firefox is the next-generation web browser from the
+    Mozilla project.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were found and fixed in Mozilla
+    Firefox:
+    </p>
+    <ul>
+    <li>"moz_bug_r_a4" and "shutdown" discovered that
+    Firefox was improperly cloning base objects (MFSA 2005-56).</li>
+    <li>Michael Krax reported that Firefox was not correctly handling
+    JavaScript URLs from external applications (MFSA 2005-53), and that the
+    "Set as wallpaper" function in versions 1.0.3 and 1.0.4 could be abused
+    to load JavaScript (MFSA 2005-47).</li>
+    <li>Several researchers
+    reported ways to trick Firefox into accepting events generated by web
+    content (MFSA 2005-45).</li>
+    <li>Kohei Yoshino discovered a new way to
+    inject script from the sidebar panel using data: (MFSA 2005-49).</li>
+    <li>"moz_bug_r_a4" reported that Firefox failed to validate XHTML DOM
+    nodes properly (MFSA 2005-55), and that XBL scripts ran even when
+    Javascript is disabled (MFSA 2005-46).</li>
+    <li>"shutdown" discovered a
+    possibly exploitable crash in InstallVersion.compareTo (MFSA
+    2005-50).</li>
+    <li>Finally, Secunia discovered that a child frame can
+    call top.focus() even if the framing page comes from a different origin
+    and has overridden the focus() routine (MFSA 2005-52), and that the
+    frame injection spoofing bug fixed in 1.0.2 was mistakenly reintroduced
+    in 1.0.3 and 1.0.4 (MFSA 2005-51).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft malicious web pages that would
+    leverage these issues to inject and execute arbitrary script code with
+    elevated privileges, steal cookies or other information from web pages,
+    or spoof content.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds for all the issues at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-1.0.5&quot;</code>
+    <p>
+    All Mozilla Firefox binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-1.0.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.mozilla.org/projects/security/known-vulnerabilities.html#Firefox">Mozilla Foundation Security Advisories</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 13 Jul 2005 20:26:29 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 15 Jul 2005 05:32:06 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-15.xml b/xml/htdocs/security/en/glsa/glsa-200507-15.xml
new file mode 100644
index 00000000..38d9cd30
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-15.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-15">
+  <title>PHP: Script injection through XML-RPC</title>
+  <synopsis>
+    PHP includes an XML-RPC implementation which allows remote attackers to
+    execute arbitrary PHP script commands.
+  </synopsis>
+  <product type="ebuild">PHP</product>
+  <announced>July 15, 2005</announced>
+  <revised>July 15, 2005: 01</revised>
+  <bug>97655</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-php/php" auto="yes" arch="*">
+      <unaffected range="ge">4.4.0</unaffected>
+      <vulnerable range="lt">4.4.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHP is a general-purpose scripting language widely used to develop
+    web-based applications. It can run inside a web server using the
+    mod_php module or the CGI version of PHP, or can run stand-alone in a
+    CLI.
+    </p>
+  </background>
+  <description>
+    <p>
+    James Bercegay has discovered that the XML-RPC implementation in
+    PHP fails to sanitize input passed in an XML document, which is used in
+    an "eval()" statement.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit the XML-RPC vulnerability to
+    execute arbitrary PHP script code by sending specially crafted XML data
+    to applications making use of this XML-RPC implementation.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-php/php-4.4.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1921">CAN-2005-1921</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 12 Jul 2005 20:30:47 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 12 Jul 2005 22:51:12 +0000">
+    formula7
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 15 Jul 2005 13:35:35 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-16.xml b/xml/htdocs/security/en/glsa/glsa-200507-16.xml
new file mode 100644
index 00000000..2322c919
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-16.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-16">
+  <title>dhcpcd: Denial of Service vulnerability</title>
+  <synopsis>
+    A vulnerability in dhcpcd may cause the dhcpcd daemon to crash.
+  </synopsis>
+  <product type="ebuild">dhcpcd</product>
+  <announced>July 15, 2005</announced>
+  <revised>July 15, 2005: 01</revised>
+  <bug>98394</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/dhcpcd" auto="yes" arch="*">
+      <unaffected range="ge">1.3.22_p4-r11</unaffected>
+      <vulnerable range="lt">1.3.22_p4-r11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    dhcpcd is a standards compliant DHCP client daemon. It requests an
+    IP address and other information from the DHCP server, automatically
+    configures the network interface, and tries to renew the lease time.
+    </p>
+  </background>
+  <description>
+    <p>
+    infamous42md discovered that dhcpcd can be tricked to read past
+    the end of the supplied DHCP buffer. As a result, this might lead to a
+    crash of the daemon.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    With a malicious DHCP server an attacker could cause a Denial of
+    Service by crashing the DHCP client.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All dhcpcd users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/dhcpcd-1.3.22_p4-r11&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1848">CAN-2005-1848</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 11 Jul 2005 14:38:55 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 11 Jul 2005 17:42:40 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 12 Jul 2005 08:00:32 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-17.xml b/xml/htdocs/security/en/glsa/glsa-200507-17.xml
new file mode 100644
index 00000000..db1fe5e2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-17.xml
@@ -0,0 +1,101 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-17">
+  <title>Mozilla Thunderbird: Multiple vulnerabilities</title>
+  <synopsis>
+    Several vulnerabilities in Mozilla Thunderbird allow attacks ranging from
+    execution of script code with elevated privileges to information leak.
+  </synopsis>
+  <product type="ebuild">thunderbird</product>
+  <announced>July 18, 2005</announced>
+  <revised>July 18, 2005: 01</revised>
+  <bug>98855</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/mozilla-thunderbird" auto="yes" arch="*">
+      <unaffected range="ge">1.0.5</unaffected>
+      <vulnerable range="lt">1.0.5</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.0.5</unaffected>
+      <vulnerable range="lt">1.0.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Thunderbird is the next-generation mail client from the
+    Mozilla project.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were found and fixed in Mozilla
+    Thunderbird:
+    </p>
+    <ul>
+    <li>"moz_bug_r_a4" and "shutdown" discovered
+    that Thunderbird was improperly cloning base objects (MFSA
+    2005-56).</li>
+    <li>"moz_bug_r_a4" also reported that Thunderbird was
+    overly trusting contents, allowing privilege escalation via property
+    overrides (MFSA 2005-41, 2005-44), that it failed to validate XHTML DOM
+    nodes properly (MFSA 2005-55), and that XBL scripts ran even when
+    Javascript is disabled (MFSA 2005-46).</li>
+    <li>"shutdown" discovered a
+    possibly exploitable crash in InstallVersion.compareTo (MFSA
+    2005-50).</li>
+    <li>Andreas Sandblad from Secunia reported that a child
+    frame can call top.focus() even if the framing page comes from a
+    different origin and has overridden the focus() routine (MFSA
+    2005-52).</li>
+    <li>Georgi Guninski reported missing Install object
+    instance checks in the native implementations of XPInstall-related
+    JavaScript objects (MFSA 2005-40).</li>
+    <li>Finally, Vladimir V.
+    Perepelitsa discovered a memory disclosure bug in JavaScript's regular
+    expression string replacement when using an anonymous function as the
+    replacement argument (CAN-2005-0989 and MFSA 2005-33).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft malicious email messages that would
+    leverage these issues to inject and execute arbitrary script code with
+    elevated privileges or help in stealing information.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds for all the issues at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Thunderbird users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-1.0.5&quot;</code>
+    <p>
+    All Mozilla Thunderbird binary users should upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-bin-1.0.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.mozilla.org/projects/security/known-vulnerabilities.html#Thunderbird">Mozilla Foundation Security Advisories</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0989">CAN-2005-0989</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 14 Jul 2005 11:30:45 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 17 Jul 2005 20:53:06 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-18.xml b/xml/htdocs/security/en/glsa/glsa-200507-18.xml
new file mode 100644
index 00000000..43f6f58c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-18.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-18">
+  <title>MediaWiki: Cross-site scripting vulnerability</title>
+  <synopsis>
+    MediaWiki is vulnerable to a cross-site scripting attack that could allow
+    arbitrary JavaScript code execution.
+  </synopsis>
+  <product type="ebuild">mediawiki</product>
+  <announced>July 20, 2005</announced>
+  <revised>August 11, 2005: 03</revised>
+  <bug>99132</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/mediawiki" auto="yes" arch="*">
+      <unaffected range="ge">1.4.6</unaffected>
+      <vulnerable range="lt">1.4.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MediaWiki is a collaborative editing software, used by big projects
+    like Wikipedia.
+    </p>
+  </background>
+  <description>
+    <p>
+    MediaWiki fails to escape a parameter in the page move template
+    correctly.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By enticing a user to visit a specially crafted URL, a remote attacker
+    could exploit this vulnerability to inject malicious JavaScript code
+    that will be executed in a user's browser session in the context of the
+    vulnerable site.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MediaWiki users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/mediawiki-1.4.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2396">CAN-2005-2396</uri>
+    <uri link="http://sourceforge.net/project/shownotes.php?release_id=342530">MediaWiki Release Notes</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 18 Jul 2005 07:34:17 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 18 Jul 2005 07:34:40 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 18 Jul 2005 07:59:14 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-19.xml b/xml/htdocs/security/en/glsa/glsa-200507-19.xml
new file mode 100644
index 00000000..03b765f5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-19.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-19">
+  <title>zlib: Buffer overflow</title>
+  <synopsis>
+    zlib is vulnerable to a buffer overflow which could potentially lead to
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">zlib</product>
+  <announced>July 22, 2005</announced>
+  <revised>July 22, 2005: 01</revised>
+  <bug>99751</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-libs/zlib" auto="yes" arch="*">
+      <unaffected range="ge">1.2.3</unaffected>
+      <vulnerable range="lt">1.2.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    zlib is a widely used free and patent unencumbered data
+    compression library.
+    </p>
+  </background>
+  <description>
+    <p>
+    zlib improperly handles invalid data streams which could lead to a
+    buffer overflow.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By creating a specially crafted compressed data stream, attackers
+    can overwrite data structures for applications that use zlib, resulting
+    in arbitrary code execution or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All zlib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-libs/zlib-1.2.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://archives.neohapsis.com/archives/fulldisclosure/2005-07/0489.html">Full Disclosure Announcement</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1849">CAN-2005-1849</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 21 Jul 2005 05:28:09 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 21 Jul 2005 07:38:10 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 21 Jul 2005 18:38:18 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-20.xml b/xml/htdocs/security/en/glsa/glsa-200507-20.xml
new file mode 100644
index 00000000..9f038dd5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-20.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-20">
+  <title>Shorewall: Security policy bypass</title>
+  <synopsis>
+    A vulnerability in Shorewall allows clients authenticated by MAC address
+    filtering to bypass all other security rules.
+  </synopsis>
+  <product type="ebuild">shorewall</product>
+  <announced>July 22, 2005</announced>
+  <revised>September 14, 2005: 02</revised>
+  <bug>99398</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-firewall/shorewall" auto="yes" arch="*">
+      <unaffected range="ge">2.4.2</unaffected>
+      <vulnerable range="le">2.4.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Shorewall is a high level tool for configuring Netfilter, the firewall
+    facility included in the Linux Kernel.
+    </p>
+  </background>
+  <description>
+    <p>
+    Shorewall fails to enforce security policies if configured with
+    "MACLIST_DISPOSITION" set to "ACCEPT" or "MACLIST_TTL" set to a value
+    greater or equal to 0.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A client authenticated by MAC address filtering could bypass all
+    security policies, possibly allowing him to gain access to restricted
+    services. The default installation has MACLIST_DISPOSITION=REJECT and
+    MACLIST_TTL=(blank) (equivalent to 0). This can be checked by looking
+    at the settings in /etc/shorewall/shorewall.conf
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Set "MACLIST_TTL" to "0" and "MACLIST_DISPOSITION" to "REJECT" in the
+    Shorewall configuration file (usually /etc/shorewall/shorewall.conf).
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Shorewall users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose net-firewall/shorewall</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2317">CAN-2005-2317</uri>
+    <uri link="http://www.shorewall.net/News.htm#20050717">Shorewall Announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 20 Jul 2005 08:32:24 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 20 Jul 2005 09:04:23 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 21 Jul 2005 21:07:14 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-21.xml b/xml/htdocs/security/en/glsa/glsa-200507-21.xml
new file mode 100644
index 00000000..7062e6c2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-21.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-21">
+  <title>fetchmail: Buffer Overflow</title>
+  <synopsis>
+    fetchmail is susceptible to a buffer overflow resulting in a Denial of
+    Service or arbitrary code execution.
+  </synopsis>
+  <product type="ebuild">fetchmail</product>
+  <announced>July 25, 2005</announced>
+  <revised>July 25, 2005: 01</revised>
+  <bug>99865</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/fetchmail" auto="yes" arch="*">
+      <unaffected range="ge">6.2.5.2</unaffected>
+      <vulnerable range="lt">6.2.5.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    fetchmail is a utility that retrieves and forwards mail from
+    remote systems using IMAP, POP, and other protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    fetchmail does not properly validate UIDs coming from a POP3 mail
+    server. The UID is placed in a fixed length buffer on the stack, which
+    can be overflown.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Very long UIDs returned from a malicious or compromised POP3
+    server can cause fetchmail to crash, resulting in a Denial of Service,
+    or allow arbitrary code to be placed on the stack.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All fetchmail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/fetchmail-6.2.5.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://fetchmail.berlios.de/fetchmail-SA-2005-01.txt">Fetchmail Security Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2335">CAN-2005-2335</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 22 Jul 2005 05:37:13 +0000">
+    r2d2
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 24 Jul 2005 07:43:36 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-22.xml b/xml/htdocs/security/en/glsa/glsa-200507-22.xml
new file mode 100644
index 00000000..7d9cc3a2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-22.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-22">
+  <title>sandbox: Insecure temporary file handling</title>
+  <synopsis>
+    The sandbox utility may create temporary files in an insecure manner.
+  </synopsis>
+  <product type="ebuild">sandbox</product>
+  <announced>July 25, 2005</announced>
+  <revised>August 11, 2005: 02</revised>
+  <bug>96782</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-apps/sandbox" auto="yes" arch="*">
+      <unaffected range="ge">1.2.11</unaffected>
+      <vulnerable range="lt">1.2.11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    sandbox is a Gentoo Linux utility used by the Portage package
+    management system.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Gentoo Linux Security Audit Team discovered that the sandbox
+    utility was vulnerable to multiple TOCTOU (Time of Check, Time of Use)
+    file creation race conditions.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    Local users may be able to create or overwrite arbitrary files with the
+    permissions of the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All sandbox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/sandbox-1.2.11&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2449">CAN-2005-2449</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 23 Jul 2005 11:46:49 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 23 Jul 2005 12:17:37 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 24 Jul 2005 07:49:01 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-23.xml b/xml/htdocs/security/en/glsa/glsa-200507-23.xml
new file mode 100644
index 00000000..9b2f3739
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-23.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-23">
+  <title>Kopete: Vulnerability in included Gadu library</title>
+  <synopsis>
+    Kopete is vulnerable to several input validation vulnerabilities which may
+    lead to execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">kopete</product>
+  <announced>July 25, 2005</announced>
+  <revised>July 25, 2005: 01</revised>
+  <bug>99754</bug>
+  <access>remote</access>
+  <affected>
+    <package name="kde-base/kdenetwork" auto="yes" arch="*">
+      <unaffected range="ge">3.4.1-r1</unaffected>
+      <unaffected range="rge">3.3.2-r2</unaffected>
+      <vulnerable range="lt">3.4.1-r1</vulnerable>
+    </package>
+    <package name="kde-base/kopete" auto="yes" arch="*">
+      <unaffected range="ge">3.4.1-r1</unaffected>
+      <vulnerable range="lt">3.4.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDE is a feature-rich graphical desktop environment for Linux and
+    Unix-like Operating Systems. Kopete (also part of kdenetwork) is the
+    KDE Instant Messenger.
+    </p>
+  </background>
+  <description>
+    <p>
+    Kopete contains an internal copy of libgadu and is therefore
+    subject to several input validation vulnerabilities in libgadu.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this vulnerability to execute
+    arbitrary code or crash Kopete.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Delete all Gadu Gadu contacts.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Kopete users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose kde-base/kdenetwork</code>
+    <p>
+    All KDE Split Ebuild Kopete users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kopete-3.4.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.kde.org/info/security/advisory-20050721-1.txt">KDE Security Advisory: libgadu vulnerabilities</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1852">CAN-2005-1852</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 21 Jul 2005 09:34:55 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 25 Jul 2005 17:39:48 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-24.xml b/xml/htdocs/security/en/glsa/glsa-200507-24.xml
new file mode 100644
index 00000000..b8ab7f74
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-24.xml
@@ -0,0 +1,112 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-24">
+  <title>Mozilla Suite: Multiple vulnerabilities</title>
+  <synopsis>
+    Several vulnerabilities in the Mozilla Suite allow attacks ranging from the
+    execution of javascript code with elevated privileges to information
+    leakage.
+  </synopsis>
+  <product type="ebuild">mozilla</product>
+  <announced>July 26, 2005</announced>
+  <revised>July 26, 2005: 01</revised>
+  <bug>98846</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla" auto="yes" arch="*">
+      <unaffected range="ge">1.7.10</unaffected>
+      <vulnerable range="lt">1.7.10</vulnerable>
+    </package>
+    <package name="www-client/mozilla-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.7.10</unaffected>
+      <vulnerable range="lt">1.7.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Mozilla Suite is an all-in-one Internet application suite
+    including a web browser, an advanced e-mail and newsgroup client, IRC
+    client and HTML editor.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were found and fixed in the Mozilla
+    Suite:
+    </p>
+    <ul>
+    <li>"moz_bug_r_a4" and "shutdown" discovered that the
+    Mozilla Suite was improperly cloning base objects (MFSA 2005-56).</li>
+    <li>"moz_bug_r_a4" reported that the suite failed to validate XHTML DOM
+    nodes properly (MFSA 2005-55).</li>
+    <li>Secunia reported that alerts
+    and prompts scripts are presented with the generic title [JavaScript
+    Application] which could lead to tricking a user (MFSA 2005-54).</li>
+    <li>Andreas Sandblad of Secunia reported that top.focus() can be called
+    in the context of a child frame even if the framing page comes from a
+    different origin and has overridden the focus() routine (MFSA
+    2005-52).</li>
+    <li>Secunia reported that a frame-injection spoofing bug
+    which was fixed in earlier versions, was accidently bypassed in Mozilla
+    Suite 1.7.7 (MFSA 2005-51).</li>
+    <li>"shutdown" reported that
+    InstallVersion.compareTo() might be exploitable. When it gets an object
+    rather than a string, the browser would generally crash with an access
+    violation (MFSA 2005-50).</li>
+    <li>Matthew Mastracci reported that by
+    forcing a page navigation immediately after calling the install method
+    can end up running in the context of the new page selected by the
+    attacker (MFSA 2005-48).</li>
+    <li>"moz_bug_r_a4" reported that XBL
+    scripts run even when Javascript is disabled (MFSA 2005-46).</li>
+    <li>
+    Omar Khan, Jochen, "shutdown" and Matthew Mastracci reported that the
+    Mozilla Suite incorrectly distinguished between true events like mouse
+    clicks or keystrokes and synthetic events generated by a web content
+    (MFSA 2005-45).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft malicious web pages that would
+    leverage these issues to inject and execute arbitrary javascript code
+    with elevated privileges, steal cookies or other information from web
+    pages, or spoof content.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Suite users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-1.7.10&quot;</code>
+    <p>
+    All Mozilla Suite binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-bin-1.7.10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.mozilla.org/projects/security/known-vulnerabilities.html#Mozilla">Mozilla Foundation Security Advisories</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 23 Jul 2005 18:08:05 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 23 Jul 2005 18:09:18 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 24 Jul 2005 07:24:03 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-25.xml b/xml/htdocs/security/en/glsa/glsa-200507-25.xml
new file mode 100644
index 00000000..0b2ea759
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-25.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-25">
+  <title>Clam AntiVirus: Integer overflows</title>
+  <synopsis>
+    Clam AntiVirus is vulnerable to integer overflows when handling several
+    file formats, potentially resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>July 26, 2005</announced>
+  <revised>August 11, 2005: 02</revised>
+  <bug>100178</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.86.2</unaffected>
+      <vulnerable range="lt">0.86.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Clam AntiVirus is a GPL anti-virus toolkit, designed for integration
+    with mail servers to perform attachment scanning. Clam AntiVirus also
+    provides a command line scanner and a tool for fetching updates of the
+    virus database.
+    </p>
+  </background>
+  <description>
+    <p>
+    Neel Mehta and Alex Wheeler discovered that Clam AntiVirus is
+    vulnerable to integer overflows when handling the TNEF, CHM and FSG
+    file formats.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By sending a specially-crafted file an attacker could execute arbitrary
+    code with the permissions of the user running Clam AntiVirus.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Clam AntiVirus users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.86.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2450">CAN-2005-2450</uri>
+    <uri link="http://sourceforge.net/project/shownotes.php?release_id=344514">Clam AntiVirus: Release Notes</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 25 Jul 2005 17:48:24 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 25 Jul 2005 19:44:22 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 26 Jul 2005 20:33:43 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-26.xml b/xml/htdocs/security/en/glsa/glsa-200507-26.xml
new file mode 100644
index 00000000..caf86243
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-26.xml
@@ -0,0 +1,115 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-26">
+  <title>GNU Gadu, CenterICQ, Kadu, EKG, libgadu: Remote code execution in Gadu library</title>
+  <synopsis>
+    GNU Gadu, CenterICQ, Kadu, EKG and libgadu are vulnerable to an integer
+    overflow which could potentially lead to the execution of arbitrary code or
+    a Denial of Service.
+  </synopsis>
+  <product type="ebuild">gnugadu centericq kadu ekg libgadu</product>
+  <announced>July 27, 2005</announced>
+  <revised>February 26, 2007: 02</revised>
+  <bug>99816</bug>
+  <bug>99890</bug>
+  <bug>99583</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/gnugadu" auto="yes" arch="*">
+      <unaffected range="ge">2.2.6-r1</unaffected>
+      <vulnerable range="lt">2.2.6-r1</vulnerable>
+    </package>
+    <package name="net-im/centericq" auto="yes" arch="*">
+      <unaffected range="ge">4.20.0-r3</unaffected>
+      <vulnerable range="lt">4.20.0-r3</vulnerable>
+    </package>
+    <package name="net-im/kadu" auto="yes" arch="*">
+      <unaffected range="ge">0.4.1</unaffected>
+      <vulnerable range="lt">0.4.1</vulnerable>
+    </package>
+    <package name="net-im/ekg" auto="yes" arch="*">
+      <unaffected range="ge">1.6_rc3</unaffected>
+      <vulnerable range="lt">1.6_rc3</vulnerable>
+    </package>
+    <package name="net-libs/libgadu" auto="yes" arch="*">
+      <unaffected range="ge">1.7.0_pre20050719</unaffected>
+      <vulnerable range="lt">1.7.0_pre20050719</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GNU Gadu, CenterICQ, Kadu and EKG are instant messaging applications
+    created to support Gadu Gadu instant messaging protocol. libgadu is a
+    library that implements the client side of the Gadu-Gadu protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    GNU Gadu, CenterICQ, Kadu, EKG and libgadu are vulnerable to an integer
+    overflow.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit the integer overflow to execute
+    arbitrary code or cause a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GNU Gadu users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/gnugadu-2.2.6-r1&quot;</code>
+    <p>
+    All Kadu users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/kadu-0.4.1&quot;</code>
+    <p>
+    All EKG users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/ekg-1.6_rc3&quot;</code>
+    <p>
+    All libgadu users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/libgadu-20050719&quot;</code>
+    <p>
+    All CenterICQ users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/centericq-4.20.0-r3&quot;</code>
+    <p>
+    CenterICQ is no longer distributed with Gadu Gadu support, affected
+    users are encouraged to migrate to an alternative package.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1852">CAN-2005-1852</uri>
+    <uri link="http://www.securityfocus.com/archive/1/406026/30/">BugTraq Announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 23 Jul 2005 12:05:13 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 23 Jul 2005 12:53:13 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 26 Jul 2005 19:58:40 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-27.xml b/xml/htdocs/security/en/glsa/glsa-200507-27.xml
new file mode 100644
index 00000000..e604d1a1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-27.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-27">
+  <title>Ethereal: Multiple vulnerabilities</title>
+  <synopsis>
+    Ethereal is vulnerable to numerous vulnerabilities potentially resulting in
+    the execution of arbitrary code or abnormal termination.
+  </synopsis>
+  <product type="ebuild">Ethereal</product>
+  <announced>July 28, 2005</announced>
+  <revised>July 28, 2005: 01</revised>
+  <bug>100316</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/ethereal" auto="yes" arch="*">
+      <unaffected range="ge">0.10.12</unaffected>
+      <vulnerable range="lt">0.10.12</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ethereal is a feature-rich network protocol analyzer.
+    </p>
+  </background>
+  <description>
+    <p>
+    There are numerous vulnerabilities in versions of Ethereal prior
+    to 0.10.12, including:
+    </p>
+    <ul>
+    <li>The SMB dissector could overflow a
+    buffer or exhaust memory (CAN-2005-2365).</li>
+    <li>iDEFENSE discovered
+    that several dissectors are vulnerable to format string overflows
+    (CAN-2005-2367).</li>
+    <li>Additionally multiple potential crashes in
+    many dissectors have been fixed, see References for further
+    details.</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker might be able to use these vulnerabilities to crash
+    Ethereal or execute arbitrary code with the permissions of the user
+    running Ethereal, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ethereal users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/ethereal-0.10.12&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.ethereal.com/appnotes/enpa-sa-00020.html">Ethereal enpa-sa-00020</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2360">CAN-2005-2360</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2361">CAN-2005-2361</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2362">CAN-2005-2362</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2363">CAN-2005-2363</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2364">CAN-2005-2364</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2365">CAN-2005-2365</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2366">CAN-2005-2366</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2367">CAN-2005-2367</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 26 Jul 2005 19:41:31 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 28 Jul 2005 05:33:45 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-28.xml b/xml/htdocs/security/en/glsa/glsa-200507-28.xml
new file mode 100644
index 00000000..eec04e84
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-28.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-28">
+  <title>AMD64 x86 emulation base libraries: Buffer overflow</title>
+  <synopsis>
+    The x86 emulation base libraries for AMD64 contain a vulnerable version of
+    zlib which could potentially lead to execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">emul-linux-x86-baselibs</product>
+  <announced>July 30, 2005</announced>
+  <revised>August 02, 2005: 02</revised>
+  <bug>100686</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-emulation/emul-linux-x86-baselibs" auto="yes" arch="AMD64">
+      <unaffected range="ge">2.1.2</unaffected>
+      <vulnerable range="lt">2.1.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The x86 emulation base libraries for AMD64 emulate the x86 (32-bit)
+    architecture on the AMD64 (64-bit) architecture.
+    </p>
+  </background>
+  <description>
+    <p>
+    Earlier versions of emul-linux-x86-baselibs contain a vulnerable
+    version of zlib, which may lead to a buffer overflow.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By creating a specially crafted compressed data stream, attackers can
+    overwrite data structures for applications that use the x86 emulation
+    base libraries for AMD64, resulting in a Denial of Service and
+    potentially arbitrary code execution.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All AMD64 x86 emulation base libraries users should upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose app-emulation/emul-linux-x86-baselibs</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200507-05.xml">GLSA 200507-05</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200507-19.xml">GLSA 200507-19</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1849">CAN-2005-1849</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2096">CAN-2005-2096</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 30 Jul 2005 08:48:26 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 30 Jul 2005 08:50:21 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 30 Jul 2005 09:53:12 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200507-29.xml b/xml/htdocs/security/en/glsa/glsa-200507-29.xml
new file mode 100644
index 00000000..2c652690
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200507-29.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200507-29">
+  <title>pstotext: Remote execution of arbitrary code</title>
+  <synopsis>
+    pstotext contains a vulnerability which can potentially result in the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">pstotext</product>
+  <announced>July 31, 2005</announced>
+  <revised>August 11, 2005: 02</revised>
+  <bug>100245</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/pstotext" auto="yes" arch="*">
+      <unaffected range="ge">1.8g-r1</unaffected>
+      <vulnerable range="lt">1.8g-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    pstotext is a program that works with GhostScript to extract plain text
+    from PostScript and PDF files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Max Vozeler reported that pstotext calls the GhostScript interpreter on
+    untrusted PostScript files without specifying the -dSAFER option.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could craft a malicious PostScript file and entice a user
+    to run pstotext on it, resulting in the execution of arbitrary commands
+    with the permissions of the user running pstotext.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All pstotext users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/pstotext-1.8g-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2536">CAN-2005-2536</uri>
+    <uri link="http://secunia.com/advisories/16183/">Secunia Advisory SA16183</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 30 Jul 2005 18:50:03 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 30 Jul 2005 18:53:14 +0000">
+    adir
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 30 Jul 2005 19:15:41 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-01.xml b/xml/htdocs/security/en/glsa/glsa-200508-01.xml
new file mode 100644
index 00000000..a189b348
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-01.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-01">
+  <title>Compress::Zlib: Buffer overflow</title>
+  <synopsis>
+    Compress::Zlib is vulnerable to a buffer overflow which could potentially
+    lead to execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Compress-Zlib</product>
+  <announced>August 01, 2005</announced>
+  <revised>May 28, 2009: 02</revised>
+  <bug>100540</bug>
+  <access>remote</access>
+  <affected>
+    <package name="perl-core/Compress-Zlib" auto="yes" arch="*">
+      <unaffected range="ge">1.35</unaffected>
+      <vulnerable range="lt">1.35</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Compress::Zlib is a Perl module which provides an interface to
+    the zlib compression library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Compress::Zlib 1.34 contains a local vulnerable version of zlib,
+    which may lead to a buffer overflow.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By creating a specially crafted compressed data stream, attackers
+    can overwrite data structures for applications that use Compress::Zlib,
+    resulting in a Denial of Service and potentially arbitrary code
+    execution.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Compress::Zlib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=perl-core/Compress-Zlib-1.35&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200507-19.xml">GLSA 200507-19</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200507-05.xml">GLSA 200507-05</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1849">CAN-2005-1849</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2096">CAN-2005-2096</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 28 Jul 2005 11:43:56 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 29 Jul 2005 23:24:17 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 01 Aug 2005 05:55:33 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-02.xml b/xml/htdocs/security/en/glsa/glsa-200508-02.xml
new file mode 100644
index 00000000..6d657876
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-02.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-02">
+  <title>ProFTPD: Format string vulnerabilities</title>
+  <synopsis>
+    Under specific circumstances, ProFTPD is vulnerable to format string
+    vulnerabilities, potentially resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">proftpd</product>
+  <announced>August 01, 2005</announced>
+  <revised>August 01, 2005: 01</revised>
+  <bug>100364</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-ftp/proftpd" auto="yes" arch="*">
+      <unaffected range="ge">1.2.10-r7</unaffected>
+      <vulnerable range="lt">1.2.10-r7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ProFTPD is a configurable GPL-licensed FTP server software.
+    </p>
+  </background>
+  <description>
+    <p> "infamous42md" reported that ProFTPD is vulnerable to format
+    string vulnerabilities when displaying a shutdown message containing
+    the name of the current directory, and when displaying response
+    messages to the client using information retrieved from a database
+    using mod_sql.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could create a directory with a malicious name
+    that would trigger the format string issue if specific variables are
+    used in the shutdown message, potentially resulting in a Denial of
+    Service or the execution of arbitrary code with the rights of the user
+    running the ProFTPD server. An attacker with control over the database
+    contents could achieve the same result by introducing malicious
+    messages that would trigger the other format string issue when used in
+    server responses.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not use the "%C", "%R", or "%U" in shutdown messages, and do
+    not set the "SQLShowInfo" directive.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ProFTPD users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-ftp/proftpd-1.2.10-r7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2390">CAN-2005-2390</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 27 Jul 2005 14:13:46 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 30 Jul 2005 00:11:05 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 31 Jul 2005 14:18:50 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-03.xml b/xml/htdocs/security/en/glsa/glsa-200508-03.xml
new file mode 100644
index 00000000..6f7af32e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-03.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-03">
+  <title>nbSMTP: Format string vulnerability</title>
+  <synopsis>
+    nbSMTP is vulnerable to a format string vulnerability which may result in
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">nbsmtp</product>
+  <announced>August 02, 2005</announced>
+  <revised>August 11, 2005: 02</revised>
+  <bug>100274</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-mta/nbsmtp" auto="yes" arch="*">
+      <unaffected range="ge">1.00</unaffected>
+      <vulnerable range="lt">1.00</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    nbSMTP is an SMTP client suitable to run in chroot jails, in embedded
+    systems, laptops and workstations.
+    </p>
+  </background>
+  <description>
+    <p>
+    Niels Heinen discovered a format string vulnerability.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker can setup a malicious SMTP server and exploit this
+    vulnerability to execute arbitrary code with the permissions of the
+    user running nbSMTP.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All nbSMTP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-mta/nbsmtp-1.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2409">CAN-2005-2409</uri>
+    <uri link="http://nbsmtp.ferdyx.org/">nbSMTP official site</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 29 Jul 2005 15:56:07 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 29 Jul 2005 23:01:19 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 02 Aug 2005 12:46:50 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-04.xml b/xml/htdocs/security/en/glsa/glsa-200508-04.xml
new file mode 100644
index 00000000..849c257d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-04.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-04">
+  <title>Netpbm: Arbitrary code execution in pstopnm</title>
+  <synopsis>
+    The pstopnm utility, part of the Netpbm tools, contains a vulnerability
+    which can potentially result in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Netpbm</product>
+  <announced>August 05, 2005</announced>
+  <revised>May 28, 2009: 06</revised>
+  <bug>100398</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/netpbm" auto="yes" arch="*">
+      <unaffected range="ge">10.28</unaffected>
+      <unaffected range="rge">10.26.32</unaffected>
+      <unaffected range="rge">10.26.33</unaffected>
+      <unaffected range="rge">10.26.42</unaffected>
+      <unaffected range="rge">10.26.43</unaffected>
+      <unaffected range="rge">10.26.44</unaffected>
+      <unaffected range="rge">10.26.48</unaffected>
+      <unaffected range="rge">10.26.49</unaffected>
+      <unaffected range="rge">10.26.59</unaffected>
+      <unaffected range="rge">10.26.61</unaffected>
+      <vulnerable range="lt">10.28</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Netpbm is a package of 220 graphics programs and a programming
+    libraries, including pstopnm. pstopnm is a tool which converts
+    PostScript files to PNM image files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Max Vozeler reported that pstopnm calls the GhostScript interpreter on
+    untrusted PostScript files without specifying the -dSAFER option, to
+    convert a PostScript file into a PBM, PGM, or PNM file.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could craft a malicious PostScript file and entice a user
+    to run pstopnm on it, resulting in the execution of arbitrary commands
+    with the permissions of the user running pstopnm.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Netpbm users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose media-libs/netpbm</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2471">CAN-2005-2471</uri>
+    <uri link="http://secunia.com/advisories/16184/">Secunia Advisory SA16184</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 02 Aug 2005 10:10:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 02 Aug 2005 11:24:11 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 05 Aug 2005 10:42:23 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-05.xml b/xml/htdocs/security/en/glsa/glsa-200508-05.xml
new file mode 100644
index 00000000..897de7a5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-05.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-05">
+  <title>Heartbeat: Insecure temporary file creation</title>
+  <synopsis>
+    Heartbeat is vulnerable to symlink attacks, potentially allowing a local
+    user to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">Heartbeat</product>
+  <announced>August 07, 2005</announced>
+  <revised>August 07, 2005: 01</revised>
+  <bug>97175</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-cluster/heartbeat" auto="yes" arch="*">
+      <unaffected range="ge">1.2.3-r1</unaffected>
+      <vulnerable range="lt">1.2.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Heartbeat is a component of the High-Availability Linux project.
+    It it used to perform death-of-node detection, communications and
+    cluster management.
+    </p>
+  </background>
+  <description>
+    <p>
+    Eric Romang has discovered that Heartbeat insecurely creates
+    temporary files with predictable filenames.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary file
+    directory, pointing to a valid file somewhere on the filesystem. When a
+    vulnerable script is executed, this could lead to the file being
+    overwritten with the rights of the user running the affected
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Heartbeat users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-cluster/heartbeat-1.2.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2231">CAN-2005-2231</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 05 Aug 2005 07:37:14 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 05 Aug 2005 14:33:59 +0000">
+    formula7
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 05 Aug 2005 14:54:26 +0000">
+    formula7
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-06.xml b/xml/htdocs/security/en/glsa/glsa-200508-06.xml
new file mode 100644
index 00000000..9ad35420
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-06.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-06">
+  <title>Gaim: Remote execution of arbitrary code</title>
+  <synopsis>
+    Gaim is vulnerable to a buffer overflow which could lead to the execution
+    of arbitrary code or to a Denial of Service.
+  </synopsis>
+  <product type="ebuild">Gaim</product>
+  <announced>August 15, 2005</announced>
+  <revised>August 15, 2005: 01</revised>
+  <bug>102000</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/gaim" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0</unaffected>
+      <vulnerable range="lt">1.5.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gaim is a full featured instant messaging client which handles a
+    variety of instant messaging protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    Brandon Perry discovered that Gaim is vulnerable to a heap-based
+    buffer overflow when handling away messages (CAN-2005-2103).
+    Furthermore, Daniel Atallah discovered a vulnerability in the handling
+    of file transfers (CAN-2005-2102).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could create a specially crafted away message
+    which, when viewed by the target user, could lead to the execution of
+    arbitrary code. Also, an attacker could send a file with a non-UTF8
+    filename to a user, which would result in a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gaim users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/gaim-1.5.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2102">CAN-2005-2102</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2103">CAN-2005-2103</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 12 Aug 2005 08:01:27 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 12 Aug 2005 19:16:18 +0000">
+    formula7
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 13 Aug 2005 08:53:41 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-07.xml b/xml/htdocs/security/en/glsa/glsa-200508-07.xml
new file mode 100644
index 00000000..ae8e8e77
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-07.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-07">
+  <title>AWStats: Arbitrary code execution using malicious Referrer information</title>
+  <synopsis>
+    AWStats fails to validate certain log input, which could lead to the
+    execution of arbitrary Perl code during the generation of the statistics.
+  </synopsis>
+  <product type="ebuild">awstats</product>
+  <announced>August 16, 2005</announced>
+  <revised>May 28, 2009: 02</revised>
+  <bug>102145</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-misc/awstats" auto="yes" arch="*">
+      <unaffected range="ge">6.5</unaffected>
+      <vulnerable range="lt">6.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    AWStats is an advanced log file analyzer and statistics generator.
+    In HTTP reports it parses Referrer information in order to display the
+    most common Referrer values that caused users to visit the website.
+    </p>
+  </background>
+  <description>
+    <p>
+    When using a URLPlugin, AWStats fails to sanitize Referrer URL
+    data before using them in a Perl eval() routine.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker can include arbitrary Referrer information in a
+    HTTP request to a web server, therefore injecting tainted data in the
+    log files. When AWStats is run on this log file, this can result in the
+    execution of arbitrary Perl code with the rights of the user running
+    AWStats.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable all URLPlugins in the AWStats configuration.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All AWStats users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-misc/awstats-6.5&quot;</code>
+    <p>
+    Note: Users with the vhosts USE flag set should manually use
+    webapp-config to finalize the update.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1527">CAN-2005-1527</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=290&amp;type=vulnerabilities">iDEFENSE Advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 12 Aug 2005 17:33:30 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 13 Aug 2005 08:56:51 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-08.xml b/xml/htdocs/security/en/glsa/glsa-200508-08.xml
new file mode 100644
index 00000000..b4bd6ae8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-08.xml
@@ -0,0 +1,103 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-08">
+  <title>Xpdf, Kpdf, GPdf: Denial of Service vulnerability</title>
+  <synopsis>
+    Xpdf, Kpdf and GPdf may crash as a result of a Denial of Service
+    vulnerability.
+  </synopsis>
+  <product type="ebuild">xpdf kpdf gpdf</product>
+  <announced>August 16, 2005</announced>
+  <revised>August 16, 2005: 01</revised>
+  <bug>99769</bug>
+  <bug>100263</bug>
+  <bug>100265</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/xpdf" auto="yes" arch="*">
+      <unaffected range="ge">3.00-r10</unaffected>
+      <vulnerable range="lt">3.00-r10</vulnerable>
+    </package>
+    <package name="kde-base/kdegraphics" auto="yes" arch="*">
+      <unaffected range="ge">3.3.2-r3</unaffected>
+      <vulnerable range="lt">3.3.2-r3</vulnerable>
+    </package>
+    <package name="kde-base/kpdf" auto="yes" arch="*">
+      <unaffected range="ge">3.4.1-r1</unaffected>
+      <vulnerable range="lt">3.4.1-r1</vulnerable>
+    </package>
+    <package name="app-text/gpdf" auto="yes" arch="*">
+      <unaffected range="ge">2.10.0-r1</unaffected>
+      <vulnerable range="lt">2.10.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Xpdf, Kpdf and GPdf are PDF file viewers that run under the X
+    Window System. Kpdf and GPdf both contain Xpdf code. Kpdf is also part
+    of kdegraphics.
+    </p>
+  </background>
+  <description>
+    <p>
+    Xpdf, Kpdf and GPdf do not handle a broken table of embedded
+    TrueType fonts correctly. After detecting such a table, Xpdf, Kpdf and
+    GPdf attempt to reconstruct the information in it by decoding the PDF
+    file, which causes the generation of a huge temporary file.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker may cause a Denial of Service by creating a
+    specially crafted PDF file, sending it to a CUPS printing system (which
+    uses Xpdf), or by enticing a user to open it in Xpdf, Kpdf, or GPdf.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Xpdf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/xpdf-3.00-r10&quot;</code>
+    <p>
+    All GPdf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/gpdf-2.10.0-r1&quot;</code>
+    <p>
+    All Kpdf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kdegraphics-3.3.2-r3&quot;</code>
+    <p>
+    All KDE Split Ebuild Kpdf users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kpdf-3.4.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2097">CAN-2005-2097</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 12 Aug 2005 15:22:33 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 12 Aug 2005 20:47:38 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 13 Aug 2005 08:53:33 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-09.xml b/xml/htdocs/security/en/glsa/glsa-200508-09.xml
new file mode 100644
index 00000000..be8e16c7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-09.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-09">
+  <title>bluez-utils: Bluetooth device name validation vulnerability</title>
+  <synopsis>
+    Improper validation of Bluetooth device names can lead to arbitrary command
+    execution.
+  </synopsis>
+  <product type="ebuild">bluez-utils</product>
+  <announced>August 17, 2005</announced>
+  <revised>August 17, 2005: 01</revised>
+  <bug>101557</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-wireless/bluez-utils" auto="yes" arch="*">
+      <unaffected range="ge">2.19</unaffected>
+      <vulnerable range="lt">2.19</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    bluez-utils are the utilities for use with the BlueZ
+    implementation of the Bluetooth wireless standards for Linux.
+    </p>
+  </background>
+  <description>
+    <p>
+    The name of a Bluetooth device is improperly validated by the hcid
+    utility when a remote device attempts to pair itself with a computer.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could create a malicious device name on a Bluetooth
+    device resulting in arbitrary commands being executed as root upon
+    attempting to pair the device with the computer.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All bluez-utils users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-wireless/bluez-utils-2.19&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2547">CAN-2005-2547</uri>
+    <uri link="http://cvs.sourceforge.net/viewcvs.py/bluez/utils/ChangeLog?rev=1.28&amp;view=markup">bluez-utils ChangeLog</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 09 Aug 2005 20:35:32 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 10 Aug 2005 02:45:23 +0000">
+    r2d2
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 17 Aug 2005 13:18:39 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-10.xml b/xml/htdocs/security/en/glsa/glsa-200508-10.xml
new file mode 100644
index 00000000..d2cccf26
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-10.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-10">
+  <title>Kismet: Multiple vulnerabilities</title>
+  <synopsis>
+    Kismet is vulnerable to multiple issues potentially resulting in the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Kismet</product>
+  <announced>August 19, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>102702</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-wireless/kismet" auto="yes" arch="*">
+      <unaffected range="ge">2005.08.1</unaffected>
+      <vulnerable range="lt">2005.08.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Kismet is an 802.11 Layer 2 wireless network detector, sniffer, and
+    intrusion detection system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Kismet is vulnerable to a heap overflow when handling pcap captures and
+    to an integer underflow in the CDP protocol dissector.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    With a specially crafted packet an attacker could cause Kismet to
+    execute arbitrary code with the rights of the user running the program.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Kismet users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-wireless/kismet-2005.08.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.kismetwireless.net/blog/?entry=/kismet/entry-1124158146.txt">Kismet Release Notes</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2626">CVE-2005-2626</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2627">CVE-2005-2627</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 17 Aug 2005 05:08:47 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 18 Aug 2005 05:16:35 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 18 Aug 2005 07:53:07 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-11.xml b/xml/htdocs/security/en/glsa/glsa-200508-11.xml
new file mode 100644
index 00000000..a98a0681
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-11.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-11">
+  <title>Adobe Reader: Buffer Overflow</title>
+  <synopsis>
+    Adobe Reader is vulnerable to a buffer overflow which could potentially
+    lead to execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">acroread</product>
+  <announced>August 19, 2005</announced>
+  <revised>August 19, 2005: 01</revised>
+  <bug>102730</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/acroread" auto="yes" arch="*">
+      <unaffected range="ge">7.0.1.1</unaffected>
+      <vulnerable range="lt">7.0.1.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Adobe Reader is a utility used to view PDF files.
+    </p>
+  </background>
+  <description>
+    <p>
+    A buffer overflow has been reported within a core application
+    plug-in, which is part of Adobe Reader.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker may create a specially-crafted PDF file, enticing a
+    user to open it. This could trigger a buffer overflow as the file is
+    being loaded, resulting in the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Adobe Reader users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/acroread-7.0.1.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2470">CAN-2005-2470</uri>
+    <uri link="http://www.adobe.com/support/techdocs/321644.html">Adobe Document 321644</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 16 Aug 2005 23:13:16 +0000">
+    formula7
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 17 Aug 2005 16:19:50 +0000">
+    adir
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 17 Aug 2005 16:52:49 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-12.xml b/xml/htdocs/security/en/glsa/glsa-200508-12.xml
new file mode 100644
index 00000000..3fec98bc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-12.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-12">
+  <title>Evolution: Format string vulnerabilities</title>
+  <synopsis>
+    Evolution is vulnerable to format string vulnerabilities which may result
+    in remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">evolution</product>
+  <announced>August 23, 2005</announced>
+  <revised>August 23, 2005: 01</revised>
+  <bug>102051</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/evolution" auto="yes" arch="*">
+      <unaffected range="ge">2.2.3-r3</unaffected>
+      <vulnerable range="lt">2.2.3-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Evolution is a GNOME groupware application.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ulf Harnhammar discovered that Evolution is vulnerable to format
+    string bugs when viewing attached vCards and when displaying contact
+    information from remote LDAP servers or task list data from remote
+    servers (CAN-2005-2549). He also discovered that Evolution fails to
+    handle special calendar entries if the user switches to the Calendars
+    tab (CAN-2005-2550).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could attach specially crafted vCards to emails or
+    setup malicious LDAP servers or calendar entries which would trigger
+    the format string vulnerabilities when viewed or accessed from
+    Evolution. This could potentially result in the execution of arbitrary
+    code with the rights of the user running Evolution.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Evolution users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/evolution-2.2.3-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2549">CAN-2005-2549</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2550">CAN-2005-2550</uri>
+    <uri link="http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html">SITIC Vulnerability Advisory SA05-001</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 21 Aug 2005 20:42:02 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 22 Aug 2005 11:14:56 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 23 Aug 2005 07:46:15 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-13.xml b/xml/htdocs/security/en/glsa/glsa-200508-13.xml
new file mode 100644
index 00000000..9585761b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-13.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-13">
+  <title>PEAR XML-RPC, phpxmlrpc: New PHP script injection vulnerability</title>
+  <synopsis>
+    The PEAR XML-RPC and phpxmlrpc libraries allow remote attackers to execute
+    arbitrary PHP script commands.
+  </synopsis>
+  <product type="ebuild">pear-xml_rpc phpxmlrpc</product>
+  <announced>August 24, 2005</announced>
+  <revised>August 24, 2005: 01</revised>
+  <bug>102378</bug>
+  <bug>102576</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-php/PEAR-XML_RPC" auto="yes" arch="*">
+      <unaffected range="ge">1.4.0</unaffected>
+      <vulnerable range="lt">1.4.0</vulnerable>
+    </package>
+    <package name="dev-php/phpxmlrpc" auto="yes" arch="*">
+      <unaffected range="ge">1.2-r1</unaffected>
+      <vulnerable range="lt">1.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The PEAR XML-RPC and phpxmlrpc libraries are both PHP
+    implementations of the XML-RPC protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Esser of the Hardened-PHP Project discovered that the PEAR
+    XML-RPC and phpxmlrpc libraries were improperly handling XMLRPC
+    requests and responses with malformed nested tags.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this vulnerability to inject
+    arbitrary PHP script code into eval() statements by sending a specially
+    crafted XML document to web applications making use of these libraries.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PEAR-XML_RPC users should upgrade to the latest available
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-php/PEAR-XML_RPC-1.4.0&quot;</code>
+    <p>
+    All phpxmlrpc users should upgrade to the latest available
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-php/phpxmlrpc-1.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2498">CAN-2005-2498</uri>
+    <uri link="http://www.hardened-php.net/advisory_142005.66.html">Hardened-PHP 14/2005 Advisory</uri>
+    <uri link="http://www.hardened-php.net/advisory_152005.67.html">Hardened-PHP 15/2005 Advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 23 Aug 2005 08:36:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 23 Aug 2005 20:48:36 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-14.xml b/xml/htdocs/security/en/glsa/glsa-200508-14.xml
new file mode 100644
index 00000000..ad596c1f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-14.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-14">
+  <title>TikiWiki, eGroupWare: Arbitrary command execution through XML-RPC</title>
+  <synopsis>
+    TikiWiki and eGroupWare both include PHP XML-RPC code vulnerable to
+    arbitrary command execution.
+  </synopsis>
+  <product type="ebuild">tikiwiki egroupware</product>
+  <announced>August 24, 2005</announced>
+  <revised>August 24, 2005: 01</revised>
+  <bug>102374</bug>
+  <bug>102377</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/tikiwiki" auto="yes" arch="*">
+      <unaffected range="ge">1.8.5-r2</unaffected>
+      <vulnerable range="lt">1.8.5-r2</vulnerable>
+    </package>
+    <package name="www-apps/egroupware" auto="yes" arch="*">
+      <unaffected range="ge">1.0.0.009</unaffected>
+      <vulnerable range="lt">1.0.0.009</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    TikiWiki is a full featured Free Software Wiki, CMS and Groupware
+    written in PHP. eGroupWare is a web-based collaboration software suite.
+    Both TikiWiki and eGroupWare include a PHP library to handle XML-RPC
+    requests.
+    </p>
+  </background>
+  <description>
+    <p>
+    The XML-RPC library shipped in TikiWiki and eGroupWare improperly
+    handles XML-RPC requests and responses with malformed nested tags.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this vulnerability to inject
+    arbitrary PHP script code into eval() statements by sending a specially
+    crafted XML document to TikiWiki or eGroupWare.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All TikiWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/tikiwiki-1.8.5-r2&quot;</code>
+    <p>
+    All eGroupWare users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/egroupware-1.0.0.009&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2498">CAN-2005-2498</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 22 Aug 2005 20:59:23 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 23 Aug 2005 23:39:36 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 24 Aug 2005 19:23:08 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-15.xml b/xml/htdocs/security/en/glsa/glsa-200508-15.xml
new file mode 100644
index 00000000..9d9a13e3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-15.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-15">
+  <title>Apache 2.0: Denial of Service vulnerability</title>
+  <synopsis>
+    A bug in Apache may allow a remote attacker to perform a Denial of Service
+    attack.
+  </synopsis>
+  <product type="ebuild">apache</product>
+  <announced>August 25, 2005</announced>
+  <revised>December 30, 2007: 03</revised>
+  <bug>102991</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="ge">2.0.54-r9</unaffected>
+      <unaffected range="lt">2.0</unaffected>
+      <vulnerable range="lt">2.0.54-r9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP Server Project is a featureful, freely-available HTTP
+    (Web) server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Filip Sneppe discovered that Apache improperly handles byterange
+    requests to CGI scripts.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker may access vulnerable scripts in a malicious way,
+    exhausting all RAM and swap space on the server, resulting in a Denial
+    of Service of the Apache server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All apache users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/apache-2.0.54-r9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://issues.apache.org/bugzilla/show_bug.cgi?id=29962">ASF Bugzilla Bug 29962</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2728">CVE-2005-2728</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 22 Aug 2005 07:26:08 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 22 Aug 2005 07:47:26 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 24 Aug 2005 00:58:46 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-16.xml b/xml/htdocs/security/en/glsa/glsa-200508-16.xml
new file mode 100644
index 00000000..e7938a1a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-16.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-16">
+  <title>Tor: Information disclosure</title>
+  <synopsis>
+    A flaw in Tor leads to the disclosure of information and the loss of
+    anonymity, integrity and confidentiality.
+  </synopsis>
+  <product type="ebuild">tor</product>
+  <announced>August 25, 2005</announced>
+  <revised>August 25, 2005: 01</revised>
+  <bug>102245</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/tor" auto="yes" arch="*">
+      <unaffected range="ge">0.1.0.14</unaffected>
+      <vulnerable range="lt">0.1.0.14</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Tor is an implementation of second generation Onion Routing, a
+    connection-oriented anonymizing communication service.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Diffie-Hellman implementation of Tor fails to verify the
+    cryptographic strength of keys which are used during handshakes.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By setting up a malicious Tor server and enticing users to use
+    this server as first hop, a remote attacker could read and modify all
+    traffic of the user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Tor users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/tor-0.1.0.14&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2643">CAN-2005-2643</uri>
+    <uri link="http://archives.seul.org/or/announce/Aug-2005/msg00002.html">Tor Security Announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 23 Aug 2005 08:23:08 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 23 Aug 2005 09:42:34 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 23 Aug 2005 16:08:44 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-17.xml b/xml/htdocs/security/en/glsa/glsa-200508-17.xml
new file mode 100644
index 00000000..7a3ee81c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-17.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-17">
+  <title>libpcre: Heap integer overflow</title>
+  <synopsis>
+    libpcre is vulnerable to a heap integer overflow, possibly leading to the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">libpcre</product>
+  <announced>August 25, 2005</announced>
+  <revised>August 25, 2005: 01</revised>
+  <bug>103337</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/libpcre" auto="yes" arch="*">
+      <unaffected range="ge">6.3</unaffected>
+      <vulnerable range="lt">6.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libpcre is a library providing functions for Perl-compatible
+    regular expressions.
+    </p>
+  </background>
+  <description>
+    <p>
+    libpcre fails to check certain quantifier values in regular
+    expressions for sane values.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could possibly exploit this vulnerability to execute
+    arbitrary code by sending specially crafted regular expressions to
+    applications making use of the libpcre library.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libpcre users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/libpcre-6.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2491">CAN-2005-2491</uri>
+    <uri link="http://www.securitytracker.com/alerts/2005/Aug/1014744.html">SecurityTracker Alert ID 1014744</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 23 Aug 2005 08:06:54 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 23 Aug 2005 16:35:02 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 23 Aug 2005 19:48:38 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-18.xml b/xml/htdocs/security/en/glsa/glsa-200508-18.xml
new file mode 100644
index 00000000..6b0ffbea
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-18.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-18">
+  <title>PhpWiki: Arbitrary command execution through XML-RPC</title>
+  <synopsis>
+    PhpWiki includes PHP XML-RPC code which is vulnerable to arbitrary command
+    execution.
+  </synopsis>
+  <product type="ebuild">phpwiki</product>
+  <announced>August 26, 2005</announced>
+  <revised>August 26, 2005: 01</revised>
+  <bug>102380</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phpwiki" auto="yes" arch="*">
+      <unaffected range="ge">1.3.10-r2</unaffected>
+      <vulnerable range="lt">1.3.10-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PhpWiki is an application that creates a web site where anyone can
+    edit the pages through HTML forms.
+    </p>
+  </background>
+  <description>
+    <p>
+    Earlier versions of PhpWiki contain an XML-RPC library that
+    improperly handles XML-RPC requests and responses with malformed nested
+    tags.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this vulnerability to inject
+    arbitrary PHP script code into eval() statements by sending a specially
+    crafted XML document to PhpWiki.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PhpWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/phpwiki-1.3.10-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2498">CAN-2005-2498</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 25 Aug 2005 08:45:11 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 25 Aug 2005 11:46:47 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 25 Aug 2005 20:44:22 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-19.xml b/xml/htdocs/security/en/glsa/glsa-200508-19.xml
new file mode 100644
index 00000000..35b613e5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-19.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-19">
+  <title>lm_sensors: Insecure temporary file creation</title>
+  <synopsis>
+    lm_sensors is vulnerable to linking attacks, potentially allowing a local
+    user to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">lm_sensors</product>
+  <announced>August 30, 2005</announced>
+  <revised>August 30, 2005: 01</revised>
+  <bug>103568</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-apps/lm_sensors" auto="yes" arch="*">
+      <unaffected range="ge">2.9.1-r1</unaffected>
+      <vulnerable range="lt">2.9.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    lm_sensors is a software package that provides drivers for
+    monitoring the temperatures, voltages, and fans of Linux systems with
+    hardware monitoring devices.
+    </p>
+  </background>
+  <description>
+    <p>
+    Javier Fernandez-Sanguino Pena has discovered that lm_sensors
+    insecurely creates temporary files with predictable filenames when
+    saving configurations.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary file
+    directory, pointing to a valid file somewhere on the filesystem. When
+    the pwmconfig script of lm_sensors is executed, this would result in
+    the file being overwritten with the rights of the user running the
+    script, which typically is the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All lm_sensors users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/lm_sensors-2.9.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2672">CAN-2005-2672</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 27 Aug 2005 09:37:19 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 27 Aug 2005 09:38:55 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 27 Aug 2005 22:28:16 +0000">
+    formula7
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-20.xml b/xml/htdocs/security/en/glsa/glsa-200508-20.xml
new file mode 100644
index 00000000..85306a91
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-20.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-20">
+  <title>phpGroupWare: Multiple vulnerabilities</title>
+  <synopsis>
+    phpGroupWare is vulnerable to multiple issues ranging from information
+    disclosure to a potential execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">phpgroupware</product>
+  <announced>August 30, 2005</announced>
+  <revised>August 30, 2005: 01</revised>
+  <bug>102379</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phpgroupware" auto="yes" arch="*">
+      <unaffected range="ge">0.9.16.008</unaffected>
+      <vulnerable range="lt">0.9.16.008</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpGroupWare is a multi-user groupware suite written in PHP.
+    </p>
+  </background>
+  <description>
+    <p>
+    phpGroupWare improperly validates the "mid" parameter retrieved
+    via a forum post. The current version of phpGroupWare also adds several
+    safeguards to prevent XSS issues, and disables the use of a potentially
+    vulnerable XML-RPC library.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker may leverage the XML-RPC vulnerability to
+    execute arbitrary PHP script code. He could also create a specially
+    crafted request that will reveal private posts.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpGroupWare users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/phpgroupware-0.9.16.008&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2005-2498">CAN-2005-2498</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2005-2600">CAN-2005-2600</uri>
+    <uri link="http://secunia.com/advisories/16414">Secunia Advisory SA16414</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 28 Aug 2005 18:52:38 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 29 Aug 2005 09:01:02 +0000">
+    adir
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 29 Aug 2005 10:35:27 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-21.xml b/xml/htdocs/security/en/glsa/glsa-200508-21.xml
new file mode 100644
index 00000000..fc67d73a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-21.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-21">
+  <title>phpWebSite: Arbitrary command execution through XML-RPC and SQL injection</title>
+  <synopsis>
+    phpWebSite is vulnerable to multiple issues which result in the execution
+    of arbitrary code and SQL injection.
+  </synopsis>
+  <product type="ebuild">phpwebsite</product>
+  <announced>August 31, 2005</announced>
+  <revised>August 31, 2005: 01</revised>
+  <bug>102785</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phpwebsite" auto="yes" arch="*">
+      <unaffected range="ge">0.10.2_rc2</unaffected>
+      <vulnerable range="lt">0.10.2_rc2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpWebSite is a web site content management system.
+    </p>
+  </background>
+  <description>
+    <p>
+    phpWebSite uses an XML-RPC library that improperly handles XML-RPC
+    requests and responses with malformed nested tags. Furthermore,
+    "matrix_killer" reported that phpWebSite is vulnerable to an SQL
+    injection attack.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A malicious remote user could exploit this vulnerability to inject
+    arbitrary PHP script code into eval() statements by sending a specially
+    crafted XML document, and also inject SQL commands to access the
+    underlying database directly.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpWebSite users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/phpwebsite-0.10.2_rc2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2498">CAN-2005-2498</uri>
+    <uri link="http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0497.html">Original Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 25 Aug 2005 18:35:22 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 29 Aug 2005 11:14:08 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 31 Aug 2005 02:40:59 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200508-22.xml b/xml/htdocs/security/en/glsa/glsa-200508-22.xml
new file mode 100644
index 00000000..7d6b74db
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200508-22.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200508-22">
+  <title>pam_ldap: Authentication bypass vulnerability</title>
+  <synopsis>
+    pam_ldap contains a vulnerability that may allow a remote attacker to gain
+    system access.
+  </synopsis>
+  <product type="ebuild">pam_ldap</product>
+  <announced>August 31, 2005</announced>
+  <revised>August 31, 2005: 01</revised>
+  <bug>103659</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-auth/pam_ldap" auto="yes" arch="*">
+      <unaffected range="ge">180</unaffected>
+      <vulnerable range="lt">180</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    pam_ldap is a Pluggable Authentication Module which allows
+    authentication against LDAP directories.
+    </p>
+  </background>
+  <description>
+    <p>
+    When a pam_ldap client attempts to authenticate against an LDAP
+    server that omits the optional error value from the
+    PasswordPolicyResponseValue, the authentication attempt will always
+    succeed.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker may exploit this vulnerability to bypass the
+    LDAP authentication mechanism, gaining access to the system possibly
+    with elevated privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All pam_ldap users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-auth/pam_ldap-180&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2641">CAN-2005-2641</uri>
+    <uri link="http://www.kb.cert.org/vuls/id/778916">US-CERT VU#778916</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 29 Aug 2005 14:50:51 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 29 Aug 2005 14:51:34 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 29 Aug 2005 20:08:30 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-01.xml b/xml/htdocs/security/en/glsa/glsa-200509-01.xml
new file mode 100644
index 00000000..3b03aaa3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-01.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-01">
+  <title>MPlayer: Heap overflow in ad_pcm.c</title>
+  <synopsis>
+    A heap overflow in MPlayer might lead to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">MPlayer</product>
+  <announced>September 01, 2005</announced>
+  <revised>September 01, 2005: 01</revised>
+  <bug>103555</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/mplayer" auto="yes" arch="*">
+      <unaffected range="ge">1.0_pre7-r1</unaffected>
+      <vulnerable range="lt">1.0_pre7-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MPlayer is a media player capable of handling multiple multimedia
+    file formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sven Tantau discovered a heap overflow in the code handling the
+    strf chunk of PCM audio streams.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could craft a malicious video or audio file which,
+    when opened using MPlayer, would end up executing arbitrary code on the
+    victim's computer with the permissions of the user running MPlayer.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    You can mitigate the issue by adding "ac=-pcm," to your MPlayer
+    configuration file (note that this will prevent you from playing
+    uncompressed audio).
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MPlayer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/mplayer-1.0_pre7-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2718">CAN-2005-2718</uri>
+    <uri link="http://www.sven-tantau.de/public_files/mplayer/mplayer_20050824.txt">Original Advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 28 Aug 2005 16:55:40 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 01 Sep 2005 08:08:19 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-02.xml b/xml/htdocs/security/en/glsa/glsa-200509-02.xml
new file mode 100644
index 00000000..e62534ab
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-02.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-02">
+  <title>Gnumeric: Heap overflow in the included PCRE library</title>
+  <synopsis>
+    Gnumeric is vulnerable to a heap overflow, possibly leading to the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Gnumeric</product>
+  <announced>September 03, 2005</announced>
+  <revised>September 03, 2005: 01</revised>
+  <bug>104010</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/gnumeric" auto="yes" arch="*">
+      <unaffected range="ge">1.4.3-r2</unaffected>
+      <vulnerable range="lt">1.4.3-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Gnumeric spreadsheet is a versatile application developed as
+    part of the GNOME Office project. libpcre is a library providing
+    functions for Perl-compatible regular expressions.
+    </p>
+  </background>
+  <description>
+    <p>
+    Gnumeric contains a private copy of libpcre which is subject to an
+    integer overflow leading to a heap overflow (see GLSA 200508-17).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could potentially exploit this vulnerability by
+    tricking a user into opening a specially crafted spreadsheet, which
+    could lead to the execution of arbitrary code with the privileges of
+    the user running Gnumeric.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gnumeric users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/gnumeric-1.4.3-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2491">CAN-2005-2491</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200508-17.xml">GLSA 200508-17</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 02 Sep 2005 07:34:06 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 02 Sep 2005 08:27:17 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 02 Sep 2005 15:23:09 +0000">
+    formula7
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-03.xml b/xml/htdocs/security/en/glsa/glsa-200509-03.xml
new file mode 100644
index 00000000..3f24cf34
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-03.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-03">
+  <title>OpenTTD: Format string vulnerabilities</title>
+  <synopsis>
+    OpenTTD is vulnerable to format string vulnerabilities which may result in
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">openttd</product>
+  <announced>September 05, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>102631</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-simulation/openttd" auto="yes" arch="*">
+      <unaffected range="ge">0.4.0.1-r1</unaffected>
+      <vulnerable range="lt">0.4.0.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenTTD is an open source clone of the simulation game "Transport
+    Tycoon Deluxe" by Microprose.
+    </p>
+  </background>
+  <description>
+    <p>
+    Alexey Dobriyan discovered several format string vulnerabilities in
+    OpenTTD.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit these vulnerabilities to crash the
+    OpenTTD server or client and possibly execute arbitrary code with the
+    rights of the user running OpenTTD.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenTTD users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-simulation/openttd-0.4.0.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2763">CAN-2005-2763</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2764">CVE-2005-2764</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 01 Sep 2005 05:03:56 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 01 Sep 2005 08:12:01 +0000">
+    adir
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 04 Sep 2005 15:43:14 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-04.xml b/xml/htdocs/security/en/glsa/glsa-200509-04.xml
new file mode 100644
index 00000000..8a4807ab
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-04.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-04">
+  <title>phpLDAPadmin: Authentication bypass</title>
+  <synopsis>
+    A flaw in phpLDAPadmin may allow attackers to bypass security restrictions
+    and connect anonymously.
+  </synopsis>
+  <product type="ebuild">phpLDAPadmin</product>
+  <announced>September 06, 2005</announced>
+  <revised>September 06, 2005: 01</revised>
+  <bug>104293</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-nds/phpldapadmin" auto="yes" arch="*">
+      <unaffected range="ge">0.9.7_alpha6</unaffected>
+      <vulnerable range="lt">0.9.7_alpha6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpLDAPadmin is a web-based LDAP client allowing to easily manage
+    LDAP servers.
+    </p>
+  </background>
+  <description>
+    <p>
+    Alexander Gerasiov discovered a flaw in login.php preventing the
+    application from validating whether anonymous bind has been disabled in
+    the target LDAP server configuration.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    Anonymous users can access the LDAP server, even if the
+    "disable_anon_bind" parameter was explicitly set to avoid this.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpLDAPadmin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-nds/phpldapadmin-0.9.7_alpha6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2654">CAN-2005-2654</uri>
+    <uri link="http://secunia.com/advisories/16611/">Secunia Advisory SA16611</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 31 Aug 2005 17:15:50 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 31 Aug 2005 17:15:59 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 02 Sep 2005 18:39:01 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-05.xml b/xml/htdocs/security/en/glsa/glsa-200509-05.xml
new file mode 100644
index 00000000..009a8d47
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-05.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-05">
+  <title>Net-SNMP: Insecure RPATH</title>
+  <synopsis>
+    The Gentoo Net-SNMP package may provide Perl modules containing an insecure
+    DT_RPATH, potentially allowing privilege escalation.
+  </synopsis>
+  <product type="ebuild">net-snmp</product>
+  <announced>September 06, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>103776</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-analyzer/net-snmp" auto="yes" arch="*">
+      <unaffected range="ge">5.2.1.2-r1</unaffected>
+      <vulnerable range="lt">5.2.1.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Net-SNMP is a suite of applications used to implement the Simple
+    Network Management Protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    James Cloos reported that Perl modules from the Net-SNMP package look
+    for libraries in an untrusted location. This is due to a flaw in the
+    Gentoo package, and not the Net-SNMP suite.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker (member of the portage group) may be able to create a
+    shared object that would be loaded by the Net-SNMP Perl modules,
+    executing arbitrary code with the privileges of the user invoking the
+    Perl script.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Limit group portage access to trusted users.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Net-SNMP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/net-snmp-5.2.1.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2811">CVE-2005-2811</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 04 Sep 2005 14:57:52 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 04 Sep 2005 15:49:44 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 04 Sep 2005 23:48:38 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-06.xml b/xml/htdocs/security/en/glsa/glsa-200509-06.xml
new file mode 100644
index 00000000..6a2bcc6b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-06.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-06">
+  <title>Squid: Denial of Service vulnerabilities</title>
+  <synopsis>
+    Squid contains several bugs when handling certain malformed requests
+    resulting in a Denial of Service.
+  </synopsis>
+  <product type="ebuild">Squid</product>
+  <announced>September 07, 2005</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>104603</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-proxy/squid" auto="yes" arch="*">
+      <unaffected range="ge">2.5.10-r2</unaffected>
+      <vulnerable range="lt">2.5.10-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Squid is a full-featured Web proxy cache designed to run on Unix-like
+    systems. It supports proxying and caching of HTTP, FTP, and other
+    protocols, as well as SSL support, cache hierarchies, transparent
+    caching, access control lists and many more features.
+    </p>
+  </background>
+  <description>
+    <p>
+    Certain malformed requests result in a segmentation fault in the
+    sslConnectTimeout function, handling of other certain requests trigger
+    assertion failures.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By performing malformed requests an attacker could cause Squid to crash
+    by triggering an assertion failure or invalid memory reference.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Squid users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-proxy/squid-2.5.10-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.squid-cache.org/Versions/v2/2.5/bugs/">Squid Patches</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2794">CVE-2005-2794</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2796">CVE-2005-2796</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 05 Sep 2005 08:24:13 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 05 Sep 2005 08:39:15 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-07.xml b/xml/htdocs/security/en/glsa/glsa-200509-07.xml
new file mode 100644
index 00000000..89bad546
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-07.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-07">
+  <title>X.Org: Heap overflow in pixmap allocation</title>
+  <synopsis>
+    An integer overflow in pixmap memory allocation potentially allows any
+    X.Org user to execute arbitrary code with elevated privileges.
+  </synopsis>
+  <product type="ebuild">X.Org</product>
+  <announced>September 12, 2005</announced>
+  <revised>September 12, 2005: 01</revised>
+  <bug>105688</bug>
+  <access>local</access>
+  <affected>
+    <package name="x11-base/xorg-x11" auto="yes" arch="*">
+      <unaffected range="ge">6.8.2-r3</unaffected>
+      <vulnerable range="lt">6.8.2-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    X.Org is X.Org Foundation's Public Implementation of the X Window
+    System.
+    </p>
+  </background>
+  <description>
+    <p>
+    X.Org is missing an integer overflow check during pixmap memory
+    allocation.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An X.Org user could exploit this issue to make the X server
+    execute arbitrary code with elevated privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All X.org users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-base/xorg-x11-6.8.2-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2495">CAN-2005-2495</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 06 Sep 2005 08:58:25 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 12 Sep 2005 15:28:20 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-08.xml b/xml/htdocs/security/en/glsa/glsa-200509-08.xml
new file mode 100644
index 00000000..b1647480
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-08.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-08">
+  <title>Python: Heap overflow in the included PCRE library</title>
+  <synopsis>
+    The "re" Python module is vulnerable to a heap overflow, possibly leading
+    to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Python</product>
+  <announced>September 12, 2005</announced>
+  <revised>September 12, 2005: 01</revised>
+  <bug>104009</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/python" auto="yes" arch="*">
+      <unaffected range="ge">2.3.5-r2</unaffected>
+      <vulnerable range="lt">2.3.5-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Python is an interpreted, interactive, object-oriented,
+    cross-platform programming language. The "re" Python module provides
+    regular expression functions.
+    </p>
+  </background>
+  <description>
+    <p>
+    The "re" Python module makes use of a private copy of libpcre
+    which is subject to an integer overflow leading to a heap overflow (see
+    GLSA 200508-17).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could target a Python-based web application (or SUID
+    application) that would use untrusted data as regular expressions,
+    potentially resulting in the execution of arbitrary code (or privilege
+    escalation).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Python users that don't run any Python web application or SUID
+    application (or that run one that wouldn't use untrusted inputs as
+    regular expressions) are not affected by this issue.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Python users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/python-2.3.5-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2491">CAN-2005-2491</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200508-17.xml">GLSA 200508-17</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 10 Sep 2005 18:18:03 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 11 Sep 2005 15:37:16 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 11 Sep 2005 18:47:02 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-09.xml b/xml/htdocs/security/en/glsa/glsa-200509-09.xml
new file mode 100644
index 00000000..53b5edb3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-09.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-09">
+  <title>Py2Play: Remote execution of arbitrary Python code</title>
+  <synopsis>
+    A design error in Py2Play allows attackers to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">py2play</product>
+  <announced>September 17, 2005</announced>
+  <revised>September 05, 2006: 02</revised>
+  <bug>103524</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-python/py2play" auto="yes" arch="*">
+      <unaffected range="ge">0.1.8</unaffected>
+      <vulnerable range="le">0.1.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Py2Play is a peer-to-peer network game engine written in Python.
+    Pickling is a Python feature allowing to serialize Python objects into
+    string representations (called pickles) that can be sent over the
+    network.
+    </p>
+  </background>
+  <description>
+    <p>
+    Arc Riley discovered that Py2Play uses Python pickles to send objects
+    over a peer-to-peer game network, and that clients accept without
+    restriction the objects and code sent by peers.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker participating in a Py2Play-powered game can send
+    malicious Python pickles, resulting in the execution of arbitrary
+    Python code on the targeted game client.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All py2play users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-python/py2play-0.1.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2875">CAN-2005-2875</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 13 Sep 2005 14:02:17 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 14 Sep 2005 11:59:59 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 14 Sep 2005 20:47:34 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-10.xml b/xml/htdocs/security/en/glsa/glsa-200509-10.xml
new file mode 100644
index 00000000..b340036e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-10.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-10">
+  <title>Mailutils: Format string vulnerability in imap4d</title>
+  <synopsis>
+    The imap4d server contains a vulnerability allowing an authenticated user
+    to execute arbitrary code with the privileges of the imap4d process.
+  </synopsis>
+  <product type="ebuild">mailutils</product>
+  <announced>September 17, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>105458</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/mailutils" auto="yes" arch="*">
+      <unaffected range="ge">0.6-r2</unaffected>
+      <vulnerable range="lt">0.6-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The GNU Mailutils are a collection of mail-related utilities, including
+    an IMAP4 server (imap4d).
+    </p>
+  </background>
+  <description>
+    <p>
+    The imap4d server contains a format string bug in the handling of IMAP
+    SEARCH requests.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An authenticated IMAP user could exploit the format string error in
+    imap4d to execute arbitrary code as the imap4d user, which is usually
+    root.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GNU Mailutils users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/mailutils-0.6-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.idefense.com/application/poi/display?id=303&amp;type=vulnerabilities">iDEFENSE 09.09.05 advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2878">CVE-2005-2878</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 15 Sep 2005 13:42:03 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 15 Sep 2005 13:42:17 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-11.xml b/xml/htdocs/security/en/glsa/glsa-200509-11.xml
new file mode 100644
index 00000000..c6b8d0fc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-11.xml
@@ -0,0 +1,134 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-11">
+  <title>Mozilla Suite, Mozilla Firefox: Multiple vulnerabilities</title>
+  <synopsis>
+    Mozilla Suite and Firefox are vulnerable to multiple issues, including some
+    that might be exploited to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">mozilla</product>
+  <announced>September 18, 2005</announced>
+  <revised>September 29, 2005: 02</revised>
+  <bug>105396</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">1.0.7-r2</unaffected>
+      <vulnerable range="lt">1.0.7-r2</vulnerable>
+    </package>
+    <package name="www-client/mozilla" auto="yes" arch="*">
+      <unaffected range="ge">1.7.12-r2</unaffected>
+      <vulnerable range="lt">1.7.12-r2</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.0.7</unaffected>
+      <vulnerable range="lt">1.0.7</vulnerable>
+    </package>
+    <package name="www-client/mozilla-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.7.12</unaffected>
+      <vulnerable range="lt">1.7.12</vulnerable>
+    </package>
+    <package name="net-libs/gecko-sdk" auto="yes" arch="*">
+      <unaffected range="ge">1.7.12</unaffected>
+      <vulnerable range="lt">1.7.12</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Mozilla Suite is a popular all-in-one web browser that includes a
+    mail and news reader. Mozilla Firefox is the next-generation browser
+    from the Mozilla project. Gecko is the layout engine used in both
+    products.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Mozilla Suite and Firefox are both vulnerable to the following
+    issues:
+    </p>
+    <ul>
+    <li>Tom Ferris reported a heap overflow in IDN-enabled browsers with
+    malicious Host: headers (CAN-2005-2871).</li>
+    <li>"jackerror" discovered a heap overrun in XBM image processing
+    (CAN-2005-2701).</li>
+    <li>Mats Palmgren reported a potentially exploitable stack corruption
+    using specific Unicode sequences (CAN-2005-2702).</li>
+    <li>Georgi Guninski discovered an integer overflow in the JavaScript
+    engine (CAN-2005-2705)</li>
+    <li>Other issues ranging from DOM object spoofing to request header
+    spoofing were also found and fixed in the latest versions
+    (CAN-2005-2703, CAN-2005-2704, CAN-2005-2706, CAN-2005-2707).</li>
+    </ul>
+    <p>
+    The Gecko engine in itself is also affected by some of these issues and
+    has been updated as well.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could setup a malicious site and entice a victim to
+    visit it, potentially resulting in arbitrary code execution with the
+    victim's privileges or facilitated spoofing of known websites.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround for all the issues.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-1.0.7-r2&quot;</code>
+    <p>
+    All Mozilla Suite users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-1.7.12-r2&quot;</code>
+    <p>
+    All Mozilla Firefox binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-1.0.7&quot;</code>
+    <p>
+    All Mozilla Suite binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-bin-1.7.12&quot;</code>
+    <p>
+    All Gecko library users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/gecko-sdk-1.7.12&quot;</code>
+    <p>
+    
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2701">CAN-2005-2701</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2702">CAN-2005-2702</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2703">CAN-2005-2703</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2704">CAN-2005-2704</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2705">CAN-2005-2705</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2706">CAN-2005-2706</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2707">CAN-2005-2707</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2871">CAN-2005-2871</uri>
+    <uri link="http://www.mozilla.org/projects/security/known-vulnerabilities.html">Mozilla Foundation Security Advisories</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 15 Sep 2005 12:38:09 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 18 Sep 2005 09:17:15 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-12.xml b/xml/htdocs/security/en/glsa/glsa-200509-12.xml
new file mode 100644
index 00000000..acb59490
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-12.xml
@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-12">
+  <title>Apache, mod_ssl: Multiple vulnerabilities</title>
+  <synopsis>
+    mod_ssl and Apache are vulnerable to a restriction bypass and a potential
+    local privilege escalation.
+  </synopsis>
+  <product type="ebuild">Apache</product>
+  <announced>September 19, 2005</announced>
+  <revised>December 30, 2007: 03</revised>
+  <bug>103554</bug>
+  <bug>104807</bug>
+  <access>remote and local</access>
+  <affected>
+    <package name="net-www/mod_ssl" auto="yes" arch="*">
+      <unaffected range="ge">2.8.24</unaffected>
+      <vulnerable range="lt">2.8.24</vulnerable>
+    </package>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="ge">2.0.54-r15</unaffected>
+      <unaffected range="lt">2</unaffected>
+      <vulnerable range="lt">2.0.54-r15</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP server is one of the most popular web servers on the
+    Internet. mod_ssl provides SSL v2/v3 and TLS v1 support for Apache 1.3
+    and is also included in Apache 2.
+    </p>
+  </background>
+  <description>
+    <p>
+    mod_ssl contains a security issue when "SSLVerifyClient optional" is
+    configured in the global virtual host configuration (CAN-2005-2700).
+    Also, Apache's httpd includes a PCRE library, which makes it vulnerable
+    to an integer overflow (CAN-2005-2491).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Under a specific configuration, mod_ssl does not properly enforce the
+    client-based certificate authentication directive, "SSLVerifyClient
+    require", in a per-location context, which could be potentially used by
+    a remote attacker to bypass some restrictions. By creating a specially
+    crafted ".htaccess" file, a local attacker could possibly exploit
+    Apache's vulnerability, which would result in a local privilege
+    escalation.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mod_ssl users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-www/mod_ssl-2.8.24&quot;</code>
+    <p>
+    All Apache 2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/apache-2.0.54-r15&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2491">CAN-2005-2491</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2700">CAN-2005-2700</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 11 Sep 2005 10:15:26 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 16 Sep 2005 16:41:43 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 17 Sep 2005 14:36:28 +0000">
+    formula7
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-13.xml b/xml/htdocs/security/en/glsa/glsa-200509-13.xml
new file mode 100644
index 00000000..3591f187
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-13.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-13">
+  <title>Clam AntiVirus: Multiple vulnerabilities</title>
+  <synopsis>
+    Clam AntiVirus is subject to vulnerabilities ranging from Denial of Service
+    to execution of arbitrary code when handling compressed executables.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>September 19, 2005</announced>
+  <revised>September 19, 2005: 01</revised>
+  <bug>106279</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.87</unaffected>
+      <vulnerable range="lt">0.87</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Clam AntiVirus is a GPL anti-virus toolkit, designed for
+    integration with mail servers to perform attachment scanning. Clam
+    AntiVirus also provides a command line scanner and a tool for fetching
+    updates of the virus database.
+    </p>
+  </background>
+  <description>
+    <p>
+    Clam AntiVirus is vulnerable to a buffer overflow in
+    "libclamav/upx.c" when processing malformed UPX-packed executables. It
+    can also be sent into an infinite loop in "libclamav/fsg.c" when
+    processing specially-crafted FSG-packed executables.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By sending a specially-crafted file an attacker could execute
+    arbitrary code with the permissions of the user running Clam AntiVirus,
+    or cause a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Clam AntiVirus users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.87&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2919">CAN-2005-2919</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2920">CAN-2005-2920</uri>
+    <uri link="http://sourceforge.net/project/shownotes.php?release_id=356974">Clam AntiVirus: Release Notes</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 18 Sep 2005 16:20:33 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 18 Sep 2005 16:20:41 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-14.xml b/xml/htdocs/security/en/glsa/glsa-200509-14.xml
new file mode 100644
index 00000000..5c0d60e7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-14.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-14">
+  <title>Zebedee: Denial of Service vulnerability</title>
+  <synopsis>
+    A bug in Zebedee allows a remote attacker to perform a Denial of Service
+    attack.
+  </synopsis>
+  <product type="ebuild">zebedee</product>
+  <announced>September 20, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>105115</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/zebedee" auto="yes" arch="*">
+      <unaffected range="rge">2.4.1-r1</unaffected>
+      <unaffected range="ge">2.5.3</unaffected>
+      <vulnerable range="lt">2.5.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Zebedee is an application that establishes an encrypted, compressed
+    tunnel for TCP/IP or UDP data transfer between two systems.
+    </p>
+  </background>
+  <description>
+    <p>
+    "Shiraishi.M" reported that Zebedee crashes when "0" is received as the
+    port number in the protocol option header.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By performing malformed requests a remote attacker could cause Zebedee
+    to crash.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Zebedee users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose net-misc/zebedee</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/bid/14796">BugTraq ID 14796</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2904">CVE-2005-2904</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 14 Sep 2005 10:16:59 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 16 Sep 2005 08:11:57 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 17 Sep 2005 12:52:52 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-15.xml b/xml/htdocs/security/en/glsa/glsa-200509-15.xml
new file mode 100644
index 00000000..3e00dc8a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-15.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-15">
+  <title>util-linux: umount command validation error</title>
+  <synopsis>
+    A command validation error in umount can lead to an escalation of
+    privileges.
+  </synopsis>
+  <product type="ebuild">util-linux</product>
+  <announced>September 20, 2005</announced>
+  <revised>September 20, 2005: 01</revised>
+  <bug>105805</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-apps/util-linux" auto="yes" arch="*">
+      <unaffected range="ge">2.12q-r3</unaffected>
+      <vulnerable range="lt">2.12q-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    util-linux is a suite of useful Linux programs including umount, a
+    program used to unmount filesystems.
+    </p>
+  </background>
+  <description>
+    <p>
+    When a regular user mounts a filesystem, they are subject to
+    restrictions in the /etc/fstab configuration file. David Watson
+    discovered that when unmounting a filesystem with the '-r' option, the
+    read-only bit is set, while other bits, such as nosuid or nodev, are
+    not set, even if they were previously.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An unprivileged user facing nosuid or nodev restrictions can
+    umount -r a filesystem clearing those bits, allowing applications to be
+    executed suid, or have device nodes interpreted. In the case where the
+    user can freely modify the contents of the filesystem, privilege
+    escalation may occur as a custom program may execute with suid
+    permissions.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Two workarounds exist, first, the suid bit can be removed from the
+    umount utility, or users can be restricted from mounting and unmounting
+    filesystems in /etc/fstab.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All util-linux users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/util-linux-2.12q-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2005-2876">CAN-2005-2876</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 17 Sep 2005 16:18:46 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 19 Sep 2005 16:52:19 +0000">
+    r2d2
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 20 Sep 2005 14:09:16 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-16.xml b/xml/htdocs/security/en/glsa/glsa-200509-16.xml
new file mode 100644
index 00000000..8eb90529
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-16.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-16">
+  <title>Mantis: XSS and SQL injection vulnerabilities</title>
+  <synopsis>
+    Mantis is affected by an SQL injection and several cross-site scripting
+    (XSS) vulnerabilities.
+  </synopsis>
+  <product type="ebuild">Mantis</product>
+  <announced>September 24, 2005</announced>
+  <revised>September 24, 2005: 01</revised>
+  <bug>103308</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/mantisbt" auto="yes" arch="*">
+      <unaffected range="ge">0.19.2</unaffected>
+      <vulnerable range="lt">0.19.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mantis is a web-based bugtracking system written in PHP.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mantis fails to properly sanitize untrusted input before using it.
+    This leads to an SQL injection and several cross-site scripting
+    vulnerabilities.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could possibly use the SQL injection vulnerability to
+    access or modify information from the Mantis database. Furthermore the
+    cross-site scripting issues give an attacker the ability to inject and
+    execute malicious script code or to steal cookie-based authentication
+    credentials, potentially compromising the victim's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mantis users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/mantisbt-0.19.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2556">CAN-2005-2556</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2557">CAN-2005-2557</uri>
+    <uri link="http://secunia.com/advisories/16506/">Secunia Advisory SA16506</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 23 Sep 2005 12:20:33 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 23 Sep 2005 12:21:10 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-17.xml b/xml/htdocs/security/en/glsa/glsa-200509-17.xml
new file mode 100644
index 00000000..7d98617c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-17.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-17">
+  <title>Webmin, Usermin: Remote code execution through PAM authentication</title>
+  <synopsis>
+    If Webmin or Usermin is configured to use full PAM conversations, it is
+    vulnerable to the remote execution of arbitrary code with root privileges.
+  </synopsis>
+  <product type="ebuild">Webmin Usermin</product>
+  <announced>September 24, 2005</announced>
+  <revised>September 24, 2005: 01</revised>
+  <bug>106705</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-admin/webmin" auto="yes" arch="*">
+      <unaffected range="ge">1.230</unaffected>
+      <vulnerable range="lt">1.230</vulnerable>
+    </package>
+    <package name="app-admin/usermin" auto="yes" arch="*">
+      <unaffected range="ge">1.160</unaffected>
+      <vulnerable range="lt">1.160</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Webmin and Usermin are web-based system administration consoles.
+    Webmin allows an administrator to easily configure servers and other
+    features. Usermin allows users to configure their own accounts, execute
+    commands, and read e-mails.
+    </p>
+  </background>
+  <description>
+    <p>
+    Keigo Yamazaki discovered that the miniserv.pl webserver, used in
+    both Webmin and Usermin, does not properly validate authentication
+    credentials before sending them to the PAM (Pluggable Authentication
+    Modules) authentication process. The default configuration shipped with
+    Gentoo does not enable the "full PAM conversations" option and is
+    therefore unaffected by this flaw.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could bypass the authentication process and run
+    any command as the root user on the target server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not enable "full PAM conversations" in the Authentication
+    options of Webmin and Usermin.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Webmin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/webmin-1.230&quot;</code>
+    <p>
+    All Usermin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/usermin-1.160&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3042">CAN-2005-3042</uri>
+    <uri link="http://www.lac.co.jp/business/sns/intelligence/SNSadvisory_e/83_e.html">Original Advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 23 Sep 2005 12:50:05 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 23 Sep 2005 12:50:25 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-18.xml b/xml/htdocs/security/en/glsa/glsa-200509-18.xml
new file mode 100644
index 00000000..362c91b7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-18.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-18">
+  <title>Qt: Buffer overflow in the included zlib library</title>
+  <synopsis>
+    Qt is vulnerable to a buffer overflow which could potentially lead to the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">qt</product>
+  <announced>September 26, 2005</announced>
+  <revised>September 26, 2005: 02</revised>
+  <bug>105695</bug>
+  <access>local</access>
+  <affected>
+    <package name="x11-libs/qt" auto="yes" arch="*">
+      <unaffected range="ge">3.3.4-r8</unaffected>
+      <vulnerable range="lt">3.3.4-r8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Qt is a cross-platform GUI toolkit used by KDE.
+    </p>
+  </background>
+  <description>
+    <p>
+    Qt links to a bundled vulnerable version of zlib when emerged with the
+    zlib USE-flag disabled. This may lead to a buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By creating a specially crafted compressed data stream, attackers can
+    overwrite data structures for applications that use Qt, resulting in a
+    Denial of Service or potentially arbitrary code execution.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Emerge Qt with the zlib USE-flag enabled.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Qt users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/qt-3.3.4-r8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200507-05.xml">GLSA 200507-05</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200507-19.xml">GLSA 200507-19</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1849">CAN-2005-1849</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2096">CAN-2005-2096</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 22 Sep 2005 16:49:17 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 23 Sep 2005 12:32:05 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-19.xml b/xml/htdocs/security/en/glsa/glsa-200509-19.xml
new file mode 100644
index 00000000..31d219da
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-19.xml
@@ -0,0 +1,97 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-19">
+  <title>PHP: Vulnerabilities in included PCRE and XML-RPC libraries</title>
+  <synopsis>
+    PHP makes use of an affected PCRE library and ships with an affected
+    XML-RPC library and is therefore potentially vulnerable to remote execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">PHP</product>
+  <announced>September 27, 2005</announced>
+  <revised>September 27, 2005: 01</revised>
+  <bug>102373</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-php/php" auto="yes" arch="*">
+      <unaffected range="rge">4.3.11-r1</unaffected>
+      <unaffected range="ge">4.4.0-r1</unaffected>
+      <vulnerable range="lt">4.4.0-r1</vulnerable>
+    </package>
+    <package name="dev-php/mod_php" auto="yes" arch="*">
+      <unaffected range="rge">4.3.11-r1</unaffected>
+      <unaffected range="ge">4.4.0-r2</unaffected>
+      <vulnerable range="lt">4.4.0-r2</vulnerable>
+    </package>
+    <package name="dev-php/php-cgi" auto="yes" arch="*">
+      <unaffected range="rge">4.3.11-r2</unaffected>
+      <unaffected range="ge">4.4.0-r2</unaffected>
+      <vulnerable range="lt">4.4.0-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHP is a general-purpose scripting language widely used to develop
+    web-based applications. It can run inside a web server using the
+    mod_php module or the CGI version of PHP, or can run stand-alone in a
+    CLI.
+    </p>
+  </background>
+  <description>
+    <p>
+    PHP makes use of a private copy of libpcre which is subject to an
+    integer overflow leading to a heap overflow (see GLSA 200508-17). It
+    also ships with an XML-RPC library affected by a script injection
+    vulnerability (see GLSA 200508-13).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could target a PHP-based web application that would
+    use untrusted data as regular expressions, potentially resulting in the
+    execution of arbitrary code. If web applications make use of the
+    XML-RPC library shipped with PHP, they are also vulnerable to remote
+    execution of arbitrary PHP code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-php/php</code>
+    <p>
+    All mod_php users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-php/mod_php</code>
+    <p>
+    All php-cgi users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-php/php-cgi</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2491">CAN-2005-2491</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2498">CAN-2005-2498</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200508-13.xml">GLSA 200508-13</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200508-17.xml">GLSA 200508-17</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 26 Sep 2005 15:50:10 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 27 Sep 2005 07:58:50 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-20.xml b/xml/htdocs/security/en/glsa/glsa-200509-20.xml
new file mode 100644
index 00000000..ab2ae2e8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-20.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-20">
+  <title>AbiWord: RTF import stack-based buffer overflow</title>
+  <synopsis>
+    AbiWord is vulnerable to a stack-based buffer overflow during RTF import,
+    making it vulnerable to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">AbiWord</product>
+  <announced>September 30, 2005</announced>
+  <revised>September 30, 2005: 01</revised>
+  <bug>107351</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/abiword" auto="yes" arch="*">
+      <unaffected range="ge">2.2.10</unaffected>
+      <vulnerable range="lt">2.2.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    AbiWord is a free and cross-platform word processing program. It
+    allows to import RTF files into AbiWord documents.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Evans discovered that the RTF import function in AbiWord is
+    vulnerable to a stack-based buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could design a malicious RTF file and entice the user
+    to import it in AbiWord, potentially resulting in the execution of
+    arbitrary code with the rights of the user running AbiWord.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All AbiWord users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/abiword-2.2.10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2964">CAN-2005-2964</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 28 Sep 2005 16:02:24 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 29 Sep 2005 12:13:23 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 29 Sep 2005 20:47:05 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200509-21.xml b/xml/htdocs/security/en/glsa/glsa-200509-21.xml
new file mode 100644
index 00000000..85999235
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200509-21.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200509-21">
+  <title>Hylafax: Insecure temporary file creation in xferfaxstats script</title>
+  <synopsis>
+    Hylafax is vulnerable to linking attacks, potentially allowing a local user
+    to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">hylafax</product>
+  <announced>September 30, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>106882</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-misc/hylafax" auto="yes" arch="*">
+      <unaffected range="rge">4.2.0-r3</unaffected>
+      <unaffected range="rge">4.2.1-r2</unaffected>
+      <unaffected range="ge">4.2.2</unaffected>
+      <vulnerable range="lt">4.2.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Hylafax is a client-server fax package for class 1 and 2 fax modems.
+    </p>
+  </background>
+  <description>
+    <p>
+    Javier Fernandez-Sanguino has discovered that xferfaxstats cron script
+    supplied by Hylafax insecurely creates temporary files with predictable
+    filenames.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary file
+    directory, pointing to a valid file somewhere on the filesystem. When
+    the xferfaxstats script of Hylafax is executed, this would result in
+    the file being overwritten with the rights of the user running the
+    script, which typically is the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Hylafax users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose net-misc/hylafax</code>
+  </resolution>
+  <references>
+    <uri link="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=329384">Original bug report</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3069">CVE-2005-3069</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 28 Sep 2005 15:24:43 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 28 Sep 2005 19:07:36 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 30 Sep 2005 07:45:48 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-01.xml b/xml/htdocs/security/en/glsa/glsa-200510-01.xml
new file mode 100644
index 00000000..a829c45e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-01.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-01">
+  <title>gtkdiskfree: Insecure temporary file creation</title>
+  <synopsis>
+    gtkdiskfree is vulnerable to symlink attacks, potentially allowing a local
+    user to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">gtkdiskfree</product>
+  <announced>October 03, 2005</announced>
+  <revised>October 03, 2005: 01</revised>
+  <bug>104565</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-admin/gtkdiskfree" auto="yes" arch="*">
+      <unaffected range="ge">1.9.3-r1</unaffected>
+      <vulnerable range="lt">1.9.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    gtkdiskfree is a GTK-based GUI to show free disk space.
+    </p>
+  </background>
+  <description>
+    <p>
+    Eric Romang discovered that gtkdiskfree insecurely creates a
+    predictable temporary file to handle command output.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create a symbolic link in the temporary
+    files directory, pointing to a valid file somewhere on the filesystem.
+    When gtkdiskfree is executed, this would result in the file being
+    overwritten with the rights of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All gtkdiskfree users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/gtkdiskfree-1.9.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2918">CAN-2005-2918</uri>
+    <uri link="http://www.zataz.net/adviso/gtkdiskfree-09052005.txt">Original Advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 03 Oct 2005 07:42:10 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 03 Oct 2005 07:42:18 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-02.xml b/xml/htdocs/security/en/glsa/glsa-200510-02.xml
new file mode 100644
index 00000000..ec963c54
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-02.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-02">
+  <title>Berkeley MPEG Tools: Multiple insecure temporary files</title>
+  <synopsis>
+    The Berkeley MPEG Tools use temporary files in various insecure ways,
+    potentially allowing a local user to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">MPEG Tools</product>
+  <announced>October 03, 2005</announced>
+  <revised>October 03, 2005: 01</revised>
+  <bug>107344</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-video/mpeg-tools" auto="yes" arch="*">
+      <unaffected range="ge">1.5b-r2</unaffected>
+      <vulnerable range="lt">1.5b-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Berkeley MPEG Tools are a collection of utilities for
+    manipulating MPEG video technology, including an encoder (mpeg_encode)
+    and various conversion utilities.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mike Frysinger of the Gentoo Security Team discovered that
+    mpeg_encode and the conversion utilities were creating temporary files
+    with predictable or fixed filenames. The 'test' make target of the MPEG
+    Tools also relied on several temporary files created insecurely.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary
+    files directory, pointing to a valid file somewhere on the filesystem.
+    When the utilities are executed (or 'make test' is run), this would
+    result in the file being overwritten with the rights of the user
+    running the command.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Berkeley MPEG Tools users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/mpeg-tools-1.5b-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3115">CAN-2005-3115</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 30 Sep 2005 07:41:47 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 01 Oct 2005 09:55:55 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 02 Oct 2005 13:13:54 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-03.xml b/xml/htdocs/security/en/glsa/glsa-200510-03.xml
new file mode 100644
index 00000000..f64b9cbd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-03.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-03">
+  <title>Uim: Privilege escalation vulnerability</title>
+  <synopsis>
+    Under certain conditions, applications linked against Uim suffer from a
+    privilege escalation vulnerability.
+  </synopsis>
+  <product type="ebuild">uim</product>
+  <announced>October 04, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>107748</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-i18n/uim" auto="yes" arch="*">
+      <unaffected range="ge">0.4.9.1</unaffected>
+      <vulnerable range="lt">0.4.9.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Uim is a multilingual input method library which provides secure and
+    useful input method for all languages.
+    </p>
+  </background>
+  <description>
+    <p>
+    Masanari Yamamoto discovered that Uim uses environment variables
+    incorrectly. This bug causes a privilege escalation if setuid/setgid
+    applications are linked to libuim. This bug only affects
+    immodule-enabled Qt (if you build Qt 3.3.2 or later versions with
+    USE="immqt" or USE="immqt-bc").
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious local user could exploit this vulnerability to execute
+    arbitrary code with escalated privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Uim users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-i18n/uim-0.4.9.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://lists.freedesktop.org/pipermail/uim/2005-September/001346.html">Original advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3149">CVE-2005-3149</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 02 Oct 2005 13:02:25 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 02 Oct 2005 13:02:52 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 03 Oct 2005 09:56:44 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-04.xml b/xml/htdocs/security/en/glsa/glsa-200510-04.xml
new file mode 100644
index 00000000..d9f85c07
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-04.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-04">
+  <title>Texinfo: Insecure temporary file creation</title>
+  <synopsis>
+    Texinfo is vulnerable to symlink attacks, potentially allowing a local user
+    to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">Texinfo</product>
+  <announced>October 05, 2005</announced>
+  <revised>October 05, 2005: 01</revised>
+  <bug>106105</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-apps/texinfo" auto="yes" arch="*">
+      <unaffected range="ge">4.8-r1</unaffected>
+      <vulnerable range="lt">4.8-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Texinfo is the official documentation system created by the GNU
+    project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Frank Lichtenheld has discovered that the "sort_offline()"
+    function in texindex insecurely creates temporary files with
+    predictable filenames.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary
+    files directory, pointing to a valid file somewhere on the filesystem.
+    When texindex is executed, this would result in the file being
+    overwritten with the rights of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Texinfo users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/texinfo-4.8-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3011">CAN-2005-3011</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 29 Sep 2005 14:54:06 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 29 Sep 2005 19:15:57 +0000">
+    formula7
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 01 Oct 2005 09:53:58 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-05.xml b/xml/htdocs/security/en/glsa/glsa-200510-05.xml
new file mode 100644
index 00000000..0ab4c7d2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-05.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-05">
+  <title>Ruby: Security bypass vulnerability</title>
+  <synopsis>
+    Ruby is vulnerable to a security bypass of the safe level mechanism.
+  </synopsis>
+  <product type="ebuild">ruby</product>
+  <announced>October 06, 2005</announced>
+  <revised>October 06, 2005: 01</revised>
+  <bug>106996</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/ruby" auto="yes" arch="*">
+      <unaffected range="ge">1.8.3</unaffected>
+      <vulnerable range="lt">1.8.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ruby is an interpreted scripting language for quick and easy
+    object-oriented programming. Ruby supports the safe execution of
+    untrusted code using a safe level and taint flag mechanism.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dr. Yutaka Oiwa discovered that Ruby fails to properly enforce
+    safe level protections.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit this vulnerability to execute arbitrary
+    code beyond the restrictions specified in each safe level.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ruby users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/ruby-1.8.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2337">CAN-2005-2337</uri>
+    <uri link="http://www.ruby-lang.org/en/20051003.html">Ruby release announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 04 Oct 2005 12:55:13 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 04 Oct 2005 12:55:25 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 04 Oct 2005 18:17:21 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-06.xml b/xml/htdocs/security/en/glsa/glsa-200510-06.xml
new file mode 100644
index 00000000..c53dbf8a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-06.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-06">
+  <title>Dia: Arbitrary code execution through SVG import</title>
+  <synopsis>
+    Improperly sanitised data in Dia allows remote attackers to execute
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">dia</product>
+  <announced>October 06, 2005</announced>
+  <revised>October 06, 2005: 01</revised>
+  <bug>107916</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/dia" auto="yes" arch="*">
+      <unaffected range="ge">0.94-r3</unaffected>
+      <vulnerable range="lt">0.94-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Dia is a gtk+ based diagram creation program released under the
+    GPL license.
+    </p>
+  </background>
+  <description>
+    <p>
+    Joxean Koret discovered that the SVG import plugin in Dia fails to
+    properly sanitise data read from an SVG file.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could create a specially crafted SVG file, which, when
+    imported into Dia, could lead to the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Dia users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/dia-0.94-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2966">CAN-2005-2966</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 04 Oct 2005 12:58:56 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 04 Oct 2005 18:51:11 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 05 Oct 2005 07:39:21 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-07.xml b/xml/htdocs/security/en/glsa/glsa-200510-07.xml
new file mode 100644
index 00000000..390cdce4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-07.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-07">
+  <title>RealPlayer, Helix Player: Format string vulnerability</title>
+  <synopsis>
+    RealPlayer and Helix Player are vulnerable to a format string vulnerability
+    resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">realplayer helixplayer</product>
+  <announced>October 07, 2005</announced>
+  <revised>November 22, 2005: 02</revised>
+  <bug>107309</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/realplayer" auto="yes" arch="*">
+      <unaffected range="ge">10.0.6</unaffected>
+      <vulnerable range="lt">10.0.6</vulnerable>
+    </package>
+    <package name="media-video/helixplayer" auto="yes" arch="*">
+      <vulnerable range="lt">1.0.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    RealPlayer is a multimedia player capable of handling multiple
+    multimedia file formats. Helix Player is an open source media player
+    for Linux.
+    </p>
+  </background>
+  <description>
+    <p>
+    "c0ntex" reported that RealPlayer and Helix Player suffer from a heap
+    overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to play a specially crafted realpix (.rp) or
+    realtext (.rt) file, an attacker could execute arbitrary code with the
+    permissions of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All RealPlayer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/realplayer-10.0.6&quot;</code>
+    <p>
+    Note to Helix Player users: There is currently no stable secure Helix
+    Player package. Affected users should remove the package until an
+    updated Helix Player package is released.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2710">CAN-2005-2710</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 01 Oct 2005 10:35:35 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 04 Oct 2005 19:39:34 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 07 Oct 2005 14:20:23 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-08.xml b/xml/htdocs/security/en/glsa/glsa-200510-08.xml
new file mode 100644
index 00000000..97ec9404
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-08.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-08">
+  <title>xine-lib: Format string vulnerability</title>
+  <synopsis>
+    xine-lib contains a format string error in CDDB response handling that may
+    be exploited to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">xine-lib</product>
+  <announced>October 08, 2005</announced>
+  <revised>October 08, 2005: 01</revised>
+  <bug>107854</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/xine-lib" auto="yes" arch="*">
+      <unaffected range="ge">1.1.0-r5</unaffected>
+      <unaffected range="rge">1.0.1-r4</unaffected>
+      <unaffected range="rge">1_rc8-r2</unaffected>
+      <vulnerable range="lt">1.1.0-r5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xine-lib is a multimedia library which can be utilized to create
+    multimedia frontends. It includes functions to retrieve information
+    about audio CD contents from public CDDB servers.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ulf Harnhammar discovered a format string bug in the routines
+    handling CDDB server response contents.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could submit malicious information about an audio CD
+    to a public CDDB server (or impersonate a public CDDB server). When the
+    victim plays this CD on a multimedia frontend relying on xine-lib, it
+    could end up executing arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xine-lib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose media-libs/xine-lib</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2967">CAN-2005-2967</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 07 Oct 2005 11:30:51 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 08 Oct 2005 16:01:28 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-09.xml b/xml/htdocs/security/en/glsa/glsa-200510-09.xml
new file mode 100644
index 00000000..9aed069c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-09.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-09">
+  <title>Weex: Format string vulnerability</title>
+  <synopsis>
+    Weex contains a format string error that may be exploited by malicious
+    servers to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">Weex</product>
+  <announced>October 08, 2005</announced>
+  <revised>October 08, 2005: 01</revised>
+  <bug>107849</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-ftp/weex" auto="yes" arch="*">
+      <unaffected range="ge">2.6.1.5-r1</unaffected>
+      <vulnerable range="lt">2.6.1.5-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Weex is a non-interactive FTP client typically used to update web
+    pages.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ulf Harnhammar discovered a format string bug in Weex that can be
+    triggered when it is first run (or when its cache files are rebuilt,
+    using the -r option).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could setup a malicious FTP server which, when
+    accessed using Weex, could trigger the format string bug and end up
+    executing arbitrary code with the rights of the user running Weex.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Weex users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-ftp/weex-2.6.1.5-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3150">CAN-2005-3150</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 07 Oct 2005 11:45:52 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 07 Oct 2005 11:46:02 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-10.xml b/xml/htdocs/security/en/glsa/glsa-200510-10.xml
new file mode 100644
index 00000000..75f030ed
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-10.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-10">
+  <title>uw-imap: Remote buffer overflow</title>
+  <synopsis>
+    uw-imap is vulnerable to remote overflow of a buffer in the IMAP server
+    leading to execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">uw-imap</product>
+  <announced>October 11, 2005</announced>
+  <revised>October 11, 2005: 01</revised>
+  <bug>108206</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/uw-imap" auto="yes" arch="*">
+      <unaffected range="ge">2004g</unaffected>
+      <vulnerable range="lt">2004g</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    uw-imap is the University of Washington's IMAP and POP server
+    daemons.
+    </p>
+  </background>
+  <description>
+    <p>
+    Improper bounds checking of user supplied data while parsing IMAP
+    mailbox names can lead to overflowing the stack buffer.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Successful exploitation requires an authenticated IMAP user to
+    request a malformed mailbox name. This can lead to execution of
+    arbitrary code with the permissions of the IMAP server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All uw-imap users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/uw-imap-2004g&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2933">CAN-2005-2933</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=313&amp;type=vulnerabilities&amp;flashstatus=false">iDEFENSE Security Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 07 Oct 2005 11:49:05 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 07 Oct 2005 15:06:14 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 08 Oct 2005 06:13:24 +0000">
+    r2d2
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-11.xml b/xml/htdocs/security/en/glsa/glsa-200510-11.xml
new file mode 100644
index 00000000..e338971a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-11.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-11">
+  <title>OpenSSL: SSL 2.0 protocol rollback</title>
+  <synopsis>
+    When using a specific option, OpenSSL can be forced to fallback to the less
+    secure SSL 2.0 protocol.
+  </synopsis>
+  <product type="ebuild">OpenSSL</product>
+  <announced>October 12, 2005</announced>
+  <revised>November 07, 2005: 02</revised>
+  <bug>108852</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/openssl" auto="yes" arch="*">
+      <unaffected range="ge">0.9.7h</unaffected>
+      <unaffected range="rge">0.9.7g-r1</unaffected>
+      <unaffected range="rge">0.9.7e-r2</unaffected>
+      <vulnerable range="lt">0.9.7h</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSSL is a toolkit implementing the Secure Sockets Layer, Transport
+    Layer Security protocols and a general-purpose cryptography library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Applications setting the SSL_OP_MSIE_SSLV2_RSA_PADDING option (or the
+    SSL_OP_ALL option, that implies it) can be forced by a third-party to
+    fallback to the less secure SSL 2.0 protocol, even if both parties
+    support the more secure SSL 3.0 or TLS 1.0 protocols.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A man-in-the-middle attacker can weaken the encryption used to
+    communicate between two parties, potentially revealing sensitive
+    information.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    If possible, disable the use of SSL 2.0 in all OpenSSL-enabled
+    applications.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenSSL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-libs/openssl</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2969">CAN-2005-2969</uri>
+    <uri link="http://www.openssl.org/news/secadv_20051011.txt ">OpenSSL security advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 11 Oct 2005 07:50:27 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 11 Oct 2005 08:03:33 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 12 Oct 2005 07:47:42 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-12.xml b/xml/htdocs/security/en/glsa/glsa-200510-12.xml
new file mode 100644
index 00000000..68e58517
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-12.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-12">
+  <title>KOffice, KWord: RTF import buffer overflow</title>
+  <synopsis>
+    KOffice and KWord are vulnerable to a buffer overflow in the RTF importer,
+    potentially resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">koffice, kword</product>
+  <announced>October 14, 2005</announced>
+  <revised>October 14, 2005: 01</revised>
+  <bug>108411</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/koffice" auto="yes" arch="*">
+      <unaffected range="ge">1.4.1-r1</unaffected>
+      <vulnerable range="lt">1.4.1-r1</vulnerable>
+    </package>
+    <package name="app-office/kword" auto="yes" arch="*">
+      <unaffected range="ge">1.4.1-r1</unaffected>
+      <vulnerable range="lt">1.4.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KOffice is an integrated office suite for KDE. KWord is the
+    KOffice word processor.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Evans discovered that the KWord RTF importer was vulnerable
+    to a heap-based buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially-crafted RTF
+    file, potentially resulting in the execution of arbitrary code with the
+    rights of the user running the affected application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All KOffice users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/koffice-1.4.1-r1&quot;</code>
+    <p>
+    All KWord users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/kword-1.4.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2005-2971">CAN-2005-2971</uri>
+    <uri link="http://www.kde.org/info/security/advisory-20051011-1.txt">KDE Security Advisory: KWord RTF import buffer overflow</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 11 Oct 2005 14:40:11 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 14 Oct 2005 05:26:32 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-13.xml b/xml/htdocs/security/en/glsa/glsa-200510-13.xml
new file mode 100644
index 00000000..3a6a9759
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-13.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-13">
+  <title>SPE: Insecure file permissions</title>
+  <synopsis>
+    SPE files are installed with world-writeable permissions, potentially
+    leading to privilege escalation.
+  </synopsis>
+  <product type="ebuild">spe</product>
+  <announced>October 15, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>108538</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-util/spe" auto="yes" arch="*">
+      <unaffected range="ge">0.7.5c-r1</unaffected>
+      <unaffected range="rge">0.5.1f-r1</unaffected>
+      <vulnerable range="lt">0.7.5c-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SPE is a cross-platform Python Integrated Development Environment
+    (IDE).
+    </p>
+  </background>
+  <description>
+    <p>
+    It was reported that due to an oversight all SPE's files are set as
+    world-writeable.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could modify the executable files, causing arbitrary
+    code to be executed with the permissions of the user running SPE.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SPE users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-util/spe</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3291">CVE-2005-3291</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 11 Oct 2005 21:00:30 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 12 Oct 2005 02:02:14 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 15 Oct 2005 08:06:19 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-14.xml b/xml/htdocs/security/en/glsa/glsa-200510-14.xml
new file mode 100644
index 00000000..31c1f40d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-14.xml
@@ -0,0 +1,97 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-14">
+  <title>Perl, Qt-UnixODBC, CMake: RUNPATH issues</title>
+  <synopsis>
+    Multiple packages suffer from RUNPATH issues that may allow users in the
+    "portage" group to escalate privileges.
+  </synopsis>
+  <product type="ebuild">Perl Qt-UnixODBC CMake</product>
+  <announced>October 17, 2005</announced>
+  <revised>May 22, 2006: 03</revised>
+  <bug>105719</bug>
+  <bug>105721</bug>
+  <bug>106678</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-lang/perl" auto="yes" arch="*">
+      <unaffected range="ge">5.8.7-r1</unaffected>
+      <unaffected range="rge">5.8.6-r6</unaffected>
+      <vulnerable range="lt">5.8.7-r1</vulnerable>
+    </package>
+    <package name="dev-db/qt-unixODBC" auto="yes" arch="*">
+      <unaffected range="ge">3.3.4-r1</unaffected>
+      <vulnerable range="lt">3.3.4-r1</vulnerable>
+    </package>
+    <package name="dev-util/cmake" auto="yes" arch="*">
+      <unaffected range="ge">2.2.0-r1</unaffected>
+      <unaffected range="rge">2.0.6-r1</unaffected>
+      <vulnerable range="lt">2.2.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Perl is a stable, cross-platform programming language created by Larry
+    Wall. Qt-UnixODBC is an ODBC library for Qt. CMake is a cross-platform
+    build environment.
+    </p>
+  </background>
+  <description>
+    <p>
+    Some packages may introduce insecure paths into the list of directories
+    that are searched for libraries at runtime. Furthermore, packages
+    depending on the MakeMaker Perl module for build configuration may have
+    incorrectly copied the LD_RUN_PATH into the DT_RPATH.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A local attacker, who is a member of the "portage" group, could create
+    a malicious shared object in the Portage temporary build directory that
+    would be loaded at runtime by a dependent executable, potentially
+    resulting in privilege escalation.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Only grant "portage" group rights to trusted users.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Perl users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-lang/perl</code>
+    <p>
+    All Qt-UnixODBC users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/qt-unixODBC-3.3.4-r1&quot;</code>
+    <p>
+    All CMake users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-util/cmake</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4278">CVE-2005-4278</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4279">CVE-2005-4279</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4280">CVE-2005-4280</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 27 Sep 2005 08:00:50 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 10 Oct 2005 08:34:31 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 15 Oct 2005 10:08:27 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-15.xml b/xml/htdocs/security/en/glsa/glsa-200510-15.xml
new file mode 100644
index 00000000..0a8198d7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-15.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-15">
+  <title>Lynx: Buffer overflow in NNTP processing</title>
+  <synopsis>
+    Lynx contains a buffer overflow that may be exploited to execute arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">Lynx</product>
+  <announced>October 17, 2005</announced>
+  <revised>October 17, 2005: 01</revised>
+  <bug>108451</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/lynx" auto="yes" arch="*">
+      <unaffected range="ge">2.8.5-r1</unaffected>
+      <vulnerable range="lt">2.8.5-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Lynx is a text-mode browser for the World Wide Web. It supports
+    multiple URL types, including HTTP and NNTP URLs.
+    </p>
+  </background>
+  <description>
+    <p>
+    When accessing a NNTP URL, Lynx connects to a NNTP server and
+    retrieves information about the available articles in the target
+    newsgroup. Ulf Harnhammar discovered a buffer overflow in a function
+    that handles the escaping of special characters.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could setup a malicious NNTP server and entice a user
+    to access it using Lynx (either by creating NNTP links on a web page or
+    by forcing a redirect for Lynx users). The data returned by the NNTP
+    server would trigger the buffer overflow and execute arbitrary code
+    with the rights of the user running Lynx.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Lynx users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/lynx-2.8.5-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3120">CAN-2005-3120</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 15 Oct 2005 09:30:52 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 17 Oct 2005 12:46:58 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-16.xml b/xml/htdocs/security/en/glsa/glsa-200510-16.xml
new file mode 100644
index 00000000..a8d8bd0f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-16.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-16">
+  <title>phpMyAdmin: Local file inclusion vulnerability</title>
+  <synopsis>
+    phpMyAdmin contains a local file inclusion vulnerability that may lead to
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">phpmyadmin</product>
+  <announced>October 17, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>108939</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-db/phpmyadmin" auto="yes" arch="*">
+      <unaffected range="ge">2.6.4_p2</unaffected>
+      <vulnerable range="lt">2.6.4_p2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpMyAdmin is a tool written in PHP intended to handle the
+    administration of MySQL over the web.
+    </p>
+  </background>
+  <description>
+    <p>
+    Maksymilian Arciemowicz reported that in
+    libraries/grab_globals.lib.php, the $__redirect parameter was not
+    correctly validated. Systems running PHP in safe mode are not affected.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker may exploit this vulnerability by sending malicious
+    requests, causing the execution of arbitrary code with the rights of
+    the user running the web server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Run PHP in safe mode.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpMyAdmin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/phpmyadmin-2.6.4_p2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4">PMASA-2005-4</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3299">CVE-2005-3299</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 15 Oct 2005 08:08:40 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 16 Oct 2005 19:41:39 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 17 Oct 2005 03:54:58 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-17.xml b/xml/htdocs/security/en/glsa/glsa-200510-17.xml
new file mode 100644
index 00000000..4d32e385
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-17.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-17">
+  <title>AbiWord: New RTF import buffer overflows</title>
+  <synopsis>
+    AbiWord is vulnerable to an additional set of buffer overflows during RTF
+    import, making it vulnerable to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">AbiWord</product>
+  <announced>October 20, 2005</announced>
+  <revised>October 20, 2005: 01</revised>
+  <bug>109157</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/abiword" auto="yes" arch="*">
+      <unaffected range="ge">2.2.11</unaffected>
+      <vulnerable range="lt">2.2.11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    AbiWord is a free and cross-platform word processing program. It
+    allows to import RTF files into AbiWord documents.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Evans discovered a different set of buffer overflows than
+    the one described in GLSA 200509-20 in the RTF import function in
+    AbiWord.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could design a malicious RTF file and entice a user to
+    import it in AbiWord, potentially resulting in the execution of
+    arbitrary code with the rights of the user running AbiWord.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All AbiWord users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/abiword-2.2.11&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200509-20.xml">GLSA-200509-20</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2972">CAN-2005-2972</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 18 Oct 2005 07:36:44 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 18 Oct 2005 14:22:32 +0000">
+    formula7
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 20 Oct 2005 05:41:16 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-18.xml b/xml/htdocs/security/en/glsa/glsa-200510-18.xml
new file mode 100644
index 00000000..5b3dc916
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-18.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-18">
+  <title>Netpbm: Buffer overflow in pnmtopng</title>
+  <synopsis>
+    The pnmtopng utility, part of the Netpbm tools, contains a vulnerability
+    which can potentially result in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Netpbm</product>
+  <announced>October 20, 2005</announced>
+  <revised>May 28, 2009: 06</revised>
+  <bug>109705</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/netpbm" auto="yes" arch="*">
+      <unaffected range="ge">10.29</unaffected>
+      <unaffected range="rge">10.26.32</unaffected>
+      <unaffected range="rge">10.26.33</unaffected>
+      <unaffected range="rge">10.26.42</unaffected>
+      <unaffected range="rge">10.26.43</unaffected>
+      <unaffected range="rge">10.26.44</unaffected>
+      <unaffected range="rge">10.26.48</unaffected>
+      <unaffected range="rge">10.26.49</unaffected>
+      <unaffected range="rge">10.26.52</unaffected>
+      <unaffected range="rge">10.26.53</unaffected>
+      <unaffected range="rge">10.26.59</unaffected>
+      <unaffected range="rge">10.26.61</unaffected>
+      <vulnerable range="lt">10.29</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Netpbm is a package of 220 graphics programs and a programming library,
+    including pnmtopng, a tool to convert PNM image files to the PNG
+    format.
+    </p>
+  </background>
+  <description>
+    <p>
+    RedHat reported that pnmtopng is vulnerable to a buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could craft a malicious PNM file and entice a user to run
+    pnmtopng on it, potentially resulting in the execution of arbitrary
+    code with the permissions of the user running pnmtopng.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Netpbm users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose media-libs/netpbm</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2978">CAN-2005-2978</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 15 Oct 2005 09:38:18 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 20 Oct 2005 07:38:22 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-19.xml b/xml/htdocs/security/en/glsa/glsa-200510-19.xml
new file mode 100644
index 00000000..99089c12
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-19.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-19">
+  <title>cURL: NTLM username stack overflow</title>
+  <synopsis>
+    cURL is vulnerable to a buffer overflow which could lead to the execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">cURL</product>
+  <announced>October 22, 2005</announced>
+  <revised>October 22, 2005: 01</revised>
+  <bug>109097</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/curl" auto="yes" arch="*">
+      <unaffected range="ge">7.15.0</unaffected>
+      <vulnerable range="lt">7.15.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    cURL is a command line tool and library for transferring files via
+    many different protocols. It supports NTLM authentication to retrieve
+    files from Windows-based systems.
+    </p>
+  </background>
+  <description>
+    <p>
+    iDEFENSE reported that insufficient bounds checking on a memcpy()
+    of the supplied NTLM username can result in a stack overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could setup a malicious server and entice an
+    user to connect to it using a cURL client, potentially leading to the
+    execution of arbitrary code with the permissions of the user running
+    cURL.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable NTLM authentication by not using the --anyauth or --ntlm
+    options when using cURL (the command line version). Workarounds for
+    programs that use the cURL library depend on the configuration options
+    presented by those programs.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All cURL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/curl-7.15.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3185">CVE-2005-3185</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=322&amp;type=vulnerabilities">iDefense Security Advisory 10.13.05</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 21 Oct 2005 09:04:01 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 21 Oct 2005 09:04:50 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-20.xml b/xml/htdocs/security/en/glsa/glsa-200510-20.xml
new file mode 100644
index 00000000..335f5de2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-20.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-20">
+  <title>Zope: File inclusion through RestructuredText</title>
+  <synopsis>
+    Zope is vulnerable to a file inclusion vulnerability when exposing
+    RestructuredText functionalities to untrusted users.
+  </synopsis>
+  <product type="ebuild">Zope</product>
+  <announced>October 25, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>109087</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-zope/zope" auto="yes" arch="*">
+      <unaffected range="ge">2.7.8</unaffected>
+      <vulnerable range="lt">2.7.8</vulnerable>
+      <vulnerable range="eq">2.8.0</vulnerable>
+      <vulnerable range="eq">2.8.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Zope is an application server that can be used to build content
+    management systems, intranets, portals or other custom applications.
+    </p>
+  </background>
+  <description>
+    <p>
+    Zope honors file inclusion directives in RestructuredText objects by
+    default.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit the vulnerability by sending malicious input
+    that would be interpreted in a RestructuredText Zope object,
+    potentially resulting in the execution of arbitrary Zope code with the
+    rights of the Zope server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Zope users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose net-zope/zope</code>
+  </resolution>
+  <references>
+    <uri link="http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert">Zope Hotfix 2005-10-09 Alert</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3323">CVE-2005-3323</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 20 Oct 2005 15:36:29 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 23 Oct 2005 15:31:35 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 23 Oct 2005 16:31:59 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-21.xml b/xml/htdocs/security/en/glsa/glsa-200510-21.xml
new file mode 100644
index 00000000..6a227085
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-21.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-21">
+  <title>phpMyAdmin: Local file inclusion and XSS vulnerabilities</title>
+  <synopsis>
+    phpMyAdmin contains a local file inclusion vulnerability that may lead to
+    the execution of arbitrary code, along with several cross-site scripting
+    issues.
+  </synopsis>
+  <product type="ebuild">phpmyadmin</product>
+  <announced>October 25, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>110146</bug>
+  <access>local and remote</access>
+  <affected>
+    <package name="dev-db/phpmyadmin" auto="yes" arch="*">
+      <unaffected range="ge">2.6.4_p3</unaffected>
+      <vulnerable range="lt">2.6.4_p3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpMyAdmin is a tool written in PHP intended to handle the
+    administration of MySQL over the web.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Esser discovered that by calling certain PHP files directly, it
+    was possible to workaround the grab_globals.lib.php security model and
+    overwrite the $cfg configuration array. Systems running PHP in safe
+    mode are not affected. Futhermore, Tobias Klein reported several
+    cross-site-scripting issues resulting from insufficient user input
+    sanitizing.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker may exploit this vulnerability by sending malicious
+    requests, causing the execution of arbitrary code with the rights of
+    the user running the web server. Furthermore, the cross-site scripting
+    issues give a remote attacker the ability to inject and execute
+    malicious script code or to steal cookie-based authentication
+    credentials, potentially compromising the victim's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround for all those issues at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpMyAdmin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/phpmyadmin-2.6.4_p3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5">PMASA-2005-5</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3300">CVE-2005-3300</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3301">CVE-2005-3301</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 24 Oct 2005 08:28:30 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 25 Oct 2005 08:03:47 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-22.xml b/xml/htdocs/security/en/glsa/glsa-200510-22.xml
new file mode 100644
index 00000000..c1fdd0ca
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-22.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-22">
+  <title>SELinux PAM: Local password guessing attack</title>
+  <synopsis>
+    A vulnerability in the SELinux version of PAM allows a local attacker to
+    brute-force system passwords.
+  </synopsis>
+  <product type="ebuild">PAM</product>
+  <announced>October 28, 2005</announced>
+  <revised>October 28, 2005: 01</revised>
+  <bug>109485</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-libs/pam" auto="yes" arch="*">
+      <unaffected range="ge">0.78-r3</unaffected>
+      <vulnerable range="lt">0.78-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PAM (Pluggable Authentication Modules) is an architecture allowing
+    the separation of the development of privilege granting software from
+    the development of secure and appropriate authentication schemes.
+    SELinux is an operating system based on Linux which includes Mandatory
+    Access Control.
+    </p>
+  </background>
+  <description>
+    <p>
+    The SELinux patches for PAM introduce a vulnerability allowing a
+    password to be checked with the unix_chkpwd utility without delay or
+    logging. This vulnerability doesn't affect users who do not run
+    SELinux.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit this vulnerability to brute-force
+    passwords and escalate privileges on an SELinux system.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SELinux PAM users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-libs/pam-0.78-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2977">CVE-2005-2977</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 26 Oct 2005 15:44:45 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 27 Oct 2005 07:49:03 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 27 Oct 2005 12:12:27 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-23.xml b/xml/htdocs/security/en/glsa/glsa-200510-23.xml
new file mode 100644
index 00000000..3659431c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-23.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-23">
+  <title>TikiWiki: XSS vulnerability</title>
+  <synopsis>
+    TikiWiki is vulnerable to cross-site scripting attacks.
+  </synopsis>
+  <product type="ebuild">tikiwiki</product>
+  <announced>October 28, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>109858</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/tikiwiki" auto="yes" arch="*">
+      <unaffected range="ge">1.9.1.1</unaffected>
+      <vulnerable range="lt">1.9.1.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    TikiWiki is a web-based groupware and content management system (CMS),
+    using PHP, ADOdb and Smarty.
+    </p>
+  </background>
+  <description>
+    <p>
+    Due to improper input validation, TikiWiki can be exploited to perform
+    cross-site scripting attacks.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker could exploit this to inject and execute malicious
+    script code or to steal cookie-based authentication credentials,
+    potentially compromising the victim's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All TikiWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/tikiwiki-1.9.1.1&quot;</code>
+    <p>
+    Note: Users with the vhosts USE flag set should manually use
+    webapp-config to finalize the update.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3283">CVE-2005-3283</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 26 Oct 2005 19:43:33 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 27 Oct 2005 18:43:45 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-24.xml b/xml/htdocs/security/en/glsa/glsa-200510-24.xml
new file mode 100644
index 00000000..a1478cfc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-24.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-24">
+  <title>Mantis: Multiple vulnerabilities</title>
+  <synopsis>
+    Mantis is affected by multiple vulnerabilities ranging from information
+    disclosure to arbitrary script execution.
+  </synopsis>
+  <product type="ebuild">Mantis</product>
+  <announced>October 28, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>110326</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/mantisbt" auto="yes" arch="*">
+      <unaffected range="ge">0.19.3</unaffected>
+      <vulnerable range="lt">0.19.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mantis is a web-based bugtracking system written in PHP.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mantis contains several vulnerabilities, including:
+    </p>
+    <ul>
+    <li>a remote file inclusion vulnerability</li>
+    <li>an SQL injection vulnerability</li>
+    <li>multiple cross site scripting vulnerabilities</li>
+    <li>multiple information disclosure vulnerabilities</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could exploit the remote file inclusion vulnerability to
+    execute arbitrary script code, and the SQL injection vulnerability to
+    access or modify sensitive information from the Mantis database.
+    Furthermore the cross-site scripting issues give an attacker the
+    ability to inject and execute malicious script code or to steal
+    cookie-based authentication credentials, potentially compromising the
+    victim's browser. An attacker could exploit other vulnerabilities to
+    disclose information.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mantis users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/mantisbt-0.19.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.mantisbt.org/changelog.php">Mantis ChangeLog</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3335">CVE-2005-3335</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3336">CVE-2005-3336</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3337">CVE-2005-3337</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3338">CVE-2005-3338</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3339">CVE-2005-3339</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 26 Oct 2005 05:38:14 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 26 Oct 2005 05:38:58 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-25.xml b/xml/htdocs/security/en/glsa/glsa-200510-25.xml
new file mode 100644
index 00000000..14572956
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-25.xml
@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-25">
+  <title>Ethereal: Multiple vulnerabilities in protocol dissectors</title>
+  <synopsis>
+    Ethereal is vulnerable to numerous vulnerabilities, potentially resulting
+    in the execution of arbitrary code or abnormal termination.
+  </synopsis>
+  <product type="ebuild">Ethereal</product>
+  <announced>October 30, 2005</announced>
+  <revised>October 30, 2005: 01</revised>
+  <bug>109348</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/ethereal" auto="yes" arch="*">
+      <unaffected range="ge">0.10.13-r1</unaffected>
+      <vulnerable range="lt">0.10.13-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ethereal is a feature-rich network protocol analyzer.
+    </p>
+  </background>
+  <description>
+    <p>
+    There are numerous vulnerabilities in versions of Ethereal prior
+    to 0.10.13, including:
+    </p>
+    <ul>
+    <li>The SLIM3 and AgentX dissectors
+    could overflow a buffer (CVE-2005-3243).</li>
+    <li>iDEFENSE discovered a
+    buffer overflow in the SRVLOC dissector (CVE-2005-3184).</li>
+    <li>Multiple potential crashes in many dissectors have been fixed, see
+    References for further details.</li>
+    </ul>
+    <p>
+    Furthermore an infinite
+    loop was discovered in the IRC protocol dissector of the 0.10.13
+    release (CVE-2005-3313).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker might be able to use these vulnerabilities to crash
+    Ethereal or execute arbitrary code with the permissions of the user
+    running Ethereal, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ethereal users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/ethereal-0.10.13-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3184">CVE-2005-3184</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3241">CVE-2005-3241</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3242">CVE-2005-3242</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3243">CVE-2005-3243</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3244">CVE-2005-3244</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3245">CVE-2005-3245</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3246">CVE-2005-3246</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3247">CVE-2005-3247</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3248">CVE-2005-3248</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3249">CVE-2005-3249</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3313">CVE-2005-3313</uri>
+    <uri link="http://www.ethereal.com/appnotes/enpa-sa-00021.html">Ethereal enpa-sa-00021</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 17 Oct 2005 05:29:11 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 30 Oct 2005 09:10:32 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200510-26.xml b/xml/htdocs/security/en/glsa/glsa-200510-26.xml
new file mode 100644
index 00000000..c7bf2084
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200510-26.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200510-26">
+  <title>XLI, Xloadimage: Buffer overflow</title>
+  <synopsis>
+    XLI and Xloadimage contain a vulnerability which could potentially result
+    in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">xli xloadimage</product>
+  <announced>October 30, 2005</announced>
+  <revised>October 30, 2005: 01</revised>
+  <bug>108365</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/xli" auto="yes" arch="*">
+      <unaffected range="ge">1.17.0-r2</unaffected>
+      <vulnerable range="lt">1.17.0-r2</vulnerable>
+    </package>
+    <package name="media-gfx/xloadimage" auto="yes" arch="*">
+      <unaffected range="ge">4.1-r4</unaffected>
+      <vulnerable range="lt">4.1-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    XLI and Xloadimage are X11 image manipulation utilities.
+    </p>
+  </background>
+  <description>
+    <p>
+    When XLI or Xloadimage process an image, they create a new image
+    object to contain the new image, copying the title from the old image
+    to the newly created image. Ariel Berkman reported that the 'zoom',
+    'reduce', and 'rotate' functions use a fixed length buffer to contain
+    the new title, which could be overwritten by the NIFF or XPM image
+    processors.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious user could craft a malicious XPM or NIFF file and
+    entice a user to view it using XLI, or manipulate it using Xloadimage,
+    potentially resulting in the execution of arbitrary code with the
+    permissions of the user running XLI or Xloadimage.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All XLI users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/xli-1.17.0-r2&quot;</code>
+    <p>
+    All Xloadimage users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/xloadimage-4.1-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3178">CAN-2005-3178</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 26 Oct 2005 15:18:40 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 28 Oct 2005 03:10:06 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 30 Oct 2005 15:11:22 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-01.xml b/xml/htdocs/security/en/glsa/glsa-200511-01.xml
new file mode 100644
index 00000000..54bd5986
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-01.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-01">
+  <title>libgda: Format string vulnerabilities</title>
+  <synopsis>
+    Two format string vulnerabilities in libgda may lead to the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">libgda</product>
+  <announced>November 02, 2005</announced>
+  <revised>November 02, 2005: 01</revised>
+  <bug>110467</bug>
+  <access>remote</access>
+  <affected>
+    <package name="gnome-extra/libgda" auto="yes" arch="*">
+      <unaffected range="ge">1.2.2-r1</unaffected>
+      <vulnerable range="lt">1.2.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libgda is the library handling the data abstraction layer in the
+    Gnome data access architecture (GNOME-DB). It can also be used by
+    non-GNOME applications to manage data stored in databases or XML files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Steve Kemp discovered two format string vulnerabilities in the
+    gda_log_error and gda_log_message functions. Some applications may pass
+    untrusted input to those functions and be vulnerable.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could pass malicious input to an application making
+    use of the vulnerable libgda functions, potentially resulting in the
+    execution of arbitrary code with the rights of that application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libgda users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=gnome-extra/libgda-1.2.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2958">CVE-2005-2958</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 30 Oct 2005 15:09:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 30 Oct 2005 15:09:33 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 01 Nov 2005 13:44:10 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-02.xml b/xml/htdocs/security/en/glsa/glsa-200511-02.xml
new file mode 100644
index 00000000..a2dbb67a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-02.xml
@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-02">
+  <title>QDBM, ImageMagick, GDAL: RUNPATH issues</title>
+  <synopsis>
+    Multiple packages suffer from RUNPATH issues that may allow users in the
+    "portage" group to escalate privileges.
+  </synopsis>
+  <product type="ebuild">QDBM ImageMagick GDAL</product>
+  <announced>November 02, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>105717</bug>
+  <bug>105760</bug>
+  <bug>108534</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-db/qdbm" auto="yes" arch="*">
+      <unaffected range="ge">1.8.33-r2</unaffected>
+      <vulnerable range="lt">1.8.33-r2</vulnerable>
+    </package>
+    <package name="media-gfx/imagemagick" auto="yes" arch="*">
+      <unaffected range="ge">6.2.4.2-r1</unaffected>
+      <vulnerable range="lt">6.2.4.2-r1</vulnerable>
+    </package>
+    <package name="sci-libs/gdal" auto="yes" arch="*">
+      <unaffected range="ge">1.3.0-r1</unaffected>
+      <unaffected range="rge">1.2.6-r4</unaffected>
+      <vulnerable range="lt">1.3.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    QDBM is a library of routines for managing a database. ImageMagick is a
+    collection of tools to read, write and manipulate images. GDAL is a
+    geospatial data abstraction library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Some packages may introduce insecure paths into the list of directories
+    that are searched for libraries at runtime. Furthermore, packages
+    depending on the MakeMaker Perl module for build configuration may have
+    incorrectly copied the LD_RUN_PATH into the DT_RPATH.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A local attacker, who is a member of the "portage" group, could create
+    a malicious shared object in the Portage temporary build directory that
+    would be loaded at runtime by a dependent executable, potentially
+    resulting in privilege escalation.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Only grant "portage" group rights to trusted users.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All QDBM users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/qdbm-1.8.33-r2&quot;</code>
+    <p>
+    All ImageMagick users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/imagemagick-6.2.4.2-r1&quot;</code>
+    <p>
+    All GDAL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose sci-libs/gdal</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3580">CVE-2005-3580</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3581">CVE-2005-3581</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3582">CVE-2005-3582</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 15 Oct 2005 10:06:06 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 01 Nov 2005 13:10:18 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-03.xml b/xml/htdocs/security/en/glsa/glsa-200511-03.xml
new file mode 100644
index 00000000..e1fcdbe7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-03.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-03">
+  <title>giflib: Multiple vulnerabilities</title>
+  <synopsis>
+    giflib may dereference NULL or write out of bounds when processing
+    malformed images, potentially resulting in Denial of Service or arbitrary
+    code execution.
+  </synopsis>
+  <product type="ebuild">giflib</product>
+  <announced>November 04, 2005</announced>
+  <revised>November 04, 2005: 01</revised>
+  <bug>109997</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/giflib" auto="yes" arch="*">
+      <unaffected range="ge">4.1.4</unaffected>
+      <vulnerable range="lt">4.1.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    giflib is a library for reading and writing GIF images.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Evans and Daniel Eisenbud independently discovered two
+    out-of-bounds memory write operations and a NULL pointer dereference in
+    giflib.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could craft a malicious GIF image and entice users to
+    load it using an application making use of the giflib library,
+    resulting in an application crash or potentially the execution of
+    arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All giflib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/giflib-4.1.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2974">CVE-2005-2974</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3350">CVE-2005-3350</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 29 Oct 2005 09:30:14 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 02 Nov 2005 12:50:36 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 04 Nov 2005 08:45:23 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-04.xml b/xml/htdocs/security/en/glsa/glsa-200511-04.xml
new file mode 100644
index 00000000..04a949d4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-04.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-04">
+  <title>ClamAV: Multiple vulnerabilities</title>
+  <synopsis>
+    ClamAV has many security flaws which make it vulnerable to remote execution
+    of arbitrary code and a Denial of Service.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>November 06, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>109213</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.87.1</unaffected>
+      <vulnerable range="lt">0.87.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ClamAV is a GPL anti-virus toolkit, designed for integration with mail
+    servers to perform attachment scanning. ClamAV also provides a command
+    line scanner and a tool for fetching updates of the virus database.
+    </p>
+  </background>
+  <description>
+    <p>
+    ClamAV has multiple security flaws: a boundary check was performed
+    incorrectly in petite.c, a buffer size calculation in unfsg_133 was
+    incorrect in fsg.c, a possible infinite loop was fixed in tnef.c and a
+    possible infinite loop in cabd_find was fixed in cabd.c . In addition
+    to this, Marcin Owsiany reported that a corrupted DOC file causes a
+    segmentation fault in ClamAV.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By sending a malicious attachment to a mail server that is hooked with
+    ClamAV, a remote attacker could cause a Denial of Service or the
+    execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.87.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3239">CAN-2005-3239</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3303">CAN-2005-3303</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3500">CVE-2005-3500</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3501">CVE-2005-3501</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3587">CVE-2005-3587</uri>
+    <uri link="http://sourceforge.net/project/shownotes.php?release_id=368319">ClamAV release notes</uri>
+    <uri link="http://www.zerodayinitiative.com/advisories/ZDI-05-002.html">Zero Day Initiative advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 04 Nov 2005 08:33:36 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 04 Nov 2005 15:17:11 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 06 Nov 2005 14:23:05 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-05.xml b/xml/htdocs/security/en/glsa/glsa-200511-05.xml
new file mode 100644
index 00000000..067c32f8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-05.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-05">
+  <title>GNUMP3d: Directory traversal and XSS vulnerabilities</title>
+  <synopsis>
+    GNUMP3d is vulnerable to directory traversal and cross-site scripting
+    attacks that may result in information disclosure or the compromise of a
+    browser.
+  </synopsis>
+  <product type="ebuild">gnump3d</product>
+  <announced>November 06, 2005</announced>
+  <revised>August 21, 2007: 02</revised>
+  <bug>109667</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/gnump3d" auto="yes" arch="*">
+      <unaffected range="ge">2.9_pre7</unaffected>
+      <vulnerable range="lt">2.9_pre7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GNUMP3d is a streaming server for MP3s, OGG vorbis files, movies and
+    other media formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Steve Kemp reported about two cross-site scripting attacks that are
+    related to the handling of files (CVE-2005-3424, CVE-2005-3425). Also
+    reported is a directory traversal vulnerability which comes from the
+    attempt to sanitize input paths (CVE-2005-3123).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit this to disclose sensitive information
+    or inject and execute malicious script code, potentially compromising
+    the victim's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GNUMP3d users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/gnump3d-2.9_pre7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3123">CVE-2005-3123</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3424">CVE-2005-3424</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3425">CVE-2005-3425</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 03 Nov 2005 12:32:56 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 04 Nov 2005 13:55:23 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 05 Nov 2005 08:54:39 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-06.xml b/xml/htdocs/security/en/glsa/glsa-200511-06.xml
new file mode 100644
index 00000000..0a84ca9a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-06.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-06">
+  <title>fetchmail: Password exposure in fetchmailconf</title>
+  <synopsis>
+    fetchmailconf fails to properly handle file permissions, temporarily
+    exposing sensitive information to other local users.
+  </synopsis>
+  <product type="ebuild">fetchmail</product>
+  <announced>November 06, 2005</announced>
+  <revised>November 06, 2005: 01</revised>
+  <bug>110366</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-mail/fetchmail" auto="yes" arch="*">
+      <unaffected range="ge">6.2.5.2-r1</unaffected>
+      <vulnerable range="lt">6.2.5.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    fetchmail is a utility that retrieves and forwards mail from
+    remote systems using IMAP, POP, and other protocols. It ships with
+    fetchmailconf, a graphical utility used to create configuration files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Thomas Wolff discovered that fetchmailconf opens the configuration
+    file with default permissions, writes the configuration to it, and only
+    then restricts read permissions to the owner.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit the race condition to retrieve
+    sensitive information like IMAP/POP passwords.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Run "umask 077" to temporarily strengthen default permissions,
+    then run "fetchmailconf" from the same shell.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All fetchmail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/fetchmail-6.2.5.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://fetchmail.berlios.de/fetchmail-SA-2005-02.txt">Fetchmail Security Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3088">CVE-2005-3088</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 04 Nov 2005 12:31:43 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 04 Nov 2005 12:31:54 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-07.xml b/xml/htdocs/security/en/glsa/glsa-200511-07.xml
new file mode 100644
index 00000000..976012a9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-07.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-07">
+  <title>OpenVPN: Multiple vulnerabilities</title>
+  <synopsis>
+    The OpenVPN client is potentially vulnerable to the execution of arbitrary
+    code and the OpenVPN server is vulnerable to a Denial of Service issue.
+  </synopsis>
+  <product type="ebuild">OpenVPN</product>
+  <announced>November 06, 2005</announced>
+  <revised>November 06, 2005: 01</revised>
+  <bug>111116</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/openvpn" auto="yes" arch="*">
+      <unaffected range="ge">2.0.4</unaffected>
+      <vulnerable range="lt">2.0.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenVPN is a multi-platform, full-featured SSL VPN solution.
+    </p>
+  </background>
+  <description>
+    <p>
+    The OpenVPN client contains a format string bug in the handling of
+    the foreign_option in options.c. Furthermore, when the OpenVPN server
+    runs in TCP mode, it may dereference a NULL pointer under specific
+    error conditions.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could setup a malicious OpenVPN server and trick
+    the user into connecting to it, potentially executing arbitrary code on
+    the client's computer. A remote attacker could also exploit the NULL
+    dereference issue by sending specific packets to an OpenVPN server
+    running in TCP mode, resulting in a Denial of Service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not use "pull" or "client" options in the OpenVPN client
+    configuration file, and use UDP mode for the OpenVPN server.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenVPN users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/openvpn-2.0.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3393">CVE-2005-3393</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3409">CVE-2005-3409</uri>
+    <uri link="http://openvpn.net/changelog.html">OpenVPN changelog</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 02 Nov 2005 12:34:18 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 04 Nov 2005 13:01:51 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 06 Nov 2005 14:23:34 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-08.xml b/xml/htdocs/security/en/glsa/glsa-200511-08.xml
new file mode 100644
index 00000000..96194884
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-08.xml
@@ -0,0 +1,118 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-08">
+  <title>PHP: Multiple vulnerabilities</title>
+  <synopsis>
+    PHP suffers from multiple issues, resulting in security functions bypass,
+    local Denial of service, cross-site scripting or PHP variables overwrite.
+  </synopsis>
+  <product type="ebuild">PHP</product>
+  <announced>November 13, 2005</announced>
+  <revised>November 13, 2005: 01</revised>
+  <bug>107602</bug>
+  <bug>111032</bug>
+  <access>remote and local</access>
+  <affected>
+    <package name="dev-php/php" auto="yes" arch="*">
+      <unaffected range="rge">4.3.11-r4</unaffected>
+      <unaffected range="ge">4.4.0-r4</unaffected>
+      <vulnerable range="lt">4.4.0-r4</vulnerable>
+    </package>
+    <package name="dev-php/mod_php" auto="yes" arch="*">
+      <unaffected range="rge">4.3.11-r4</unaffected>
+      <unaffected range="ge">4.4.0-r8</unaffected>
+      <vulnerable range="lt">4.4.0-r8</vulnerable>
+    </package>
+    <package name="dev-php/php-cgi" auto="yes" arch="*">
+      <unaffected range="rge">4.3.11-r5</unaffected>
+      <unaffected range="ge">4.4.0-r5</unaffected>
+      <vulnerable range="lt">4.4.0-r5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHP is a general-purpose scripting language widely used to develop
+    web-based applications. It can run inside a web server using the
+    mod_php module or the CGI version and also stand-alone in a CLI.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been found and fixed in PHP:
+    </p>
+    <ul>
+    <li>a possible $GLOBALS variable overwrite problem through file
+    upload handling, extract() and import_request_variables()
+    (CVE-2005-3390)</li>
+    <li>a local Denial of Service through the use of
+    the session.save_path option (CVE-2005-3319)</li>
+    <li>an issue with
+    trailing slashes in allowed basedirs (CVE-2005-3054)</li>
+    <li>an issue
+    with calling virtual() on Apache 2, allowing to bypass safe_mode and
+    open_basedir restrictions (CVE-2005-3392)</li>
+    <li>a problem when a
+    request was terminated due to memory_limit constraints during certain
+    parse_str() calls (CVE-2005-3389)</li>
+    <li>The curl and gd modules
+    allowed to bypass the safe mode open_basedir restrictions
+    (CVE-2005-3391)</li>
+    <li>a cross-site scripting (XSS) vulnerability in
+    phpinfo() (CVE-2005-3388)</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    Attackers could leverage these issues to exploit applications that
+    are assumed to be secure through the use of proper register_globals,
+    safe_mode or open_basedir parameters. Remote attackers could also
+    conduct cross-site scripting attacks if a page calling phpinfo() was
+    available. Finally, a local attacker could cause a local Denial of
+    Service using malicious session.save_path options.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround that would solve all issues at this
+    time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-php/php</code>
+    <p>
+    All mod_php users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-php/mod_php</code>
+    <p>
+    All php-cgi users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-php/php-cgi</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3054">CVE-2005-3054</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3319">CVE-2005-3319</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3388">CVE-2005-3388</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3389">CVE-2005-3389</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3390">CVE-2005-3390</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3391">CVE-2005-3391</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3392">CVE-2005-3392</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 07 Nov 2005 14:11:50 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 13 Nov 2005 14:44:31 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-09.xml b/xml/htdocs/security/en/glsa/glsa-200511-09.xml
new file mode 100644
index 00000000..27771d68
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-09.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-09">
+  <title>Lynx: Arbitrary command execution</title>
+  <synopsis>
+    Lynx is vulnerable to an issue which allows the remote execution of
+    arbitrary commands.
+  </synopsis>
+  <product type="ebuild">lynx</product>
+  <announced>November 13, 2005</announced>
+  <revised>November 13, 2005: 01</revised>
+  <bug>112213</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/lynx" auto="yes" arch="*">
+      <unaffected range="ge">2.8.5-r2</unaffected>
+      <vulnerable range="lt">2.8.5-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Lynx is a fully-featured WWW client for users running
+    cursor-addressable, character-cell display devices such as vt100
+    terminals and terminal emulators.
+    </p>
+  </background>
+  <description>
+    <p>
+    iDefense labs discovered a problem within the feature to execute
+    local cgi-bin programs via the "lynxcgi:" URI handler. Due to a
+    configuration error, the default settings allow websites to specify
+    commands to run as the user running Lynx.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker can entice a user to access a malicious HTTP
+    server, causing Lynx to execute arbitrary commands.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable "lynxcgi" links by specifying the following directive in
+    lynx.cfg:
+    </p>
+    <code>
+    TRUSTED_LYNXCGI:none</code>
+  </workaround>
+  <resolution>
+    <p>
+    All Lynx users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/lynx-2.8.5-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2929">CVE-2005-2929</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=338&amp;type=vulnerabilities">iDefense Security Advisory 11.11.05</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 11 Nov 2005 20:17:54 +0000">
+    taviso
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 11 Nov 2005 21:30:52 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 13 Nov 2005 17:03:02 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-10.xml b/xml/htdocs/security/en/glsa/glsa-200511-10.xml
new file mode 100644
index 00000000..1fe25982
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-10.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-10">
+  <title>RAR: Format string and buffer overflow vulnerabilities</title>
+  <synopsis>
+    RAR contains a format string error and a buffer overflow vulnerability that
+    may be used to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">rar</product>
+  <announced>November 13, 2005</announced>
+  <revised>November 13, 2005: 01</revised>
+  <bug>111926</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/rar" auto="yes" arch="*">
+      <unaffected range="ge">3.5.1</unaffected>
+      <vulnerable range="lt">3.5.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    RAR is a powerful archive manager that can decompress RAR, ZIP and
+    other files, and can create new archives in RAR and ZIP file format.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tan Chew Keong reported about two vulnerabilities found in RAR:
+    </p>
+    <ul>
+    <li>A format string error exists when displaying a diagnostic
+    error message that informs the user of an invalid filename in an
+    UUE/XXE encoded file.</li>
+    <li>Some boundary errors in the processing
+    of malicious ACE archives can be exploited to cause a buffer
+    overflow.</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities by enticing
+    a user to:
+    </p>
+    <ul><li>decode a specially crafted UUE/XXE file,
+    or</li>
+    <li>extract a malicious ACE archive containing a file with an
+    overly long filename.</li>
+    </ul>
+    <p>
+    When the user performs these
+    actions, the arbitrary code of the attacker's choice will be executed.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All RAR users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/rar-3.5.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.rarlabs.com/rarnew.htm">RAR Release Notes</uri>
+    <uri link="http://secunia.com/secunia_research/2005-53/advisory/">Secunia Research 11/10/2005</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 11 Nov 2005 09:12:31 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 11 Nov 2005 14:35:09 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 11 Nov 2005 14:35:22 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-11.xml b/xml/htdocs/security/en/glsa/glsa-200511-11.xml
new file mode 100644
index 00000000..54116ace
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-11.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-11">
+  <title>linux-ftpd-ssl: Remote buffer overflow</title>
+  <synopsis>
+    A buffer overflow vulnerability has been found, allowing a remote attacker
+    to execute arbitrary code with escalated privileges on the local system.
+  </synopsis>
+  <product type="ebuild">linux-ftpd-ssl</product>
+  <announced>November 13, 2005</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>111573</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-ftp/netkit-ftpd" auto="yes" arch="*">
+      <unaffected range="ge">0.17-r3</unaffected>
+      <vulnerable range="lt">0.17-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    linux-ftpd-ssl is the netkit FTP server with encryption support.
+    </p>
+  </background>
+  <description>
+    <p>
+    A buffer overflow vulnerability has been found in the
+    linux-ftpd-ssl package. A command that generates an excessively long
+    response from the server may overrun a stack buffer.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker that has permission to create directories that are
+    accessible via the FTP server could exploit this vulnerability.
+    Successful exploitation would execute arbitrary code on the local
+    machine with root privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ftpd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-ftp/netkit-ftpd-0.17-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3524">CVE-2005-3524</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 06 Nov 2005 18:51:48 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 06 Nov 2005 21:31:18 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 12 Nov 2005 21:51:01 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-12.xml b/xml/htdocs/security/en/glsa/glsa-200511-12.xml
new file mode 100644
index 00000000..6dbbab1d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-12.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-12">
+  <title>Scorched 3D: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Scorched 3D allow a remote attacker to deny
+    service or execute arbitrary code on game servers.
+  </synopsis>
+  <product type="ebuild">scorched3d</product>
+  <announced>November 15, 2005</announced>
+  <revised>August 10, 2006: 03</revised>
+  <bug>111421</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-strategy/scorched3d" auto="yes" arch="*">
+      <unaffected range="ge">40</unaffected>
+      <vulnerable range="le">39.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Scorched 3D is a clone of the classic "Scorched Earth" DOS game, adding
+    features like a 3D island environment and Internet multiplayer
+    capabilities.
+    </p>
+  </background>
+  <description>
+    <p>
+    Luigi Auriemma discovered multiple flaws in the Scorched 3D game
+    server, including a format string vulnerability and several buffer
+    overflows.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker can exploit these vulnerabilities to crash a game
+    server or execute arbitrary code with the rights of the game server
+    user. Users not running a Scorched 3D game server are not affected by
+    these flaws.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Scorched 3D users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-strategy/scorched3d-40&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://seclists.org/lists/fulldisclosure/2005/Nov/0079.html">Original advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3486">CVE-2005-3486</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3487">CVE-2005-3487</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3488">CVE-2005-3488</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 14 Nov 2005 13:02:43 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 14 Nov 2005 13:04:09 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-13.xml b/xml/htdocs/security/en/glsa/glsa-200511-13.xml
new file mode 100644
index 00000000..076174f1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-13.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-13">
+  <title>Sylpheed, Sylpheed-Claws: Buffer overflow in LDIF importer</title>
+  <synopsis>
+    Sylpheed and Sylpheed-Claws contain a buffer overflow vulnerability which
+    may lead to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">sylpheed sylpheed-claws</product>
+  <announced>November 15, 2005</announced>
+  <revised>November 15, 2005: 01</revised>
+  <bug>111853</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/sylpheed" auto="yes" arch="*">
+      <unaffected range="ge">2.0.4</unaffected>
+      <vulnerable range="lt">2.0.4</vulnerable>
+    </package>
+    <package name="mail-client/sylpheed-claws" auto="yes" arch="*">
+      <unaffected range="ge">1.0.5-r1</unaffected>
+      <vulnerable range="lt">1.0.5-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Sylpheed is a lightweight email client and newsreader.
+    Sylpheed-Claws is a 'bleeding edge' version of Sylpheed. They both
+    support the import of address books in LDIF (Lightweight Directory
+    Interchange Format).
+    </p>
+  </background>
+  <description>
+    <p>
+    Colin Leroy reported buffer overflow vulnerabilities in Sylpheed
+    and Sylpheed-Claws. The LDIF importer uses a fixed length buffer to
+    store data of variable length. Two similar problems exist also in the
+    Mutt and Pine addressbook importers of Sylpheed-Claws.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By convincing a user to import a specially-crafted LDIF file into
+    the address book, a remote attacker could cause the program to crash,
+    potentially allowing the execution of arbitrary code with the
+    privileges of the user running the software.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Sylpheed users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/sylpheed-2.0.4&quot;</code>
+    <p>
+    All Sylpheed-Claws users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/sylpheed-claws-1.0.5-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3354">CVE-2005-3354</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 13 Nov 2005 17:42:22 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 13 Nov 2005 18:10:25 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 15 Nov 2005 08:35:12 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-14.xml b/xml/htdocs/security/en/glsa/glsa-200511-14.xml
new file mode 100644
index 00000000..574a7658
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-14.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-14">
+  <title>GTK+ 2, GdkPixbuf: Multiple XPM decoding vulnerabilities</title>
+  <synopsis>
+    The GdkPixbuf library, that is also included in GTK+ 2, contains
+    vulnerabilities that could lead to a Denial of Service or the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">gtk+</product>
+  <announced>November 16, 2005</announced>
+  <revised>November 16, 2005: 01</revised>
+  <bug>112608</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-libs/gtk+" auto="yes" arch="*">
+      <unaffected range="ge">2.8.6-r1</unaffected>
+      <unaffected range="rge">2.6.10-r1</unaffected>
+      <unaffected range="lt">2.0</unaffected>
+      <vulnerable range="lt">2.8.6-r1</vulnerable>
+    </package>
+    <package name="media-libs/gdk-pixbuf" auto="yes" arch="*">
+      <unaffected range="ge">0.22.0-r5</unaffected>
+      <vulnerable range="lt">0.22.0-r5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GTK+ (the GIMP Toolkit) is a toolkit for creating graphical user
+    interfaces. The GdkPixbuf library provides facilities for image
+    handling. It is available as a standalone library and also packaged
+    with GTK+ 2.
+    </p>
+  </background>
+  <description>
+    <p>
+    iDEFENSE reported a possible heap overflow in the XPM loader
+    (CVE-2005-3186). Upon further inspection, Ludwig Nussel discovered two
+    additional issues in the XPM processing functions : an integer overflow
+    (CVE-2005-2976) that affects only gdk-pixbuf, and an infinite loop
+    (CVE-2005-2975).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Using a specially crafted XPM image an attacker could cause an
+    affected application to enter an infinite loop or trigger the
+    overflows, potentially allowing the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GTK+ 2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose x11-libs/gtk+</code>
+    <p>
+    All GdkPixbuf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/gdk-pixbuf-0.22.0-r5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2975">CVE-2005-2975</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2976">CVE-2005-2976</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3186">CVE-2005-3186</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=339&amp;type=vulnerabilities">iDefense Security Advisory 11.15.05</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 14 Nov 2005 14:55:40 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 16 Nov 2005 12:54:54 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-15.xml b/xml/htdocs/security/en/glsa/glsa-200511-15.xml
new file mode 100644
index 00000000..177260e7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-15.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-15">
+  <title>Smb4k: Local unauthorized file access</title>
+  <synopsis>
+    A vulnerability has been identified that allows unauthorized access to the
+    contents of /etc/sudoers and /etc/super.tab files.
+  </synopsis>
+  <product type="ebuild">Smb4k</product>
+  <announced>November 18, 2005</announced>
+  <revised>November 18, 2005: 01</revised>
+  <bug>111089</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-misc/smb4k" auto="yes" arch="*">
+      <unaffected range="ge">0.6.4</unaffected>
+      <vulnerable range="lt">0.6.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Smb4K is a SMB/CIFS share browser for KDE.
+    </p>
+  </background>
+  <description>
+    <p>
+    A vulnerability leading to unauthorized file access has been
+    found. A pre-existing symlink from /tmp/sudoers and /tmp/super.tab to a
+    textfile will cause Smb4k to write the contents of these files to the
+    target of the symlink, as Smb4k does not check for the existence of
+    these files before writing to them.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could acquire local privilege escalation by adding
+    username(s) to the list of sudoers.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All smb4k users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/smb4k-0.6.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2851">CVE-2005-2851</uri>
+    <uri link="http://smb4k.berlios.de/">Smb4k Announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 15 Nov 2005 09:03:00 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 15 Nov 2005 09:04:04 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 16 Nov 2005 02:48:46 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-16.xml b/xml/htdocs/security/en/glsa/glsa-200511-16.xml
new file mode 100644
index 00000000..6bb85b2e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-16.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-16">
+  <title>GNUMP3d: Directory traversal and insecure temporary file creation</title>
+  <synopsis>
+    Two vulnerabilities have been identified in GNUMP3d allowing for limited
+    directory traversal and insecure temporary file creation.
+  </synopsis>
+  <product type="ebuild">GNUMP3d</product>
+  <announced>November 21, 2005</announced>
+  <revised>August 21, 2007: 02</revised>
+  <bug>111990</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/gnump3d" auto="yes" arch="*">
+      <unaffected range="ge">2.9_pre7</unaffected>
+      <vulnerable range="lt">2.9_pre7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GNUMP3d is a streaming server for MP3s, OGG vorbis files, movies and
+    other media formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ludwig Nussel from SUSE Linux has identified two vulnerabilities in
+    GNUMP3d. GNUMP3d fails to properly check for the existence of
+    /tmp/index.lok before writing to the file, allowing for local
+    unauthorized access to files owned by the user running GNUMP3d. GNUMP3d
+    also fails to properly validate the "theme" GET variable from CGI
+    input, allowing for unauthorized file inclusion.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could overwrite files owned by the user running GNUMP3d by
+    symlinking /tmp/index.lok to the file targeted for overwrite. An
+    attacker could also include arbitrary files by traversing up the
+    directory tree (at most two times, i.e. "../..") with the "theme" GET
+    variable.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GNUMP3d users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/gnump3d-2.9_pre7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3349">CVE-2005-3349</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3355">CVE-2005-3355</uri>
+    <uri link="http://www.gnu.org/software/gnump3d/ChangeLog">GNUMP3d Changelog</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 18 Nov 2005 12:35:13 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 18 Nov 2005 12:35:57 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 18 Nov 2005 22:47:09 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-17.xml b/xml/htdocs/security/en/glsa/glsa-200511-17.xml
new file mode 100644
index 00000000..b50a3f6a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-17.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-17">
+  <title>FUSE: mtab corruption through fusermount</title>
+  <synopsis>
+    The fusermount utility from FUSE can be abused to corrupt the /etc/mtab
+    file contents, potentially allowing a local attacker to set unauthorized
+    mount options.
+  </synopsis>
+  <product type="ebuild">FUSE</product>
+  <announced>November 22, 2005</announced>
+  <revised>November 22, 2005: 01</revised>
+  <bug>112902</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-fs/fuse" auto="yes" arch="*">
+      <unaffected range="ge">2.4.1-r1</unaffected>
+      <vulnerable range="lt">2.4.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    FUSE (Filesystem in Userspace) allows implementation of a fully
+    functional filesystem in a userspace program. The fusermount utility is
+    used to mount/unmount FUSE file systems.
+    </p>
+  </background>
+  <description>
+    <p>
+    Thomas Biege discovered that fusermount fails to securely handle
+    special characters specified in mount points.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could corrupt the contents of the /etc/mtab file
+    by mounting over a maliciously-named directory using fusermount,
+    potentially allowing the attacker to set unauthorized mount options.
+    This is possible only if fusermount is installed setuid root, which is
+    the default in Gentoo.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All FUSE users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-fs/fuse-2.4.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3531">CVE-2005-3531</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 20 Nov 2005 12:06:35 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 21 Nov 2005 13:30:54 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 22 Nov 2005 16:07:17 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-18.xml b/xml/htdocs/security/en/glsa/glsa-200511-18.xml
new file mode 100644
index 00000000..795f1ddc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-18.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-18">
+  <title>phpSysInfo: Multiple vulnerabilities</title>
+  <synopsis>
+    phpSysInfo is vulnerable to multiple issues, including a local file
+    inclusion leading to information disclosure and the potential execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">phpsysinfo</product>
+  <announced>November 22, 2005</announced>
+  <revised>November 22, 2005: 01</revised>
+  <bug>112482</bug>
+  <access>local and remote</access>
+  <affected>
+    <package name="www-apps/phpsysinfo" auto="yes" arch="*">
+      <unaffected range="ge">2.4.1</unaffected>
+      <vulnerable range="lt">2.4.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpSysInfo displays various system stats via PHP scripts.
+    </p>
+  </background>
+  <description>
+    <p>
+    Christopher Kunz from the Hardened-PHP Project discovered
+    that phpSysInfo is vulnerable to local file inclusion, cross-site
+    scripting and a HTTP Response Splitting attacks.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker may exploit the file inclusion vulnerability by
+    sending malicious requests, causing the execution of arbitrary code
+    with the rights of the user running the web server. A remote attacker
+    could exploit the vulnerability to disclose local file content.
+    Furthermore, the cross-site scripting issues gives a remote attacker
+    the ability to inject and execute malicious script code in the user's
+    browser context or to steal cookie-based authentication credentials.
+    The HTTP response splitting issue give an attacker the ability to
+    perform site hijacking and cache poisoning.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpSysInfo users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/phpsysinfo-2.4.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.hardened-php.net/advisory_222005.81.html">Original advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3347">CVE-2005-3347</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3348">CVE-2005-3348</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 21 Nov 2005 11:13:22 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 21 Nov 2005 13:32:38 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 21 Nov 2005 18:14:24 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-19.xml b/xml/htdocs/security/en/glsa/glsa-200511-19.xml
new file mode 100644
index 00000000..4feb51f9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-19.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-19">
+  <title>eix: Insecure temporary file creation</title>
+  <synopsis>
+    eix has an insecure temporary file creation vulnerability, potentially
+    allowing a local user to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">eix</product>
+  <announced>November 22, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>112061</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-portage/eix" auto="yes" arch="*">
+      <unaffected range="ge">0.5.0_pre2</unaffected>
+      <unaffected range="rge">0.3.0-r2</unaffected>
+      <vulnerable range="lt">0.5.0_pre2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    eix is a small utility for searching ebuilds with indexing for fast
+    results.
+    </p>
+  </background>
+  <description>
+    <p>
+    Eric Romang discovered that eix creates a temporary file with a
+    predictable name. eix creates a temporary file in /tmp/eix.*.sync where
+    * is the process ID of the shell running eix.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker can watch the process list and determine the process
+    ID of the shell running eix while the "emerge --sync" command is
+    running, then create a link from the corresponding temporary file to a
+    system file, which would result in the file being overwritten with the
+    rights of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All eix users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose app-portage/eix</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3785">CVE-2005-3785</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 21 Nov 2005 09:11:10 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 21 Nov 2005 20:48:28 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 22 Nov 2005 08:46:22 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-20.xml b/xml/htdocs/security/en/glsa/glsa-200511-20.xml
new file mode 100644
index 00000000..0c56e27b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-20.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-20">
+  <title>Horde Application Framework: XSS vulnerability</title>
+  <synopsis>
+    The Horde Application Framework is vulnerable to a cross-site scripting
+    vulnerability which could lead to the compromise of the victim's browser
+    content.
+  </synopsis>
+  <product type="ebuild">horde</product>
+  <announced>November 22, 2005</announced>
+  <revised>November 22, 2005: 01</revised>
+  <bug>112491</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/horde" auto="yes" arch="*">
+      <unaffected range="ge">2.2.9</unaffected>
+      <vulnerable range="lt">2.2.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Horde Application Framework is a general-purpose web
+    application framework written in PHP, providing classes for handling
+    preferences, compression, browser detection, connection tracking, MIME,
+    and more.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Horde Team reported a potential XSS vulnerability. Horde fails
+    to properly escape error messages which may lead to displaying
+    unsanitized error messages via Notification_Listener::getMessage()
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By enticing a user to read a specially-crafted e-mail or using a
+    manipulated URL, an attacker can execute arbitrary scripts running in
+    the context of the victim's browser. This could lead to a compromise of
+    the user's browser content.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Horde Application Framework users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-2.2.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3570">CVE-2005-3570</uri>
+    <uri link="http://lists.horde.org/archives/announce/2005/000231.html">Horde Announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 20 Nov 2005 18:32:42 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 20 Nov 2005 19:23:12 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 21 Nov 2005 09:22:48 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-21.xml b/xml/htdocs/security/en/glsa/glsa-200511-21.xml
new file mode 100644
index 00000000..111b9c4d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-21.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-21">
+  <title>Macromedia Flash Player: Remote arbitrary code execution</title>
+  <synopsis>
+    A vulnerability has been identified that allows arbitrary code execution on
+    a user's system via the handling of malicious SWF files.
+  </synopsis>
+  <product type="ebuild">Flash</product>
+  <announced>November 25, 2005</announced>
+  <revised>May 28, 2009: 02</revised>
+  <bug>112251</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-plugins/adobe-flash" auto="yes" arch="*">
+      <unaffected range="ge">7.0.61</unaffected>
+      <vulnerable range="lt">7.0.61</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Macromedia Flash Player is a renderer for the popular SWF
+    filetype which is commonly used to provide interactive websites,
+    digital experiences and mobile content.
+    </p>
+  </background>
+  <description>
+    <p>
+    When handling a SWF file, the Macromedia Flash Player incorrectly
+    validates the frame type identifier stored in the SWF file which is
+    used as an index to reference an array of function pointers. A
+    specially crafted SWF file can cause this index to reference memory
+    outside of the scope of the Macromedia Flash Player, which in turn can
+    cause the Macromedia Flash Player to use unintended memory address(es)
+    as function pointers.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker serving a maliciously crafted SWF file could entice a
+    user to view the SWF file and execute arbitrary code on the user's
+    machine.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Macromedia Flash Player users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-plugins/adobe-flash-7.0.61&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2628">CVE-2005-2628</uri>
+    <uri link="http://www.macromedia.com/devnet/security/security_zone/mpsb05-07.html">Macromedia Announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 18 Nov 2005 12:28:16 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 18 Nov 2005 22:27:02 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 25 Nov 2005 08:20:52 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-22.xml b/xml/htdocs/security/en/glsa/glsa-200511-22.xml
new file mode 100644
index 00000000..18805282
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-22.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-22">
+  <title>Inkscape: Buffer overflow</title>
+  <synopsis>
+    A vulnerability has been identified that allows a specially crafted SVG
+    file to exploit a buffer overflow and potentially execute arbitrary code
+    when opened.
+  </synopsis>
+  <product type="ebuild">Inkscape</product>
+  <announced>November 28, 2005</announced>
+  <revised>November 28, 2005: 01</revised>
+  <bug>109993</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/inkscape" auto="yes" arch="*">
+      <unaffected range="ge">0.43</unaffected>
+      <vulnerable range="lt">0.43</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Inkscape is an Open Source vector graphics editor using the W3C
+    standard Scalable Vector Graphics (SVG) file format.
+    </p>
+  </background>
+  <description>
+    <p>
+    Joxean Koret has discovered that Inkscape incorrectly allocates
+    memory when opening an SVG file, creating the possibility of a buffer
+    overflow if the SVG file being opened is specially crafted.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user into opening a maliciously crafted
+    SVG file, allowing for the execution of arbitrary code on a machine
+    with the privileges of the user running Inkscape.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Inkscape users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/inkscape-0.43&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3737">CVE-2005-3737</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 23 Nov 2005 12:36:14 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 23 Nov 2005 22:39:24 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 27 Nov 2005 21:35:11 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200511-23.xml b/xml/htdocs/security/en/glsa/glsa-200511-23.xml
new file mode 100644
index 00000000..3c950d46
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200511-23.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200511-23">
+  <title>chmlib, KchmViewer: Stack-based buffer overflow</title>
+  <synopsis>
+    chmlib and KchmViewer contain a buffer overflow vulnerability which may
+    lead to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">chmlib kchmviewer</product>
+  <announced>November 28, 2005</announced>
+  <revised>May 28, 2009: 03</revised>
+  <bug>110557</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/chmlib" auto="yes" arch="*">
+      <unaffected range="ge">0.37.4</unaffected>
+      <vulnerable range="lt">0.37.4</vulnerable>
+    </package>
+    <package name="app-text/kchmviewer" auto="yes" arch="*">
+      <unaffected range="ge">1.1</unaffected>
+      <vulnerable range="lt">1.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    chmlib is a library for dealing with Microsoft ITSS and CHM format
+    files. KchmViewer is a CHM viewer that includes its own copy of the
+    chmlib library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sven Tantau reported about a buffer overflow vulnerability in
+    chmlib. The function "_chm_decompress_block()" does not properly
+    perform boundary checking, resulting in a stack-based buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By convincing a user to open a specially crafted ITSS or CHM file,
+    using KchmViewer or a program makes use of chmlib, a remote attacker
+    could execute arbitrary code with the privileges of the user running
+    the software.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All chmlib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/chmlib-0.37.4&quot;</code>
+    <p>
+    All KchmViewer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/kchmviewer-1.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3318">CVE-2005-3318</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 25 Nov 2005 10:03:15 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 26 Nov 2005 02:10:11 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 27 Nov 2005 20:16:26 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200512-01.xml b/xml/htdocs/security/en/glsa/glsa-200512-01.xml
new file mode 100644
index 00000000..7957827d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200512-01.xml
@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200512-01">
+  <title>Perl: Format string errors can lead to code execution</title>
+  <synopsis>
+    A fix is available for Perl to mitigate the effects of format string
+    programming errors, that could otherwise be exploited to execute arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">Perl</product>
+  <announced>December 07, 2005</announced>
+  <revised>December 07, 2005: 01</revised>
+  <bug>114113</bug>
+  <access>remote and local</access>
+  <affected>
+    <package name="dev-lang/perl" auto="yes" arch="*">
+      <unaffected range="ge">5.8.7-r3</unaffected>
+      <unaffected range="rge">5.8.6-r8</unaffected>
+      <vulnerable range="lt">5.8.7-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Perl is a stable, cross-platform programming language created by
+    Larry Wall. It contains printf functions that allows construction of
+    strings from format specifiers and parameters, like the C printf
+    functions. A well-known class of vulnerabilities, called format string
+    errors, result of the improper use of the printf functions in C. Perl
+    in itself is vulnerable to a limited form of format string errors
+    through its own sprintf function, especially through wrapper functions
+    that call sprintf (for example the syslog function) and by taking
+    advantage of Perl powerful string expansion features rather than using
+    format string specifiers.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jack Louis discovered a new way to exploit format string errors in
+    Perl that could lead to the execution of arbitrary code. This is
+    perfomed by causing an integer wrap overflow in the efix variable
+    inside the function Perl_sv_vcatpvfn. The proposed fix closes that
+    specific exploitation vector to mitigate the risk of format string
+    programming errors in Perl. This fix does not remove the need to fix
+    such errors in Perl code.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Perl applications making improper use of printf functions (or
+    derived functions) using untrusted data may be vulnerable to the
+    already-known forms of Perl format string exploits and also to the
+    execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Fix all misbehaving Perl applications so that they make proper use
+    of the printf and derived Perl functions.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Perl users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-lang/perl</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3962">CVE-2005-3962</uri>
+    <uri link="http://www.dyadsecurity.com/perl-0002.html">Dyad Security Advisory</uri>
+    <uri link="http://www.securityfocus.com/archive/1/418460/30/30">Research on format string errors in Perl</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 01 Dec 2005 12:36:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 01 Dec 2005 16:05:52 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 07 Dec 2005 10:06:40 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200512-02.xml b/xml/htdocs/security/en/glsa/glsa-200512-02.xml
new file mode 100644
index 00000000..d6129b2f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200512-02.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200512-02">
+  <title>Webmin, Usermin: Format string vulnerability</title>
+  <synopsis>
+    Webmin and Usermin are vulnerable to a format string vulnerability which
+    may lead to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">webmin usermin</product>
+  <announced>December 07, 2005</announced>
+  <revised>December 07, 2005: 01</revised>
+  <bug>113888</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-admin/webmin" auto="yes" arch="*">
+      <unaffected range="ge">1.250</unaffected>
+      <vulnerable range="lt">1.250</vulnerable>
+    </package>
+    <package name="app-admin/usermin" auto="yes" arch="*">
+      <unaffected range="ge">1.180</unaffected>
+      <vulnerable range="lt">1.180</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Webmin is a web-based interface for Unix-like systems. Usermin is
+    a simplified version of Webmin designed for use by normal users rather
+    than system administrators.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jack Louis discovered that the Webmin and Usermin "miniserv.pl"
+    web server component is vulnerable to a Perl format string
+    vulnerability. Login with the supplied username is logged via the Perl
+    "syslog" facility in an unsafe manner.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker can trigger this vulnerability via a specially
+    crafted username containing format string data. This can be exploited
+    to consume a large amount of CPU and memory resources on a vulnerable
+    system, and possibly to execute arbitrary code of the attacker's choice
+    with the permissions of the user running Webmin.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Webmin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/webmin-1.250&quot;</code>
+    <p>
+    All Usermin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/usermin-1.180&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3912">CVE-2005-3912</uri>
+    <uri link="http://www.dyadsecurity.com/webmin-0001.html">Dyad Security Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 01 Dec 2005 16:39:12 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 04 Dec 2005 19:02:00 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 05 Dec 2005 03:16:21 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200512-03.xml b/xml/htdocs/security/en/glsa/glsa-200512-03.xml
new file mode 100644
index 00000000..fc317eab
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200512-03.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200512-03">
+  <title>phpMyAdmin: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple flaws in phpMyAdmin may lead to several XSS issues and local and
+    remote file inclusion vulnerabilities.
+  </synopsis>
+  <product type="ebuild">phpmyadmin</product>
+  <announced>December 11, 2005</announced>
+  <revised>December 11, 2005: 01</revised>
+  <bug>114662</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/phpmyadmin" auto="yes" arch="*">
+      <unaffected range="ge">2.7.0_p1</unaffected>
+      <vulnerable range="lt">2.7.0_p1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpMyAdmin is a tool written in PHP intended to handle the
+    administration of MySQL over the web.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Esser from Hardened-PHP reported about multiple
+    vulnerabilties found in phpMyAdmin. The $GLOBALS variable allows
+    modifying the global variable import_blacklist to open phpMyAdmin to
+    local and remote file inclusion, depending on your PHP version
+    (CVE-2005-4079, PMASA-2005-9). Furthermore, it is also possible to
+    conduct an XSS attack via the $HTTP_HOST variable and a local and
+    remote file inclusion because the contents of the variable are under
+    total control of the attacker (CVE-2005-3665, PMASA-2005-8).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker may exploit these vulnerabilities by sending
+    malicious requests, causing the execution of arbitrary code with the
+    rights of the user running the web server. The cross-site scripting
+    issues allow a remote attacker to inject and execute malicious script
+    code or to steal cookie-based authentication credentials, potentially
+    allowing unauthorized access to phpMyAdmin.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpMyAdmin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/phpmyadmin-2.7.0_p1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3665">CVE-2005-3665</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4079">CVE-2005-4079</uri>
+    <uri link="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8">PMASA-2005-8</uri>
+    <uri link="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-9">PMASA-2005-9</uri>
+    <uri link="http://www.hardened-php.net/advisory_252005.110.html">Hardened-PHP Advisory 25/2005</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 07 Dec 2005 12:42:53 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 08 Dec 2005 11:27:37 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 11 Dec 2005 17:53:22 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200512-04.xml b/xml/htdocs/security/en/glsa/glsa-200512-04.xml
new file mode 100644
index 00000000..0c78d0d9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200512-04.xml
@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200512-04">
+  <title>Openswan, IPsec-Tools: Vulnerabilities in ISAKMP Protocol implementation</title>
+  <synopsis>
+    Openswan and IPsec-Tools suffer from an implementation flaw which may allow
+    a Denial of Service attack.
+  </synopsis>
+  <product type="ebuild">openswan ipsec-tools</product>
+  <announced>December 12, 2005</announced>
+  <revised>December 14, 2005: 02</revised>
+  <bug>112568</bug>
+  <bug>113201</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/openswan" auto="yes" arch="*">
+      <unaffected range="ge">2.4.4</unaffected>
+      <vulnerable range="lt">2.4.4</vulnerable>
+    </package>
+    <package name="net-firewall/ipsec-tools" auto="yes" arch="*">
+      <unaffected range="ge">0.6.3</unaffected>
+      <unaffected range="rge">0.6.2-r1</unaffected>
+      <unaffected range="rge">0.4-r2</unaffected>
+      <vulnerable range="lt">0.6.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Openswan is an implementation of IPsec for Linux. IPsec-Tools is a port
+    of KAME's implementation of the IPsec utilities, including racoon, an
+    Internet Key Exchange daemon. Internet Key Exchange version 1 (IKEv1),
+    a derivate of ISAKMP, is an important part of IPsec. IPsec is widely
+    used to secure exchange of packets at the IP layer and mostly used to
+    implement Virtual Private Networks (VPNs).
+    </p>
+  </background>
+  <description>
+    <p>
+    The Oulu University Secure Programming Group (OUSPG) discovered that
+    various ISAKMP implementations, including Openswan and racoon (included
+    in the IPsec-Tools package), behave in an anomalous way when they
+    receive and handle ISAKMP Phase 1 packets with invalid or abnormal
+    contents.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker could craft specific packets that would result in a
+    Denial of Service attack, if Openswan and racoon are used in specific,
+    weak configurations.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Openswan users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/openswan-2.4.4&quot;</code>
+    <p>
+    All IPsec-Tools users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose net-firewall/ipsec-tools</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3671">CVE-2005-3671</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3732">CVE-2005-3732</uri>
+    <uri link="http://www.ee.oulu.fi/research/ouspg/protos/testing/c09/isakmp/">Original Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 02 Dec 2005 12:39:46 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 05 Dec 2005 03:24:10 +0000">
+    adir
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 05 Dec 2005 03:54:41 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200512-05.xml b/xml/htdocs/security/en/glsa/glsa-200512-05.xml
new file mode 100644
index 00000000..4782c742
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200512-05.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200512-05">
+  <title>Xmail: Privilege escalation through sendmail</title>
+  <synopsis>
+    The sendmail program in Xmail is vulnerable to a buffer overflow,
+    potentially resulting in local privilege escalation.
+  </synopsis>
+  <product type="ebuild">xmail</product>
+  <announced>December 14, 2005</announced>
+  <revised>December 14, 2005: 01</revised>
+  <bug>109381</bug>
+  <access>local</access>
+  <affected>
+    <package name="mail-mta/xmail" auto="yes" arch="*">
+      <unaffected range="ge">1.22</unaffected>
+      <vulnerable range="lt">1.22</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Xmail is an Internet and intranet mail server.
+    </p>
+  </background>
+  <description>
+    <p>
+    iDEFENSE reported that the AddressFromAtPtr function in the
+    sendmail program fails to check bounds on arguments passed from other
+    functions, and as a result an exploitable stack overflow condition
+    occurs when specifying the "-t" command line option.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker can make a malicious call to sendmail,
+    potentially resulting in code execution with elevated privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Xmail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-mta/xmail-1.22&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2943">CVE-2005-2943</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=321&amp;type=vulnerabilities&amp;flashstatus=true">iDEFENSE Security Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 11 Dec 2005 18:01:24 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 12 Dec 2005 15:24:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 13 Dec 2005 08:46:36 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200512-06.xml b/xml/htdocs/security/en/glsa/glsa-200512-06.xml
new file mode 100644
index 00000000..47bfd941
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200512-06.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200512-06">
+  <title>Ethereal: Buffer overflow in OSPF protocol dissector</title>
+  <synopsis>
+    Ethereal is missing bounds checking in the OSPF protocol dissector that
+    could lead to abnormal program termination or the execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">Ethereal</product>
+  <announced>December 14, 2005</announced>
+  <revised>December 14, 2005: 01</revised>
+  <bug>115030</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/ethereal" auto="yes" arch="*">
+      <unaffected range="ge">0.10.13-r2</unaffected>
+      <vulnerable range="lt">0.10.13-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ethereal is a feature-rich network protocol analyzer. It provides
+    protocol analyzers for various network flows, including one for Open
+    Shortest Path First (OSPF) Interior Gateway Protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    iDEFENSE reported a possible overflow due to the lack of bounds
+    checking in the dissect_ospf_v3_address_prefix() function, part of the
+    OSPF protocol dissector.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker might be able to craft a malicious network flow that
+    would crash Ethereal. It may be possible, though unlikely, to exploit
+    this flaw to execute arbitrary code with the permissions of the user
+    running Ethereal, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ethereal users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/ethereal-0.10.13-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3651">CVE-2005-3651</uri>
+    <uri link="http://www.idefense.com/application/poi/display?id=349&amp;type=vulnerabilities">iDEFENSE Advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 12 Dec 2005 15:18:48 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 14 Dec 2005 12:23:23 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200512-07.xml b/xml/htdocs/security/en/glsa/glsa-200512-07.xml
new file mode 100644
index 00000000..cf0e8b5e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200512-07.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200512-07">
+  <title>OpenLDAP, Gauche: RUNPATH issues</title>
+  <synopsis>
+    OpenLDAP and Gauche suffer from RUNPATH issues that may allow users in the
+    "portage" group to escalate privileges.
+  </synopsis>
+  <product type="ebuild">OpenLDAP Gauche</product>
+  <announced>December 15, 2005</announced>
+  <revised>December 30, 2007: 03</revised>
+  <bug>105380</bug>
+  <bug>112577</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-nds/openldap" auto="yes" arch="*">
+      <unaffected range="ge">2.2.28-r3</unaffected>
+      <unaffected range="rge">2.1.30-r6</unaffected>
+      <vulnerable range="lt">2.2.28-r3</vulnerable>
+    </package>
+    <package name="dev-scheme/gauche" auto="yes" arch="*">
+      <unaffected range="ge">0.8.6-r1</unaffected>
+      <vulnerable range="lt">0.8.6-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenLDAP is a suite of LDAP-related application and development tools.
+    Gauche is an R5RS Scheme interpreter.
+    </p>
+  </background>
+  <description>
+    <p>
+    Gentoo packaging for OpenLDAP and Gauche may introduce insecure paths
+    into the list of directories that are searched for libraries at
+    runtime.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A local attacker, who is a member of the "portage" group, could create
+    a malicious shared object in the Portage temporary build directory that
+    would be loaded at runtime by a dependent binary, potentially resulting
+    in privilege escalation.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Only grant "portage" group rights to trusted users.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenLDAP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose net-nds/openldap</code>
+    <p>
+    All Gauche users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-scheme/gauche-0.8.6-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4442">CVE-2005-4442</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4443">CVE-2005-4443</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 14 Dec 2005 13:30:23 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 14 Dec 2005 13:31:28 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200512-08.xml b/xml/htdocs/security/en/glsa/glsa-200512-08.xml
new file mode 100644
index 00000000..0d86732f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200512-08.xml
@@ -0,0 +1,104 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200512-08">
+  <title>Xpdf, GPdf, CUPS, Poppler: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Xpdf, GPdf, CUPS and
+    Poppler potentially resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">xpdf, gpdf, poppler,cups</product>
+  <announced>December 16, 2005</announced>
+  <revised>December 17, 2005: 02</revised>
+  <bug>114428</bug>
+  <bug>115286</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/xpdf" auto="yes" arch="*">
+      <unaffected range="ge">3.01-r2</unaffected>
+      <vulnerable range="lt">3.01-r2</vulnerable>
+    </package>
+    <package name="app-text/gpdf" auto="yes" arch="*">
+      <unaffected range="ge">2.10.0-r2</unaffected>
+      <vulnerable range="lt">2.10.0-r2</vulnerable>
+    </package>
+    <package name="app-text/poppler" auto="yes" arch="*">
+      <unaffected range="ge">0.4.2-r1</unaffected>
+      <unaffected range="rge">0.3.0-r1</unaffected>
+      <vulnerable range="lt">0.4.2-r1</vulnerable>
+    </package>
+    <package name="net-print/cups" auto="yes" arch="*">
+      <unaffected range="ge">1.1.23-r3</unaffected>
+      <vulnerable range="lt">1.1.23-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Xpdf and GPdf are PDF file viewers that run under the X Window System.
+    Poppler is a PDF rendering library based on Xpdf code. The Common UNIX
+    Printing System (CUPS) is a cross-platform print spooler. It makes use
+    of Xpdf code to handle PDF files.
+    </p>
+  </background>
+  <description>
+    <p>
+    infamous41md discovered that several Xpdf functions lack sufficient
+    boundary checking, resulting in multiple exploitable buffer overflows.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially-crafted PDF file
+    which would trigger an overflow, potentially resulting in execution of
+    arbitrary code with the rights of the user running Xpdf, CUPS, GPdf or
+    Poppler.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Xpdf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/xpdf-3.01-r2&quot;</code>
+    <p>
+    All GPdf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/gpdf-2.10.0-r2&quot;</code>
+    <p>
+    All Poppler users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose app-text/poppler</code>
+    <p>
+    All CUPS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-print/cups-1.1.23-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3191">CVE-2005-3191</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3192">CVE-2005-3192</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3193">CVE-2005-3193</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 08 Dec 2005 08:57:56 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 14 Dec 2005 12:15:58 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 15 Dec 2005 11:55:50 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200512-09.xml b/xml/htdocs/security/en/glsa/glsa-200512-09.xml
new file mode 100644
index 00000000..6480cabd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200512-09.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200512-09">
+  <title>cURL: Off-by-one errors in URL handling</title>
+  <synopsis>
+    cURL is vulnerable to local arbitrary code execution via buffer overflow
+    due to the insecure parsing of URLs.
+  </synopsis>
+  <product type="ebuild">cURL</product>
+  <announced>December 16, 2005</announced>
+  <revised>December 16, 2005: 01</revised>
+  <bug>114710</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-misc/curl" auto="yes" arch="*">
+      <unaffected range="ge">7.15.1</unaffected>
+      <vulnerable range="lt">7.15.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    cURL is a command line tool for transferring files with URL
+    syntax, supporting numerous protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Esser from the Hardened-PHP Project has reported a
+    vulnerability in cURL that allows for a local buffer overflow when cURL
+    attempts to parse specially crafted URLs. The URL can be specially
+    crafted in one of two ways: the URL could be malformed in a way that
+    prevents a terminating null byte from being added to either a hostname
+    or path buffer; or the URL could contain a "?" separator in the
+    hostname portion, which causes a "/" to be prepended to the resulting
+    string.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    An attacker capable of getting cURL to parse a maliciously crafted
+    URL could cause a denial of service or execute arbitrary code with the
+    privileges of the user making the call to cURL. An attacker could also
+    escape open_basedir or safe_mode pseudo-restrictions when exploiting
+    this problem from within a PHP program when PHP is compiled with
+    libcurl.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All cURL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/curl-7.15.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4077">CVE-2005-4077</uri>
+    <uri link="http://www.hardened-php.net/advisory_242005.109.html">Hardened-PHP Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 14 Dec 2005 13:39:33 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 14 Dec 2005 17:20:45 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 15 Dec 2005 11:37:18 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200512-10.xml b/xml/htdocs/security/en/glsa/glsa-200512-10.xml
new file mode 100644
index 00000000..6bbce4e9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200512-10.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200512-10">
+  <title>Opera: Command-line URL shell command injection</title>
+  <synopsis>
+    Lack of URL validation in Opera command-line wrapper could be abused to
+    execute arbitrary commands.
+  </synopsis>
+  <product type="ebuild">opera</product>
+  <announced>December 18, 2005</announced>
+  <revised>December 18, 2005: 01</revised>
+  <bug>113239</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/opera" auto="yes" arch="*">
+      <unaffected range="ge">8.51</unaffected>
+      <vulnerable range="lt">8.51</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Opera is a multi-platform web browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    Peter Zelezny discovered that the shell script used to launch
+    Opera parses shell commands that are enclosed within backticks in the
+    URL provided via the command line.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit this vulnerability by enticing a
+    user to follow a specially crafted URL from a tool that uses Opera to
+    open URLs, resulting in the execution of arbitrary commands on the
+    targeted machine.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Opera users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/opera-8.51&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3750">CVE-2005-3750</uri>
+    <uri link="http://www.opera.com/docs/changelogs/linux/851/">Opera 8.51 Changelog</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 15 Dec 2005 12:24:01 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 15 Dec 2005 12:24:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 16 Dec 2005 02:18:07 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200512-11.xml b/xml/htdocs/security/en/glsa/glsa-200512-11.xml
new file mode 100644
index 00000000..2606a2a2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200512-11.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200512-11">
+  <title>CenterICQ: Multiple vulnerabilities</title>
+  <synopsis>
+    CenterICQ is vulnerable to a Denial of Service issue, and also potentially
+    to the execution of arbitrary code through an included vulnerable ktools
+    library.
+  </synopsis>
+  <product type="ebuild">CenterICQ</product>
+  <announced>December 20, 2005</announced>
+  <revised>December 20, 2005: 01</revised>
+  <bug>100519</bug>
+  <bug>114038</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/centericq" auto="yes" arch="*">
+      <unaffected range="ge">4.21.0-r2</unaffected>
+      <vulnerable range="lt">4.21.0-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CenterICQ is a text-based instant messaging interface that
+    supports multiple protocols. It includes the ktools library, which
+    provides text-mode user interface controls.
+    </p>
+  </background>
+  <description>
+    <p>
+    Gentoo developer Wernfried Haas discovered that when the "Enable
+    peer-to-peer communications" option is enabled, CenterICQ opens a port
+    that insufficiently validates whatever is sent to it. Furthermore,
+    Zone-H Research reported a buffer overflow in the ktools library.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could cause a crash of CenterICQ by sending
+    packets to the peer-to-peer communications port, and potentially cause
+    the execution of arbitrary code by enticing a CenterICQ user to edit
+    overly long contact details.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CenterICQ users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/centericq-4.21.0-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3694">CVE-2005-3694</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3863">CVE-2005-3863</uri>
+    <uri link="http://www.zone-h.org/en/advisories/read/id=8480/">Zone-H Research ZRCSA 200503</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 16 Dec 2005 12:39:29 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 17 Dec 2005 10:48:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 18 Dec 2005 11:38:58 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200512-12.xml b/xml/htdocs/security/en/glsa/glsa-200512-12.xml
new file mode 100644
index 00000000..30070e36
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200512-12.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200512-12">
+  <title>Mantis: Multiple vulnerabilities</title>
+  <synopsis>
+    Mantis is affected by multiple vulnerabilities ranging from file upload and
+    SQL injection to cross-site scripting and HTTP response splitting.
+  </synopsis>
+  <product type="ebuild">Mantis</product>
+  <announced>December 22, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>116036</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/mantisbt" auto="yes" arch="*">
+      <unaffected range="ge">0.19.4</unaffected>
+      <vulnerable range="lt">0.19.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mantis is a web-based bugtracking system written in PHP.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tobias Klein discovered that Mantis contains several vulnerabilities,
+    including:
+    </p>
+    <ul>
+    <li>a file upload vulnerability.</li>
+    <li>an injection vulnerability in filters.</li>
+    <li>an SQL injection vulnerability in the user-management page.</li>
+    <li>a port cross-site-scripting vulnerability in filters.</li>
+    <li>an HTTP header CRLF injection vulnerability.</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could possibly exploit the file upload vulnerability to
+    execute arbitrary script code, and the SQL injection vulnerability to
+    access or modify sensitive information from the Mantis database.
+    Furthermore, the cross-site scripting and HTTP response splitting may
+    allow an attacker to inject and execute malicious script code or to
+    steal cookie-based authentication credentials, potentially compromising
+    the victim's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mantis users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/mantisbt-0.19.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.mantisbt.org/changelog.php">Mantis ChangeLog</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4518">CVE-2005-4518</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4519">CVE-2005-4519</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4520">CVE-2005-4520</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4521">CVE-2005-4521</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4522">CVE-2005-4522</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 20 Dec 2005 11:13:27 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 20 Dec 2005 11:13:46 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200512-13.xml b/xml/htdocs/security/en/glsa/glsa-200512-13.xml
new file mode 100644
index 00000000..29c84163
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200512-13.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200512-13">
+  <title>Dropbear: Privilege escalation</title>
+  <synopsis>
+    A buffer overflow in Dropbear could allow authenticated users to execute
+    arbitrary code as the root user.
+  </synopsis>
+  <product type="ebuild">dropbear</product>
+  <announced>December 23, 2005</announced>
+  <revised>December 23, 2005: 01</revised>
+  <bug>116006</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/dropbear" auto="yes" arch="*">
+      <unaffected range="ge">0.47</unaffected>
+      <vulnerable range="lt">0.47</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Dropbear is an SSH server and client with a small memory
+    footprint.
+    </p>
+  </background>
+  <description>
+    <p>
+    Under certain conditions Dropbear could fail to allocate a
+    sufficient amount of memory, possibly resulting in a buffer overflow.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By sending specially crafted data to the server, authenticated
+    users could exploit this vulnerability to execute arbitrary code with
+    the permissions of the SSH server user, which is the root user by
+    default.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Dropbear users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/dropbear-0.47&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4178">CVE-2005-4178</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 20 Dec 2005 11:10:03 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 20 Dec 2005 16:40:12 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 21 Dec 2005 10:00:54 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200512-14.xml b/xml/htdocs/security/en/glsa/glsa-200512-14.xml
new file mode 100644
index 00000000..08712ac4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200512-14.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200512-14">
+  <title>NBD Tools: Buffer overflow in NBD server</title>
+  <synopsis>
+    The NBD server is vulnerable to a buffer overflow that may result in the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">NBD</product>
+  <announced>December 23, 2005</announced>
+  <revised>December 23, 2005: 01</revised>
+  <bug>116314</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-block/nbd" auto="yes" arch="*">
+      <unaffected range="ge">2.8.2-r1</unaffected>
+      <vulnerable range="lt">2.8.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The NBD Tools are the Network Block Device utilities allowing one
+    to use remote block devices over a TCP/IP network. It includes a
+    userland NBD server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Kurt Fitzner discovered that the NBD server allocates a request
+    buffer that fails to take into account the size of the reply header.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send a malicious request that can result
+    in the execution of arbitrary code with the rights of the NBD server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All NBD Tools users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-block/nbd-2.8.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3534">CVE-2005-3534</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 23 Dec 2005 10:21:27 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 23 Dec 2005 10:21:38 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200512-15.xml b/xml/htdocs/security/en/glsa/glsa-200512-15.xml
new file mode 100644
index 00000000..d8a652e5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200512-15.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200512-15">
+  <title>rssh: Privilege escalation</title>
+  <synopsis>
+    Local users could gain root privileges by chrooting into arbitrary
+    directories.
+  </synopsis>
+  <product type="ebuild">rssh</product>
+  <announced>December 27, 2005</announced>
+  <revised>December 27, 2005: 01</revised>
+  <bug>115082</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-shells/rssh" auto="yes" arch="*">
+      <unaffected range="ge">2.3.0</unaffected>
+      <vulnerable range="lt">2.3.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    rssh is a restricted shell, allowing only a few commands like scp
+    or sftp. It is often used as a complement to OpenSSH to provide limited
+    access to users.
+    </p>
+  </background>
+  <description>
+    <p>
+    Max Vozeler discovered that the rssh_chroot_helper command allows
+    local users to chroot into arbitrary directories.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could exploit this vulnerability to gain root
+    privileges by chrooting into arbitrary directories.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All rssh users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-shells/rssh-2.3.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3345">CVE-2005-3345</uri>
+    <uri link="http://www.pizzashack.org/rssh/security.shtml">rssh security announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 23 Dec 2005 10:25:35 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 25 Dec 2005 13:06:13 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 26 Dec 2005 13:28:20 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200512-16.xml b/xml/htdocs/security/en/glsa/glsa-200512-16.xml
new file mode 100644
index 00000000..05b0d779
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200512-16.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200512-16">
+  <title>OpenMotif, AMD64 x86 emulation X libraries: Buffer overflows in libUil library</title>
+  <synopsis>
+    Two buffer overflows have been discovered in libUil, part of the OpenMotif
+    toolkit, that can potentially lead to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">openmotif</product>
+  <announced>December 28, 2005</announced>
+  <revised>January 29, 2006: 03</revised>
+  <bug>114234</bug>
+  <bug>116481</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-libs/openmotif" auto="yes" arch="*">
+      <unaffected range="ge">2.2.3-r8</unaffected>
+      <unaffected range="rge">2.1.30-r13</unaffected>
+      <vulnerable range="lt">2.2.3-r8</vulnerable>
+    </package>
+    <package name="app-emulation/emul-linux-x86-xlibs" auto="yes" arch="AMD64">
+      <unaffected range="ge">2.2.1</unaffected>
+      <vulnerable range="lt">2.2.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenMotif provides a free version of the Motif toolkit for open source
+    applications. The OpenMotif libraries are included in the AMD64 x86
+    emulation X libraries, which emulate the x86 (32-bit) architecture on
+    the AMD64 (64-bit) architecture.
+    </p>
+  </background>
+  <description>
+    <p>
+    xfocus discovered two potential buffer overflows in the libUil library,
+    in the diag_issue_diagnostic and open_source_file functions.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    Remotely-accessible or SUID applications making use of the affected
+    functions might be exploited to execute arbitrary code with the
+    privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenMotif users should upgrade to an unaffected version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --unmerge --verbose x11-libs/openmotif
+    # emerge --ask --oneshot --verbose x11-libs/openmotif</code>
+    <p>
+    All AMD64 x86 emulation X libraries users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose app-emulation/emul-linux-x86-xlibs</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3964">CVE-2005-3964</uri>
+    <uri link="http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0047.html">xfocus SD-051202 Original Advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 27 Dec 2005 10:06:00 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 27 Dec 2005 10:07:13 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200512-17.xml b/xml/htdocs/security/en/glsa/glsa-200512-17.xml
new file mode 100644
index 00000000..abe2747e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200512-17.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200512-17">
+  <title>scponly: Multiple privilege escalation issues</title>
+  <synopsis>
+    Local users can exploit an scponly flaw to gain root privileges, and
+    scponly restricted users can use another vulnerability to evade shell
+    restrictions.
+  </synopsis>
+  <product type="ebuild">scponly</product>
+  <announced>December 29, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>116526</bug>
+  <access>local and remote</access>
+  <affected>
+    <package name="net-misc/scponly" auto="yes" arch="*">
+      <unaffected range="ge">4.2</unaffected>
+      <vulnerable range="lt">4.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    scponly is a restricted shell, allowing only a few predefined commands.
+    It is often used as a complement to OpenSSH to provide access to remote
+    users without providing any remote execution privileges.
+    </p>
+  </background>
+  <description>
+    <p>
+    Max Vozeler discovered that the scponlyc command allows users to chroot
+    into arbitrary directories. Furthermore, Pekka Pessi reported that
+    scponly insufficiently validates command-line parameters to a scp or
+    rsync command.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could gain root privileges by chrooting into arbitrary
+    directories containing hardlinks to setuid programs. A remote scponly
+    user could also send malicious parameters to a scp or rsync command
+    that would allow to escape the shell restrictions and execute arbitrary
+    programs.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All scponly users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/scponly-4.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://sublimation.org/scponly/index.html#relnotes">scponly release notes</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4532">CVE-2005-4532</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4533">CVE-2005-4533</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 27 Dec 2005 09:38:39 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 29 Dec 2005 10:10:38 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200512-18.xml b/xml/htdocs/security/en/glsa/glsa-200512-18.xml
new file mode 100644
index 00000000..a9491247
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200512-18.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200512-18">
+  <title>XnView: Privilege escalation</title>
+  <synopsis>
+    XnView may search for shared libraries in an untrusted location,
+    potentially allowing local users to execute arbitrary code with the
+    privileges of another user.
+  </synopsis>
+  <product type="ebuild">xnview</product>
+  <announced>December 30, 2005</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>117063</bug>
+  <access>local</access>
+  <affected>
+    <package name="x11-misc/xnview" auto="yes" arch="x86">
+      <unaffected range="ge">1.70-r1</unaffected>
+      <vulnerable range="lt">1.70-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    XnView is an efficient multimedia viewer, browser and converter,
+    distributed free for non-commercial use.
+    </p>
+  </background>
+  <description>
+    <p>
+    Krzysiek Pawlik of Gentoo Linux discovered that the XnView package for
+    IA32 used the DT_RPATH field insecurely, causing the dynamic loader to
+    search for shared libraries in potentially untrusted directories.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create a malicious shared object that would be
+    loaded and executed when a user attempted to use an XnView utility.
+    This would allow a malicious user to effectively hijack XnView and
+    execute arbitrary code with the privileges of the user running the
+    program.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    The system administrator may use the chrpath utility to remove the
+    DT_RPATH field from the XnView utilities:
+    </p>
+    <code>
+    # emerge app-admin/chrpath
+    # chrpath --delete /opt/bin/nconvert /opt/bin/nview /opt/bin/xnview</code>
+  </workaround>
+  <resolution>
+    <p>
+    All XnView users on the x86 platform should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-misc/xnview-1.70-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4595">CVE-2005-4595</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 29 Dec 2005 17:05:23 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 30 Dec 2005 12:33:06 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200601-01.xml b/xml/htdocs/security/en/glsa/glsa-200601-01.xml
new file mode 100644
index 00000000..605daa27
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200601-01.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200601-01">
+  <title>pinentry: Local privilege escalation</title>
+  <synopsis>
+    pinentry is vulnerable to privilege escalation.
+  </synopsis>
+  <product type="ebuild">pinentry</product>
+  <announced>January 03, 2006</announced>
+  <revised>January 03, 2006: 01</revised>
+  <bug>116822</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-crypt/pinentry" auto="yes" arch="*">
+      <unaffected range="ge">0.7.2-r2</unaffected>
+      <vulnerable range="lt">0.7.2-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    pinentry is a collection of simple PIN or passphrase entry dialogs
+    which utilize the Assuan protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Audit Team has
+    discovered that the pinentry ebuild incorrectly sets the permissions of
+    the pinentry binaries upon installation, so that the sgid bit is set
+    making them execute with the privileges of group ID 0.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A user of pinentry could potentially read and overwrite files with
+    a group ID of 0.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All pinentry users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-crypt/pinentry-0.7.2-r2&quot;</code>
+  </resolution>
+  <references>
+        <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0071">CVE-2006-0071</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 31 Dec 2005 13:13:15 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 31 Dec 2005 13:13:43 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 02 Jan 2006 22:02:30 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200601-02.xml b/xml/htdocs/security/en/glsa/glsa-200601-02.xml
new file mode 100644
index 00000000..19f7708a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200601-02.xml
@@ -0,0 +1,108 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200601-02">
+  <title>KPdf, KWord: Multiple overflows in included Xpdf code</title>
+  <synopsis>
+    KPdf and KWord both include vulnerable Xpdf code to handle PDF files,
+    making them vulnerable to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">kdegraphics, kpdf, koffice, kword</product>
+  <announced>January 04, 2006</announced>
+  <revised>January 07, 2006: 03</revised>
+  <bug>114429</bug>
+  <bug>115851</bug>
+  <access>remote</access>
+  <affected>
+    <package name="kde-base/kdegraphics" auto="yes" arch="*">
+      <unaffected range="ge">3.4.3-r3</unaffected>
+      <vulnerable range="lt">3.4.3-r3</vulnerable>
+    </package>
+    <package name="kde-base/kpdf" auto="yes" arch="*">
+      <unaffected range="ge">3.4.3-r3</unaffected>
+      <vulnerable range="lt">3.4.3-r3</vulnerable>
+    </package>
+    <package name="app-office/koffice" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2-r6</unaffected>
+      <vulnerable range="lt">1.4.2-r6</vulnerable>
+    </package>
+    <package name="app-office/kword" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2-r6</unaffected>
+      <vulnerable range="lt">1.4.2-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KPdf is a KDE-based PDF viewer included in the kdegraphics package.
+    KWord is a KDE-based word processor also included in the koffice
+    package.
+    </p>
+  </background>
+  <description>
+    <p>
+    KPdf and KWord both include Xpdf code to handle PDF files. This Xpdf
+    code is vulnerable to several heap overflows (GLSA 200512-08) as well
+    as several buffer and integer overflows discovered by Chris Evans
+    (CESA-2005-003).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially crafted PDF file
+    with Kpdf or KWord, potentially resulting in the execution of arbitrary
+    code with the rights of the user running the affected application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All kdegraphics users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kdegraphics-3.4.3-r3&quot;</code>
+    <p>
+    All Kpdf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kpdf-3.4.3-r3&quot;</code>
+    <p>
+    All KOffice users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/koffice-1.4.2-r6&quot;</code>
+    <p>
+    All KWord users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/kword-1.4.2-r6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3191">CAN-2005-3191</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3192">CAN-2005-3192</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3193">CAN-2005-3193</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3624">CVE-2005-3624</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3625">CVE-2005-3625</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3626">CVE-2005-3626</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3627">CVE-2005-3627</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3628">CVE-2005-3628</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200512-08.xml">GLSA 200512-08</uri>
+    <uri link="http://www.kde.org/info/security/advisory-20051207-2.txt">KDE Security Advisory: kpdf/xpdf multiple integer overflows</uri>
+    <uri link="http://scary.beasts.org/security/CESA-2005-003.txt">CESA-2005-003</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 08 Dec 2005 08:56:38 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 04 Jan 2006 21:03:58 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200601-03.xml b/xml/htdocs/security/en/glsa/glsa-200601-03.xml
new file mode 100644
index 00000000..b0cf10d2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200601-03.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200601-03">
+  <title>HylaFAX: Multiple vulnerabilities</title>
+  <synopsis>
+    HylaFAX is vulnerable to arbitrary code execution and unauthorized access
+    vulnerabilities.
+  </synopsis>
+  <product type="ebuild">hylafax</product>
+  <announced>January 06, 2006</announced>
+  <revised>January 06, 2006: 01</revised>
+  <bug>116389</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/hylafax" auto="yes" arch="*">
+      <unaffected range="ge">4.2.3-r1</unaffected>
+      <vulnerable range="lt">4.2.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    HylaFAX is an enterprise-class system for sending and receiving
+    facsimile messages and for sending alpha-numeric pages.
+    </p>
+  </background>
+  <description>
+    <p>
+    Patrice Fournier discovered that HylaFAX runs the notify script on
+    untrusted user input. Furthermore, users can log in without a password
+    when HylaFAX is installed with the pam USE-flag disabled.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could exploit the input validation vulnerability to
+    run arbitrary code as the user running HylaFAX, which is usually uucp.
+    The password vulnerability could be exploited to log in without proper
+    user credentials.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All HylaFAX users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/hylafax-4.2.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3538">CVE-2005-3538</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3539">CVE-2005-3539</uri>
+    <uri link="http://www.hylafax.org/content/HylaFAX_4.2.4_release">HylaFAX release announcement</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 02 Jan 2006 21:40:30 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 06 Jan 2006 13:37:21 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200601-04.xml b/xml/htdocs/security/en/glsa/glsa-200601-04.xml
new file mode 100644
index 00000000..88842c05
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200601-04.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200601-04">
+  <title>VMware Workstation: Vulnerability in NAT networking</title>
+  <synopsis>
+    VMware guest operating systems can execute arbitrary code with elevated
+    privileges on the host operating system through a flaw in NAT networking.
+  </synopsis>
+  <product type="ebuild">VMware</product>
+  <announced>January 07, 2006</announced>
+  <revised>May 25, 2006: 02</revised>
+  <bug>116238</bug>
+  <access>remote and local</access>
+  <affected>
+    <package name="app-emulation/vmware-workstation" auto="yes" arch="*">
+      <unaffected range="ge">5.5.1.19175</unaffected>
+      <unaffected range="rge">4.5.3.19414</unaffected>
+      <unaffected range="rge">3.2.1.2242-r10</unaffected>
+      <vulnerable range="lt">5.5.1.19175</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    VMware Workstation is a powerful virtual machine for developers and
+    system administrators.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tim Shelton discovered that vmnet-natd, the host module providing
+    NAT-style networking for VMware guest operating systems, is unable to
+    process incorrect 'EPRT' and 'PORT' FTP requests.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Malicious guest operating systems using the NAT networking feature or
+    local VMware Workstation users could exploit this vulnerability to
+    execute arbitrary code on the host system with elevated privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable the NAT service by following the instructions at <uri
+    link="http://www.vmware.com/support/kb">http://www.vmware.com/support/k
+    b</uri>, Answer ID 2002.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All VMware Workstation users should upgrade to a fixed version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose app-emulation/vmware-workstation</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4459">CVE-2005-4459</uri>
+    <uri link="http://www.vmware.com/support/kb/enduser/std_adp.php?p_faqid=2000">VMware Security Response</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 04 Jan 2006 10:03:43 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 05 Jan 2006 15:09:42 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200601-05.xml b/xml/htdocs/security/en/glsa/glsa-200601-05.xml
new file mode 100644
index 00000000..9a40445d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200601-05.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200601-05">
+  <title>mod_auth_pgsql: Multiple format string vulnerabilities</title>
+  <synopsis>
+    Format string vulnerabilities in mod_auth_pgsql may lead to the execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mod_auth_pgsql</product>
+  <announced>January 10, 2006</announced>
+  <revised>December 30, 2007: 03</revised>
+  <bug>118096</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apache/mod_auth_pgsql" auto="yes" arch="*">
+      <unaffected range="ge">2.0.3</unaffected>
+      <unaffected range="lt">1.0.0</unaffected>
+      <vulnerable range="lt">2.0.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    mod_auth_pgsql is an Apache2 module that allows user authentication
+    against a PostgreSQL database.
+    </p>
+  </background>
+  <description>
+    <p>
+    The error logging functions of mod_auth_pgsql fail to validate certain
+    strings before passing them to syslog, resulting in format string
+    vulnerabilities.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An unauthenticated remote attacker could exploit these vulnerabilities
+    to execute arbitrary code with the rights of the user running the
+    Apache2 server by sending specially crafted login names.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mod_auth_pgsql users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apache/mod_auth_pgsql-2.0.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3656">CVE-2005-3656</uri>
+    <uri link="http://www.frsirt.com/english/advisories/2006/0070">FrSIRT ADV-2006-0070</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 08 Jan 2006 17:42:51 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 08 Jan 2006 17:43:17 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 09 Jan 2006 09:56:56 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200601-06.xml b/xml/htdocs/security/en/glsa/glsa-200601-06.xml
new file mode 100644
index 00000000..cc9486a0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200601-06.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200601-06">
+  <title>xine-lib, FFmpeg: Heap-based buffer overflow</title>
+  <synopsis>
+    xine-lib and FFmpeg are vulnerable to a buffer overflow that may be
+    exploited by attackers to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">xine-lib ffmpeg</product>
+  <announced>January 10, 2006</announced>
+  <revised>January 10, 2006: 01</revised>
+  <bug>115849</bug>
+  <bug>116181</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/xine-lib" auto="yes" arch="*">
+      <unaffected range="ge">1.1.1-r3</unaffected>
+      <vulnerable range="lt">1.1.1-r3</vulnerable>
+    </package>
+    <package name="media-video/ffmpeg" auto="yes" arch="*">
+      <unaffected range="ge">0.4.9_p20051216</unaffected>
+      <vulnerable range="lt">0.4.9_p20051216</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xine is a GPL high-performance, portable and reusable multimedia
+    playback engine. xine-lib is xine's core engine. FFmpeg is a very fast
+    video and audio converter and is used in xine-lib.
+    </p>
+  </background>
+  <description>
+    <p>
+    Simon Kilvington has reported a vulnerability in FFmpeg
+    libavcodec. The flaw is due to a buffer overflow error in the
+    "avcodec_default_get_buffer()" function. This function doesn't properly
+    handle specially crafted PNG files as a result of a heap overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to run an FFmpeg based
+    application on a maliciously crafted PNG file, resulting in the
+    execution of arbitrary code with the permissions of the user running
+    the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xine-lib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/xine-lib-1.1.1-r3&quot;</code>
+    <p>
+    All FFmpeg users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/ffmpeg-0.4.9_p20051216&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4048">CVE-2005-4048</uri>
+    <uri link="http://article.gmane.org/gmane.comp.video.ffmpeg.devel/26558">Original advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 03 Jan 2006 10:30:55 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 06 Jan 2006 00:22:43 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 09 Jan 2006 22:59:16 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200601-07.xml b/xml/htdocs/security/en/glsa/glsa-200601-07.xml
new file mode 100644
index 00000000..a221a206
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200601-07.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200601-07">
+  <title>ClamAV: Remote execution of arbitrary code</title>
+  <synopsis>
+    ClamAV is vulnerable to a buffer overflow which may lead to remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>January 13, 2006</announced>
+  <revised>January 13, 2006: 01</revised>
+  <bug>118459</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.88</unaffected>
+      <vulnerable range="lt">0.88</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ClamAV is a GPL virus scanner.
+    </p>
+  </background>
+  <description>
+    <p>
+    Zero Day Initiative (ZDI) reported a heap buffer overflow
+    vulnerability. The vulnerability is due to an incorrect boundary check
+    of the user-supplied data prior to copying it to an insufficiently
+    sized memory buffer. The flaw occurs when the application attempts to
+    handle compressed UPX files.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    For example by sending a maliciously crafted UPX file into a mail
+    server that is integrated with ClamAV, a remote attacker's supplied
+    code could be executed with escalated privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.88&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0162">CVE-2006-0162</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 09 Jan 2006 23:12:07 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 11 Jan 2006 01:55:27 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 12 Jan 2006 21:27:50 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200601-08.xml b/xml/htdocs/security/en/glsa/glsa-200601-08.xml
new file mode 100644
index 00000000..ccc5bb8b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200601-08.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200601-08">
+  <title>Blender: Heap-based buffer overflow</title>
+  <synopsis>
+    Blender is vulnerable to a buffer overflow that may be exploited by
+    attackers to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">blender</product>
+  <announced>January 13, 2006</announced>
+  <revised>January 13, 2006: 01</revised>
+  <bug>118163</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/blender" auto="yes" arch="*">
+      <unaffected range="ge">2.40</unaffected>
+      <vulnerable range="lt">2.40</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Blender is an open source software for 3D modeling, animation,
+    rendering, post-production, interactive creation and playback.
+    </p>
+  </background>
+  <description>
+    <p>
+    Damian Put has reported a flaw due to an integer overflow in the
+    "get_bhead()" function, leading to a heap overflow when processing
+    malformed ".blend" files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user into opening a specially
+    crafted ".blend" file, resulting in the execution of arbitrary code
+    with the permissions of the user running Blender.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Blender users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/blender-2.40&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4470">CVE-2005-4470</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 10 Jan 2006 19:17:22 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 10 Jan 2006 19:17:39 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 11 Jan 2006 01:12:10 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200601-09.xml b/xml/htdocs/security/en/glsa/glsa-200601-09.xml
new file mode 100644
index 00000000..66bcd456
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200601-09.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200601-09">
+  <title>Wine: Windows Metafile SETABORTPROC vulnerability</title>
+  <synopsis>
+    There is a flaw in Wine in the handling of Windows Metafiles (WMF) files,
+    which could possibly result in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">wine</product>
+  <announced>January 13, 2006</announced>
+  <revised>February 26, 2007: 03</revised>
+  <bug>118101</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-emulation/wine" auto="yes" arch="*">
+      <unaffected range="ge">0.9</unaffected>
+      <vulnerable range="lt">20060000</vulnerable>
+      <vulnerable range="gt">20040000</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Wine is a free implementation of Windows APIs for Unix-like systems.
+    </p>
+  </background>
+  <description>
+    <p>
+    H D Moore discovered that Wine implements the insecure-by-design
+    SETABORTPROC GDI Escape function for Windows Metafile (WMF) files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially crafted Windows
+    Metafile (WMF) file from within a Wine executed Windows application,
+    possibly resulting in the execution of arbitrary code with the rights
+    of the user running Wine.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Wine users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/wine-0.9.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0106">CVE-2006-0106</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 08 Jan 2006 16:28:07 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 08 Jan 2006 17:43:07 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 12 Jan 2006 08:25:50 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200601-10.xml b/xml/htdocs/security/en/glsa/glsa-200601-10.xml
new file mode 100644
index 00000000..1d779afb
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200601-10.xml
@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200601-10">
+  <title>Sun and Blackdown Java: Applet privilege escalation</title>
+  <synopsis>
+    Sun's and Blackdown's JDK or JRE may allow untrusted applets to elevate
+    their privileges.
+  </synopsis>
+  <product type="ebuild">sun-jdk sun-jre-bin blackdown-jre blackdown-jdk</product>
+  <announced>January 16, 2006</announced>
+  <revised>January 16, 2006: 01</revised>
+  <bug>118114</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/sun-jdk" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2.09</unaffected>
+      <vulnerable range="lt">1.4.2.09</vulnerable>
+    </package>
+    <package name="dev-java/sun-jre-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2.09</unaffected>
+      <vulnerable range="lt">1.4.2.09</vulnerable>
+    </package>
+    <package name="dev-java/blackdown-jdk" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2.03</unaffected>
+      <vulnerable range="lt">1.4.2.03</vulnerable>
+    </package>
+    <package name="dev-java/blackdown-jre" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2.03</unaffected>
+      <vulnerable range="lt">1.4.2.03</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Sun and Blackdown both provide implementations of the Java
+    Development Kit (JDK) and Java Runtime Environment (JRE).
+    </p>
+  </background>
+  <description>
+    <p>
+    Adam Gowdiak discovered multiple vulnerabilities in the Java
+    Runtime Environment's Reflection APIs that may allow untrusted applets
+    to elevate privileges.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could embed a malicious Java applet in a web
+    page and entice a victim to view it. This applet can then bypass
+    security restrictions and execute any command or access any file with
+    the rights of the user running the web browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Sun JDK users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jdk-1.4.2.09&quot;</code>
+    <p>
+    All Sun JRE users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jre-bin-1.4.2.09&quot;</code>
+    <p>
+    All Blackdown JDK users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/blackdown-jdk-1.4.2.03&quot;</code>
+    <p>
+    All Blackdown JRE users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/blackdown-jre-1.4.2.03&quot;</code>
+    <p>
+    Note to SPARC and PPC users: There is no stable secure
+    Blackdown Java for the SPARC or PPC architectures. Affected users on
+    the PPC architecture should consider switching to the IBM Java packages
+    (ibm-jdk-bin and ibm-jre-bin). Affected users on the SPARC should
+    remove the package until a SPARC package is released.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3905">CVE-2005-3905</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3906">CVE-2005-3906</uri>
+    <uri link="http://sunsolve.sun.com/searchproxy/document.do?assetkey=1-26-102003-1">Sun Security Alert ID 102003</uri>
+    <uri link="http://www.blackdown.org/java-linux/java2-status/security/Blackdown-SA-2005-03.txt">Blackdown Java-Linux Security Advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 13 Jan 2006 09:49:14 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 13 Jan 2006 09:55:18 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200601-11.xml b/xml/htdocs/security/en/glsa/glsa-200601-11.xml
new file mode 100644
index 00000000..b7093f9a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200601-11.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200601-11">
+  <title>KDE kjs: URI heap overflow vulnerability</title>
+  <synopsis>
+    KDE fails to properly validate URIs when handling javascript, potentially
+    resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">KDE</product>
+  <announced>January 22, 2006</announced>
+  <revised>January 22, 2006: 01</revised>
+  <bug>118550</bug>
+  <access>remote</access>
+  <affected>
+    <package name="kde-base/kdelibs" auto="yes" arch="*">
+      <unaffected range="ge">3.4.3-r1</unaffected>
+      <vulnerable range="lt">3.4.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDE is a feature-rich graphical desktop environment for Linux and
+    Unix-like Operating Systems. kjs is the javascript interpreter used in
+    Konqueror and other parts of KDE.
+    </p>
+  </background>
+  <description>
+    <p>
+    Maksim Orlovich discovered an incorrect bounds check in kjs when
+    handling URIs.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to load a specially crafted webpage containing
+    malicious javascript, an attacker could execute arbitrary code with the
+    rights of the user running kjs.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All kdelibs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose kde-base/kdelibs-3.4.3-r1</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0019">CVE-2006-0019</uri>
+    <uri link="http://www.kde.org/info/security/advisory-20060119-1.txt">KDE Security Advisory: kjs encodeuri/decodeuri heap overflow vulnerability</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 20 Jan 2006 06:30:56 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 21 Jan 2006 13:57:57 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200601-12.xml b/xml/htdocs/security/en/glsa/glsa-200601-12.xml
new file mode 100644
index 00000000..31a8d795
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200601-12.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200601-12">
+  <title>Trac: Cross-site scripting vulnerability</title>
+  <synopsis>
+    Trac is vulnerable to a cross-site scripting attack that could allow
+    arbitrary JavaScript code execution.
+  </synopsis>
+  <product type="ebuild">trac</product>
+  <announced>January 26, 2006</announced>
+  <revised>January 26, 2006: 01</revised>
+  <bug>118302</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/trac" auto="yes" arch="*">
+      <unaffected range="ge">0.9.3</unaffected>
+      <vulnerable range="lt">0.9.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Trac is a minimalistic web-based project management, wiki and bug
+    tracking system including a Subversion interface.
+    </p>
+  </background>
+  <description>
+    <p>
+    Christophe Truc discovered that Trac fails to properly sanitize
+    input passed in the URL.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker could exploit this to inject and execute
+    malicious script code or to steal cookie-based authentication
+    credentials, potentially compromising the victim's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Trac users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/trac-0.9.3&quot;</code>
+    <p>
+    Note: Users with the vhosts USE flag set should manually use
+    webapp-config to finalize the update.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4305">CVE-2005-4305</uri>
+    <uri link="http://projects.edgewall.com/trac/wiki/ChangeLog#a0.9.3">Trac Changelog</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 18 Jan 2006 15:05:49 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 18 Jan 2006 15:05:57 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 22 Jan 2006 19:44:58 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200601-13.xml b/xml/htdocs/security/en/glsa/glsa-200601-13.xml
new file mode 100644
index 00000000..47fdc3b3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200601-13.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200601-13">
+  <title>Gallery: Cross-site scripting vulnerability</title>
+  <synopsis>
+    Gallery is possibly vulnerable to a cross-site scripting attack that could
+    allow arbitrary JavaScript code execution.
+  </synopsis>
+  <product type="ebuild">gallery</product>
+  <announced>January 26, 2006</announced>
+  <revised>January 26, 2006: 01</revised>
+  <bug>119590</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/gallery" auto="yes" arch="*">
+      <unaffected range="ge">1.5.2</unaffected>
+      <vulnerable range="lt">1.5.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gallery is a web application written in PHP which is used to
+    organize and publish photo albums. It allows multiple users to build
+    and maintain their own albums. It also supports the mirroring of images
+    on other servers.
+    </p>
+  </background>
+  <description>
+    <p>
+    Peter Schumacher discovered that Gallery fails to sanitize the
+    fullname set by users, possibly leading to a cross-site scripting
+    vulnerability.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By setting a specially crafted fullname, an attacker can inject
+    and execute script code in the victim's browser window and potentially
+    compromise the user's gallery.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gallery users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/gallery-1.5.2&quot;</code>
+    <p>
+    Note: Users with the vhosts USE flag set should manually use
+    webapp-config to finalize the update.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://gallery.menalto.com/page/gallery_1_5_2_release">Gallery Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0330">CVE-2006-0330</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 22 Jan 2006 19:16:38 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 22 Jan 2006 19:17:06 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 22 Jan 2006 19:28:37 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200601-14.xml b/xml/htdocs/security/en/glsa/glsa-200601-14.xml
new file mode 100644
index 00000000..1b99b6c5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200601-14.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200601-14">
+  <title>LibAST: Privilege escalation</title>
+  <synopsis>
+    A buffer overflow in LibAST may result in execution of arbitrary code with
+    escalated privileges.
+  </synopsis>
+  <product type="ebuild">LibAST</product>
+  <announced>January 29, 2006</announced>
+  <revised>January 29, 2006: 02</revised>
+  <bug>120106</bug>
+  <access>local</access>
+  <affected>
+    <package name="x11-libs/libast" auto="yes" arch="*">
+      <unaffected range="ge">0.7</unaffected>
+      <vulnerable range="lt">0.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    LibAST is a utility library that was originally intended to accompany
+    Eterm, but may be used by various other applications.
+    </p>
+  </background>
+  <description>
+    <p>
+    Michael Jennings discovered an exploitable buffer overflow in the
+    configuration engine of LibAST.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    The vulnerability can be exploited to gain escalated privileges if the
+    application using LibAST is setuid/setgid and passes a specifically
+    crafted filename to LibAST's configuration engine.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Identify all applications linking against LibAST and verify they are
+    not setuid/setgid.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the latest version and run revdep-rebuild:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/libast-0.7&quot;
+    # revdep-rebuild</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0224">CVE-2006-0224</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 25 Jan 2006 21:44:39 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 26 Jan 2006 09:35:14 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 27 Jan 2006 21:23:22 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200601-15.xml b/xml/htdocs/security/en/glsa/glsa-200601-15.xml
new file mode 100644
index 00000000..8e02aefe
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200601-15.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200601-15">
+  <title>Paros: Default administrator password</title>
+  <synopsis>
+    Paros's database component is installed without a password, allowing
+    execution of arbitrary system commands.
+  </synopsis>
+  <product type="ebuild">Paros</product>
+  <announced>January 29, 2006</announced>
+  <revised>January 29, 2006: 01</revised>
+  <bug>120352</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-proxy/paros" auto="yes" arch="*">
+      <unaffected range="gt">3.2.5</unaffected>
+      <vulnerable range="le">3.2.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Paros is an intercepting proxy between a web server and a client
+    meant to be used for security assessments. It allows the user to watch
+    and modify the HTTP(S) traffic.
+    </p>
+  </background>
+  <description>
+    <p>
+    Andrew Christensen discovered that in older versions of Paros the
+    database component HSQLDB is installed with an empty password for the
+    database administrator "sa".
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Since the database listens globally by default, an attacker can
+    connect and issue arbitrary commands, including execution of binaries
+    installed on the host.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Paros users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --snyc
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-proxy/paros-3.2.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3280">CVE-2005-3280</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 26 Jan 2006 06:06:09 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 27 Jan 2006 21:44:45 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200601-16.xml b/xml/htdocs/security/en/glsa/glsa-200601-16.xml
new file mode 100644
index 00000000..e857483e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200601-16.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200601-16">
+  <title>MyDNS: Denial of Service</title>
+  <synopsis>
+    MyDNS contains a vulnerability that may lead to a Denial of Service attack.
+  </synopsis>
+  <product type="ebuild">MyDNS</product>
+  <announced>January 30, 2006</announced>
+  <revised>January 30, 2006: 01</revised>
+  <bug>119548</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/mydns" auto="yes" arch="*">
+      <unaffected range="ge">1.1.0</unaffected>
+      <vulnerable range="lt">1.1.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MyDNS is a DNS server using a MySQL database as a backend. It is
+    designed to allow for fast updates and small resource usage.
+    </p>
+  </background>
+  <description>
+    <p>
+    MyDNS contains an unspecified flaw that may allow a remote Denial
+    of Service.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could cause a Denial of Service by sending malformed
+    DNS queries to the MyDNS server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MyDNS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/mydns-1.1.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0351">CVE-2006-0351</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 25 Jan 2006 19:31:44 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 27 Jan 2006 05:37:45 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 27 Jan 2006 21:29:58 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200601-17.xml b/xml/htdocs/security/en/glsa/glsa-200601-17.xml
new file mode 100644
index 00000000..5787192d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200601-17.xml
@@ -0,0 +1,117 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200601-17">
+  <title>Xpdf, Poppler, GPdf, libextractor, pdftohtml: Heap overflows</title>
+  <synopsis>
+    Xpdf, Poppler, GPdf, libextractor and pdftohtml are vulnerable to integer
+    overflows that may be exploited to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">xpdf poppler gpdf libextractor pdftohtml</product>
+  <announced>January 30, 2006</announced>
+  <revised>January 30, 2006: 01</revised>
+  <bug>117481</bug>
+  <bug>117494</bug>
+  <bug>117495</bug>
+  <bug>115789</bug>
+  <bug>118665</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/xpdf" auto="yes" arch="*">
+      <unaffected range="ge">3.01-r5</unaffected>
+      <vulnerable range="lt">3.01-r5</vulnerable>
+    </package>
+    <package name="app-text/poppler" auto="yes" arch="*">
+      <unaffected range="ge">0.4.3-r4</unaffected>
+      <vulnerable range="lt">0.4.3-r4</vulnerable>
+    </package>
+    <package name="app-text/gpdf" auto="yes" arch="*">
+      <unaffected range="ge">2.10.0-r3</unaffected>
+      <vulnerable range="lt">2.10.0-r3</vulnerable>
+    </package>
+    <package name="media-libs/libextractor" auto="yes" arch="*">
+      <unaffected range="ge">0.5.9</unaffected>
+      <vulnerable range="lt">0.5.9</vulnerable>
+    </package>
+    <package name="app-text/pdftohtml" auto="yes" arch="*">
+      <vulnerable range="lt">0.36-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Xpdf is a PDF file viewer that runs under the X Window System.
+    Poppler is a PDF rendering library based on the Xpdf 3.0 code base.
+    GPdf is a PDF file viewer for the GNOME 2 platform, also based on Xpdf.
+    libextractor is a library which includes Xpdf code to extract arbitrary
+    meta-data from files. pdftohtml is a utility to convert PDF files to
+    HTML or XML formats that makes use of Xpdf code to decode PDF files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Evans has reported some integer overflows in Xpdf when
+    attempting to calculate buffer sizes for memory allocation, leading to
+    a heap overflow and a potential infinite loop when handling malformed
+    input files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a specially crafted PDF file to a victim, an attacker
+    could cause an overflow, potentially resulting in the execution of
+    arbitrary code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Xpdf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/xpdf-3.01-r5&quot;</code>
+    <p>
+    All Poppler users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/poppler-0.4.3-r4&quot;</code>
+    <p>
+    All GPdf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/gpdf-2.10.0-r3&quot;</code>
+    <p>
+    All libextractor users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libextractor-0.5.9&quot;</code>
+    <p>
+    All pdftohtml users should migrate to the latest stable version
+    of Poppler.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3627">CVE-2005-3627</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3626">CVE-2005-3626</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3625">CVE-2005-3625</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3624">CVE-2005-3624</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 16 Jan 2006 22:04:57 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 17 Jan 2006 03:14:48 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 29 Jan 2006 17:26:11 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200602-01.xml b/xml/htdocs/security/en/glsa/glsa-200602-01.xml
new file mode 100644
index 00000000..14a3f158
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200602-01.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200602-01">
+  <title>GStreamer FFmpeg plugin: Heap-based buffer overflow</title>
+  <synopsis>
+    The GStreamer FFmpeg plugin is vulnerable to a buffer overflow that may be
+    exploited by attackers to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">gst-plugins-ffmpeg</product>
+  <announced>February 05, 2006</announced>
+  <revised>February 05, 2006: 01</revised>
+  <bug>119512</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-plugins/gst-plugins-ffmpeg" auto="yes" arch="*">
+      <unaffected range="ge">0.8.7-r1</unaffected>
+      <vulnerable range="lt">0.8.7-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The GStreamer FFmpeg plugin uses code from the FFmpeg library to
+    provide fast colorspace conversion and multimedia decoders to the
+    GStreamer open source media framework.
+    </p>
+  </background>
+  <description>
+    <p>
+    The GStreamer FFmpeg plugin contains derived code from the FFmpeg
+    library, which is vulnerable to a heap overflow in the
+    "avcodec_default_get_buffer()" function discovered by Simon Kilvington
+    (see GLSA 200601-06).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to run an application using
+    the GStreamer FFmpeg plugin on a maliciously crafted PIX_FMT_PAL8
+    format image file (like PNG images), possibly leading to the execution
+    of arbitrary code with the permissions of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GStreamer FFmpeg plugin users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-plugins/gst-plugins-ffmpeg-0.8.7-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4048">CVE-2005-4048</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200601-06.xml">GLSA 200601-06</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 29 Jan 2006 21:54:38 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 31 Jan 2006 03:13:44 +0000">
+    adir
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 01 Feb 2006 15:27:50 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200602-02.xml b/xml/htdocs/security/en/glsa/glsa-200602-02.xml
new file mode 100644
index 00000000..8b9608af
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200602-02.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200602-02">
+  <title>ADOdb: PostgresSQL command injection</title>
+  <synopsis>
+    ADOdb is vulnerable to SQL injections if used in conjunction with a
+    PostgreSQL database.
+  </synopsis>
+  <product type="ebuild">ADOdb</product>
+  <announced>February 06, 2006</announced>
+  <revised>February 06, 2006: 01</revised>
+  <bug>120215</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-php/adodb" auto="yes" arch="*">
+      <unaffected range="ge">4.71</unaffected>
+      <vulnerable range="lt">4.71</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ADOdb is an abstraction library for PHP creating a common API for
+    a wide range of database backends.
+    </p>
+  </background>
+  <description>
+    <p>
+    Andy Staudacher discovered that ADOdb does not properly sanitize
+    all parameters.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending specifically crafted requests to an application that
+    uses ADOdb and a PostgreSQL backend, an attacker might exploit the flaw
+    to execute arbitrary SQL queries on the host.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ADOdb users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-php/adodb-4.71&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0410">CVE-2006-0410</uri>
+  </references>
+  <metadata tag="bugReady" timestamp="Sat, 04 Feb 2006 17:34:56 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 06 Feb 2006 08:23:05 +0000">
+    frilled
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200602-03.xml b/xml/htdocs/security/en/glsa/glsa-200602-03.xml
new file mode 100644
index 00000000..01591086
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200602-03.xml
@@ -0,0 +1,101 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200602-03">
+  <title>Apache: Multiple vulnerabilities</title>
+  <synopsis>
+    Apache can be exploited for cross-site scripting attacks and is vulnerable
+    to a Denial of Service attack.
+  </synopsis>
+  <product type="ebuild">Apache</product>
+  <announced>February 06, 2006</announced>
+  <revised>December 30, 2007: 03</revised>
+  <bug>115324</bug>
+  <bug>118875</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="ge">2.0.55-r1</unaffected>
+      <unaffected range="rge">2.0.54-r16</unaffected>
+      <unaffected range="eq">1.3.34-r2</unaffected>
+      <unaffected range="rge">1.3.34-r11</unaffected>
+      <unaffected range="rge">1.3.37</unaffected>
+      <vulnerable range="lt">2.0.55-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP server is one of the most popular web servers on the
+    Internet. mod_imap provides support for server-side image maps; mod_ssl
+    provides secure HTTP connections.
+    </p>
+  </background>
+  <description>
+    <p>
+    Apache's mod_imap fails to properly sanitize the "Referer" directive of
+    imagemaps in some cases, leaving the HTTP Referer header unescaped. A
+    flaw in mod_ssl can lead to a NULL pointer dereference if the site uses
+    a custom "Error 400" document. These vulnerabilities were reported by
+    Marc Cox and Hartmut Keil, respectively.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit mod_imap to inject arbitrary HTML or
+    JavaScript into a user's browser to gather sensitive information.
+    Attackers could also cause a Denial of Service on hosts using the SSL
+    module (Apache 2.0.x only).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Apache users should upgrade to the latest version, depending on
+    whether they still use the old configuration style
+    (/etc/apache/conf/*.conf) or the new one (/etc/apache2/httpd.conf).
+    </p>
+    <p>
+    2.0.x users, new style config:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/apache-2.0.55-r1&quot;</code>
+    <p>
+    2.0.x users, old style config:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;=www-servers/apache-2.0.54-r16&quot;</code>
+    <p>
+    1.x users, new style config:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;=www-servers/apache-1.3.34-r11&quot;</code>
+    <p>
+    1.x users, old style config:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;=www-servers/apache-1.3.34-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3352">CVE-2005-3352</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3357">CVE-2005-3357</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 23 Jan 2006 08:56:54 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 27 Jan 2006 06:31:39 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 06 Feb 2006 06:26:14 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200602-04.xml b/xml/htdocs/security/en/glsa/glsa-200602-04.xml
new file mode 100644
index 00000000..15376b59
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200602-04.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200602-04">
+  <title>Xpdf, Poppler: Heap overflow</title>
+  <synopsis>
+    Xpdf and Poppler are vulnerable to a heap overflow that may be exploited to
+    execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">xpdf poppler</product>
+  <announced>February 12, 2006</announced>
+  <revised>February 12, 2006: 01</revised>
+  <bug>120985</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/xpdf" auto="yes" arch="*">
+      <unaffected range="ge">3.01-r7</unaffected>
+      <vulnerable range="lt">3.01-r7</vulnerable>
+    </package>
+    <package name="app-text/poppler" auto="yes" arch="*">
+      <unaffected range="ge">0.5.0-r4</unaffected>
+      <vulnerable range="lt">0.5.0-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Xpdf is a PDF file viewer that runs under the X Window System.
+    Poppler is a PDF rendering library based on the Xpdf 3.0 code base.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dirk Mueller has reported a vulnerability in Xpdf. It is caused by
+    a missing boundary check in the splash rasterizer engine when handling
+    PDF splash images with overly large dimensions.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a specially crafted PDF file to a victim, an attacker
+    could cause an overflow, potentially resulting in the execution of
+    arbitrary code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Xpdf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/xpdf-3.01-r7&quot;</code>
+    <p>
+    All Poppler users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/poppler-0.5.0-r4&quot;</code>
+    <p>
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0301">CVE-2006-0301</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 08 Feb 2006 03:05:29 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 08 Feb 2006 03:06:48 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200602-05.xml b/xml/htdocs/security/en/glsa/glsa-200602-05.xml
new file mode 100644
index 00000000..ce9c63ff
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200602-05.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200602-05">
+  <title>KPdf: Heap based overflow</title>
+  <synopsis>
+    KPdf includes vulnerable Xpdf code to handle PDF files, making it
+    vulnerable to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">kdegraphics, kpdf</product>
+  <announced>February 12, 2006</announced>
+  <revised>February 12, 2006: 01</revised>
+  <bug>121375</bug>
+  <access>remote</access>
+  <affected>
+    <package name="kde-base/kdegraphics" auto="yes" arch="*">
+      <unaffected range="ge">3.4.3-r4</unaffected>
+      <vulnerable range="lt">3.4.3-r4</vulnerable>
+    </package>
+    <package name="kde-base/kpdf" auto="yes" arch="*">
+      <unaffected range="ge">3.4.3-r4</unaffected>
+      <vulnerable range="lt">3.4.3-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KPdf is a KDE-based PDF viewer included in the kdegraphics
+    package.
+    </p>
+  </background>
+  <description>
+    <p>
+    KPdf includes Xpdf code to handle PDF files. Dirk Mueller
+    discovered that the Xpdf code is vulnerable a heap based overflow in
+    the splash rasterizer engine.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially crafted PDF
+    file with Kpdf, potentially resulting in the execution of arbitrary
+    code with the rights of the user running the affected application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All kdegraphics users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kdegraphics-3.4.3-r4&quot;</code>
+    <p>
+    All Kpdf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kpdf-3.4.3-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0301">CVE-2006-0301</uri>
+    <uri link="http://www.kde.org/info/security/advisory-20060202-1.txt">KDE Security Advisory: kpdf/xpdf heap based buffer overflow</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 10 Feb 2006 17:37:49 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 11 Feb 2006 21:32:42 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200602-06.xml b/xml/htdocs/security/en/glsa/glsa-200602-06.xml
new file mode 100644
index 00000000..92a1d435
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200602-06.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200602-06">
+  <title>ImageMagick: Format string vulnerability</title>
+  <synopsis>
+    A vulnerability in ImageMagick allows attackers to crash the application
+    and potentially execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">ImageMagick</product>
+  <announced>February 13, 2006</announced>
+  <revised>February 13, 2006: 01</revised>
+  <bug>83542</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/imagemagick" auto="yes" arch="*">
+      <unaffected range="ge">6.2.5.5</unaffected>
+      <vulnerable range="lt">6.2.5.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ImageMagick is an application suite to manipulate and convert
+    images. It is often used as a utility backend by web applications like
+    forums, content management systems or picture galleries.
+    </p>
+  </background>
+  <description>
+    <p>
+    The SetImageInfo function was found vulnerable to a format string
+    mishandling. Daniel Kobras discovered that the handling of "%"-escaped
+    sequences in filenames passed to the function is inadequate. This is a
+    new vulnerability that is not addressed by GLSA 200503-11.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By feeding specially crafted file names to ImageMagick, an
+    attacker can crash the program and possibly execute arbitrary code with
+    the privileges of the user running ImageMagick.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ImageMagick users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/imagemagick-6.2.5.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0082">CVE-2006-0082</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200503-11.xml">GLSA 200503-11</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 01 Feb 2006 19:11:00 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 02 Feb 2006 08:22:50 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 09 Feb 2006 18:59:37 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200602-07.xml b/xml/htdocs/security/en/glsa/glsa-200602-07.xml
new file mode 100644
index 00000000..5d0eeae4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200602-07.xml
@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200602-07">
+  <title>Sun JDK/JRE: Applet privilege escalation</title>
+  <synopsis>
+    Sun's Java Development Kit (JDK) and Java Runtime Environment (JRE) do not
+    adequately constrain applets from privilege escalation and arbitrary code
+    execution.
+  </synopsis>
+  <product type="ebuild">Sun JDK, applet</product>
+  <announced>February 15, 2006</announced>
+  <revised>February 15, 2006: 01</revised>
+  <bug>122156</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/sun-jdk" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2.10</unaffected>
+      <vulnerable range="lt">1.4.2.10</vulnerable>
+    </package>
+    <package name="dev-java/sun-jre-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2.10</unaffected>
+      <vulnerable range="lt">1.4.2.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Sun's JDK and JRE provide interpreters for Java Applets in a
+    sandboxed environment. These implementations provide the Java Web Start
+    technology that can be used for easy client-side deployment of Java
+    applications.
+    </p>
+  </background>
+  <description>
+    <p>
+    Applets executed using JRE or JDK can use "reflection" APIs
+    functions to elevate its privileges beyond the sandbox restrictions.
+    Adam Gowdiak discovered five vulnerabilities that use this method for
+    privilege escalation. Two more vulnerabilities were discovered by the
+    vendor. Peter Csepely discovered that Web Start Java applications also
+    can an escalate their privileges.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious Java applet can bypass Java sandbox restrictions and
+    hence access local files, connect to arbitrary network locations and
+    execute arbitrary code on the user's machine. Java Web Start
+    applications are affected likewise.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Select another Java implementation using java-config.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Sun JDK users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jdk-1.4.2.10&quot;</code>
+    <p>
+    All Sun JRE users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jre-bin-1.4.2.10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://sunsolve.sun.com/search/document.do?assetkey=1-26-102170-1">Sun Security Alert ID 102170</uri>
+    <uri link="http://sunsolve.sun.com/search/document.do?assetkey=1-26-102171-1">Sun Security Alert ID 102171</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0614">CVE-2006-0614</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0615">CVE-2006-0615</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0616">CVE-2006-0616</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0617">CVE-2006-0617</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 09 Feb 2006 20:48:45 +0000">
+    dragonheart
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 12 Feb 2006 13:04:50 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200602-08.xml b/xml/htdocs/security/en/glsa/glsa-200602-08.xml
new file mode 100644
index 00000000..d4139864
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200602-08.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200602-08">
+  <title>libtasn1, GNU TLS: Security flaw in DER decoding</title>
+  <synopsis>
+    A flaw in the parsing of Distinguished Encoding Rules (DER) has been
+    discovered in libtasn1, potentially resulting in the execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">libtasn1</product>
+  <announced>February 16, 2006</announced>
+  <revised>February 16, 2006: 01</revised>
+  <bug>122307</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/libtasn1" auto="yes" arch="*">
+      <unaffected range="ge">0.2.18</unaffected>
+      <vulnerable range="lt">0.2.18</vulnerable>
+    </package>
+    <package name="net-libs/gnutls" auto="yes" arch="*">
+      <unaffected range="ge">1.2.10</unaffected>
+      <vulnerable range="lt">1.2.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Libtasn1 is a library used to parse ASN.1 (Abstract Syntax
+    Notation One) objects, and perform DER (Distinguished Encoding Rules)
+    decoding. Libtasn1 is included with the GNU TLS library, which is used
+    by applications to provide a cryptographically secure communications
+    channel.
+    </p>
+  </background>
+  <description>
+    <p>
+    Evgeny Legerov has reported a flaw in the DER decoding routines
+    provided by libtasn1, which could cause an out of bounds access to
+    occur.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could cause an application using libtasn1 to
+    crash and potentially execute arbitrary code by sending specially
+    crafted input.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libtasn1 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/libtasn1-0.2.18&quot;</code>
+    <p>
+    All GNU TLS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/gnutls-1.2.10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0645">CVE-2006-0645</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 13 Feb 2006 20:11:10 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 13 Feb 2006 20:11:49 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 14 Feb 2006 22:53:09 +0000">
+    taviso
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200602-09.xml b/xml/htdocs/security/en/glsa/glsa-200602-09.xml
new file mode 100644
index 00000000..384958de
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200602-09.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200602-09">
+  <title>BomberClone: Remote execution of arbitrary code</title>
+  <synopsis>
+    BomberClone is vulnerable to a buffer overflow which may lead to remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">games-action/bomberclone</product>
+  <announced>February 16, 2006</announced>
+  <revised>February 16, 2006: 01</revised>
+  <bug>121605</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-action/bomberclone" auto="yes" arch="*">
+      <unaffected range="ge">0.11.6.2-r1</unaffected>
+      <vulnerable range="lt">0.11.6.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    BomberClone is a remake of the classic game "BomberMan". It
+    supports multiple players via IP network connection.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Cornelius of the Gentoo Security team discovered multiple
+    missing buffer checks in BomberClone's code.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By sending overly long error messages to the game via network, a
+    remote attacker may exploit buffer overflows to execute arbitrary code
+    with the rights of the user running BomberClone.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All BomberClone users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-action/bomberclone-0.11.6.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0460">CVE-2006-0460</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 14 Feb 2006 17:56:10 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 14 Feb 2006 17:58:09 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 15 Feb 2006 11:54:36 +0000">
+    frilled
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200602-10.xml b/xml/htdocs/security/en/glsa/glsa-200602-10.xml
new file mode 100644
index 00000000..796aac90
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200602-10.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200602-10">
+  <title>GnuPG: Incorrect signature verification</title>
+  <synopsis>
+    Applications relying on GnuPG to authenticate digital signatures may
+    incorrectly believe a signature has been verified.
+  </synopsis>
+  <product type="ebuild">gnupg</product>
+  <announced>February 18, 2006</announced>
+  <revised>February 18, 2006: 01</revised>
+  <bug>122721</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/gnupg" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2.1</unaffected>
+      <vulnerable range="lt">1.4.2.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GnuPG (The GNU Privacy Guard) is a free replacement for PGP
+    (Pretty Good Privacy). As GnuPG does not rely on any patented
+    algorithms, it can be used without any restrictions. gpgv is the
+    OpenPGP signature verification tool provided by the GnuPG system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Auditing Team
+    discovered that automated systems relying on the return code of GnuPG
+    or gpgv to authenticate digital signatures may be misled by malformed
+    signatures. GnuPG documentation states that a return code of zero (0)
+    indicates success, however gpg and gpgv may also return zero if no
+    signature data was found in a detached signature file.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker may be able to bypass authentication in automated
+    systems relying on the return code of gpg or gpgv to authenticate
+    digital signatures.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GnuPG users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-crypt/gnupg-1.4.2.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000211.html">GnuPG Security Announcement</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0455">CVE-2006-0455</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 15 Feb 2006 16:05:31 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 18 Feb 2006 12:22:36 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200602-11.xml b/xml/htdocs/security/en/glsa/glsa-200602-11.xml
new file mode 100644
index 00000000..76a7f3d0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200602-11.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200602-11">
+  <title>OpenSSH, Dropbear: Insecure use of system() call</title>
+  <synopsis>
+    A flaw in OpenSSH and Dropbear allows local users to elevate their
+    privileges via scp.
+  </synopsis>
+  <product type="ebuild">OpenSSH</product>
+  <announced>February 20, 2006</announced>
+  <revised>February 20, 2006: 01</revised>
+  <bug>119232</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-misc/openssh" auto="yes" arch="*">
+      <unaffected range="ge">4.2_p1-r1</unaffected>
+      <vulnerable range="lt">4.2_p1-r1</vulnerable>
+    </package>
+    <package name="net-misc/dropbear" auto="yes" arch="*">
+      <unaffected range="ge">0.47-r1</unaffected>
+      <vulnerable range="lt">0.47-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSSH is a free application suite consisting of server and
+    clients that replace tools like telnet, rlogin, rcp and ftp with more
+    secure versions offering additional functionality. Dropbear is an SSH
+    server and client designed with a small memory footprint that includes
+    OpenSSH scp code.
+    </p>
+  </background>
+  <description>
+    <p>
+    To copy from a local filesystem to another local filesystem, scp
+    constructs a command line using 'cp' which is then executed via
+    system(). Josh Bressers discovered that special characters are not
+    escaped by scp, but are simply passed to the shell.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By tricking other users or applications to use scp on maliciously
+    crafted filenames, a local attacker user can execute arbitrary commands
+    with the rights of the user running scp.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenSSH users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/openssh-4.2_p1-r1&quot;</code>
+    <p>
+    All Dropbear users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/dropbear-0.47-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0225">CVE-2006-0225</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 06 Feb 2006 20:22:40 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 07 Feb 2006 06:29:22 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 20 Feb 2006 20:03:36 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200602-12.xml b/xml/htdocs/security/en/glsa/glsa-200602-12.xml
new file mode 100644
index 00000000..b1ee7dfe
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200602-12.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200602-12">
+  <title>GPdf: heap overflows in included Xpdf code</title>
+  <synopsis>
+    GPdf includes vulnerable Xpdf code to handle PDF files, making it
+    vulnerable to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">gpdf</product>
+  <announced>February 21, 2006</announced>
+  <revised>February 21, 2006: 01</revised>
+  <bug>121511</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/gpdf" auto="yes" arch="*">
+      <unaffected range="ge">2.10.0-r4</unaffected>
+      <vulnerable range="lt">2.10.0-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GPdf is a Gnome PDF viewer.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dirk Mueller found a heap overflow vulnerability in the XPdf
+    codebase when handling splash images that exceed size of the associated
+    bitmap.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially crafted PDF
+    file with GPdf, potentially resulting in the execution of arbitrary
+    code with the rights of the user running the affected application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GPdf users should upgrade to the latest version.
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/gpdf-2.10.0-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0301">CVE-2006-0301</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 16 Feb 2006 20:47:35 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 17 Feb 2006 21:40:10 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 17 Feb 2006 23:04:04 +0000">
+    dragonheart
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200602-13.xml b/xml/htdocs/security/en/glsa/glsa-200602-13.xml
new file mode 100644
index 00000000..2c7e26b6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200602-13.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200602-13">
+  <title>GraphicsMagick: Format string vulnerability</title>
+  <synopsis>
+    A vulnerability in GraphicsMagick allows attackers to crash the application
+    and potentially execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">graphicsmagick</product>
+  <announced>February 26, 2006</announced>
+  <revised>February 26, 2006: 01</revised>
+  <bug>119476</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/graphicsmagick" auto="yes" arch="*">
+      <unaffected range="ge">1.1.7</unaffected>
+      <vulnerable range="lt">1.1.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GraphicsMagick is a collection of tools to read, write and
+    manipulate images in many formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    The SetImageInfo function was found vulnerable to a format string
+    mishandling. Daniel Kobras discovered that the handling of "%"-escaped
+    sequences in filenames passed to the function is inadequate in
+    ImageMagick GLSA 200602-06 and the same vulnerability exists in
+    GraphicsMagick.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By feeding specially crafted file names to GraphicsMagick an
+    attacker can crash the program and possibly execute arbitrary code with
+    the privileges of the user running GraphicsMagick.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GraphicsMagick users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/graphicsmagick-1.1.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200602-06.xml">GLSA 200602-06</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0082">CVE-2006-0082</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 21 Feb 2006 18:24:37 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 22 Feb 2006 11:24:17 +0000">
+    dragonheart
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 22 Feb 2006 21:18:32 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200602-14.xml b/xml/htdocs/security/en/glsa/glsa-200602-14.xml
new file mode 100644
index 00000000..2dd712d7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200602-14.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200602-14">
+  <title>noweb: Insecure temporary file creation</title>
+  <synopsis>
+    noweb is vulnerable to symlink attacks, potentially allowing a local user
+    to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">noweb</product>
+  <announced>February 26, 2006</announced>
+  <revised>February 26, 2006: 01</revised>
+  <bug>122705</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-text/noweb" auto="yes" arch="*">
+      <unaffected range="ge">2.9-r5</unaffected>
+      <vulnerable range="lt">2.9-r5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    noweb is a simple, extensible, and language independent literate
+    programming tool.
+    </p>
+  </background>
+  <description>
+    <p>
+    Javier Fernandez-Sanguino has discovered that the lib/toascii.nw
+    and shell/roff.mm scripts insecurely create temporary files with
+    predictable filenames.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the temporary file
+    directory, pointing to a valid file somewhere on the filesystem. When
+    an affected script is called, this would result in the file being
+    overwritten with the rights of the user running the script.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All noweb users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/noweb-2.9-r5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3342">CVE-2005-3342</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 23 Feb 2006 20:08:48 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 23 Feb 2006 20:09:04 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 24 Feb 2006 14:44:04 +0000">
+    formula7
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-01.xml b/xml/htdocs/security/en/glsa/glsa-200603-01.xml
new file mode 100644
index 00000000..e7a55781
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-01.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-01">
+  <title>WordPress: SQL injection vulnerability</title>
+  <synopsis>
+    WordPress is vulnerable to an SQL injection vulnerability.
+  </synopsis>
+  <product type="ebuild">WordPress</product>
+  <announced>March 04, 2006</announced>
+  <revised>March 04, 2006: 01</revised>
+  <bug>121661</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/wordpress" auto="yes" arch="*">
+      <unaffected range="ge">2.0.1</unaffected>
+      <vulnerable range="le">1.5.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    WordPress is a PHP and MySQL based content management and
+    publishing system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Patrik Karlsson reported that WordPress 1.5.2 makes use of an
+    insufficiently filtered User Agent string in SQL queries related to
+    comments posting. This vulnerability was already fixed in the
+    2.0-series of WordPress.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could send a comment with a malicious User Agent
+    parameter, resulting in SQL injection and potentially in the subversion
+    of the WordPress database. This vulnerability wouldn't affect WordPress
+    sites which do not allow comments or which require that comments go
+    through a moderator.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable or moderate comments on your WordPress blogs.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All WordPress users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/wordpress-2.0.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1012">CVE-2006-1012</uri>
+  </references>
+  
+  <metadata tag="submitter" timestamp="Sun, 26 Feb 2006 14:42:26 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 26 Feb 2006 14:42:47 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-02.xml b/xml/htdocs/security/en/glsa/glsa-200603-02.xml
new file mode 100644
index 00000000..0a4b878d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-02.xml
@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-02">
+  <title>teTeX, pTeX, CSTeX: Multiple overflows in included XPdf code</title>
+  <synopsis>
+    CSTeTeX, pTeX, and teTeX include vulnerable XPdf code to handle PDF files,
+    making them vulnerable to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">tetex</product>
+  <announced>March 04, 2006</announced>
+  <revised>March 04, 2006: 01</revised>
+  <bug>115775</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/tetex" auto="yes" arch="*">
+      <unaffected range="ge">2.0.2-r8</unaffected>
+      <vulnerable range="lt">2.0.2-r8</vulnerable>
+    </package>
+    <package name="app-text/cstetex" auto="yes" arch="*">
+      <unaffected range="ge">2.0.2-r2</unaffected>
+      <vulnerable range="lt">2.0.2-r2</vulnerable>
+    </package>
+    <package name="app-text/ptex" auto="yes" arch="*">
+      <unaffected range="ge">3.1.5-r1</unaffected>
+      <vulnerable range="lt">3.1.5-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    teTex is a complete TeX distribution. It is used for creating and
+    manipulating LaTeX documents. CSTeX is a TeX distribution with Czech
+    and Slovak support. pTeX is and ASCII publishing TeX distribution.
+    </p>
+  </background>
+  <description>
+    <p>
+    CSTeX, teTex, and pTeX include XPdf code to handle PDF files. This
+    XPdf code is vulnerable to several heap overflows (GLSA 200512-08) as
+    well as several buffer and integer overflows discovered by Chris Evans
+    (CESA-2005-003).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially crafted PDF
+    file with teTeX, pTeX or CSTeX, potentially resulting in the execution
+    of arbitrary code with the rights of the user running the affected
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All teTex users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/tetex-2.0.2-r8&quot;</code>
+    <p>
+    All CSTeX users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/cstetex-2.0.2-r2&quot;</code>
+    <p>
+    All pTeX users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/ptex-3.1.5-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3193">CVE-2005-3193</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200512-08.xml">GLSA 200512-08</uri>
+    <uri link="http://scary.beasts.org/security/CESA-2005-003.txt">CESA-2005-003</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 16 Feb 2006 20:57:52 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 17 Feb 2006 12:11:23 +0000">
+    dragonheart
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 04 Mar 2006 16:30:04 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-03.xml b/xml/htdocs/security/en/glsa/glsa-200603-03.xml
new file mode 100644
index 00000000..5e2062d0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-03.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-03">
+  <title>MPlayer: Multiple integer overflows</title>
+  <synopsis>
+    MPlayer is vulnerable to integer overflows in FFmpeg and ASF decoding that
+    could potentially result in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">MPlayer</product>
+  <announced>March 04, 2006</announced>
+  <revised>June 21, 2006: 02</revised>
+  <bug>115760</bug>
+  <bug>122029</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/mplayer" auto="yes" arch="*">
+      <unaffected range="ge">1.0.20060217</unaffected>
+      <unaffected range="ge">1.0_pre8</unaffected>
+      <vulnerable range="lt">1.0.20060217</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MPlayer is a media player capable of handling multiple multimedia file
+    formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    MPlayer makes use of the FFmpeg library, which is vulnerable to a heap
+    overflow in the avcodec_default_get_buffer() function discovered by
+    Simon Kilvington (see GLSA 200601-06). Furthermore, AFI Security
+    Research discovered two integer overflows in ASF file format decoding,
+    in the new_demux_packet() function from libmpdemux/demuxer.h and the
+    demux_asf_read_packet() function from libmpdemux/demux_asf.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could craft a malicious media file which, when opened using
+    MPlayer, would lead to a heap-based buffer overflow. This could result
+    in the execution of arbitrary code with the permissions of the user
+    running MPlayer.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MPlayer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/mplayer-1.0.20060217&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4048">CVE-2005-4048</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0579">CVE-2006-0579</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200601-06.xml">GLSA 200601-06</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 04 Mar 2006 11:56:49 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 04 Mar 2006 11:56:59 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-04.xml b/xml/htdocs/security/en/glsa/glsa-200603-04.xml
new file mode 100644
index 00000000..512cd9f3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-04.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-04">
+  <title>IMAP Proxy: Format string vulnerabilities</title>
+  <synopsis>
+    Format string vulnerabilities in IMAP Proxy may lead to the execution of
+    arbitrary code when connected to malicious IMAP servers.
+  </synopsis>
+  <product type="ebuild">up-imapproxy</product>
+  <announced>March 06, 2006</announced>
+  <revised>March 06, 2006: 01</revised>
+  <bug>107679</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/up-imapproxy" auto="yes" arch="*">
+      <unaffected range="ge">1.2.4</unaffected>
+      <vulnerable range="lt">1.2.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    IMAP Proxy (also known as up-imapproxy) proxies IMAP transactions
+    between an IMAP client and an IMAP server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Steve Kemp discovered two format string errors in IMAP Proxy.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could design a malicious IMAP server and entice
+    someone to connect to it using IMAP Proxy, resulting in the execution
+    of arbitrary code with the rights of the victim user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Only connect to trusted IMAP servers using IMAP Proxy.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All IMAP Proxy users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/up-imapproxy-1.2.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2661">CVE-2005-2661</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 05 Mar 2006 09:44:08 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 05 Mar 2006 09:44:28 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 05 Mar 2006 15:59:30 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-05.xml b/xml/htdocs/security/en/glsa/glsa-200603-05.xml
new file mode 100644
index 00000000..ad377313
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-05.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-05">
+  <title>zoo: Stack-based buffer overflow</title>
+  <synopsis>
+    A stack-based buffer overflow in zoo may be exploited to execute arbitrary
+    code through malicious ZOO archives.
+  </synopsis>
+  <product type="ebuild">zoo</product>
+  <announced>March 06, 2006</announced>
+  <revised>March 06, 2006: 01</revised>
+  <bug>123782</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/zoo" auto="yes" arch="*">
+      <unaffected range="ge">2.10-r1</unaffected>
+      <vulnerable range="lt">2.10-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    zoo is a file archiving utility for maintaining collections of
+    files, written by Rahul Dhesi.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jean-Sebastien Guay-Leroux discovered a boundary error in the
+    fullpath() function in misc.c when processing overly long file and
+    directory names in ZOO archives.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could craft a malicious ZOO archive and entice someone
+    to open it using zoo. This would trigger a stack-based buffer overflow
+    and potentially allow execution of arbitrary code with the rights of
+    the victim user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All zoo users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/zoo-2.10-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0855">CVE-2006-0855</uri>
+    <uri link="http://www.guay-leroux.com/projects/zoo-advisory.txt">Original Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 26 Feb 2006 17:26:29 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 03 Mar 2006 17:54:01 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 04 Mar 2006 16:06:52 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-06.xml b/xml/htdocs/security/en/glsa/glsa-200603-06.xml
new file mode 100644
index 00000000..4b230f18
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-06.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-06">
+  <title>GNU tar: Buffer overflow</title>
+  <synopsis>
+    A malicious tar archive could trigger a Buffer overflow in GNU tar,
+    potentially resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">tar</product>
+  <announced>March 10, 2006</announced>
+  <revised>March 10, 2006: 01</revised>
+  <bug>123038</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/tar" auto="yes" arch="*">
+      <unaffected range="ge">1.15.1-r1</unaffected>
+      <vulnerable range="lt">1.15.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GNU tar is the standard GNU utility for creating and manipulating
+    tar archives, a common format used for creating backups and
+    distributing files on UNIX-like systems.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jim Meyering discovered a flaw in the handling of certain header
+    fields that could result in a buffer overflow when extracting or
+    listing the contents of an archive.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could construct a malicious tar archive that
+    could potentially execute arbitrary code with the privileges of the
+    user running GNU tar.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GNU tar users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/tar-1.15.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0300">CVE-2006-0300</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 07 Mar 2006 20:43:28 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 08 Mar 2006 16:57:53 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 10 Mar 2006 18:23:47 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-07.xml b/xml/htdocs/security/en/glsa/glsa-200603-07.xml
new file mode 100644
index 00000000..99e54cfd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-07.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-07">
+  <title>flex: Potential insecure code generation</title>
+  <synopsis>
+    flex might generate code with a buffer overflow, making applications using
+    such scanners vulnerable to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">flex</product>
+  <announced>March 10, 2006</announced>
+  <revised>March 10, 2006: 01</revised>
+  <bug>122940</bug>
+  <access>remote and local</access>
+  <affected>
+    <package name="sys-devel/flex" auto="yes" arch="*">
+      <unaffected range="ge">2.5.33-r1</unaffected>
+      <vulnerable range="lt">2.5.33-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    flex is a programming tool used to generate scanners (programs
+    which recognize lexical patterns in text).
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Moore discovered a buffer overflow in a special class of
+    lexicographical scanners generated by flex. Only scanners generated by
+    grammars which use either REJECT, or rules with a "variable trailing
+    context" might be at risk.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could feed malicious input to an application making
+    use of an affected scanner and trigger the buffer overflow, potentially
+    resulting in the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Avoid using vulnerable grammar in your flex scanners.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All flex users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-devel/flex-2.5.33-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0459">CVE-2006-0459</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 03 Mar 2006 18:28:11 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 03 Mar 2006 18:29:09 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 07 Mar 2006 21:06:21 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-08.xml b/xml/htdocs/security/en/glsa/glsa-200603-08.xml
new file mode 100644
index 00000000..c0a31bb2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-08.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-08">
+  <title>GnuPG: Incorrect signature verification</title>
+  <synopsis>
+    GnuPG may erroneously report a modified or unsigned message has a valid
+    digital signature.
+  </synopsis>
+  <product type="ebuild">gnupg</product>
+  <announced>March 10, 2006</announced>
+  <revised>March 10, 2006: 01</revised>
+  <bug>125217</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/gnupg" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2.2</unaffected>
+      <vulnerable range="lt">1.4.2.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The GNU Privacy Guard, GnuPG, is a free replacement for the PGP
+    suite of cryptographic software that may be used without restriction,
+    as it does not rely on any patented algorithms. GnuPG can be used to
+    digitally sign messages, a method of ensuring the authenticity of a
+    message using public key cryptography.
+    </p>
+  </background>
+  <description>
+    <p>
+    OpenPGP is the standard that defines the format of digital
+    signatures supported by GnuPG. OpenPGP signatures consist of multiple
+    sections, in a strictly defined order. Tavis Ormandy of the Gentoo
+    Linux Security Audit Team discovered that certain illegal signature
+    formats could allow signed data to be modified without detection. GnuPG
+    has previously attempted to be lenient when processing malformed or
+    legacy signature formats, but this has now been found to be insecure.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker may be able to construct or modify a
+    digitally-signed message, potentially allowing them to bypass
+    authentication systems, or impersonate another user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GnuPG users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-crypt/gnupg-1.4.2.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0049">CVE-2006-0049</uri>
+    <uri link="http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html">GnuPG Announcement</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 08 Mar 2006 22:34:09 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 10 Mar 2006 21:32:19 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-09.xml b/xml/htdocs/security/en/glsa/glsa-200603-09.xml
new file mode 100644
index 00000000..b0c70bdd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-09.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-09">
+  <title>SquirrelMail: Cross-site scripting and IMAP command injection</title>
+  <synopsis>
+    SquirrelMail is vulnerable to several cross-site scripting vulnerabilities
+    and IMAP command injection.
+  </synopsis>
+  <product type="ebuild">squirrelmail</product>
+  <announced>March 12, 2006</announced>
+  <revised>March 12, 2006: 01</revised>
+  <bug>123781</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/squirrelmail" auto="yes" arch="*">
+      <unaffected range="ge">1.4.6</unaffected>
+      <vulnerable range="lt">1.4.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SquirrelMail is a webmail package written in PHP. It supports IMAP
+    and SMTP protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    SquirrelMail does not validate the right_frame parameter in
+    webmail.php, possibly allowing frame replacement or cross-site
+    scripting (CVE-2006-0188). Martijn Brinkers and Scott Hughes discovered
+    that MagicHTML fails to handle certain input correctly, potentially
+    leading to cross-site scripting (only Internet Explorer,
+    CVE-2006-0195). Vicente Aguilera reported that the
+    sqimap_mailbox_select function did not strip newlines from the mailbox
+    or subject parameter, possibly allowing IMAP command injection
+    (CVE-2006-0377).
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By exploiting the cross-site scripting vulnerabilities, an
+    attacker can execute arbitrary scripts running in the context of the
+    victim's browser. This could lead to a compromise of the user's webmail
+    account, cookie theft, etc. A remote attacker could exploit the IMAP
+    command injection to execute arbitrary IMAP commands on the configured
+    IMAP server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SquirrelMail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/squirrelmail-1.4.6&quot;</code>
+    <p>
+    Note: Users with the vhosts USE flag set should manually use
+    webapp-config to finalize the update.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0188">CVE-2006-0188</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0195">CVE-2006-0195</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0377">CVE-2006-0377</uri>
+  </references>
+  <metadata tag="">
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 11 Mar 2006 16:55:59 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 11 Mar 2006 21:38:55 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-10.xml b/xml/htdocs/security/en/glsa/glsa-200603-10.xml
new file mode 100644
index 00000000..47999a37
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-10.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-10">
+  <title>Cube: Multiple vulnerabilities</title>
+  <synopsis>
+    Cube is vulnerable to a buffer overflow, invalid memory access and remote
+    client crashes, possibly leading to a Denial of Service or remote code
+    execution.
+  </synopsis>
+  <product type="ebuild">cube</product>
+  <announced>March 13, 2006</announced>
+  <revised>March 13, 2006: 01</revised>
+  <bug>125289</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-fps/cube" auto="yes" arch="*">
+      <vulnerable range="le">20050829</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cube is an open source first person shooter game engine supporting
+    multiplayer via LAN or internet.
+    </p>
+  </background>
+  <description>
+    <p>
+    Luigi Auriemma reported that Cube is vulnerable to a buffer
+    overflow in the sgetstr() function (CVE-2006-1100) and that the
+    sgetstr() and getint() functions fail to verify the length of the
+    supplied argument, possibly leading to the access of invalid memory
+    regions (CVE-2006-1101). Furthermore, he discovered that a client
+    crashes when asked to load specially crafted mapnames (CVE-2006-1102).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit the buffer overflow to execute
+    arbitrary code with the rights of the user running cube. An attacker
+    could also exploit the other vulnerabilities to crash a Cube client or
+    server, resulting in a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Play solo games or restrict your multiplayer games to trusted
+    parties.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Upstream stated that there will be no fixed version of Cube, thus
+    the Gentoo Security Team decided to hardmask Cube for security reasons.
+    All Cube users are encouraged to uninstall Cube:
+    </p>
+    <code>
+    # emerge --ask --unmerge games-fps/cube</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1100">CVE-2006-1100</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1101">CVE-2006-1101</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1102">CVE-2006-1102</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 11 Mar 2006 12:37:07 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 11 Mar 2006 16:16:08 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-11.xml b/xml/htdocs/security/en/glsa/glsa-200603-11.xml
new file mode 100644
index 00000000..ccbef20d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-11.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-11">
+  <title>Freeciv: Denial of Service</title>
+  <synopsis>
+    A memory allocation bug in Freeciv allows a remote attacker to perform a
+    Denial of Service attack.
+  </synopsis>
+  <product type="ebuild">freeciv</product>
+  <announced>March 16, 2006</announced>
+  <revised>March 16, 2006: 01</revised>
+  <bug>125304</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-strategy/freeciv" auto="yes" arch="*">
+      <unaffected range="ge">2.0.8</unaffected>
+      <vulnerable range="lt">2.0.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Freeciv is an open source turn-based multiplayer strategy game,
+    similar to the famous Civilization series.
+    </p>
+  </background>
+  <description>
+    <p>
+    Luigi Auriemma discovered that Freeciv could be tricked into the
+    allocation of enormous chunks of memory when trying to uncompress
+    malformed data packages, possibly leading to an out of memory condition
+    which causes Freeciv to crash or freeze.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit this issue to cause a Denial of
+    Service by sending specially crafted data packages to the Freeciv game
+    server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Play solo games or restrict your multiplayer games to trusted
+    parties.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Freeciv users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-strategy/freeciv-2.0.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0047">CVE-2006-0047</uri>
+    <uri link="http://aluigi.altervista.org/adv/freecivdos-adv.txt">Original advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 12 Mar 2006 20:13:19 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 12 Mar 2006 20:29:12 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-12.xml b/xml/htdocs/security/en/glsa/glsa-200603-12.xml
new file mode 100644
index 00000000..4dcec005
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-12.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-12">
+  <title>zoo: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow in zoo may be exploited to execute arbitrary when
+    creating archives of specially crafted directories and files.
+  </synopsis>
+  <product type="ebuild">zoo</product>
+  <announced>March 16, 2006</announced>
+  <revised>March 16, 2006: 01</revised>
+  <bug>125622</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-arch/zoo" auto="yes" arch="*">
+      <unaffected range="ge">2.10-r2</unaffected>
+      <vulnerable range="lt">2.10-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    zoo is a file archiving utility for maintaining collections of
+    files, written by Rahul Dhesi.
+    </p>
+  </background>
+  <description>
+    <p>
+    zoo is vulnerable to a new buffer overflow due to insecure use of
+    the strcpy() function when trying to create an archive from certain
+    directories or filenames.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit this issue by enticing a user to create
+    a zoo archive of specially crafted directories and filenames, possibly
+    leading to the execution of arbitrary code with the rights of the user
+    running zoo.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All zoo users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/zoo-2.10-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=183426">RedHat Bug #183426</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1269">CVE-2006-1269</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 11 Mar 2006 11:35:08 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 12 Mar 2006 16:19:21 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 12 Mar 2006 17:50:06 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-13.xml b/xml/htdocs/security/en/glsa/glsa-200603-13.xml
new file mode 100644
index 00000000..8cf1dee9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-13.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-13">
+  <title>PEAR-Auth: Potential authentication bypass</title>
+  <synopsis>
+    PEAR-Auth did not correctly verify data passed to the DB and LDAP
+    containers, thus allowing to inject false credentials to bypass the
+    authentication.
+  </synopsis>
+  <product type="ebuild">pear-auth</product>
+  <announced>March 17, 2006</announced>
+  <revised>March 17, 2006: 01</revised>
+  <bug>123832</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-php/PEAR-Auth" auto="yes" arch="*">
+      <unaffected range="ge">1.2.4</unaffected>
+      <vulnerable range="lt">1.2.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PEAR-Auth is a PEAR package that provides methods to create a PHP
+    based authentication system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Matt Van Gundy discovered that PEAR-Auth did not correctly
+    validate data passed to the DB and LDAP containers.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could possibly exploit this vulnerability to
+    bypass the authentication mechanism by injecting specially crafted
+    input to the underlying storage containers.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PEAR-Auth users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-php/PEAR-Auth-1.2.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0868">CVE-2006-0868</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 14 Mar 2006 21:29:18 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 14 Mar 2006 21:29:45 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 14 Mar 2006 23:22:04 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-14.xml b/xml/htdocs/security/en/glsa/glsa-200603-14.xml
new file mode 100644
index 00000000..ec844637
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-14.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-14">
+  <title>Heimdal: rshd privilege escalation</title>
+  <synopsis>
+    An error in the rshd daemon of Heimdal could allow authenticated users to
+    elevate privileges.
+  </synopsis>
+  <product type="ebuild">heimdal</product>
+  <announced>March 17, 2006</announced>
+  <revised>March 17, 2006: 01</revised>
+  <bug>121839</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/heimdal" auto="yes" arch="*">
+      <unaffected range="ge">0.7.2</unaffected>
+      <vulnerable range="lt">0.7.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Heimdal is a free implementation of Kerberos 5.
+    </p>
+  </background>
+  <description>
+    <p>
+    An unspecified privilege escalation vulnerability in the rshd
+    server of Heimdal has been reported.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Authenticated users could exploit the vulnerability to escalate
+    privileges or to change the ownership and content of arbitrary files.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Heimdal users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-crypt/heimdal-0.7.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0582">CVE-2006-0582</uri>
+    <uri link="http://www.pdc.kth.se/heimdal/advisory/2006-02-06/">Heimdal Advisory 2006-02-06</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 14 Mar 2006 18:02:33 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 16 Mar 2006 09:34:15 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 17 Mar 2006 10:14:03 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-15.xml b/xml/htdocs/security/en/glsa/glsa-200603-15.xml
new file mode 100644
index 00000000..787ffed2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-15.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-15">
+  <title>Crypt::CBC: Insecure initialization vector</title>
+  <synopsis>
+    Crypt::CBC uses an insecure initialization vector, potentially resulting in
+    a weaker encryption.
+  </synopsis>
+  <product type="ebuild">crypt-cbc</product>
+  <announced>March 17, 2006</announced>
+  <revised>March 17, 2006: 01</revised>
+  <bug>126048</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-perl/crypt-cbc" auto="yes" arch="*">
+      <unaffected range="ge">2.17</unaffected>
+      <vulnerable range="lt">2.17</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Crypt::CBC is a Perl module to encrypt data using cipher block
+    chaining (CBC).
+    </p>
+  </background>
+  <description>
+    <p>
+    Lincoln Stein discovered that Crypt::CBC fails to handle 16 bytes
+    long initializiation vectors correctly when running in the RandomIV
+    mode, resulting in a weaker encryption because the second part of every
+    block will always be encrypted with zeros if the blocksize of the
+    cipher is greater than 8 bytes.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    An attacker could exploit weak ciphertext produced by Crypt::CBC
+    to bypass certain security restrictions or to gain access to sensitive
+    data.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Crypt::CBC users should upgrade to the latest available
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-perl/crypt-cbc-2.17&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0898">CVE-2006-0898</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 14 Mar 2006 21:26:26 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 14 Mar 2006 21:26:50 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 14 Mar 2006 23:04:56 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-16.xml b/xml/htdocs/security/en/glsa/glsa-200603-16.xml
new file mode 100644
index 00000000..fe9e3edb
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-16.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-16">
+  <title>Metamail: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow in Metamail could possibly be exploited to execute
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">metamail</product>
+  <announced>March 17, 2006</announced>
+  <revised>March 17, 2006: 01</revised>
+  <bug>126052</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/metamail" auto="yes" arch="*">
+      <unaffected range="ge">2.7.45.3-r1</unaffected>
+      <vulnerable range="lt">2.7.45.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Metamail is a program that decodes MIME encoded mail.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ulf Harnhammar discovered a buffer overflow in Metamail when
+    processing mime boundraries.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By sending a specially crafted email, attackers could potentially
+    exploit this vulnerability to crash Metamail or to execute arbitrary
+    code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Metamail users should update to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/metamail-2.7.45.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0709">CVE-2006-0709</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 14 Mar 2006 21:16:22 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 16 Mar 2006 09:48:07 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 16 Mar 2006 21:04:49 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-17.xml b/xml/htdocs/security/en/glsa/glsa-200603-17.xml
new file mode 100644
index 00000000..522c4196
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-17.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-17">
+  <title>PeerCast: Buffer overflow</title>
+  <synopsis>
+    PeerCast is vulnerable to a buffer overflow that may lead to the execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">peercast</product>
+  <announced>March 21, 2006</announced>
+  <revised>March 21, 2006: 01</revised>
+  <bug>123432</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/peercast" auto="yes" arch="*">
+      <unaffected range="ge">0.1217</unaffected>
+      <vulnerable range="lt">0.1217</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PeerCast is a Peer to Peer broadcasting technology for listening
+    to radio and watching video on the Internet.
+    </p>
+  </background>
+  <description>
+    <p>
+    INFIGO discovered a problem in the URL handling code. Buffers that
+    are allocated on the stack can be overflowed inside of nextCGIarg()
+    function.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By sending a specially crafted request to the HTTP server, a
+    remote attacker can cause a stack overflow, resulting in the execution
+    of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PeerCast users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/peercast-0.1217&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2006-1148">CVE-2006-1148</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 11 Mar 2006 11:34:53 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 12 Mar 2006 17:55:02 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 18 Mar 2006 02:16:00 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-18.xml b/xml/htdocs/security/en/glsa/glsa-200603-18.xml
new file mode 100644
index 00000000..2ac4622e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-18.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-18">
+  <title>Pngcrush: Buffer overflow</title>
+  <synopsis>
+    Pngcrush is vulnerable to a buffer overflow which could potentially lead to
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">pngcrush</product>
+  <announced>March 21, 2006</announced>
+  <revised>March 21, 2006: 01</revised>
+  <bug>123286</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/pngcrush" auto="yes" arch="*">
+      <unaffected range="ge">1.6.2</unaffected>
+      <vulnerable range="lt">1.6.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Pngcrush is an optimizer for PNG files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Carsten Lohrke of Gentoo Linux reported that Pngcrush contains a
+    vulnerable version of zlib (GLSA 200507-19).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By creating a specially crafted data stream, attackers can
+    overwrite data structures for applications that use Pngcrush, resulting
+    in a Denial of Service and potentially arbitrary code execution.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Pngcrush users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/pngcrush-1.6.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200507-19.xml">GLSA 200507-19</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1849">CVE-2005-1849</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 22 Feb 2006 18:06:23 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 03 Mar 2006 17:03:15 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 18 Mar 2006 02:00:13 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-19.xml b/xml/htdocs/security/en/glsa/glsa-200603-19.xml
new file mode 100644
index 00000000..886602b4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-19.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-19">
+  <title>cURL/libcurl: Buffer overflow in the handling of TFTP URLs</title>
+  <synopsis>
+    libcurl is affected by a buffer overflow in the handling of URLs for the
+    TFTP protocol, which could be exploited to compromise a user's system.
+  </synopsis>
+  <product type="ebuild">curl</product>
+  <announced>March 21, 2006</announced>
+  <revised>March 21, 2006: 01</revised>
+  <bug>125766</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/curl" auto="yes" arch="*">
+      <unaffected range="rge">7.15.1-r1</unaffected>
+      <unaffected range="ge">7.15.3</unaffected>
+      <unaffected range="le">7.14.1</unaffected>
+      <vulnerable range="lt">7.15.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    cURL is a command line tool for transferring files with URL
+    syntax, supporting numerous protocols. libcurl is the corresponding
+    client-side library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ulf Harnhammar reported a possible buffer overflow in the handling
+    of TFTP URLs in libcurl due to the lack of boundary checks.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit this vulnerability to compromise a
+    user's system by enticing the user to request a malicious URL with
+    cURL/libcurl or to use a HTTP server redirecting to a malicious TFTP
+    URL.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All cURL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/curl-7.15.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://curl.haxx.se/docs/adv_20060320.html">Project cURL Security Advisory, March 20th 2006</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1061">CVE-2006-1061</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 20 Mar 2006 17:27:58 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 20 Mar 2006 17:28:46 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 20 Mar 2006 22:09:32 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-20.xml b/xml/htdocs/security/en/glsa/glsa-200603-20.xml
new file mode 100644
index 00000000..801f1fb6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-20.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-20">
+  <title>Macromedia Flash Player: Arbitrary code execution</title>
+  <synopsis>
+    Multiple vulnerabilities have been identified that allows arbitrary code execution on
+    a user's system via the handling of malicious SWF files.
+  </synopsis>
+  <product type="ebuild">Flash</product>
+  <announced>March 21, 2006</announced>
+  <revised>May 28, 2009: 02</revised>
+  <bug>102777</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-plugins/adobe-flash" auto="yes" arch="*">
+      <unaffected range="ge">7.0.63</unaffected>
+      <vulnerable range="lt">7.0.63</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Macromedia Flash Player is a renderer for the popular SWF
+    filetype which is commonly used to provide interactive websites,
+    digital experiences and mobile content.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Macromedia Flash Player contains multiple unspecified
+    vulnerabilities.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker serving a maliciously crafted SWF file could entice a
+    user to view the SWF file and execute arbitrary code on the user's
+    machine.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Macromedia Flash Player users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-plugins/adobe-flash-7.0.63&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0024">CVE-2006-0024</uri>
+    <uri link="http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html">Macromedia Announcement</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 21 Mar 2006 19:42:52 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 21 Mar 2006 19:43:49 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-21.xml b/xml/htdocs/security/en/glsa/glsa-200603-21.xml
new file mode 100644
index 00000000..b8631a77
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-21.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-21">
+  <title>Sendmail: Race condition in the handling of asynchronous signals</title>
+  <synopsis>
+    Sendmail is vulnerable to a race condition which could lead to the
+    execution of arbitrary code with sendmail privileges.
+  </synopsis>
+  <product type="ebuild">sendmail</product>
+  <announced>March 22, 2006</announced>
+  <revised>March 22, 2006: 01</revised>
+  <bug>125623</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-mta/sendmail" auto="yes" arch="*">
+      <unaffected range="ge">8.13.6</unaffected>
+      <vulnerable range="lt">8.13.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Sendmail is a popular mail transfer agent (MTA).
+    </p>
+  </background>
+  <description>
+    <p>
+    ISS discovered that Sendmail is vulnerable to a race condition in
+    the handling of asynchronous signals.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could exploit this via certain crafted timing
+    conditions.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Sendmail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-mta/sendmail-8.13.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0058">CVE-2006-0058</uri>
+    <uri link="http://www.sendmail.com/company/advisory/index.shtml">Sendmail Inc. advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 21 Mar 2006 20:21:08 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 22 Mar 2006 19:48:59 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-22.xml b/xml/htdocs/security/en/glsa/glsa-200603-22.xml
new file mode 100644
index 00000000..47eb123b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-22.xml
@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-22">
+  <title>PHP: Format string and XSS vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in PHP allow remote attackers to inject arbitrary
+    HTTP headers, perform cross site scripting or in some cases execute
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">php</product>
+  <announced>March 22, 2006</announced>
+  <revised>March 22, 2006: 01</revised>
+  <bug>125878</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/php" auto="yes" arch="*">
+      <unaffected range="ge">5.1.2</unaffected>
+      <vulnerable range="lt">4.4.2</vulnerable>
+      <vulnerable range="rge">5.1.1</vulnerable>
+      <vulnerable range="rge">5.0.5</vulnerable>
+      <vulnerable range="rge">5.0.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHP is a general-purpose scripting language widely used to develop
+    web-based applications. It can run on a web server with the mod_php
+    module or the CGI version and also stand-alone in a CLI.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Esser of the Hardened PHP project has reported a few
+    vulnerabilities found in PHP:
+    </p>
+    <ul>
+    <li>Input passed to the session
+    ID in the session extension isn't properly sanitised before being
+    returned to the user via a "Set-Cookie" HTTP header, which can contain
+    arbitrary injected data.</li>
+    <li>A format string error while
+    processing error messages using the mysqli extension in version 5.1 and
+    above.</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a specially crafted request, a remote attacker can
+    exploit this vulnerability to inject arbitrary HTTP headers, which will
+    be included in the response sent to the user. The format string
+    vulnerability may be exploited to execute arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHP 5.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/php-5.1.2&quot;</code>
+    <p>
+    All PHP 4.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/php-4.4.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0207">CVE-2006-0207</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0208">CVE-2006-0208</uri>
+    <uri link="http://www.hardened-php.net/advisory_022006.112.html">Hardened-PHP Advisory 01/2006</uri>
+    <uri link="http://www.hardened-php.net/advisory_012006.113.html">Hardened-PHP Advisory 02/2006</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 14 Mar 2006 21:28:04 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 14 Mar 2006 21:28:11 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 18 Mar 2006 03:27:49 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-23.xml b/xml/htdocs/security/en/glsa/glsa-200603-23.xml
new file mode 100644
index 00000000..34f49750
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-23.xml
@@ -0,0 +1,95 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-23">
+  <title>NetHack, Slash'EM, Falcon's Eye: Local privilege escalation</title>
+  <synopsis>
+    NetHack, Slash'EM and Falcon's Eye are vulnerable to local privilege
+    escalation vulnerabilities that could potentially allow the execution of
+    arbitrary code as other users.
+  </synopsis>
+  <product type="ebuild">nethack slashem falconseye</product>
+  <announced>March 23, 2006</announced>
+  <revised>March 30, 2006: 01</revised>
+  <bug>125902</bug>
+  <bug>122376</bug>
+  <bug>127167</bug>
+  <bug>127319</bug>
+  <access>local</access>
+  <affected>
+    <package name="games-roguelike/nethack" auto="yes" arch="*">
+      <vulnerable range="le">3.4.3-r1</vulnerable>
+    </package>
+    <package name="games-roguelike/falconseye" auto="yes" arch="*">
+      <vulnerable range="le">1.9.4a</vulnerable>
+    </package>
+    <package name="games-roguelike/slashem" auto="yes" arch="*">
+      <vulnerable range="le">0.0.760</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    NetHack is the classic single player dungeon exploration game. Slash'EM
+    and Falcon's Eye are NetHack variants.
+    </p>
+  </background>
+  <description>
+    <p>
+    NetHack, Slash'EM and Falcon's Eye have been found to be incompatible
+    with the system used for managing games on Gentoo Linux. As a result,
+    they cannot be played securely on systems with multiple users.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local user who is a member of group "games" may be able to modify the
+    state data used by NetHack, Slash'EM or Falcon's Eye to trigger the
+    execution of arbitrary code with the privileges of other players.
+    Additionally, the games may create save game files in a manner not
+    suitable for use on Gentoo Linux, potentially allowing a local user to
+    create or overwrite files with the permissions of other players.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not add untrusted users to the "games" group.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    NetHack has been masked in Portage pending the resolution of these
+    issues. Vulnerable NetHack users are advised to uninstall the package
+    until further notice.
+    </p>
+    <code>
+    # emerge --ask --verbose --unmerge &quot;games-roguelike/nethack&quot;</code>
+    <p>
+    Slash'EM has been masked in Portage pending the resolution of these
+    issues. Vulnerable Slash'EM users are advised to uninstall the package
+    until further notice.
+    </p>
+    <code>
+    # emerge --ask --verbose --unmerge &quot;games-roguelike/slashem&quot;</code>
+    <p>
+    Falcon's Eye has been masked in Portage pending the resolution of these
+    issues. Vulnerable Falcon's Eye users are advised to uninstall the
+    package until further notice.
+    </p>
+    <code>
+    # emerge --ask --verbose --unmerge &quot;games-roguelike/falconseye&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1390">CVE-2006-1390</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 22 Mar 2006 22:13:28 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 22 Mar 2006 22:57:23 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 23 Mar 2006 22:05:55 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-24.xml b/xml/htdocs/security/en/glsa/glsa-200603-24.xml
new file mode 100644
index 00000000..3fe19bce
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-24.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-24">
+  <title>RealPlayer: Buffer overflow vulnerability</title>
+  <synopsis>
+    RealPlayer is vulnerable to a buffer overflow that could lead to remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">RealPlayer</product>
+  <announced>March 26, 2006</announced>
+  <revised>March 26, 2006: 01</revised>
+  <bug>127352</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/realplayer" auto="yes" arch="*">
+      <unaffected range="ge">10.0.7</unaffected>
+      <vulnerable range="lt">10.0.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    RealPlayer is a multimedia player capable of handling multiple
+    multimedia file formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    RealPlayer is vulnerable to a buffer overflow when processing
+    malicious SWF files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to open a specially crafted SWF file an
+    attacker could execute arbitrary code with the permissions of the user
+    running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All RealPlayer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/realplayer-10.0.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0323">CVE-2006-0323</uri>
+    <uri link="http://service.real.com/realplayer/security/03162006_player/en/">RealNetworks Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 23 Mar 2006 23:38:12 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 24 Mar 2006 13:36:18 +0000">
+    formula7
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 26 Mar 2006 17:28:15 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-25.xml b/xml/htdocs/security/en/glsa/glsa-200603-25.xml
new file mode 100644
index 00000000..7cb7cb65
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-25.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-25">
+  <title>OpenOffice.org: Heap overflow in included libcurl</title>
+  <synopsis>
+    OpenOffice.org contains a vulnerable version of libcurl that may cause a
+    heap overflow when parsing URLs.
+  </synopsis>
+  <product type="ebuild">openoffice openoffice-bin</product>
+  <announced>March 27, 2006</announced>
+  <revised>March 27, 2006: 01</revised>
+  <bug>126433</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/openoffice-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.0.2</unaffected>
+      <vulnerable range="lt">2.0.2</vulnerable>
+    </package>
+    <package name="app-office/openoffice" auto="yes" arch="*">
+      <unaffected range="ge">2.0.1-r1</unaffected>
+      <vulnerable range="lt">2.0.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenOffice.org is an office productivity suite, including word
+    processing, spreadsheet, presentation, data charting, formula editing
+    and file conversion facilities. libcurl, which is included in
+    OpenOffice.org, is a free and easy-to-use client-side library for
+    transferring files with URL syntaxes, supporting numerous protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    OpenOffice.org includes libcurl code. This libcurl code is
+    vulnerable to a heap overflow when it tries to parse a URL that exceeds
+    a 256-byte limit (GLSA 200512-09).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to call a specially crafted URL
+    with OpenOffice.org, potentially resulting in the execution of
+    arbitrary code with the rights of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenOffice.org binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-bin-2.0.2&quot;</code>
+    <p>
+    All OpenOffice.org users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-2.0.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4077">CVE-2005-4077</uri>
+    <uri link="http://www.hardened-php.net/advisory_242005.109.html">Hardened-PHP Advisory 24/2005</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200512-09.xml">GLSA 200512-09</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 17 Mar 2006 09:53:36 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 17 Mar 2006 18:15:26 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 18 Mar 2006 01:42:41 +0000">
+    adir
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200603-26.xml b/xml/htdocs/security/en/glsa/glsa-200603-26.xml
new file mode 100644
index 00000000..adc9a207
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200603-26.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200603-26">
+  <title>bsd-games: Local privilege escalation in tetris-bsd</title>
+  <synopsis>
+    tetris-bsd is prone to local privilege escalation vulnerabilities.
+  </synopsis>
+  <product type="ebuild">bsd-games</product>
+  <announced>March 29, 2006</announced>
+  <revised>May 22, 2006: 02</revised>
+  <bug>122399</bug>
+  <access>local</access>
+  <affected>
+    <package name="games-misc/bsd-games" auto="yes" arch="*">
+      <unaffected range="ge">2.17-r1</unaffected>
+      <vulnerable range="lt">2.17-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    bsd-games is a collection of NetBSD games ported to Linux.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Audit Team discovered that
+    the checkscores() function in scores.c reads in the data from the
+    /var/games/tetris-bsd.scores file without validation, rendering it
+    vulnerable to buffer overflows and incompatible with the system used
+    for managing games on Gentoo Linux. As a result, it cannot be played
+    securely on systems with multiple users. Please note that this is
+    probably a Gentoo-specific issue.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local user who is a member of group "games" may be able to modify the
+    tetris-bsd.scores file to trigger the execution of arbitrary code with
+    the privileges of other players.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not add untrusted users to the "games" group.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All bsd-games users are advised to update to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-misc/bsd-games-2.17-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1539">CVE-2006-1539</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 21 Mar 2006 19:50:34 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 27 Mar 2006 15:36:51 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 28 Mar 2006 18:00:28 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200604-01.xml b/xml/htdocs/security/en/glsa/glsa-200604-01.xml
new file mode 100644
index 00000000..9fb93825
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200604-01.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200604-01">
+  <title>MediaWiki: Cross-site scripting vulnerability</title>
+  <synopsis>
+    MediaWiki is vulnerable to a cross-site scripting attack that could allow
+    arbitrary JavaScript code execution.
+  </synopsis>
+  <product type="ebuild">mediawiki</product>
+  <announced>April 04, 2006</announced>
+  <revised>April 04, 2006: 01</revised>
+  <bug>127971</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/mediawiki" auto="yes" arch="*">
+      <unaffected range="ge">1.4.15</unaffected>
+      <vulnerable range="lt">1.4.15</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MediaWiki is a collaborative editing software, used by big
+    projects like Wikipedia.
+    </p>
+  </background>
+  <description>
+    <p>
+    MediaWiki fails to decode certain encoded URLs correctly.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By supplying specially crafted links, a remote attacker could
+    exploit this vulnerability to inject malicious HTML or JavaScript code
+    that will be executed in a user's browser session in the context of the
+    vulnerable site.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MediaWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/mediawiki-1.4.15&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1498">CVE-2006-1498</uri>
+    <uri link="http://sourceforge.net/project/shownotes.php?release_id=404869">MediaWiki 1.4.15 Release Notes</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 02 Apr 2006 08:58:31 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 02 Apr 2006 08:58:55 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 02 Apr 2006 17:15:00 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200604-02.xml b/xml/htdocs/security/en/glsa/glsa-200604-02.xml
new file mode 100644
index 00000000..fc534628
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200604-02.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200604-02">
+  <title>Horde Application Framework: Remote code execution</title>
+  <synopsis>
+    The help viewer of the Horde Framework allows attackers to execute
+    arbitrary remote code.
+  </synopsis>
+  <product type="ebuild">horde</product>
+  <announced>April 04, 2006</announced>
+  <revised>April 04, 2006: 01</revised>
+  <bug>127889</bug>
+  <bug>126435</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/horde" auto="yes" arch="*">
+      <unaffected range="ge">3.1.1</unaffected>
+      <vulnerable range="lt">3.1.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Horde Application Framework is a general-purpose web
+    application framework written in PHP, providing classes for handling
+    preferences, compression, browser detection, connection tracking, MIME
+    and more.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jan Schneider of the Horde team discovered a vulnerability in the
+    help viewer of the Horde Application Framework that could allow remote
+    code execution (CVE-2006-1491). Paul Craig reported that
+    "services/go.php" fails to validate the passed URL parameter correctly
+    (CVE-2006-1260).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could exploit the vulnerability in the help viewer to
+    execute arbitrary code with the privileges of the web server user. By
+    embedding a NULL character in the URL parameter, an attacker could
+    exploit the input validation issue in go.php to read arbitrary files.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Horde Application Framework users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-3.1.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1260">CVE-2006-1260</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1491">CVE-2006-1491</uri>
+    <uri link="http://lists.horde.org/archives/announce/2006/000271.html">Horde Announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 31 Mar 2006 23:07:49 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 03 Apr 2006 09:02:34 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 04 Apr 2006 18:34:51 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200604-03.xml b/xml/htdocs/security/en/glsa/glsa-200604-03.xml
new file mode 100644
index 00000000..285859cf
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200604-03.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200604-03">
+  <title>FreeRADIUS: Authentication bypass in EAP-MSCHAPv2 module</title>
+  <synopsis>
+    The EAP-MSCHAPv2 module of FreeRADIUS is affected by a validation issue
+    which causes some authentication checks to be bypassed.
+  </synopsis>
+  <product type="ebuild">freeradius</product>
+  <announced>April 04, 2006</announced>
+  <revised>April 04, 2006: 01</revised>
+  <bug>127229</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dialup/freeradius" auto="yes" arch="*">
+      <unaffected range="ge">1.1.1</unaffected>
+      <unaffected range="lt">1.0.0</unaffected>
+      <vulnerable range="lt">1.1.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    FreeRADIUS is an open source RADIUS authentication server
+    implementation.
+    </p>
+  </background>
+  <description>
+    <p>
+    FreeRADIUS suffers from insufficient input validation in the
+    EAP-MSCHAPv2 state machine.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could cause the server to bypass authentication checks
+    by manipulating the EAP-MSCHAPv2 client state machine.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All FreeRADIUS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dialup/freeradius-1.1.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1354">CVE-2006-1354</uri>
+    <uri link="http://www.freeradius.org/security.html">FreeRADIUS Vulnerability Notifications</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 01 Apr 2006 10:41:34 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 01 Apr 2006 10:42:20 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 01 Apr 2006 23:30:58 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200604-04.xml b/xml/htdocs/security/en/glsa/glsa-200604-04.xml
new file mode 100644
index 00000000..97f3c4ad
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200604-04.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200604-04">
+  <title>Kaffeine: Buffer overflow</title>
+  <synopsis>
+    Kaffeine is vulnerable to a buffer overflow that could lead to the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">kaffeine</product>
+  <announced>April 05, 2006</announced>
+  <revised>April 05, 2006: 01</revised>
+  <bug>127326</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/kaffeine" auto="yes" arch="*">
+      <unaffected range="ge">0.7.1-r2</unaffected>
+      <vulnerable range="lt">0.7.1-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Kaffeine is a graphical front-end for the xine-lib multimedia
+    library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Kaffeine uses an unchecked buffer when fetching remote RAM
+    playlists via HTTP.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to play a specially-crafted
+    RAM playlist resulting in the execution of arbitrary code with the
+    permissions of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Kaffeine users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/kaffeine-0.7.1-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0051">CVE-2006-0051</uri>
+    <uri link="http://www.kde.org/info/security/advisory-20060404-1.txt">KDE Security Advisory: Kaffeine buffer overflow</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 04 Apr 2006 13:17:18 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 04 Apr 2006 19:29:42 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 05 Apr 2006 21:13:35 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200604-05.xml b/xml/htdocs/security/en/glsa/glsa-200604-05.xml
new file mode 100644
index 00000000..961bee44
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200604-05.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200604-05">
+  <title>Doomsday: Format string vulnerability</title>
+  <synopsis>
+    Format string vulnerabilities in Doomsday may lead to the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">doomsday</product>
+  <announced>April 06, 2006</announced>
+  <revised>June 15, 2006: 02</revised>
+  <bug>128690</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-fps/doomsday" auto="yes" arch="*">
+      <unaffected range="ge">1.9.0_beta4</unaffected>
+      <vulnerable range="le">1.9.0_beta4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Doomsday is a modern gaming engine for popular ID games like Doom,
+    Heretic and Hexen.
+    </p>
+  </background>
+  <description>
+    <p>
+    Luigi Auriemma discovered that Doomsday incorrectly implements
+    formatted printing.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit these vulnerabilities to execute
+    arbitrary code with the rights of the user running the Doomsday server
+    or client by sending specially crafted strings.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Doomsday users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-fps/doomsday-1.9.0_beta4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1618">CVE-2006-1618</uri>
+    <uri link="http://aluigi.altervista.org/adv/doomsdayfs-adv.txt">Original advisory by Luigi Auriemma</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 04 Apr 2006 04:57:40 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 04 Apr 2006 10:51:26 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 04 Apr 2006 12:10:41 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200604-06.xml b/xml/htdocs/security/en/glsa/glsa-200604-06.xml
new file mode 100644
index 00000000..892c19c8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200604-06.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200604-06">
+  <title>ClamAV: Multiple vulnerabilities</title>
+  <synopsis>
+    ClamAV contains multiple vulnerabilities that could lead to remote
+    execution of arbitrary code or cause an application crash.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>April 07, 2006</announced>
+  <revised>April 07, 2006: 01</revised>
+  <bug>128963</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.88.1</unaffected>
+      <vulnerable range="lt">0.88.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ClamAV is a GPL virus scanner.
+    </p>
+  </background>
+  <description>
+    <p>
+    ClamAV contains format string vulnerabilities in the logging code
+    (CVE-2006-1615). Furthermore Damian Put discovered an integer overflow
+    in ClamAV's PE header parser (CVE-2006-1614) and David Luyer discovered
+    that ClamAV can be tricked into performing an invalid memory access
+    (CVE-2006-1630).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By sending a malicious attachment to a mail server running ClamAV,
+    a remote attacker could cause a Denial of Service or the execution of
+    arbitrary code. Note that the overflow in the PE header parser is only
+    exploitable when the ArchiveMaxFileSize option is disabled.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.88.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1614">CVE-2006-1614</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1615">CVE-2006-1615</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1630">CVE-2006-1630</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 06 Apr 2006 18:09:01 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 07 Apr 2006 19:35:00 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200604-07.xml b/xml/htdocs/security/en/glsa/glsa-200604-07.xml
new file mode 100644
index 00000000..a0c0302c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200604-07.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200604-07">
+  <title>Cacti: Multiple vulnerabilities in included ADOdb</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in the ADOdb layer included
+    in Cacti, potentially resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Cacti</product>
+  <announced>April 14, 2006</announced>
+  <revised>April 14, 2006: 01</revised>
+  <bug>129284</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/cacti" auto="yes" arch="*">
+      <unaffected range="ge">0.8.6h_p20060108-r2</unaffected>
+      <vulnerable range="lt">0.8.6h_p20060108-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cacti is a complete web-based frontend to rrdtool. ADOdb is a
+    PHP-based database abstraction layer which is included in Cacti.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several vulnerabilities have been identified in the copy of ADOdb
+    included in Cacti. Andreas Sandblad discovered a dynamic code
+    evaluation vulnerability (CVE-2006-0147) and a potential SQL injection
+    vulnerability (CVE-2006-0146). Andy Staudacher reported another SQL
+    injection vulnerability (CVE-2006-0410), and Gulftech Security
+    discovered multiple cross-site-scripting issues (CVE-2006-0806).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Remote attackers could trigger these vulnerabilities by sending
+    malicious queries to the Cacti web application, resulting in arbitrary
+    code execution, database compromise through arbitrary SQL execution,
+    and malicious HTML or JavaScript code injection.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cacti users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/cacti-0.8.6h_p20060108-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0146">CVE-2006-0146</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0147">CVE-2006-0147</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0410">CVE-2006-0410</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0806">CVE-2006-0806</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 13 Apr 2006 06:13:49 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 13 Apr 2006 16:58:52 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 13 Apr 2006 20:36:27 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200604-08.xml b/xml/htdocs/security/en/glsa/glsa-200604-08.xml
new file mode 100644
index 00000000..03eb99bc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200604-08.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200604-08">
+  <title>libapreq2: Denial of Service vulnerability</title>
+  <synopsis>
+    A vulnerability has been reported in libapreq2 which could lead to a Denial
+    of Service.
+  </synopsis>
+  <product type="ebuild">libapreq2</product>
+  <announced>April 17, 2006</announced>
+  <revised>April 17, 2006: 01</revised>
+  <bug>128610</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apache/libapreq2" auto="yes" arch="*">
+      <unaffected range="ge">2.07</unaffected>
+      <vulnerable range="lt">2.07</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libapreq is a shared library with associated modules for
+    manipulating client request data via the Apache API.
+    </p>
+  </background>
+  <description>
+    <p>
+    A vulnerability has been reported in the apreq_parse_headers() and
+    apreq_parse_urlencoded() functions of Apache2::Request.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could possibly exploit the vulnerability to
+    cause a Denial of Service by CPU consumption.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libapreq2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apache/libapreq2-2.07&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0042">CVE-2006-0042</uri>
+    <uri link="http://svn.apache.org/viewcvs.cgi/httpd/apreq/tags/v2_07/CHANGES?rev=376998&amp;view=markup">libapreq2 Changes</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 09 Apr 2006 19:33:11 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 11 Apr 2006 17:20:17 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 13 Apr 2006 19:11:49 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200604-09.xml b/xml/htdocs/security/en/glsa/glsa-200604-09.xml
new file mode 100644
index 00000000..c08076c3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200604-09.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200604-09">
+  <title>Cyrus-SASL: DIGEST-MD5 Pre-Authentication Denial of Service</title>
+  <synopsis>
+    Cyrus-SASL contains a vulnerability in the DIGEST-MD5 process that could
+    lead to a Denial of Service.
+  </synopsis>
+  <product type="ebuild">cyrus-sasl</product>
+  <announced>April 21, 2006</announced>
+  <revised>April 21, 2006: 01</revised>
+  <bug>129523</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/cyrus-sasl" auto="yes" arch="*">
+      <unaffected range="ge">2.1.21-r2</unaffected>
+      <vulnerable range="lt">2.1.21-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cyrus-SASL is an implementation of the Simple Authentication and
+    Security Layer.
+    </p>
+  </background>
+  <description>
+    <p>
+    Cyrus-SASL contains an unspecified vulnerability in the DIGEST-MD5
+    process that could lead to a Denial of Service.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could possibly exploit this vulnerability by sending
+    specially crafted data stream to the Cyrus-SASL server, resulting in a
+    Denial of Service even if the attacker is not able to authenticate.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cyrus-SASL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/cyrus-sasl-2.1.21-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1721">CVE-2006-1721</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 15 Apr 2006 12:54:10 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 17 Apr 2006 16:43:15 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 20 Apr 2006 16:06:22 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200604-10.xml b/xml/htdocs/security/en/glsa/glsa-200604-10.xml
new file mode 100644
index 00000000..3c625d19
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200604-10.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200604-10">
+  <title>zgv, xzgv: Heap overflow</title>
+  <synopsis>
+    xzgv and zgv attempt to decode JPEG images within the CMYK/YCCK colour
+    space incorrectly, potentially resulting in the execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">xzgv</product>
+  <announced>April 21, 2006</announced>
+  <revised>June 10, 2006: 02</revised>
+  <bug>127008</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/xzgv" auto="yes" arch="*">
+      <unaffected range="ge">0.8-r2</unaffected>
+      <vulnerable range="lt">0.8-r2</vulnerable>
+    </package>
+    <package name="media-gfx/zgv" auto="yes" arch="*">
+      <unaffected range="ge">5.9</unaffected>
+      <vulnerable range="lt">5.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xzgv and zgv are picture viewing utilities with a thumbnail based file
+    selector.
+    </p>
+  </background>
+  <description>
+    <p>
+    Andrea Barisani of Gentoo Linux discovered xzgv and zgv allocate
+    insufficient memory when rendering images with more than 3 output
+    components, such as images using the YCCK or CMYK colour space. When
+    xzgv or zgv attempt to render the image, data from the image overruns a
+    heap allocated buffer.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker may be able to construct a malicious image that executes
+    arbitrary code with the permissions of the xzgv or zgv user when
+    attempting to render the image.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xzgv users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/xzgv-0.8-r2&quot;</code>
+    <p>
+    All zgv users should also upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/zgv-5.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1060">CVE-2006-1060</uri>
+    <uri link="http://www.svgalib.org/rus/zgv/">homepage plus Changelog</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 07 Apr 2006 14:45:12 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 14 Apr 2006 20:39:46 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 20 Apr 2006 16:13:24 +0000">
+    taviso
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200604-11.xml b/xml/htdocs/security/en/glsa/glsa-200604-11.xml
new file mode 100644
index 00000000..1214df53
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200604-11.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200604-11">
+  <title>Crossfire server: Denial of Service and potential arbitrary code execution</title>
+  <synopsis>
+    The Crossfire game server is vulnerable to a Denial of Service and
+    potentially to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Crossfire</product>
+  <announced>April 22, 2006</announced>
+  <revised>April 22, 2006: 01</revised>
+  <bug>126169</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-server/crossfire-server" auto="yes" arch="*">
+      <unaffected range="ge">1.9.0</unaffected>
+      <vulnerable range="lt">1.9.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Crossfire is a cooperative multiplayer graphical adventure and
+    role-playing game. The Crossfire game server allows various compatible
+    clients to connect to participate in a cooperative game.
+    </p>
+  </background>
+  <description>
+    <p>
+    Luigi Auriemma discovered a vulnerability in the Crossfire game
+    server, in the handling of the "oldsocketmode" option when processing
+    overly large requests.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker can set up a malicious Crossfire client that would
+    send a large request in "oldsocketmode", resulting in a Denial of
+    Service on the Crossfire server and potentially in the execution of
+    arbitrary code on the server with the rights of the game server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Crossfire server users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-server/crossfire-server-1.9.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1010">CVE-2006-1010</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 21 Apr 2006 16:56:02 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 21 Apr 2006 16:56:22 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 22 Apr 2006 08:20:53 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200604-12.xml b/xml/htdocs/security/en/glsa/glsa-200604-12.xml
new file mode 100644
index 00000000..de7ec528
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200604-12.xml
@@ -0,0 +1,100 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200604-12">
+  <title>Mozilla Firefox: Multiple vulnerabilities</title>
+  <synopsis>
+    Several vulnerabilities in Mozilla Firefox allow attacks ranging from
+    execution of script code with elevated privileges to information leaks.
+  </synopsis>
+  <product type="ebuild">mozilla-firefox</product>
+  <announced>April 23, 2006</announced>
+  <revised>April 23, 2006: 01</revised>
+  <bug>129924</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">1.0.8</unaffected>
+      <vulnerable range="lt">1.0.8</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.0.8</unaffected>
+      <vulnerable range="lt">1.0.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Firefox is the next-generation web browser from the
+    Mozilla project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several vulnerabilities were found in Mozilla Firefox. Versions
+    1.0.8 and 1.5.0.2 were released to fix them.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft malicious web pages that would
+    leverage these issues to inject and execute arbitrary script code with
+    elevated privileges, steal local files, cookies or other information
+    from web pages, and spoof content. Some of these vulnerabilities might
+    even be exploited to execute arbitrary code with the rights of the
+    browser user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds for all the issues at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-1.0.8&quot;</code>
+    <p>
+    All Mozilla Firefox binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-1.0.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4134">CVE-2005-4134</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0292">CVE-2006-0292</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0296">CVE-2006-0296</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0748">CVE-2006-0748</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0749">CVE-2006-0749</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1727">CVE-2006-1727</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1728">CVE-2006-1728</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1729">CVE-2006-1729</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1730">CVE-2006-1730</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1731">CVE-2006-1731</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1732">CVE-2006-1732</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1733">CVE-2006-1733</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1734">CVE-2006-1734</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1735">CVE-2006-1735</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1736">CVE-2006-1736</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1737">CVE-2006-1737</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1738">CVE-2006-1738</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1739">CVE-2006-1739</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1740">CVE-2006-1740</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1741">CVE-2006-1741</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1742">CVE-2006-1742</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1790">CVE-2006-1790</uri>
+    <uri link="http://www.mozilla.org/projects/security/known-vulnerabilities.html#Firefox">Mozilla Foundation Security Advisories</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 22 Apr 2006 20:40:23 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 22 Apr 2006 20:48:17 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200604-13.xml b/xml/htdocs/security/en/glsa/glsa-200604-13.xml
new file mode 100644
index 00000000..2c152ff4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200604-13.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200604-13">
+  <title>fbida: Insecure temporary file creation</title>
+  <synopsis>
+    fbida is vulnerable to linking attacks, potentially allowing a local user
+    to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">fbida</product>
+  <announced>April 23, 2006</announced>
+  <revised>April 23, 2006: 01</revised>
+  <bug>129470</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-gfx/fbida" auto="yes" arch="*">
+      <unaffected range="ge">2.03-r3</unaffected>
+      <vulnerable range="lt">2.03-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    fbida is a collection of image viewers and editors for the
+    framebuffer console and X11.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jan Braun has discovered that the "fbgs" script provided by fbida
+    insecurely creates temporary files in the "/var/tmp" directory.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create links in the temporary file
+    directory, pointing to a valid file somewhere on the filesystem. When
+    an affected script is called, this could result in the file being
+    overwritten with the rights of the user running the script.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All fbida users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/fbida-2.03-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1695">CVE-2006-1695</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 21 Apr 2006 15:53:11 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 21 Apr 2006 16:54:39 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 22 Apr 2006 21:26:19 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200604-14.xml b/xml/htdocs/security/en/glsa/glsa-200604-14.xml
new file mode 100644
index 00000000..31f0099e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200604-14.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200604-14">
+  <title>Dia: Arbitrary code execution through XFig import</title>
+  <synopsis>
+    Buffer overflows in Dia's XFig import could allow remote attackers to
+    execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">dia</product>
+  <announced>April 23, 2006</announced>
+  <revised>April 23, 2006: 01</revised>
+  <bug>128107</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/dia" auto="yes" arch="*">
+      <unaffected range="ge">0.94-r5</unaffected>
+      <vulnerable range="lt">0.94-r5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Dia is a GTK+ based diagram creation program.
+    </p>
+  </background>
+  <description>
+    <p>
+    infamous41md discovered multiple buffer overflows in Dia's XFig
+    file import plugin.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to import a specially crafted XFig file into
+    Dia, an attacker could exploit this issue to execute arbitrary code
+    with the rights of the user running Dia.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Dia users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/dia-0.94-r5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1550">CVE-2006-1550</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 22 Apr 2006 17:58:09 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 22 Apr 2006 17:58:17 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 22 Apr 2006 20:01:59 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200604-15.xml b/xml/htdocs/security/en/glsa/glsa-200604-15.xml
new file mode 100644
index 00000000..a936aa35
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200604-15.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200604-15">
+  <title>xine-ui: Format string vulnerabilities</title>
+  <synopsis>
+    Format string vulnerabilities in xine-ui may lead to the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">xine-ui</product>
+  <announced>April 26, 2006</announced>
+  <revised>April 26, 2006: 01</revised>
+  <bug>130801</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/xine-ui" auto="yes" arch="*">
+      <unaffected range="ge">0.99.4-r5</unaffected>
+      <vulnerable range="lt">0.99.4-r5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xine-ui is a skin-based user interface for xine. xine is a free
+    multimedia player. It plays CDs, DVDs, and VCDs, and can also decode
+    other common multimedia formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ludwig Nussel discovered that xine-ui incorrectly implements
+    formatted printing.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By constructing a malicious playlist file, a remote attacker could
+    exploit these vulnerabilities to execute arbitrary code with the rights
+    of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xine-ui users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/xine-ui-0.99.4-r5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1905">CVE-2006-1905</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 22 Apr 2006 18:05:30 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 23 Apr 2006 00:24:14 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 25 Apr 2006 05:57:00 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200604-16.xml b/xml/htdocs/security/en/glsa/glsa-200604-16.xml
new file mode 100644
index 00000000..3a539e48
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200604-16.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200604-16">
+  <title>xine-lib: Buffer overflow vulnerability</title>
+  <synopsis>
+    xine-lib contains a buffer overflow vulnerability which may lead to the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">xine-lib</product>
+  <announced>April 26, 2006</announced>
+  <revised>April 26, 2006: 01</revised>
+  <bug>128838</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/xine-lib" auto="yes" arch="*">
+      <unaffected range="ge">1.1.2_pre20060328-r1</unaffected>
+      <vulnerable range="lt">1.1.2_pre20060328-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xine-lib is the xine core engine. xine is a free multimedia
+    player. It plays CDs, DVDs, and VCDs, and can also decode other common
+    multimedia formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Federico L. Bossi Bonin discovered that when handling MPEG streams
+    xine-lib fails to make a proper boundary check of the input data
+    supplied by the user before copying it to an insufficiently sized
+    memory buffer.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to play a specially-crafted
+    MPEG file, resulting in the execution of arbitrary code with the
+    permissions of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xine-lib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/xine-lib-1.1.2_pre20060328-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1664">CVE-2006-1664</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 21 Apr 2006 20:35:23 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 23 Apr 2006 00:46:13 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 24 Apr 2006 16:31:50 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200604-17.xml b/xml/htdocs/security/en/glsa/glsa-200604-17.xml
new file mode 100644
index 00000000..9d2c7ea7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200604-17.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200604-17">
+  <title>Ethereal: Multiple vulnerabilities in protocol dissectors</title>
+  <synopsis>
+    Ethereal is vulnerable to numerous vulnerabilities, potentially resulting
+    in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Ethereal</product>
+  <announced>April 27, 2006</announced>
+  <revised>April 27, 2006: 01</revised>
+  <bug>130505</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/ethereal" auto="yes" arch="*">
+      <unaffected range="ge">0.99.0</unaffected>
+      <vulnerable range="lt">0.99.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ethereal is a feature-rich network protocol analyzer.
+    </p>
+  </background>
+  <description>
+    <p>
+    Coverity discovered numerous vulnerabilities in versions of
+    Ethereal prior to 0.99.0, including:
+    </p>
+    <ul>
+    <li>
+    buffer overflows in the ALCAP (CVE-2006-1934), COPS (CVE-2006-1935)
+    and telnet (CVE-2006-1936) dissectors.</li>
+    <li>buffer overflows
+    in the NetXray/Windows Sniffer and Network Instruments file code
+    (CVE-2006-1934).</li>
+    </ul>
+    <p>
+    For further details please consult the
+    references below.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker might be able to exploit these vulnerabilities to crash
+    Ethereal or execute arbitrary code with the permissions of the user
+    running Ethereal, which could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ethereal users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/ethereal-0.99.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1932">CVE-2006-1932</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1933">CVE-2006-1933</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1934">CVE-2006-1934</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1935">CVE-2006-1935</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1936">CVE-2006-1936</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1937">CVE-2006-1937</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1938">CVE-2006-1938</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1939">CVE-2006-1939</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1940">CVE-2006-1940</uri>
+    <uri link="http://www.ethereal.com/appnotes/enpa-sa-00023.html">Ethereal enpa-sa-00023</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 25 Apr 2006 11:35:49 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 27 Apr 2006 05:10:07 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200604-18.xml b/xml/htdocs/security/en/glsa/glsa-200604-18.xml
new file mode 100644
index 00000000..b5bc444b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200604-18.xml
@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200604-18">
+  <title>Mozilla Suite: Multiple vulnerabilities</title>
+  <synopsis>
+    Several vulnerabilities in Mozilla Suite allow attacks ranging from script
+    execution with elevated privileges to information leaks.
+  </synopsis>
+  <product type="ebuild">mozilla</product>
+  <announced>April 28, 2006</announced>
+  <revised>April 28, 2006: 01</revised>
+  <bug>130887</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla" auto="yes" arch="*">
+      <unaffected range="ge">1.7.13</unaffected>
+      <vulnerable range="lt">1.7.13</vulnerable>
+    </package>
+    <package name="www-client/mozilla-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.7.13</unaffected>
+      <vulnerable range="lt">1.7.13</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Mozilla Suite is a popular all-in-one web browser that
+    includes a mail and news reader.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several vulnerabilities were found in Mozilla Suite. Version
+    1.7.13 was released to fix them.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft malicious web pages or emails that
+    would leverage these issues to inject and execute arbitrary script code
+    with elevated privileges, steal local files, cookies or other
+    information from web pages or emails, and spoof content. Some of these
+    vulnerabilities might even be exploited to execute arbitrary code with
+    the rights of the user running the client.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds for all the issues at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Suite users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-1.7.13&quot;</code>
+    <p>
+    All Mozilla Suite binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-bin-1.7.13&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4134">CVE-2005-4134</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0292">CVE-2006-0292</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0293">CVE-2006-0293</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0296">CVE-2006-0296</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0748">CVE-2006-0748</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0749">CVE-2006-0749</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0884">CVE-2006-0884</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1045">CVE-2006-1045</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1727">CVE-2006-1727</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1728">CVE-2006-1728</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1729">CVE-2006-1729</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1730">CVE-2006-1730</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1731">CVE-2006-1731</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1732">CVE-2006-1732</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1733">CVE-2006-1733</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1734">CVE-2006-1734</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1735">CVE-2006-1735</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1736">CVE-2006-1736</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1737">CVE-2006-1737</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1738">CVE-2006-1738</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1739">CVE-2006-1739</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1740">CVE-2006-1740</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1741">CVE-2006-1741</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1742">CVE-2006-1742</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1790">CVE-2006-1790</uri>
+    <uri link="http://www.mozilla.org/projects/security/known-vulnerabilities.html#Mozilla">Mozilla Foundation Security Advisories</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 24 Apr 2006 16:32:37 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 24 Apr 2006 22:51:13 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 26 Apr 2006 17:28:01 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200605-01.xml b/xml/htdocs/security/en/glsa/glsa-200605-01.xml
new file mode 100644
index 00000000..a12e053a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200605-01.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200605-01">
+  <title>MPlayer: Heap-based buffer overflow</title>
+  <synopsis>
+    MPlayer contains multiple integer overflows that may lead to a heap-based
+    buffer overflow.
+  </synopsis>
+  <product type="ebuild">mplayer mplayer-bin</product>
+  <announced>May 01, 2006</announced>
+  <revised>June 21, 2006: 02</revised>
+  <bug>127969</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/mplayer" auto="yes" arch="*">
+      <unaffected range="ge">1.0.20060415</unaffected>
+      <unaffected range="ge">1.0_pre8</unaffected>
+      <vulnerable range="lt">1.0.20060415</vulnerable>
+    </package>
+    <package name="media-video/mplayer-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.0.20060415</unaffected>
+      <unaffected range="ge">1.0_pre8</unaffected>
+      <vulnerable range="lt">1.0.20060415</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MPlayer is a media player that supports many multimedia file types.
+    </p>
+  </background>
+  <description>
+    <p>
+    Xfocus Team discovered multiple integer overflows that may lead to a
+    heap-based buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to play a specially crafted multimedia
+    file, potentially resulting in the execution of arbitrary code with the
+    privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MPlayer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/mplayer-1.0.20060415&quot;</code>
+    <p>
+    All MPlayer binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/mplayer-bin-1.0.20060415&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1502">CVE-2006-1502</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 09 Apr 2006 10:59:36 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 23 Apr 2006 01:03:22 +0000">
+    adir
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 30 Apr 2006 14:44:19 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200605-02.xml b/xml/htdocs/security/en/glsa/glsa-200605-02.xml
new file mode 100644
index 00000000..6392eb79
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200605-02.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200605-02">
+  <title>X.Org: Buffer overflow in XRender extension</title>
+  <synopsis>
+    A buffer overflow in the XRender extension potentially allows any X.Org
+    user to execute arbitrary code with elevated privileges.
+  </synopsis>
+  <product type="ebuild">X.Org</product>
+  <announced>May 02, 2006</announced>
+  <revised>May 02, 2006: 01</revised>
+  <bug>130979</bug>
+  <access>local</access>
+  <affected>
+    <package name="x11-base/xorg-x11" auto="yes" arch="*">
+      <unaffected range="ge">6.8.2-r7</unaffected>
+      <vulnerable range="lt">6.8.2-r7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    X.Org is X.Org Foundation's public implementation of the X Window
+    System.
+    </p>
+  </background>
+  <description>
+    <p>
+    X.Org miscalculates the size of a buffer in the XRender extension.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An X.Org user could exploit this issue to make the X server
+    execute arbitrary code with elevated privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All X.Org users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-base/xorg-x11-6.8.2-r7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1526">CVE-2006-1526</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 01 May 2006 14:14:06 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 02 May 2006 17:42:54 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200605-03.xml b/xml/htdocs/security/en/glsa/glsa-200605-03.xml
new file mode 100644
index 00000000..79cfdb80
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200605-03.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200605-03">
+  <title>ClamAV: Buffer overflow in Freshclam</title>
+  <synopsis>
+    Freshclam is vulnerable to a buffer overflow that could lead to execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>May 02, 2006</announced>
+  <revised>May 02, 2006: 01</revised>
+  <bug>131791</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.88.2</unaffected>
+      <vulnerable range="lt">0.88.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ClamAV is a GPL virus scanner. Freshclam is a utility to download
+    virus signature updates.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ulf Harnhammar and an anonymous German researcher discovered that
+    Freshclam fails to check the size of the header data returned by a
+    webserver.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to connect to a malicious webserver an attacker
+    could cause the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.88.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1989">CVE-2006-1989</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 02 May 2006 04:03:38 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 02 May 2006 04:54:25 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200605-04.xml b/xml/htdocs/security/en/glsa/glsa-200605-04.xml
new file mode 100644
index 00000000..97a0b0b8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200605-04.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200605-04">
+  <title>phpWebSite: Local file inclusion</title>
+  <synopsis>
+    Remote attackers can include local files which may lead to the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">phpwebsite</product>
+  <announced>May 02, 2006</announced>
+  <revised>May 02, 2006: 01</revised>
+  <bug>130295</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phpwebsite" auto="yes" arch="*">
+      <unaffected range="ge">0.10.2</unaffected>
+      <vulnerable range="lt">0.10.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpWebSite provides a complete web site content management system.
+    </p>
+  </background>
+  <description>
+    <p>
+    rgod has reported that the "hub_dir" parameter in "index.php"
+    isn't properly verified. When "magic_quotes_gpc" is disabled, this can
+    be exploited to include arbitrary files from local ressources.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    If "magic_quotes_gpc" is disabled, which is not the default on
+    Gentoo Linux, a remote attacker could exploit this issue to include and
+    execute PHP scripts from local ressources with the rights of the user
+    running the web server, or to disclose sensitive information and
+    potentially compromise a vulnerable system.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpWebSite users should upgrade to the latest available
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/phpwebsite-0.10.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1819">CVE-2006-1819</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 01 May 2006 10:33:24 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 01 May 2006 10:58:55 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 01 May 2006 11:02:34 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200605-05.xml b/xml/htdocs/security/en/glsa/glsa-200605-05.xml
new file mode 100644
index 00000000..da90b4f2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200605-05.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200605-05">
+  <title>rsync: Potential integer overflow</title>
+  <synopsis>
+    An attacker having write access to an rsync module might be able to execute
+    arbitrary code on an rsync server.
+  </synopsis>
+  <product type="ebuild">rsync</product>
+  <announced>May 06, 2006</announced>
+  <revised>May 06, 2006: 01</revised>
+  <bug>131631</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/rsync" auto="yes" arch="*">
+      <unaffected range="ge">2.6.8</unaffected>
+      <vulnerable range="lt">2.6.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    rsync is a server and client utility that provides fast
+    incremental file transfers. It is used to efficiently synchronize files
+    between hosts and is used by emerge to fetch Gentoo's Portage tree.
+    </p>
+  </background>
+  <description>
+    <p>
+    An integer overflow was found in the receive_xattr function from
+    the extended attributes patch (xattr.c) for rsync. The vulnerable
+    function is only present when the "acl" USE flag is set.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker with write access to an rsync module could craft
+    malicious extended attributes which would trigger the integer overflow,
+    potentially resulting in the execution of arbitrary code with the
+    rights of the rsync daemon.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not provide write access to an rsync module to untrusted
+    parties.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All rsync users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/rsync-2.6.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2083">CVE-2006-2083</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 02 May 2006 15:25:29 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 02 May 2006 16:18:28 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 04 May 2006 20:00:28 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200605-06.xml b/xml/htdocs/security/en/glsa/glsa-200605-06.xml
new file mode 100644
index 00000000..0e6066b1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200605-06.xml
@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200605-06">
+  <title>Mozilla Firefox: Potential remote code execution</title>
+  <synopsis>
+    The Mozilla Firefox 1.5 line is vulnerable to a buffer overflow in the
+    JavaScript extension which may in theory lead to remote execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">mozilla-firefox</product>
+  <announced>May 06, 2006</announced>
+  <revised>May 06, 2006: 01</revised>
+  <bug>131138</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.3</unaffected>
+      <unaffected range="lt">1.5</unaffected>
+      <vulnerable range="lt">1.5.0.3</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.3</unaffected>
+      <unaffected range="lt">1.5</unaffected>
+      <vulnerable range="lt">1.5.0.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Firefox is the next-generation web browser from the
+    Mozilla project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Martijn Wargers and Nick Mott discovered a vulnerability when
+    rendering malformed JavaScript content. The Mozilla Firefox 1.0 line is
+    not affected.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    If JavaScript is enabled, by tricking a user into visiting a
+    malicious web page which would send a specially crafted HTML script
+    that contains references to deleted objects with the "designMode"
+    property enabled, an attacker can crash the web browser and in theory
+    manage to execute arbitrary code with the rights of the user running
+    the browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Firefox 1.5 users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-1.5.0.3&quot;</code>
+    <p>
+    All Mozilla Firefox 1.5 binary users should upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-1.5.0.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1993">CVE-2006-1993</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 04 May 2006 16:54:02 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 05 May 2006 18:30:27 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 06 May 2006 13:15:08 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200605-07.xml b/xml/htdocs/security/en/glsa/glsa-200605-07.xml
new file mode 100644
index 00000000..6000f193
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200605-07.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200605-07">
+  <title>Nagios: Buffer overflow</title>
+  <synopsis>
+    Nagios is vulnerable to a buffer overflow which may lead to remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">nagios</product>
+  <announced>May 07, 2006</announced>
+  <revised>May 25, 2006: 03</revised>
+  <bug>132159</bug>
+  <bug>133487</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/nagios-core" auto="yes" arch="*">
+      <unaffected range="ge">1.4.1</unaffected>
+      <vulnerable range="lt">1.4.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Nagios is an open source host, service and network monitoring program.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sebastian Krahmer of the SuSE security team discovered a buffer
+    overflow vulnerability in the handling of a negative HTTP
+    Content-Length header.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A buffer overflow in Nagios CGI scripts under certain web servers
+    allows remote attackers to execute arbitrary code via a negative
+    content length HTTP header.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Nagios users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/nagios-core-1.4.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2162">CVE-2006-2162</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2489">CVE-2006-2489</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 04 May 2006 17:10:32 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 05 May 2006 19:09:01 +0000">
+    fox2mike
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 06 May 2006 04:21:12 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200605-08.xml b/xml/htdocs/security/en/glsa/glsa-200605-08.xml
new file mode 100644
index 00000000..f92c5a32
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200605-08.xml
@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200605-08">
+  <title>PHP: Multiple vulnerabilities</title>
+  <synopsis>
+    PHP is affected by multiple issues, including a buffer overflow in
+    wordwrap() which may lead to execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">php</product>
+  <announced>May 08, 2006</announced>
+  <revised>May 15, 2007: 09</revised>
+  <bug>127939</bug>
+  <bug>128883</bug>
+  <bug>131135</bug>
+  <bug>133524</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/php" auto="yes" arch="arm hppa ppc s390 sh sparc x86 x86-fbsd">
+      <unaffected range="ge">5.1.4</unaffected>
+      <unaffected range="rge">4.4.2-r2</unaffected>
+      <unaffected range="rge">4.4.3-r1</unaffected>
+      <unaffected range="rge">4.4.4-r4</unaffected>
+      <unaffected range="rge">4.4.6</unaffected>
+      <unaffected range="ge">4.4.7</unaffected>
+      <vulnerable range="lt">5.1.4</vulnerable>
+    </package>
+    <package name="dev-lang/php" auto="yes" arch="alpha amd64 ia64 ppc64">
+      <unaffected range="ge">5.1.4-r4</unaffected>
+      <unaffected range="rge">4.4.2-r6</unaffected>
+      <unaffected range="rge">4.4.3-r1</unaffected>
+      <unaffected range="rge">4.4.4-r4</unaffected>
+      <unaffected range="rge">4.4.6</unaffected>
+      <unaffected range="ge">4.4.7</unaffected>
+      <vulnerable range="lt">5.1.4-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHP is a widely-used general-purpose scripting language that is
+    especially suited for Web development and can be embedded into HTML.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several vulnerabilities were discovered on PHP4 and PHP5 by Infigo,
+    Tonu Samuel and Maksymilian Arciemowicz. These included a buffer
+    overflow in the wordwrap() function, restriction bypasses in the copy()
+    and tempname() functions, a cross-site scripting issue in the phpinfo()
+    function, a potential crash in the substr_compare() function and a
+    memory leak in the non-binary-safe html_entity_decode() function.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Remote attackers might be able to exploit these issues in PHP
+    applications making use of the affected functions, potentially
+    resulting in the execution of arbitrary code, Denial of Service,
+    execution of scripted contents in the context of the affected site,
+    security bypass or information leak.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this point.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-lang/php</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0996">CVE-2006-0996</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1490">CVE-2006-1490</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1990">CVE-2006-1990</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1991">CVE-2006-1991</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 05 May 2006 20:33:13 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 06 May 2006 09:55:35 +0000">
+    fox2mike
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 08 May 2006 13:38:05 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200605-09.xml b/xml/htdocs/security/en/glsa/glsa-200605-09.xml
new file mode 100644
index 00000000..3db3961b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200605-09.xml
@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200605-09">
+  <title>Mozilla Thunderbird: Multiple vulnerabilities</title>
+  <synopsis>
+    Several vulnerabilities in Mozilla Thunderbird allow attacks ranging from
+    script execution with elevated privileges to information leaks.
+  </synopsis>
+  <product type="ebuild">mozilla-thunderbird</product>
+  <announced>May 08, 2006</announced>
+  <revised>May 08, 2006: 01</revised>
+  <bug>130888</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/mozilla-thunderbird" auto="yes" arch="*">
+      <unaffected range="ge">1.0.8</unaffected>
+      <vulnerable range="lt">1.0.8</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.0.8</unaffected>
+      <vulnerable range="lt">1.0.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Thunderbird is the next-generation mail client from the
+    Mozilla project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several vulnerabilities were found and fixed in Mozilla
+    Thunderbird.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft malicious emails that would leverage
+    these issues to inject and execute arbitrary script code with elevated
+    privileges, steal local files or other information from emails, and
+    spoof content. Some of these vulnerabilities might even be exploited to
+    execute arbitrary code with the rights of the user running Thunderbird.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds for all the issues at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Thunderbird users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-1.0.8&quot;</code>
+    <p>
+    All Mozilla Thunderbird binary users should upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-bin-1.0.8&quot;</code>
+    <p>
+    Note: There is no stable fixed version for the ALPHA
+    architecture yet. Users of Mozilla Thunderbird on ALPHA should consider
+    unmerging it until such a version is available.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0292">CVE-2006-0292</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0296">CVE-2006-0296</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0748">CVE-2006-0748</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0749">CVE-2006-0749</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0884">CVE-2006-0884</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1045">CVE-2006-1045</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1727">CVE-2006-1727</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1728">CVE-2006-1728</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1730">CVE-2006-1730</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1731">CVE-2006-1731</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1732">CVE-2006-1732</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1733">CVE-2006-1733</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1734">CVE-2006-1734</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1735">CVE-2006-1735</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1737">CVE-2006-1737</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1738">CVE-2006-1738</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1739">CVE-2006-1739</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1741">CVE-2006-1741</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1742">CVE-2006-1742</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1790">CVE-2006-1790</uri>
+    <uri link="http://www.mozilla.org/projects/security/known-vulnerabilities.html#Thunderbird">Mozilla Foundation Security Advisories</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 24 Apr 2006 16:32:56 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 24 Apr 2006 22:23:09 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 08 May 2006 17:36:25 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200605-10.xml b/xml/htdocs/security/en/glsa/glsa-200605-10.xml
new file mode 100644
index 00000000..44a9990a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200605-10.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200605-10">
+  <title>pdnsd: Denial of Service and potential arbitrary code execution</title>
+  <synopsis>
+    pdnsd is vulnerable to a buffer overflow that may result in arbitrary code
+    execution.
+  </synopsis>
+  <product type="ebuild">pdnsd</product>
+  <announced>May 10, 2006</announced>
+  <revised>May 10, 2006: 01</revised>
+  <bug>131341</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/pdnsd" auto="yes" arch="*">
+      <unaffected range="ge">1.2.4</unaffected>
+      <vulnerable range="lt">1.2.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    pdnsd is a proxy DNS server with permanent caching that is
+    designed to cope with unreachable DNS servers.
+    </p>
+  </background>
+  <description>
+    <p>
+    The pdnsd team has discovered an unspecified buffer overflow
+    vulnerability. The PROTOS DNS Test Suite, by the Oulu University Secure
+    Programming Group (OUSPG), has also revealed a memory leak error within
+    the handling of the QTYPE and QCLASS DNS queries, leading to
+    consumption of large amounts of memory.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker can craft malicious DNS queries leading to a Denial of
+    Service, and potentially the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All pdnsd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/pdnsd-1.2.4-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2076">CVE-2006-2076</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2077">CVE-2006-2077</uri>
+  </references>
+  <metadata tag="bugReady" timestamp="Sat, 06 May 2006 16:17:08 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 07 May 2006 10:55:02 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200605-11.xml b/xml/htdocs/security/en/glsa/glsa-200605-11.xml
new file mode 100644
index 00000000..aadf572e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200605-11.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200605-11">
+  <title>Ruby: Denial of Service</title>
+  <synopsis>
+    Ruby WEBrick and XMLRPC servers are vulnerable to Denial of Service.
+  </synopsis>
+  <product type="ebuild">ruby</product>
+  <announced>May 10, 2006</announced>
+  <revised>May 10, 2006: 01</revised>
+  <bug>130657</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/ruby" auto="yes" arch="*">
+      <unaffected range="ge">1.8.4-r1</unaffected>
+      <vulnerable range="lt">1.8.4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ruby is an interpreted scripting language for quick and easy
+    object-oriented programming. It comes bundled with HTTP ("WEBrick") and
+    XMLRPC server objects.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ruby uses blocking sockets for WEBrick and XMLRPC servers.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could send large amounts of data to an affected server
+    to block the socket and thus deny other connections to the server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ruby users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/ruby-1.8.4-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1931">CVE-2006-1931</uri>
+    <uri link="http://www.ruby-lang.org/en/20051224.html">Ruby release announcement</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 08 May 2006 06:23:42 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 08 May 2006 13:21:34 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200605-12.xml b/xml/htdocs/security/en/glsa/glsa-200605-12.xml
new file mode 100644
index 00000000..415d3271
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200605-12.xml
@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200605-12">
+  <title>Quake 3 engine based games: Buffer Overflow</title>
+  <synopsis>
+    The Quake 3 engine has a vulnerability that could be exploited to execute
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">quake</product>
+  <announced>May 10, 2006</announced>
+  <revised>May 10, 2006: 01</revised>
+  <bug>132377</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-fps/quake3-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.32c</unaffected>
+      <vulnerable range="lt">1.32c</vulnerable>
+    </package>
+    <package name="games-fps/rtcw" auto="yes" arch="*">
+      <unaffected range="ge">1.41b</unaffected>
+      <vulnerable range="lt">1.41b</vulnerable>
+    </package>
+    <package name="games-fps/enemy-territory" auto="yes" arch="*">
+      <unaffected range="ge">2.60b</unaffected>
+      <vulnerable range="lt">2.60b</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Quake 3 is a multiplayer first person shooter.
+    </p>
+  </background>
+  <description>
+    <p>
+    landser discovered a vulnerability within the "remapShader"
+    command. Due to a boundary handling error in "remapShader", there is a
+    possibility of a buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could set up a malicious game server and entice users
+    to connect to it, potentially resulting in the execution of arbitrary
+    code with the rights of the game user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not connect to untrusted game servers.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Quake 3 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-fps/quake3-bin-1.32c&quot;</code>
+    <p>
+    All RTCW users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-fps/rtcw-1.41b&quot;</code>
+    <p>
+    All Enemy Territory users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-fps/enemy-territory-2.60b&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2236">CVE-2006-2236</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 09 May 2006 16:37:35 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 09 May 2006 16:37:43 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 09 May 2006 17:21:13 +0000">
+    fox2mike
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200605-13.xml b/xml/htdocs/security/en/glsa/glsa-200605-13.xml
new file mode 100644
index 00000000..e60591d5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200605-13.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200605-13">
+  <title>MySQL: Information leakage</title>
+  <synopsis>
+    A MySQL server may leak information to unauthorized users.
+  </synopsis>
+  <product type="ebuild">MySQL</product>
+  <announced>May 11, 2006</announced>
+  <revised>May 15, 2006: 04</revised>
+  <bug>132146</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/mysql" auto="yes" arch="*">
+      <unaffected range="ge">4.1.19</unaffected>
+      <unaffected range="rge">4.0.27</unaffected>
+      <vulnerable range="lt">4.1.19</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MySQL is a popular multi-threaded, multi-user SQL database server.
+    </p>
+  </background>
+  <description>
+    <p>
+    The processing of the COM_TABLE_DUMP command by a MySQL server fails to
+    properly validate packets that arrive from the client via a network
+    socket.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By crafting specific malicious packets an attacker could gather
+    confidential information from the memory of a MySQL server process, for
+    example results of queries by other users or applications. By using PHP
+    code injection or similar techniques it would be possible to exploit
+    this flaw through web applications that use MySQL as a database
+    backend.
+    </p>
+    <p>
+    Note that on 5.x versions it is possible to overwrite the stack and
+    execute arbitrary code with this technique. Users of MySQL 5.x are
+    urged to upgrade to the latest available version.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MySQL users should upgrade to the latest version.
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/mysql-4.0.27&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2006-05/msg00041.html">Original advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1516">CVE-2006-1516</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1517">CVE-2006-1517</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 06 May 2006 16:33:38 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 08 May 2006 07:03:06 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 08 May 2006 13:21:08 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200605-14.xml b/xml/htdocs/security/en/glsa/glsa-200605-14.xml
new file mode 100644
index 00000000..fcf34742
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200605-14.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200605-14">
+  <title>libextractor: Two heap-based buffer overflows</title>
+  <synopsis>
+    libextractor is vulnerable to two heap overflow vulnerabilities which could
+    lead to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">libextractor</product>
+  <announced>May 21, 2006</announced>
+  <revised>May 21, 2006: 01</revised>
+  <bug>133570</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libextractor" auto="yes" arch="*">
+      <unaffected range="ge">0.5.14</unaffected>
+      <vulnerable range="lt">0.5.14</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libextractor is a library used to extract metadata from arbitrary
+    files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Luigi Auriemma has found two heap-based buffer overflows in
+    libextractor 0.5.13 and earlier: one of them occurs in the
+    asf_read_header function in the ASF plugin, and the other occurs in the
+    parse_trak_atom function in the Qt plugin.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to open a malformed file using an application
+    that employs libextractor and its ASF or Qt plugins, an attacker could
+    execute arbitrary code in the context of the application running the
+    affected library.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libextractor users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libextractor-0.5.14&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2458">CVE-2006-2458</uri>
+    <uri link="http://aluigi.altervista.org/adv/libextho-adv.txt">Original advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 19 May 2006 13:49:39 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 19 May 2006 13:49:51 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 19 May 2006 16:16:14 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200605-15.xml b/xml/htdocs/security/en/glsa/glsa-200605-15.xml
new file mode 100644
index 00000000..1e373d9f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200605-15.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200605-15">
+  <title>Quagga Routing Suite: Multiple vulnerabilities</title>
+  <synopsis>
+    Quagga's RIP daemon allows the injection of routes and the disclosure of
+    routing information. The BGP daemon is vulnerable to a Denial of Service.
+  </synopsis>
+  <product type="ebuild">quagga</product>
+  <announced>May 21, 2006</announced>
+  <revised>May 21, 2006: 01</revised>
+  <bug>132353</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/quagga" auto="yes" arch="*">
+      <unaffected range="ge">0.98.6-r1</unaffected>
+      <vulnerable range="lt">0.98.6-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Quagga Routing Suite implements three major routing protocols:
+    RIP (v1/v2/v3), OSPF (v2/v3) and BGP4.
+    </p>
+  </background>
+  <description>
+    <p>
+    Konstantin V. Gavrilenko discovered two flaws in the Routing
+    Information Protocol (RIP) daemon that allow the processing of RIP v1
+    packets (carrying no authentication) even when the daemon is configured
+    to use MD5 authentication or, in another case, even if RIP v1 is
+    completely disabled. Additionally, Fredrik Widell reported that the
+    Border Gateway Protocol (BGP) daemon contains a flaw that makes it lock
+    up and use all available CPU when a specific command is issued from the
+    telnet interface.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending RIP v1 response packets, an unauthenticated attacker
+    can alter the routing table of a router running Quagga's RIP daemon and
+    disclose routing information. Additionally, it is possible to lock up
+    the BGP daemon from the telnet interface.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Quagga users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/quagga-0.98.6-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2223">CVE-2006-2223</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2224">CVE-2006-2224</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2276">CVE-2006-2276</uri>
+    <uri link="http://www.quagga.net/news2.php?y=2006&amp;m=5&amp;d=8#id1147115280">Official release information</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 15 May 2006 05:35:52 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 15 May 2006 16:38:23 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 16 May 2006 05:49:19 +0000">
+    frilled
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200605-16.xml b/xml/htdocs/security/en/glsa/glsa-200605-16.xml
new file mode 100644
index 00000000..9c84ba1c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200605-16.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200605-16">
+  <title>CherryPy: Directory traversal vulnerability</title>
+  <synopsis>
+    CherryPy is vulnerable to a directory traversal that could allow attackers
+    to read arbitrary files.
+  </synopsis>
+  <product type="ebuild">cherrypy</product>
+  <announced>May 30, 2006</announced>
+  <revised>May 30, 2006: 01</revised>
+  <bug>134273</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-python/cherrypy" auto="yes" arch="*">
+      <unaffected range="ge">2.1.1</unaffected>
+      <vulnerable range="lt">2.1.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CherryPy is a Python-based, object-oriented web development
+    framework.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ivo van der Wijk discovered that the "staticfilter" component of
+    CherryPy fails to sanitize input correctly.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    An attacker could exploit this flaw to obtain arbitrary files from
+    the web server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CherryPy users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-python/cherrypy-2.1.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0847">CVE-2006-0847</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 27 May 2006 09:02:22 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 27 May 2006 09:02:32 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 28 May 2006 21:15:45 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200605-17.xml b/xml/htdocs/security/en/glsa/glsa-200605-17.xml
new file mode 100644
index 00000000..234d0058
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200605-17.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200605-17">
+  <title>libTIFF: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in libTIFF could lead to the execution of
+    arbitrary code or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">libtiff</product>
+  <announced>May 30, 2006</announced>
+  <revised>May 30, 2006: 01</revised>
+  <bug>129675</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/tiff" auto="yes" arch="*">
+      <unaffected range="ge">3.8.1</unaffected>
+      <vulnerable range="lt">3.8.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libTIFF provides support for reading and manipulating TIFF images.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities, ranging from integer overflows and NULL
+    pointer dereferences to double frees, were reported in libTIFF.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit these vulnerabilities by enticing a user
+    to open a specially crafted TIFF image, possibly leading to the
+    execution of arbitrary code or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libTIFF users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/tiff-3.8.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0405">CVE-2006-0405</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2024">CVE-2006-2024</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2025">CVE-2006-2025</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2026">CVE-2006-2026</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 28 May 2006 21:42:59 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 28 May 2006 21:43:06 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-01.xml b/xml/htdocs/security/en/glsa/glsa-200606-01.xml
new file mode 100644
index 00000000..ede050cf
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-01.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-01">
+  <title>Opera: Buffer overflow</title>
+  <synopsis>
+    Opera contains an integer signedness error resulting in a buffer overflow
+    which may allow a remote attacker to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">opera</product>
+  <announced>June 07, 2006</announced>
+  <revised>June 07, 2006: 01</revised>
+  <bug>129800</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/opera" auto="yes" arch="*">
+      <unaffected range="ge">8.54</unaffected>
+      <vulnerable range="lt">8.54</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Opera is a multi-platform web browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    SEC Consult has discovered a buffer overflow in the code
+    processing style sheet attributes. It is caused by an integer
+    signedness error in a length check followed by a call to a string
+    function. It seems to be hard to exploit this buffer overflow to
+    execute arbitrary code because of the very large amount memory that has
+    to be copied.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker can entice a user to visit a web page containing
+    a specially crafted style sheet attribute that will crash the user's
+    browser and maybe lead to the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Opera users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/opera-8.54&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1834">CVE-2006-1834</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 30 May 2006 13:12:35 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 31 May 2006 19:39:23 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-02.xml b/xml/htdocs/security/en/glsa/glsa-200606-02.xml
new file mode 100644
index 00000000..1543add1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-02.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-02">
+  <title>shadow: Privilege escalation</title>
+  <synopsis>
+    A security issue in shadow allows a local user to perform certain actions
+    with escalated privileges.
+  </synopsis>
+  <product type="ebuild">shadow</product>
+  <announced>June 07, 2006</announced>
+  <revised>June 07, 2006: 01</revised>
+  <bug>133615</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-apps/shadow" auto="yes" arch="*">
+      <unaffected range="ge">4.0.15-r2</unaffected>
+      <vulnerable range="lt">4.0.15-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    shadow provides a set of utilities to deal with user accounts.
+    </p>
+  </background>
+  <description>
+    <p>
+    When the mailbox is created in useradd, the "open()" function does
+    not receive the three arguments it expects while O_CREAT is present,
+    which leads to random permissions on the created file, before fchmod()
+    is executed.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Depending on the random permissions given to the mailbox file
+    which is at this time owned by root, a local user may be able to open
+    this file for reading or writing, or even executing it, maybe as the
+    root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All shadow users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/shadow-4.0.15-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1174">CVE-2006-1174</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 01 Jun 2006 07:06:38 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 01 Jun 2006 15:23:57 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 05 Jun 2006 17:20:29 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-03.xml b/xml/htdocs/security/en/glsa/glsa-200606-03.xml
new file mode 100644
index 00000000..4ef79010
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-03.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-03">
+  <title>Dia: Format string vulnerabilities</title>
+  <synopsis>
+    Format string vulnerabilities in Dia may lead to the execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">dia</product>
+  <announced>June 07, 2006</announced>
+  <revised>June 07, 2006: 01</revised>
+  <bug>133699</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/dia" auto="yes" arch="*">
+      <unaffected range="ge">0.95.1</unaffected>
+      <vulnerable range="lt">0.95.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Dia is a GTK+ based diagram creation program.
+    </p>
+  </background>
+  <description>
+    <p>
+    KaDaL-X discovered a format string error within the handling of
+    filenames. Hans de Goede also discovered several other format
+    string errors in the processing of dia files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to open a specially crafted file, a remote
+    attacker could exploit these vulnerabilities to execute arbitrary code
+    with the rights of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Dia users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/dia-0.95.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2453">CVE-2006-2453</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2480">CVE-2006-2480</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 30 May 2006 16:11:11 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 30 May 2006 23:25:33 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 05 Jun 2006 17:20:31 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-04.xml b/xml/htdocs/security/en/glsa/glsa-200606-04.xml
new file mode 100644
index 00000000..363852dd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-04.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-04">
+  <title>Tor: Several vulnerabilities</title>
+  <synopsis>
+    Tor is vulnerable to a possible buffer overflow, a Denial of Service,
+    information disclosure and information leak.
+  </synopsis>
+  <product type="ebuild">tor</product>
+  <announced>June 07, 2006</announced>
+  <revised>September 05, 2006: 02</revised>
+  <bug>134329</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/tor" auto="yes" arch="*">
+      <unaffected range="ge">0.1.1.20</unaffected>
+      <unaffected range="rge">0.1.0.18</unaffected>
+      <vulnerable range="lt">0.1.1.20</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Tor is an implementation of second generation Onion Routing, a
+    connection-oriented anonymizing communication service.
+    </p>
+  </background>
+  <description>
+    <p>
+    Some integer overflows exist when adding elements to the smartlists.
+    Non-printable characters received from the network are not properly
+    sanitised before being logged. There are additional unspecified bugs in
+    the directory server and in the internal circuits.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    The possible buffer overflow may allow a remote attacker to execute
+    arbitrary code on the server by sending large inputs. The other
+    vulnerabilities can lead to a Denial of Service, a lack of logged
+    information, or some information disclosure.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Tor users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose net-misc/tor</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0414">CVE-2006-0414</uri>
+    <uri link="http://tor.eff.org/cvs/tor/ChangeLog">Tor ChangeLog</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 01 Jun 2006 07:05:28 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 01 Jun 2006 17:37:03 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 05 Jun 2006 17:15:10 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-05.xml b/xml/htdocs/security/en/glsa/glsa-200606-05.xml
new file mode 100644
index 00000000..04c5f30c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-05.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-05">
+  <title>Pound: HTTP request smuggling</title>
+  <synopsis>
+    Pound is vulnerable to HTTP request smuggling, which could be exploited to
+    bypass security restrictions or poison web caches.
+  </synopsis>
+  <product type="ebuild">pound</product>
+  <announced>June 07, 2006</announced>
+  <revised>November 24, 2006: 03</revised>
+  <bug>118541</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/pound" auto="yes" arch="*">
+      <unaffected range="ge">2.0.5</unaffected>
+      <unaffected range="rge">1.10</unaffected>
+      <unaffected range="rge">1.9.4</unaffected>
+      <vulnerable range="lt">2.0.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Pound is a reverse proxy, load balancer and HTTPS front-end. It allows
+    to distribute the load on several web servers and offers a SSL wrapper
+    for web servers that do not support SSL directly.
+    </p>
+  </background>
+  <description>
+    <p>
+    Pound fails to handle HTTP requests with conflicting "Content-Length"
+    and "Transfer-Encoding" headers correctly.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    An attacker could exploit this vulnerability by sending HTTP requests
+    with specially crafted "Content-Length" and "Transfer-Encoding" headers
+    to bypass certain security restrictions or to poison the web proxy
+    cache.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Pound users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose www-servers/pound</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3751">CVE-2005-3751</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 25 May 2006 15:47:49 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 25 May 2006 18:03:55 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 29 May 2006 16:09:23 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-06.xml b/xml/htdocs/security/en/glsa/glsa-200606-06.xml
new file mode 100644
index 00000000..37face06
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-06.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-06">
+  <title>AWStats: Remote execution of arbitrary code</title>
+  <synopsis>
+    AWStats contains a bug in the sanitization of the input parameters which
+    can lead to the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">awstats</product>
+  <announced>June 07, 2006</announced>
+  <revised>May 28, 2009: 02</revised>
+  <bug>130487</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-misc/awstats" auto="yes" arch="*">
+      <unaffected range="ge">6.5-r1</unaffected>
+      <vulnerable range="lt">6.5-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    AWStats is an advanced log file analyzer and statistics generator.
+    </p>
+  </background>
+  <description>
+    <p>
+    Hendrik Weimer has found that if updating the statistics via the
+    web frontend is enabled, it is possible to inject arbitrary code via a
+    pipe character in the "migrate" parameter. Additionally, r0t has
+    discovered that AWStats fails to properly sanitize user-supplied input
+    in awstats.pl.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker can execute arbitrary code on the server in the
+    context of the application running the AWStats CGI script if updating
+    of the statistics via web frontend is allowed. Nonetheless, all
+    configurations are affected by a cross-site scripting vulnerability in
+    awstats.pl, allowing a remote attacker to execute arbitrary scripts
+    running in the context of the victim's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable statistics updates using the web frontend to avoid code
+    injection. However, there is no known workaround at this time
+    concerning the cross-site scripting vulnerability.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All AWStats users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-misc/awstats-6.5-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1945">CVE-2006-1945</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2237">CVE-2006-2237</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 20 May 2006 08:51:28 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 21 May 2006 19:06:44 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 05 Jun 2006 17:20:28 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-07.xml b/xml/htdocs/security/en/glsa/glsa-200606-07.xml
new file mode 100644
index 00000000..a73245ac
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-07.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-07">
+  <title>Vixie Cron: Privilege Escalation</title>
+  <synopsis>
+    Vixie Cron allows local users to execute programs as root.
+  </synopsis>
+  <product type="ebuild">vixie-cron</product>
+  <announced>June 09, 2006</announced>
+  <revised>June 09, 2006: 01</revised>
+  <bug>134194</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-process/vixie-cron" auto="yes" arch="*">
+      <unaffected range="ge">4.1-r9</unaffected>
+      <vulnerable range="lt">4.1-r9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Vixie Cron is a command scheduler with extended syntax over cron.
+    </p>
+  </background>
+  <description>
+    <p>
+    Roman Veretelnikov discovered that Vixie Cron fails to properly
+    check whether it can drop privileges accordingly if setuid() in
+    do_command.c fails due to a user exceeding assigned resource limits.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Local users can execute code with root privileges by deliberately
+    exceeding their assigned resource limits and then starting a command
+    through Vixie Cron. This requires resource limits to be in place on the
+    machine.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Vixie Cron users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-process/vixie-cron-4.1-r9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2607">CVE-2006-2607</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 07 Jun 2006 19:26:16 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 07 Jun 2006 20:17:38 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 09 Jun 2006 03:56:58 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-08.xml b/xml/htdocs/security/en/glsa/glsa-200606-08.xml
new file mode 100644
index 00000000..d31b3c4c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-08.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-08">
+  <title>WordPress: Arbitrary command execution</title>
+  <synopsis>
+    WordPress fails to sufficiently check the format of cached username data.
+  </synopsis>
+  <product type="ebuild">wordpress</product>
+  <announced>June 09, 2006</announced>
+  <revised>June 10, 2006: 02</revised>
+  <bug>134397</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/wordpress" auto="yes" arch="*">
+      <unaffected range="ge">2.0.3</unaffected>
+      <vulnerable range="lt">2.0.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    WordPress is a PHP and MySQL based content management and publishing
+    system.
+    </p>
+  </background>
+  <description>
+    <p>
+    rgod discovered that WordPress insufficiently checks the format of
+    cached username data.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could exploit this vulnerability to execute arbitrary
+    commands by sending a specially crafted username. As of Wordpress 2.0.2
+    the user data cache is disabled by default.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All WordPress users should upgrade to the latest available version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/wordpress-2.0.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2667">CVE-2006-2667</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2702">CVE-2006-2702</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 06 Jun 2006 16:40:51 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 06 Jun 2006 17:50:23 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-09.xml b/xml/htdocs/security/en/glsa/glsa-200606-09.xml
new file mode 100644
index 00000000..fcf802d9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-09.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-09">
+  <title>SpamAssassin: Execution of arbitrary code</title>
+  <synopsis>
+    SpamAssassin, when running with certain options, could allow local or even
+    remote attackers to execute arbitrary commands, possibly as the root user.
+  </synopsis>
+  <product type="ebuild">Spamassassin</product>
+  <announced>June 11, 2006</announced>
+  <revised>June 11, 2006: 01</revised>
+  <bug>135746</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-filter/spamassassin" auto="yes" arch="*">
+      <unaffected range="ge">3.1.3</unaffected>
+      <vulnerable range="lt">3.1.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SpamAssassin is an extensible email filter used to identify junk
+    email. spamd is the daemonized version of SpamAssassin.
+    </p>
+  </background>
+  <description>
+    <p>
+    When spamd is run with both the "--vpopmail" (-v) and
+    "--paranoid" (-P) options, it is vulnerable to an unspecified issue.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    With certain configuration options, a local or even remote
+    attacker could execute arbitrary code with the rights of the user
+    running spamd, which is root by default, by sending a crafted message
+    to the spamd daemon. Furthermore, the attack can be remotely
+    performed if the "--allowed-ips" (-A) option is present and specifies
+    non-local adresses. Note that Gentoo Linux is not vulnerable in the
+    default configuration.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Don't use both the "--paranoid" (-P) and the "--vpopmail" (-v)
+    options.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SpamAssassin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-filter/spamassassin-3.1.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2447">CVE-2006-2447</uri>
+  </references>
+  <metadata tag="bugReady" timestamp="Thu, 08 Jun 2006 05:47:21 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 08 Jun 2006 10:26:06 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-10.xml b/xml/htdocs/security/en/glsa/glsa-200606-10.xml
new file mode 100644
index 00000000..9f45d54d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-10.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-10">
+  <title>Cscope: Many buffer overflows</title>
+  <synopsis>
+    Cscope is vulnerable to multiple buffer overflows that could lead to the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Cscope</product>
+  <announced>June 11, 2006</announced>
+  <revised>June 11, 2006: 01</revised>
+  <bug>133829</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-util/cscope" auto="yes" arch="*">
+      <unaffected range="ge">15.5-r6</unaffected>
+      <vulnerable range="lt">15.5-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cscope is a developer's tool for browsing source code.
+    </p>
+  </background>
+  <description>
+    <p>
+    Cscope does not verify the length of file names sourced in
+    #include statements.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A user could be enticed to source a carefully crafted file which
+    will allow the attacker to execute arbitrary code with the permissions
+    of the user running Cscope.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cscope users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-util/cscope-15.5-r6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2541">CVE-2004-2541</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 01 Jun 2006 07:07:22 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 05 Jun 2006 17:21:43 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 05 Jun 2006 18:50:34 +0000">
+    dizzutch
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-11.xml b/xml/htdocs/security/en/glsa/glsa-200606-11.xml
new file mode 100644
index 00000000..a6625695
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-11.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-11">
+  <title>JPEG library: Denial of Service</title>
+  <synopsis>
+    The JPEG library is vulnerable to a Denial of Service.
+  </synopsis>
+  <product type="ebuild">jpeg</product>
+  <announced>June 11, 2006</announced>
+  <revised>July 29, 2006: 02</revised>
+  <bug>130889</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/jpeg" auto="yes" arch="*">
+      <unaffected range="ge">6b-r7</unaffected>
+      <vulnerable range="lt">6b-r7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The JPEG library is able to load, handle and manipulate images in the
+    JPEG format.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Auditing Team discovered that the
+    vulnerable JPEG library ebuilds compile JPEG without the --maxmem
+    feature which is not recommended.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to load a specially crafted JPEG image file an
+    attacker could cause a Denial of Service, due to memory exhaustion.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    JPEG users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/jpeg-6b-r7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3005">CVE-2006-3005</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 05 Jun 2006 22:15:44 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 05 Jun 2006 22:17:08 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 06 Jun 2006 08:58:39 +0000">
+    daxomatic
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-12.xml b/xml/htdocs/security/en/glsa/glsa-200606-12.xml
new file mode 100644
index 00000000..07b79414
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-12.xml
@@ -0,0 +1,95 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-12">
+  <title>Mozilla Firefox: Multiple vulnerabilities</title>
+  <synopsis>
+    Vulnerabilities in Mozilla Firefox allow privilege escalations for
+    JavaScript code, cross site scripting attacks, HTTP response smuggling and
+    possibly the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mozilla-firefox</product>
+  <announced>June 11, 2006</announced>
+  <revised>June 11, 2006: 01</revised>
+  <bug>135254</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.4</unaffected>
+      <vulnerable range="lt">1.5.0.4</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.4</unaffected>
+      <vulnerable range="lt">1.5.0.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Firefox is the next-generation web browser from the
+    Mozilla project.
+    </p>
+  </background>
+  <description>
+    <p>
+    A number of vulnerabilities were found and fixed in Mozilla
+    Firefox. For details please consult the references below.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing the user to visit a malicious website, a remote
+    attacker can inject arbitrary HTML and JavaScript Code into the user's
+    browser, execute JavaScript code with elevated privileges and possibly
+    execute arbitrary code with the permissions of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-1.5.0.4&quot;</code>
+    <p>
+    All Mozilla Firefox binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-1.5.0.4&quot;</code>
+    <p>
+    Note: There is no stable fixed version for the Alpha
+    architecture yet. Users of Mozilla Firefox on Alpha should consider
+    unmerging it until such a version is available.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2775">CVE-2006-2775</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2776">CVE-2006-2776</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2777">CVE-2006-2777</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2778">CVE-2006-2778</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2779">CVE-2006-2779</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2780">CVE-2006-2780</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2782">CVE-2006-2782</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2783">CVE-2006-2783</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2784">CVE-2006-2784</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2785">CVE-2006-2785</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2786">CVE-2006-2786</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2787">CVE-2006-2787</uri>
+    <uri link="http://www.mozilla.org/projects/security/known-vulnerabilities.html#Firefox">Mozilla Foundation Security Advisories</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 07 Jun 2006 17:33:16 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 08 Jun 2006 10:36:32 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-13.xml b/xml/htdocs/security/en/glsa/glsa-200606-13.xml
new file mode 100644
index 00000000..e265d122
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-13.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-13">
+  <title>MySQL: SQL Injection</title>
+  <synopsis>
+    MySQL is vulnerable to an SQL Injection flaw in the multi-byte encoding
+    process.
+  </synopsis>
+  <product type="ebuild">MySQL</product>
+  <announced>June 11, 2006</announced>
+  <revised>December 13, 2006: 04</revised>
+  <bug>135076</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/mysql" auto="yes" arch="*">
+      <unaffected range="ge">5.0.22</unaffected>
+      <unaffected range="rge">4.1.20</unaffected>
+      <unaffected range="rge">4.1.21</unaffected>
+      <unaffected range="rge">4.1.22</unaffected>
+      <unaffected range="lt">4.1</unaffected>
+      <vulnerable range="lt">5.0.22</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MySQL is a popular multi-threaded, multi-user SQL server.
+    </p>
+  </background>
+  <description>
+    <p>
+    MySQL is vulnerable to an injection flaw in mysql_real_escape() when
+    used with multi-byte characters.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Due to a flaw in the multi-byte character process, an attacker is still
+    able to inject arbitary SQL statements into the MySQL server for
+    execution.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are a few workarounds available: NO_BACKSLASH_ESCAPES mode as a
+    workaround for a bug in mysql_real_escape_string(): SET
+    sql_mode='NO_BACKSLASH_ESCAPES'; SET GLOBAL
+    sql_mode='NO_BACKSLASH_ESCAPES'; and server command line options:
+    --sql-mode=NO_BACKSLASH_ESCAPES.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MySQL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/mysql-4.1.20&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2753">CVE-2006-2753</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 01 Jun 2006 07:09:29 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 05 Jun 2006 19:55:54 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 07 Jun 2006 09:13:55 +0000">
+    daxomatic
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-14.xml b/xml/htdocs/security/en/glsa/glsa-200606-14.xml
new file mode 100644
index 00000000..1b3e55cf
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-14.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-14">
+  <title>GDM: Privilege escalation</title>
+  <synopsis>
+    An authentication error in GDM could allow users to gain elevated
+    privileges.
+  </synopsis>
+  <product type="ebuild">gdm</product>
+  <announced>June 12, 2006</announced>
+  <revised>June 19, 2006: 02</revised>
+  <bug>135027</bug>
+  <access>local</access>
+  <affected>
+    <package name="gnome-base/gdm" auto="yes" arch="*">
+      <unaffected range="ge">2.8.0.8</unaffected>
+      <vulnerable range="lt">2.8.0.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GDM is the GNOME display manager.
+    </p>
+  </background>
+  <description>
+    <p>
+    GDM allows a normal user to access the configuration manager.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    When the "face browser" in GDM is enabled, a normal user can use the
+    "configure login manager" with his/her own password instead of the root
+    password, and thus gain additional privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GDM users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=gnome-base/gdm-2.8.0.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://bugzilla.gnome.org/show_bug.cgi?id=343476">Gnome Bugzilla entry</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2452">CVE-2006-2452</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 08 Jun 2006 10:45:03 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 09 Jun 2006 08:32:35 +0000">
+    daxomatic
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 12 Jun 2006 04:30:05 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-15.xml b/xml/htdocs/security/en/glsa/glsa-200606-15.xml
new file mode 100644
index 00000000..da2668f8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-15.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-15">
+  <title>Asterisk: IAX2 video frame buffer overflow</title>
+  <synopsis>
+    Asterisk contains a bug in the IAX2 channel driver making it vulnerable to
+    the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">asterisk</product>
+  <announced>June 14, 2006</announced>
+  <revised>June 14, 2006: 01</revised>
+  <bug>135680</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/asterisk" auto="yes" arch="*">
+      <unaffected range="ge">1.0.11_p1</unaffected>
+      <vulnerable range="lt">1.0.11_p1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Asterisk is an open source implementation of a telephone private branch
+    exchange (PBX).
+    </p>
+  </background>
+  <description>
+    <p>
+    Asterisk fails to properly check the length of truncated video frames
+    in the IAX2 channel driver which results in a buffer overflow.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could exploit this vulnerability by sending a specially
+    crafted IAX2 video stream resulting in the execution of arbitrary code
+    with the permissions of the user running Asterisk.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable public IAX2 support.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Asterisk users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/asterisk-1.0.11_p1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2898">CVE-2006-2898</uri>
+    <uri link="http://www.coresecurity.com/common/showdoc.php?idx=547&amp;idxseccion=10">Corelabs Asterisk PBX truncated video frame vulnerability advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 08 Jun 2006 10:46:16 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 09 Jun 2006 08:21:48 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 14 Jun 2006 09:36:11 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-16.xml b/xml/htdocs/security/en/glsa/glsa-200606-16.xml
new file mode 100644
index 00000000..bee8cf41
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-16.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-16">
+  <title>DokuWiki: PHP code injection</title>
+  <synopsis>
+    A flaw in DokuWiki's spell checker allows for the execution of arbitrary
+    PHP commands, even without proper authentication.
+  </synopsis>
+  <product type="ebuild">DokuWiki</product>
+  <announced>June 14, 2006</announced>
+  <revised>June 14, 2006: 01</revised>
+  <bug>135623</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/dokuwiki" auto="yes" arch="*">
+      <unaffected range="ge">20060309-r1</unaffected>
+      <vulnerable range="lt">20060309-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    DokuWiki is a simple to use wiki targeted at developer teams,
+    workgroups and small companies.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Esser discovered that the DokuWiki spell checker fails to
+    properly sanitize PHP's "complex curly syntax".
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A unauthenticated remote attacker may execute arbitrary PHP commands -
+    and thus possibly arbitrary system commands - with the permissions of
+    the user running the webserver that serves DokuWiki pages.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All DokuWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/dokuwiki-20060309-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.hardened-php.net/advisory_042006.119.html">Hardened-PHP advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2878">CVE-2006-2878</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 11 Jun 2006 22:03:16 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 12 Jun 2006 18:33:06 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 13 Jun 2006 21:28:32 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-17.xml b/xml/htdocs/security/en/glsa/glsa-200606-17.xml
new file mode 100644
index 00000000..02a04399
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-17.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-17">
+  <title>OpenLDAP: Buffer overflow</title>
+  <synopsis>
+    The OpenLDAP replication server slurpd contains a buffer overflow that
+    could result in arbitrary code execution.
+  </synopsis>
+  <product type="ebuild">net-nds/openldap</product>
+  <announced>June 15, 2006</announced>
+  <revised>June 15, 2006: 01</revised>
+  <bug>134010</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-nsd/openldap" auto="yes" arch="*">
+      <unaffected range="ge">2.3.22</unaffected>
+      <vulnerable range="lt">2.3.22</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenLDAP is a suite of LDAP-related applications and development tools.
+    It includes slapd (the standalone LDAP server), slurpd (the standalone
+    LDAP replication server), various LDAP libraries, utilities and example
+    clients.
+    </p>
+  </background>
+  <description>
+    <p>
+    slurpd contains a buffer overflow when reading very long hostnames from
+    the status file.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By injecting an overly long hostname in the status file, an attacker
+    could possibly cause the execution of arbitrary code with the
+    permissions of the user running slurpd.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All openLDAP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-nds/openldap-2.3.22&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2754">CVE-2006-2754</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 08 Jun 2006 10:43:24 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 11 Jun 2006 20:44:06 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 12 Jun 2006 07:06:11 +0000">
+    SeJo
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-18.xml b/xml/htdocs/security/en/glsa/glsa-200606-18.xml
new file mode 100644
index 00000000..4b749fa9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-18.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-18">
+  <title>PAM-MySQL: Multiple vulnerabilities</title>
+  <synopsis>
+    Vulnerabilities in PAM-MySQL can lead to a Denial of Service, making it
+    impossible to log into a machine.
+  </synopsis>
+  <product type="ebuild">pam_mysql</product>
+  <announced>June 15, 2006</announced>
+  <revised>July 29, 2006: 02</revised>
+  <bug>120842</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-auth/pam_mysql" auto="yes" arch="*">
+      <unaffected range="ge">0.7_rc1</unaffected>
+      <vulnerable range="lt">0.7_rc1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PAM-MySQL is a PAM module used to authenticate users against a MySQL
+    backend.
+    </p>
+  </background>
+  <description>
+    <p>
+    A flaw in handling the result of pam_get_item() as well as further
+    unspecified flaws were discovered in PAM-MySQL.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By exploiting the mentioned flaws an attacker can cause a Denial of
+    Service and thus prevent users that authenticate against PAM-MySQL from
+    logging into a machine. There is also a possible additional attack
+    vector with more malicious impact that has not been confirmed yet.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PAM-MySQL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-auth/pam_mysql-0.7_rc1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://pam-mysql.sourceforge.net/News/">Official release information</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4713">CVE-2005-4713</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0056">CVE-2006-0056</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 11 Jun 2006 20:13:52 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 11 Jun 2006 20:15:46 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 13 Jun 2006 04:26:43 +0000">
+    frilled
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-19.xml b/xml/htdocs/security/en/glsa/glsa-200606-19.xml
new file mode 100644
index 00000000..fd378d39
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-19.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-19">
+  <title>Sendmail: Denial of Service</title>
+  <synopsis>
+    Faulty multipart MIME messages can cause forked Sendmail processes to
+    crash.
+  </synopsis>
+  <product type="ebuild">sendmail</product>
+  <announced>June 15, 2006</announced>
+  <revised>June 15, 2006: 01</revised>
+  <bug>135141</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-mta/sendmail" auto="yes" arch="*">
+      <unaffected range="ge">8.13.6-r1</unaffected>
+      <vulnerable range="lt">8.13.6-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Sendmail is a popular mail transfer agent (MTA).
+    </p>
+  </background>
+  <description>
+    <p>
+    Frank Sheiness discovered that the mime8to7() function can recurse
+    endlessly during the decoding of multipart MIME messages until the
+    stack of the process is filled and the process crashes.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending specially crafted multipart MIME messages, a remote
+    attacker can cause a subprocess forked by Sendmail to crash. If
+    Sendmail is not set to use a randomized queue processing, the attack
+    will effectively halt the delivery of queued mails as well as the
+    malformed one, incoming mail delivered interactively is not affected.
+    Additionally, on systems where core dumps with an individual naming
+    scheme (like "core.pid") are enabled, a filesystem may fill up with
+    core dumps. Core dumps are disabled by default in Gentoo.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    The Sendmail 8.13.7 release information offers some workarounds, please
+    see the Reference below. Note that the issue has actually been fixed in
+    the 8.13.6-r1 ebuild.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Sendmail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-mta/sendmail-8.13.6-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1173">CVE-2006-1173</uri>
+    <uri link="http://www.sendmail.org/releases/8.13.7.html">Sendmail 8.13.7 release information</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 14 Jun 2006 18:47:59 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 14 Jun 2006 19:21:03 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 15 Jun 2006 16:00:46 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-20.xml b/xml/htdocs/security/en/glsa/glsa-200606-20.xml
new file mode 100644
index 00000000..47d891a8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-20.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-20">
+  <title>Typespeed: Remote execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow in the network code of Typespeed can lead to the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">typespeed</product>
+  <announced>June 19, 2006</announced>
+  <revised>June 19, 2006: 01</revised>
+  <bug>135071</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-misc/typespeed" auto="yes" arch="*">
+      <unaffected range="ge">0.5.0</unaffected>
+      <vulnerable range="lt">0.5.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Typespeed is a game to test and practice 10-finger-typing. Network code
+    allows two users to compete head-to-head.
+    </p>
+  </background>
+  <description>
+    <p>
+    Niko Tyni discovered a buffer overflow in the addnewword() function of
+    Typespeed's network code.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By sending specially crafted network packets to a machine running
+    Typespeed in multiplayer mode, a remote attacker can execute arbitrary
+    code with the permissions of the user running the game.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not run Typespeed in multiplayer mode. There is no known workaround
+    at this time for multiplayer mode.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Typespeed users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-misc/typespeed-0.5.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1515">CVE-2006-1515</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 11 Jun 2006 22:01:54 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 13 Jun 2006 05:10:07 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 18 Jun 2006 12:23:54 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-21.xml b/xml/htdocs/security/en/glsa/glsa-200606-21.xml
new file mode 100644
index 00000000..3aa69146
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-21.xml
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-21">
+  <title>Mozilla Thunderbird: Multiple vulnerabilities</title>
+  <synopsis>
+    Several vulnerabilities in Mozilla Thunderbird allow cross site scripting,
+    JavaScript privilege escalation and possibly execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mozilla-thunderbird</product>
+  <announced>June 19, 2006</announced>
+  <revised>June 19, 2006: 01</revised>
+  <bug>135256</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/mozilla-thunderbird" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.4</unaffected>
+      <vulnerable range="lt">1.5.0.4</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.4</unaffected>
+      <vulnerable range="lt">1.5.0.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Thunderbird is the next-generation mail client from the Mozilla
+    project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several vulnerabilities were found and fixed in Mozilla Thunderbird.
+    For details, please consult the references below.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft malicious emails that would leverage
+    these issues to inject and execute arbitrary script code with elevated
+    privileges, spoof content, and possibly execute arbitrary code with the
+    rights of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds for all the issues at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Thunderbird users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-1.5.0.4&quot;</code>
+    <p>
+    All Mozilla Thunderbird binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-bin-1.5.0.4&quot;</code>
+    <p>
+    Note: There is no stable fixed version for the Alpha architecture yet.
+    Users of Mozilla Thunderbird on Alpha should consider unmerging it
+    until such a version is available.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2775">CVE-2006-2775</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2776">CVE-2006-2776</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2778">CVE-2006-2778</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2779">CVE-2006-2779</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2780">CVE-2006-2780</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2781">CVE-2006-2781</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2783">CVE-2006-2783</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2786">CVE-2006-2786</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2787">CVE-2006-2787</uri>
+    <uri link="http://www.mozilla.org/projects/security/known-vulnerabilities.html#Thunderbird">Mozilla Foundation Security Advisories</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 07 Jun 2006 17:49:37 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 18 Jun 2006 10:01:22 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-22.xml b/xml/htdocs/security/en/glsa/glsa-200606-22.xml
new file mode 100644
index 00000000..2d69b027
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-22.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-22">
+  <title>aRts: Privilege escalation</title>
+  <synopsis>
+    The artswrapper part of aRts allows local users to execute arbitrary code
+    with elevated privileges.
+  </synopsis>
+  <product type="ebuild">aRts</product>
+  <announced>June 22, 2006</announced>
+  <revised>June 22, 2006: 01</revised>
+  <bug>135970</bug>
+  <access>local</access>
+  <affected>
+    <package name="kde-base/arts" auto="yes" arch="*">
+      <unaffected range="ge">3.5.2-r1</unaffected>
+      <unaffected range="rge">3.4.3-r1</unaffected>
+      <vulnerable range="lt">3.5.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    aRts is a real time modular system for synthesizing audio used by KDE.
+    artswrapper is a helper application used to start the aRts daemon.
+    </p>
+  </background>
+  <description>
+    <p>
+    artswrapper fails to properly check whether it can drop privileges
+    accordingly if setuid() fails due to a user exceeding assigned resource
+    limits.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Local attackers could exploit this vulnerability to execute arbitrary
+    code with elevated privileges. Note that the aRts package provided by
+    Gentoo is only vulnerable if the artswrappersuid USE-flag is enabled.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All aRts users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose kde-base/arts</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2916">CVE-2006-2916</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 15 Jun 2006 13:39:42 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 17 Jun 2006 13:17:47 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-23.xml b/xml/htdocs/security/en/glsa/glsa-200606-23.xml
new file mode 100644
index 00000000..a9f2a179
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-23.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-23">
+  <title>KDM: Symlink vulnerability</title>
+  <synopsis>
+    KDM is vulnerable to a symlink vulnerability that can lead to disclosure of
+    information.
+  </synopsis>
+  <product type="ebuild">kdebase, KDM</product>
+  <announced>June 22, 2006</announced>
+  <revised>June 24, 2006: 02</revised>
+  <bug>136201</bug>
+  <access>local</access>
+  <affected>
+    <package name="kde-base/kdebase" auto="yes" arch="*">
+      <unaffected range="ge">3.5.2-r2</unaffected>
+      <unaffected range="rge">3.4.3-r2</unaffected>
+      <vulnerable range="lt">3.5.2-r2</vulnerable>
+    </package>
+    <package name="kde-base/kdm" auto="yes" arch="*">
+      <unaffected range="ge">3.5.2-r1</unaffected>
+      <unaffected range="rge">3.4.3-r2</unaffected>
+      <vulnerable range="lt">3.5.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDE is a feature-rich graphical desktop environment for Linux and
+    Unix-like Operating Systems. KDM is the KDE Display Manager and is part
+    of the kdebase package.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ludwig Nussel discovered that KDM could be tricked into allowing users
+    to read files that would otherwise not be readable.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit this issue to obtain potentially
+    sensitive information that is usually not accessable to the local user
+    such as shadow files or other user's files. The default Gentoo user
+    running KDM is root and, as a result, the local attacker can read any
+    file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All kdebase users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose kde-base/kdebase</code>
+    <p>
+    All KDE split ebuild users should upgrade to the latest KDM version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose kde-base/kdm</code>
+  </resolution>
+  <references>
+    <uri link="http://www.kde.org/info/security/advisory-20060614-1.txt">KDE Security Advisory: KDM symlink attack vulnerability</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2449">CVE-2006-2449</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 14 Jun 2006 19:50:34 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 18 Jun 2006 09:50:44 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-24.xml b/xml/htdocs/security/en/glsa/glsa-200606-24.xml
new file mode 100644
index 00000000..b892e1be
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-24.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-24">
+  <title>wv2: Integer overflow</title>
+  <synopsis>
+    An integer overflow could allow an attacker to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">wv2</product>
+  <announced>June 23, 2006</announced>
+  <revised>June 23, 2006: 01</revised>
+  <bug>136759</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/wv2" auto="yes" arch="*">
+      <unaffected range="ge">0.2.3</unaffected>
+      <vulnerable range="lt">0.2.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    wv2 is a filter library for Microsoft Word files, used in many Office
+    suites.
+    </p>
+  </background>
+  <description>
+    <p>
+    A boundary checking error was found in wv2, which could lead to an
+    integer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could execute arbitrary code with the rights of the user
+    running the program that uses the library via a maliciously crafted
+    Microsoft Word document.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All wv2 users should update to the latest stable version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/wv2-0.2.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2197">CVE 2006-2197</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 21 Jun 2006 15:46:28 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 21 Jun 2006 17:08:02 +0000">
+    hlieberman
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 21 Jun 2006 18:19:37 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-25.xml b/xml/htdocs/security/en/glsa/glsa-200606-25.xml
new file mode 100644
index 00000000..a1873a3b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-25.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-25">
+  <title>Hashcash: Possible heap overflow</title>
+  <synopsis>
+    A heap overflow vulnerability in the Hashcash utility could allow an
+    attacker to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">hashcash</product>
+  <announced>June 26, 2006</announced>
+  <revised>July 29, 2006: 02</revised>
+  <bug>134960</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/hashcash" auto="yes" arch="*">
+      <unaffected range="ge">1.21</unaffected>
+      <vulnerable range="lt">1.21</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Hashcash is a utility for generating Hashcash tokens, a proof-of-work
+    system to reduce the impact of spam.
+    </p>
+  </background>
+  <description>
+    <p>
+    Andreas Seltenreich has reported a possible heap overflow in the
+    array_push() function in hashcash.c, as a result of an incorrect amount
+    of allocated memory for the "ARRAY" structure.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By sending malicious entries to the Hashcash utility, an attacker may
+    be able to cause an overflow, potentially resulting in the execution of
+    arbitrary code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Hashcash users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/hashcash-1.21&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.hashcash.org/source/CHANGELOG">Hashcash ChangeLog</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3251">CVE-2006-3251</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 18 Jun 2006 12:26:10 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 18 Jun 2006 12:57:56 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 23 Jun 2006 18:48:20 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-26.xml b/xml/htdocs/security/en/glsa/glsa-200606-26.xml
new file mode 100644
index 00000000..e1ccf629
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-26.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-26">
+  <title>EnergyMech: Denial of Service</title>
+  <synopsis>
+    A Denial of Service vulnerability was discovered in EnergyMech that is
+    easily exploitable via IRC.
+  </synopsis>
+  <product type="ebuild">emech</product>
+  <announced>June 26, 2006</announced>
+  <revised>July 29, 2006: 02</revised>
+  <bug>132749</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-irc/emech" auto="yes" arch="*">
+      <unaffected range="ge">3.0.2</unaffected>
+      <vulnerable range="lt">3.0.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    EnergyMech is an IRC bot programmed in C.
+    </p>
+  </background>
+  <description>
+    <p>
+    A bug in EnergyMech fails to handle empty CTCP NOTICEs correctly, and
+    will cause a crash from a segmentation fault.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending an empty CTCP NOTICE, a remote attacker could exploit this
+    vulnerability to cause a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All EnergyMech users should update to the latest stable version:
+    </p>
+    <code> 
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-irc/emech-3.0.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.energymech.net/versions-3.0.html">EnergyMech Changelog</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3293">CVE-2006-3293</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 22 Jun 2006 18:15:43 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 22 Jun 2006 23:37:12 +0000">
+    hlieberman
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 23 Jun 2006 18:56:34 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-27.xml b/xml/htdocs/security/en/glsa/glsa-200606-27.xml
new file mode 100644
index 00000000..35a8998a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-27.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-27">
+  <title>Mutt: Buffer overflow</title>
+  <synopsis>
+    Mutt contains a buffer overflow that could result in arbitrary code
+    execution.
+  </synopsis>
+  <product type="ebuild">mutt</product>
+  <announced>June 28, 2006</announced>
+  <revised>June 28, 2006: 01</revised>
+  <bug>138125</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/mutt" auto="yes" arch="*">
+      <unaffected range="ge">1.5.11-r2</unaffected>
+      <vulnerable range="lt">1.5.11-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mutt is a small but very powerful text-based mail client.
+    </p>
+  </background>
+  <description>
+    <p>
+    TAKAHASHI Tamotsu has discovered that Mutt contains a boundary error in
+    the "browse_get_namespace()" function in browse.c, which can be
+    triggered when receiving an overly long namespace from an IMAP server.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious IMAP server can send an overly long namespace to Mutt in
+    order to crash the application, and possibly execute arbitrary code
+    with the permissions of the user running Mutt.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mutt users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mutt-1.5.11-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3242">CVE-2006-3242</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 27 Jun 2006 19:49:38 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 27 Jun 2006 20:02:54 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 28 Jun 2006 10:14:15 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-28.xml b/xml/htdocs/security/en/glsa/glsa-200606-28.xml
new file mode 100644
index 00000000..debfe128
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-28.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-28">
+  <title>Horde Web Application Framework: XSS vulnerability</title>
+  <synopsis>
+    The Horde Web Application Framework is vulnerable to a cross-site scripting
+    vulnerability.
+  </synopsis>
+  <product type="ebuild">horde</product>
+  <announced>June 29, 2006</announced>
+  <revised>June 29, 2006: 01</revised>
+  <bug>136830</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/horde" auto="yes" arch="*">
+      <unaffected range="ge">3.1.1-r1</unaffected>
+      <vulnerable range="lt">3.1.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Horde Web Application Framework is a general-purpose web
+    application framework written in PHP, providing classes for handling
+    preferences, compression, browser detection, connection tracking, MIME,
+    and more.
+    </p>
+  </background>
+  <description>
+    <p>
+    Michael Marek discovered that the Horde Web Application Framework
+    performs insufficient input sanitizing.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    An attacker could exploit these vulnerabilities to execute arbitrary
+    scripts running in the context of the victim's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All horde users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-3.1.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2195">CVE-2006-2195</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 22 Jun 2006 14:59:32 +0000">
+    dizzutch
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 23 Jun 2006 18:49:08 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-29.xml b/xml/htdocs/security/en/glsa/glsa-200606-29.xml
new file mode 100644
index 00000000..03b50f06
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-29.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-29">
+  <title>Tikiwiki: SQL injection and multiple XSS vulnerabilities</title>
+  <synopsis>
+    An SQL injection vulnerability and multiple XSS vulnerabilities have been
+    discovered.
+  </synopsis>
+  <product type="ebuild">tikiwiki</product>
+  <announced>June 29, 2006</announced>
+  <revised>June 29, 2006: 01</revised>
+  <bug>136723</bug>
+  <bug>134483</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/tikiwiki" auto="yes" arch="*">
+      <unaffected range="ge">1.9.4</unaffected>
+      <vulnerable range="lt">1.9.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Tikiwiki is a web-based groupware and content management system (CMS),
+    using PHP, ADOdb and Smarty.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tikiwiki fails to properly sanitize user input before processing it,
+    including in SQL statements.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could execute arbitrary SQL statements on the underlying
+    database, or inject arbitrary scripts into the context of a user's
+    browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Tikiwiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/tikiwiki-1.9.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3048">CVE-2006-3048</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3047">CVE-2006-3047</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 26 Jun 2006 00:18:20 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 26 Jun 2006 20:19:12 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200606-30.xml b/xml/htdocs/security/en/glsa/glsa-200606-30.xml
new file mode 100644
index 00000000..6c03921c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200606-30.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200606-30">
+  <title>Kiax: Arbitrary code execution</title>
+  <synopsis>
+    A security vulnerability in the iaxclient library could lead to the
+    execution of arbitrary code by a remote attacker.
+  </synopsis>
+  <product type="ebuild">kiax</product>
+  <announced>June 30, 2006</announced>
+  <revised>June 30, 2006: 01</revised>
+  <bug>136099</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/kiax" auto="yes" arch="*">
+      <unaffected range="ge">0.8.5_p1</unaffected>
+      <vulnerable range="lt">0.8.5_p1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Kiax is a graphical softphone supporting the IAX protocol (Inter
+    Asterisk eXchange), which allows PC users to make VoIP calls to
+    Asterisk servers.
+    </p>
+  </background>
+  <description>
+    <p>
+    The iax_net_read function in the iaxclient library fails to properly
+    handle IAX2 packets with truncated full frames or mini-frames. These
+    frames are detected in a length check but processed anyway, leading to
+    buffer overflows.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a specially crafted IAX2 packet, an attacker could execute
+    arbitrary code with the permissions of the user running Kiax.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Kiax users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/kiax-0.8.5_p1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2923">CVE-2006-2923</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 22 Jun 2006 11:02:44 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 22 Jun 2006 11:16:37 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 22 Jun 2006 15:23:48 +0000">
+    dizzutch
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200607-01.xml b/xml/htdocs/security/en/glsa/glsa-200607-01.xml
new file mode 100644
index 00000000..65354828
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200607-01.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200607-01">
+  <title>mpg123: Heap overflow</title>
+  <synopsis>
+    A heap overflow in mpg123 was discovered, which could result in the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mpg123</product>
+  <announced>July 03, 2006</announced>
+  <revised>July 29, 2006: 02</revised>
+  <bug>133988</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/mpg123" auto="yes" arch="*">
+      <unaffected range="ge">0.59s-r11</unaffected>
+      <vulnerable range="lt">0.59s-r11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    mpg123 is a real time audio player designed for the MPEG format.
+    </p>
+  </background>
+  <description>
+    <p>
+    In httpdget.c, a variable is assigned to the heap, and is supposed to
+    receive a smaller allocation. As this variable was not terminated
+    properly, strncpy() will overwrite the data assigned next in memory.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to visit a malicious URL, an attacker could possibly
+    execute arbitrary code with the rights of the user running mpg123.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mpg123 users should update to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/mpg123-0.59s-r11&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3355">CVE-2006-3355</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 30 Jun 2006 16:01:33 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 30 Jun 2006 18:10:59 +0000">
+    hlieberman
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 02 Jul 2006 14:50:47 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200607-02.xml b/xml/htdocs/security/en/glsa/glsa-200607-02.xml
new file mode 100644
index 00000000..28d6a1e9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200607-02.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200607-02">
+  <title>FreeType: Multiple integer overflows</title>
+  <synopsis>
+    Multiple remotely exploitable buffer overflows have been discovered in
+    FreeType, resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">FreeType</product>
+  <announced>July 09, 2006</announced>
+  <revised>September 03, 2006: 02</revised>
+  <bug>124828</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/freetype" auto="yes" arch="*">
+      <unaffected range="ge">2.1.10-r2</unaffected>
+      <unaffected range="lt">2.0</unaffected>
+      <vulnerable range="lt">2.1.10-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    FreeType is a portable font engine.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple integer overflows exist in a variety of files (bdf/bdflib.c,
+    sfnt/ttcmap.c, cff/cffgload.c, base/ftmac.c).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these buffer overflows by enticing a
+    user to load a specially crafted font, which could result in the
+    execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All FreeType users should upgrade to the latest stable version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/freetype-2.1.10-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1861">CVE-2006-1861</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 04 Jul 2006 13:58:56 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 04 Jul 2006 15:44:57 +0000">
+    hlieberman
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 05 Jul 2006 16:43:48 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200607-03.xml b/xml/htdocs/security/en/glsa/glsa-200607-03.xml
new file mode 100644
index 00000000..b307fb45
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200607-03.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200607-03">
+  <title>libTIFF: Multiple buffer overflows</title>
+  <synopsis>
+    libTIFF contains buffer overflows that could result in arbitrary code
+    execution.
+  </synopsis>
+  <product type="ebuild">tiff</product>
+  <announced>July 09, 2006</announced>
+  <revised>July 09, 2006: 01</revised>
+  <bug>135881</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/tiff" auto="yes" arch="*">
+      <unaffected range="ge">3.8.2-r1</unaffected>
+      <vulnerable range="lt">3.8.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libTIFF provides support for reading and manipulating TIFF images.
+    </p>
+  </background>
+  <description>
+    <p>
+    A buffer overflow has been found in the t2p_write_pdf_string function
+    in tiff2pdf, which can been triggered with a TIFF file containing a
+    DocumentName tag with UTF-8 characters. An additional buffer overflow
+    has been found in the handling of the parameters in tiffsplit.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to load a specially crafted TIFF
+    file, resulting in the possible execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libTIFF users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/tiff-3.8.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2193">CVE-2006-2193</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2656">CVE-2006-2656</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 05 Jul 2006 16:38:15 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 05 Jul 2006 16:38:38 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200607-04.xml b/xml/htdocs/security/en/glsa/glsa-200607-04.xml
new file mode 100644
index 00000000..6a48a6d7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200607-04.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200607-04">
+  <title>PostgreSQL: SQL injection</title>
+  <synopsis>
+    A flaw in the multibyte character handling allows execution of arbitrary
+    SQL statements.
+  </synopsis>
+  <product type="ebuild">postgresql</product>
+  <announced>July 09, 2006</announced>
+  <revised>June 26, 2007: 03</revised>
+  <bug>134168</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/postgresql" auto="yes" arch="*">
+      <unaffected range="ge">8.0.8</unaffected>
+      <unaffected range="eq">7.4*</unaffected>
+      <vulnerable range="lt">8.0.8</vulnerable>
+      <vulnerable range="lt">7.4.13</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PostgreSQL is an open source object-relational database management
+    system.
+    </p>
+  </background>
+  <description>
+    <p>
+    PostgreSQL contains a flaw in the string parsing routines that allows
+    certain backslash-escaped characters to be bypassed with some multibyte
+    character encodings. This vulnerability was discovered by Akio Ishida
+    and Yasuo Ohgaki.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could execute arbitrary SQL statements on the PostgreSQL
+    server. Be aware that web applications using PostgreSQL as a database
+    back-end might be used to exploit this vulnerability.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PostgreSQL users should upgrade to the latest version in the
+    respective branch they are using:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose dev-db/postgresql</code>
+    <p>
+    Note: While a fix exists for the 7.3 branch it doesn't currently work
+    on Gentoo. All 7.3.x users of PostgreSQL should consider updating their
+    installations to the 7.4 (or higher) branch as soon as possible!
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://www.postgresql.org/docs/techdocs.50">PostgreSQL technical information</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2313">CVE-2006-2313</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2314">CVE-2006-2314</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 01 Jun 2006 07:08:33 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 07 Jun 2006 19:43:38 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 09 Jul 2006 16:30:11 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200607-05.xml b/xml/htdocs/security/en/glsa/glsa-200607-05.xml
new file mode 100644
index 00000000..ca549312
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200607-05.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200607-05">
+  <title>SHOUTcast server: Multiple vulnerabilities</title>
+  <synopsis>
+    The SHOUTcast server is vulnerable to a file disclosure vulnerability and
+    multiple XSS vulnerabilities.
+  </synopsis>
+  <product type="ebuild">shoutcast</product>
+  <announced>July 09, 2006</announced>
+  <revised>July 29, 2006: 03</revised>
+  <bug>136721</bug>
+  <bug>136221</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/shoutcast-server-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.9.7</unaffected>
+      <vulnerable range="lt">1.9.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SHOUTcast server is a streaming audio server.
+    </p>
+  </background>
+  <description>
+    <p>
+    The SHOUTcast server is vulnerable to a file disclosure when the server
+    receives a specially crafted GET request. Furthermore it also fails to
+    sanitize the input passed to the "Description", "URL", "Genre", "AIM",
+    and "ICQ" fields.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a specially crafted GET request to the SHOUTcast server, the
+    attacker can read any file that can be read by the SHOUTcast process.
+    Furthermore it is possible that various request variables could also be
+    exploited to execute arbitrary scripts in the context of a victim's
+    browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SHOUTcast server users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/shoutcast-server-bin-1.9.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://people.ksp.sk/~goober/advisory/001-shoutcast.html">Original advisory</uri>
+    <uri link="http://secunia.com/advisories/20524/">SA20524</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3007">CVE-2006-3007</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3534">CVE-2006-3534</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3535">CVE-2006-3535</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 30 Jun 2006 16:19:23 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 30 Jun 2006 17:31:32 +0000">
+    daxomatic
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 02 Jul 2006 14:51:02 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200607-06.xml b/xml/htdocs/security/en/glsa/glsa-200607-06.xml
new file mode 100644
index 00000000..1916f82d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200607-06.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200607-06">
+  <title>libpng: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow has been found in the libpng library that could lead to
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">libpng</product>
+  <announced>July 19, 2006</announced>
+  <revised>July 19, 2006: 01</revised>
+  <bug>138433</bug>
+  <bug>138672</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libpng" auto="yes" arch="*">
+      <unaffected range="ge">1.2.12</unaffected>
+      <vulnerable range="lt">1.2.12</vulnerable>
+    </package>
+    <package name="app-emulation/emul-linux-x86-baselibs" auto="yes" arch="amd64">
+      <unaffected range="ge">2.5.1</unaffected>
+      <vulnerable range="lt">2.5.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libpng is an open, extensible image format library, with lossless
+    compression.
+    </p>
+  </background>
+  <description>
+    <p>
+    In pngrutil.c, the function png_decompress_chunk() allocates
+    insufficient space for an error message, potentially overwriting stack
+    data, leading to a buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to load a maliciously crafted PNG image, an attacker
+    could execute arbitrary code with the rights of the user, or crash the
+    application using the libpng library, such as the
+    emul-linux-x86-baselibs.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libpng users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libpng-1.2.12&quot;</code>
+    <p>
+    All AMD64 emul-linux-x86-baselibs users should also upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/emul-linux-x86-baselibs-2.5.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://heanet.dl.sourceforge.net/sourceforge/libpng/libpng-1.2.12-README.txt">libpng Changelog</uri>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3334">CVE-2006-3334</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 04 Jul 2006 14:10:20 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 04 Jul 2006 18:53:23 +0000">
+    daxomatic
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 17 Jul 2006 16:54:49 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200607-07.xml b/xml/htdocs/security/en/glsa/glsa-200607-07.xml
new file mode 100644
index 00000000..fffeb17b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200607-07.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200607-07">
+  <title>xine-lib: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow has been found in the libmms library shipped with
+    xine-lib, potentially resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">xine-lib</product>
+  <announced>July 20, 2006</announced>
+  <revised>July 20, 2006: 01</revised>
+  <bug>139319</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/xine-lib" auto="yes" arch="*">
+      <unaffected range="ge">1.1.2-r2</unaffected>
+      <vulnerable range="lt">1.1.2-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xine-lib is the core library of xine, a multimedia player.
+    </p>
+  </background>
+  <description>
+    <p>
+    There is a stack based overflow in the libmms library included with
+    xine-lib which can be triggered by malicious use of the send_command,
+    string_utf16, get_data and get_media_packet functions.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could design a malicious media file that would
+    trigger the overflow, potentially resulting in the execution of
+    arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xine-lib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/xine-lib-1.1.2-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2200">CVE-2006-2200</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 12 Jul 2006 17:17:02 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 12 Jul 2006 20:18:19 +0000">
+    daxomatic
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 17 Jul 2006 16:55:34 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200607-08.xml b/xml/htdocs/security/en/glsa/glsa-200607-08.xml
new file mode 100644
index 00000000..6134e6aa
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200607-08.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200607-08">
+  <title>GIMP: Buffer overflow</title>
+  <synopsis>
+    GIMP is prone to a buffer overflow which may lead to the execution of
+    arbitrary code when loading specially crafted XCF files.
+  </synopsis>
+  <product type="ebuild">gimp</product>
+  <announced>July 23, 2006</announced>
+  <revised>July 24, 2006: 02</revised>
+  <bug>139524</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/gimp" auto="yes" arch="*">
+      <unaffected range="ge">2.2.12</unaffected>
+      <vulnerable range="lt">2.2.12</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GIMP is the GNU Image Manipulation Program. XCF is the native image
+    file format used by GIMP.
+    </p>
+  </background>
+  <description>
+    <p>
+    Henning Makholm discovered that the "xcf_load_vector()" function is
+    vulnerable to a buffer overflow when loading a XCF file with a large
+    "num_axes" value.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit this issue to execute arbitrary code by
+    enticing a user to open a specially crafted XCF file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GIMP users should update to the latest stable version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/gimp-2.2.12&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3404">CVE-2006-3404</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 12 Jul 2006 17:07:39 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 12 Jul 2006 18:38:18 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 12 Jul 2006 19:27:03 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200607-09.xml b/xml/htdocs/security/en/glsa/glsa-200607-09.xml
new file mode 100644
index 00000000..c80a1d05
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200607-09.xml
@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200607-09">
+  <title>Wireshark: Multiple vulnerabilities</title>
+  <synopsis>
+    Wireshark (formerly known as Ethereal) is vulnerable to several security
+    issues, potentially allowing the execution of arbitrary code by a remote
+    attacker.
+  </synopsis>
+  <product type="ebuild">wireshark ethereal</product>
+  <announced>July 25, 2006</announced>
+  <revised>July 25, 2006: 01</revised>
+  <bug>140856</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/wireshark" auto="yes" arch="*">
+      <unaffected range="ge">0.99.2</unaffected>
+      <vulnerable range="lt">0.99.2</vulnerable>
+    </package>
+    <package name="net-analyzer/ethereal" auto="yes" arch="*">
+      <vulnerable range="le">0.99.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Wireshark, formerly known as Ethereal, is a popular network protocol
+    analyzer.
+    </p>
+  </background>
+  <description>
+    <p>
+    Wireshark dissectors have been found vulnerable to a large number of
+    exploits, including off-by-one errors, buffer overflows, format string
+    overflows and an infinite loop.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Running an affected version of Wireshark or Ethereal could allow for a
+    remote attacker to execute arbitrary code on the user's computer by
+    sending specially crafted packets.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Wireshark users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/wireshark-0.99.2&quot;</code>
+    <p>
+    All Ethereal users should migrate to Wireshark:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --unmerge net-analyzer/ethereal
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/wireshark-0.99.2&quot;</code>
+    <p>
+    To keep the [saved] configuration from Ethereal and reuse it with
+    Wireshark:
+    </p>
+    <code>
+    # mv ~/.ethereal ~/.wireshark</code>
+  </resolution>
+  <references>
+    <uri link="http://www.wireshark.org/security/wnpa-sec-2006-01.html">Wireshark wnpa-sec-2006-01</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3627">CVE-2006-3627</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3628">CVE-2006-3628</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3629">CVE-2006-3629</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3630">CVE-2006-3630</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3631">CVE-2006-3631</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3632">CVE-2006-3632</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 19 Jul 2006 16:53:04 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 19 Jul 2006 18:04:14 +0000">
+    dizzutch
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 22 Jul 2006 20:10:22 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200607-10.xml b/xml/htdocs/security/en/glsa/glsa-200607-10.xml
new file mode 100644
index 00000000..ddb03ef8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200607-10.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200607-10">
+  <title>Samba: Denial of Service vulnerability</title>
+  <synopsis>
+    A large number of share connection requests could cause a Denial of Service
+    within Samba.
+  </synopsis>
+  <product type="ebuild">samba</product>
+  <announced>July 25, 2006</announced>
+  <revised>July 25, 2006: 01</revised>
+  <bug>139369</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-fs/samba" auto="yes" arch="*">
+      <unaffected range="ge">3.0.22-r3</unaffected>
+      <vulnerable range="lt">3.0.22-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Samba is a freely available SMB/CIFS implementation which allows
+    seamless interoperability of file and print services to other SMB/CIFS
+    clients.
+    </p>
+  </background>
+  <description>
+    <p>
+    During an internal audit the Samba team discovered that a flaw in the
+    way Samba stores share connection requests could lead to a Denial of
+    Service.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a large amount of share connection requests to a vulnerable
+    Samba server, an attacker could cause a Denial of Service due to memory
+    consumption.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Samba users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-fs/samba-3.0.22-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3403">CVE-2006-3403</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 23 Jul 2006 19:09:42 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 23 Jul 2006 19:57:17 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 23 Jul 2006 19:57:30 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200607-11.xml b/xml/htdocs/security/en/glsa/glsa-200607-11.xml
new file mode 100644
index 00000000..74cd04c4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200607-11.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200607-11">
+  <title>TunePimp: Buffer overflow</title>
+  <synopsis>
+    A vulnerability in TunePimp has been reported which could lead to the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Tunepimp</product>
+  <announced>July 28, 2006</announced>
+  <revised>June 01, 2007: 02</revised>
+  <bug>140184</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/tunepimp" auto="yes" arch="*">
+      <unaffected range="ge">0.5.0</unaffected>
+      <vulnerable range="le">0.4.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The TunePimp library (also referred to as libtunepimp) is a development
+    library geared towards developers who wish to create MusicBrainz
+    enabled tagging applications.
+    </p>
+  </background>
+  <description>
+    <p>
+    Kevin Kofler has reported a vulnerability where three stack variables
+    are allocated with 255, 255 and 100 bytes respectively, yet 256 bytes
+    are read into each. This could lead to buffer overflows.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Running an affected version of TunePimp could lead to the execution of
+    arbitrary code by a remote attacker.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All tunepimp users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/tunepimp-0.5.&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3600">CVE-2006-3600</uri>
+    <uri link="http://bugs.musicbrainz.org/ticket/1764">MusicBrainz bug #1764</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 25 Jul 2006 17:18:27 +0000">
+    dizzutch
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 27 Jul 2006 17:51:46 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200607-12.xml b/xml/htdocs/security/en/glsa/glsa-200607-12.xml
new file mode 100644
index 00000000..931e37d6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200607-12.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200607-12">
+  <title>OpenOffice.org: Multiple vulnerabilities</title>
+  <synopsis>
+    OpenOffice.org is affected by three security vulnerabilities which can be
+    exploited to allow the execution of arbitrary code by a remote attacker.
+  </synopsis>
+  <product type="ebuild">OpenOffice.org</product>
+  <announced>July 28, 2006</announced>
+  <revised>July 28, 2006: 01</revised>
+  <bug>138545</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/openoffice" auto="yes" arch="*">
+      <unaffected range="ge">2.0.3</unaffected>
+      <vulnerable range="lt">2.0.3</vulnerable>
+    </package>
+    <package name="app-office/openoffice-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.0.3</unaffected>
+      <vulnerable range="lt">2.0.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenOffice.org is an open source office productivity suite, including
+    word processing, spreadsheet, presentation, drawing, data charting,
+    formula editing, and file conversion facilities.
+    </p>
+  </background>
+  <description>
+    <p>
+    Internal security audits by OpenOffice.org have discovered three
+    security vulnerabilities related to Java applets, macros and the XML
+    file format parser.
+    </p>
+    <ul><li>Specially crafted Java applets can
+    break through the "sandbox".</li>
+    <li>Specially crafted macros make it
+    possible to inject BASIC code into documents which is executed when the
+    document is loaded.</li>
+    <li>Loading a malformed XML file can cause a
+    buffer overflow.</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker might exploit these vulnerabilities to escape the Java
+    sandbox, execute arbitrary code or BASIC code with the permissions of
+    the user running OpenOffice.org.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disabling Java applets will protect against the vulnerability in the
+    handling of Java applets. There are no workarounds for the macro and
+    file format vulnerabilities.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenOffice.org users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-2.0.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.openoffice.org/security/bulletin-20060629.html">OpenOffice.org Security Bulletin 2006-06-29</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-2199">CVE-2006-2199</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-2198">CVE-2006-2198</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-3117">CVE-2006-3117</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 19 Jul 2006 12:40:14 +0000">
+    dizzutch
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 20 Jul 2006 16:32:57 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200607-13.xml b/xml/htdocs/security/en/glsa/glsa-200607-13.xml
new file mode 100644
index 00000000..a2bf281f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200607-13.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200607-13">
+  <title>Audacious: Multiple heap and buffer overflows</title>
+  <synopsis>
+    The adplug library included in Audacious is vulnerable to various overflows
+    that could result in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">audacious</product>
+  <announced>July 29, 2006</announced>
+  <revised>July 29, 2006: 01</revised>
+  <bug>139957</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/audacious" auto="yes" arch="*">
+      <unaffected range="ge">1.1.0</unaffected>
+      <vulnerable range="lt">1.1.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Audacious is a media player that has been forked from Beep Media
+    Player.
+    </p>
+  </background>
+  <description>
+    <p>
+    Luigi Auriemma has found that the adplug library fails to verify the
+    size of the destination buffers in the unpacking instructions,
+    resulting in various possible heap and buffer overflows.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker can entice a user to load a specially crafted media file,
+    resulting in a crash or possible execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Audacious users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/audacious-1.1.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/439432/30/0/threaded">BugTraq Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3581">CVE-2006-3581</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3582">CVE-2006-3582</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 12 Jul 2006 17:07:27 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 16 Jul 2006 10:46:17 +0000">
+    daxomatic
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 17 Jul 2006 16:55:12 +0000">
+    koon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-01.xml b/xml/htdocs/security/en/glsa/glsa-200608-01.xml
new file mode 100644
index 00000000..640e69ee
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-01.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-01">
+  <title>Apache: Off-by-one flaw in mod_rewrite</title>
+  <synopsis>
+    A flaw in mod_rewrite could result in a Denial of Service or the execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">apache</product>
+  <announced>August 01, 2006</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>141986</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="rge">1.3.34-r14</unaffected>
+      <unaffected range="rge">1.3.37</unaffected>
+      <unaffected range="ge">2.0.58-r2</unaffected>
+      <vulnerable range="lt">2.0.58-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP server is one of the most popular web servers on the
+    Internet. The Apache module mod_rewrite provides a rule-based engine to
+    rewrite requested URLs on the fly.
+    </p>
+  </background>
+  <description>
+    <p>
+    An off-by-one flaw has been found in Apache's mod_rewrite module by
+    Mark Dowd of McAfee Avert Labs. This flaw is exploitable depending on
+    the types of rewrite rules being used.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit the flaw to cause a Denial of Service
+    or execution of arbitrary code. Note that Gentoo Linux is not
+    vulnerable in the default configuration.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Apache users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose www-servers/apache</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3747">CVE-2006-3747</uri>
+    <uri link="http://www.apache.org/dist/httpd/Announcement2.0.html">Apache HTTP Server 2.0 Announcement</uri>
+    <uri link="http://www.apache.org/dist/httpd/Announcement1.3.html">Apache HTTP Server 1.3 Announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 28 Jul 2006 11:10:33 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 28 Jul 2006 12:10:22 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 29 Jul 2006 21:48:21 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-02.xml b/xml/htdocs/security/en/glsa/glsa-200608-02.xml
new file mode 100644
index 00000000..bbabe7f2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-02.xml
@@ -0,0 +1,131 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-02">
+  <title>Mozilla SeaMonkey: Multiple vulnerabilities</title>
+  <synopsis>
+    The Mozilla Foundation has reported numerous security vulnerabilities
+    related to Mozilla SeaMonkey.
+  </synopsis>
+  <product type="ebuild">SeaMonkey</product>
+  <announced>August 03, 2006</announced>
+  <revised>August 03, 2006: 01</revised>
+  <bug>141842</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/seamonkey" auto="yes" arch="*">
+      <unaffected range="ge">1.0.3</unaffected>
+      <vulnerable range="lt">1.0.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Mozilla SeaMonkey project is a community effort to deliver
+    production-quality releases of code derived from the application
+    formerly known as "Mozilla Application Suite".
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities have been reported:
+    </p>
+    <ul>
+    <li>Benjamin Smedberg discovered that chrome URL's could be made to
+    reference remote files.</li>
+    <li>Developers in the Mozilla community
+    looked for and fixed several crash bugs to improve the stability of
+    Mozilla clients, which could lead to the execution of arbitrary code by
+    a remote attacker.</li>
+    <li>"shutdown" reports that cross-site
+    scripting (XSS) attacks could be performed using the construct
+    XPCNativeWrapper(window).Function(...), which created a function that
+    appeared to belong to the window in question even after it had been
+    navigated to the target site.</li>
+    <li>"shutdown" reports that scripts
+    granting the UniversalBrowserRead privilege can leverage that into the
+    equivalent of the far more powerful UniversalXPConnect since they are
+    allowed to "read" into a privileged context.</li>
+    <li>"moz_bug_r_a4"
+    reports that A malicious Proxy AutoConfig (PAC) server could serve a
+    PAC script that can execute code with elevated privileges by setting
+    the required FindProxyForURL function to the eval method on a
+    privileged object that leaked into the PAC sandbox.</li>
+    <li>"moz_bug_r_a4" discovered that Named JavaScript functions have a
+    parent object created using the standard Object() constructor
+    (ECMA-specified behavior) and that this constructor can be redefined by
+    script (also ECMA-specified behavior).</li>
+    <li>Igor Bukanov and
+    shutdown found additional places where an untimely garbage collection
+    could delete a temporary object that was in active use.</li>
+    <li>Georgi
+    Guninski found potential integer overflow issues with long strings in
+    the toSource() methods of the Object, Array and String objects as well
+    as string function arguments.</li>
+    <li>H. D. Moore reported a testcase
+    that was able to trigger a race condition where JavaScript garbage
+    collection deleted a temporary variable still being used in the
+    creation of a new Function object.</li>
+    <li>A malicious page can hijack
+    native DOM methods on a document object in another domain, which will
+    run the attacker's script when called by the victim page.</li>
+    <li>Secunia Research has discovered a vulnerability which is caused due
+    to an memory corruption error within the handling of simultaneously
+    happening XPCOM events. This leads to use of a deleted timer
+    object.</li>
+    <li>An anonymous researcher for TippingPoint and the Zero
+    Day Initiative showed that when used in a web page Java would reference
+    properties of the window.navigator object as it started up.</li>
+    <li>Thilo Girmann discovered that in certain circumstances a JavaScript
+    reference to a frame or window was not properly cleared when the
+    referenced content went away.</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A user can be enticed to open specially crafted URLs, visit webpages
+    containing malicious JavaScript or execute a specially crafted script.
+    These events could lead to the execution of arbitrary code, or the
+    installation of malware on the user's computer.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Thunderbird users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/seamonkey-1.0.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3113">CVE-2006-3113</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3677">CVE-2006-3677</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3801">CVE-2006-3801</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3802">CVE-2006-3802</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3803">CVE-2006-3803</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3804">CVE-2006-3804</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3805">CVE-2006-3805</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3806">CVE-2006-3806</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3807">CVE-2006-3807</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3808">CVE-2006-3808</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3809">CVE-2006-3809</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3810">CVE-2006-3810</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3811">CVE-2006-3811</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3812">CVE-2006-3812</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 28 Jul 2006 14:37:24 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 28 Jul 2006 18:00:11 +0000">
+    dizzutch
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 03 Aug 2006 16:55:20 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-03.xml b/xml/htdocs/security/en/glsa/glsa-200608-03.xml
new file mode 100644
index 00000000..06debbd1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-03.xml
@@ -0,0 +1,135 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-03">
+  <title>Mozilla Firefox: Multiple vulnerabilities</title>
+  <synopsis>
+    The Mozilla Foundation has reported numerous security vulnerabilities
+    related to Mozilla Firefox.
+  </synopsis>
+  <product type="ebuild">Firefox</product>
+  <announced>August 03, 2006</announced>
+  <revised>August 03, 2006: 01</revised>
+  <bug>141842</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.5</unaffected>
+      <vulnerable range="lt">1.5.0.5</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.5</unaffected>
+      <vulnerable range="lt">1.5.0.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Firefox is a redesign of the Mozilla Navigator component. The
+    goal is to produce a cross-platform stand-alone browser application.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities have been reported:
+    </p>
+    <ul>
+    <li>Benjamin Smedberg discovered that chrome URL's could be made to
+    reference remote files.</li>
+    <li>Developers in the Mozilla community
+    looked for and fixed several crash bugs to improve the stability of
+    Mozilla clients.</li>
+    <li>"shutdown" reports that cross-site scripting
+    (XSS) attacks could be performed using the construct
+    XPCNativeWrapper(window).Function(...), which created a function that
+    appeared to belong to the window in question even after it had been
+    navigated to the target site.</li>
+    <li>"shutdown" reports that scripts
+    granting the UniversalBrowserRead privilege can leverage that into the
+    equivalent of the far more powerful UniversalXPConnect since they are
+    allowed to "read" into a privileged context.</li>
+    <li>"moz_bug_r_a4"
+    reports that A malicious Proxy AutoConfig (PAC) server could serve a
+    PAC script that can execute code with elevated privileges by setting
+    the required FindProxyForURL function to the eval method on a
+    privileged object that leaked into the PAC sandbox.</li>
+    <li>"moz_bug_r_a4" discovered that Named JavaScript functions have a
+    parent object created using the standard Object() constructor
+    (ECMA-specified behavior) and that this constructor can be redefined by
+    script (also ECMA-specified behavior).</li>
+    <li>Igor Bukanov and
+    shutdown found additional places where an untimely garbage collection
+    could delete a temporary object that was in active use.</li>
+    <li>Georgi
+    Guninski found potential integer overflow issues with long strings in
+    the toSource() methods of the Object, Array and String objects as well
+    as string function arguments.</li>
+    <li>H. D. Moore reported a testcase
+    that was able to trigger a race condition where JavaScript garbage
+    collection deleted a temporary variable still being used in the
+    creation of a new Function object.</li>
+    <li>A malicious page can hijack
+    native DOM methods on a document object in another domain, which will
+    run the attacker's script when called by the victim page.</li>
+    <li>Secunia Research has discovered a vulnerability which is caused due
+    to an memory corruption error within the handling of simultaneously
+    happening XPCOM events. This leads to use of a deleted timer
+    object.</li>
+    <li>An anonymous researcher for TippingPoint and the Zero
+    Day Initiative showed that when used in a web page Java would reference
+    properties of the window.navigator object as it started up.</li>
+    <li>Thilo Girmann discovered that in certain circumstances a JavaScript
+    reference to a frame or window was not properly cleared when the
+    referenced content went away.</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A user can be enticed to open specially crafted URLs, visit webpages
+    containing malicious JavaScript or execute a specially crafted script.
+    These events could lead to the execution of arbitrary code, or the
+    installation of malware on the user's computer.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-1.5.0.5&quot;</code>
+    <p>
+    Users of the binary package should upgrade as well:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-1.5.0.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3113">CVE-2006-3113</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3677">CVE-2006-3677</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3801">CVE-2006-3801</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3802">CVE-2006-3802</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3803">CVE-2006-3803</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3805">CVE-2006-3805</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3806">CVE-2006-3806</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3807">CVE-2006-3807</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3808">CVE-2006-3808</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3809">CVE-2006-3809</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3810">CVE-2006-3810</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3811">CVE-2006-3811</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3812">CVE-2006-3812</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 28 Jul 2006 18:10:10 +0000">
+    dizzutch
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 03 Aug 2006 16:55:03 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-04.xml b/xml/htdocs/security/en/glsa/glsa-200608-04.xml
new file mode 100644
index 00000000..b0100f72
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-04.xml
@@ -0,0 +1,128 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-04">
+  <title>Mozilla Thunderbird: Multiple vulnerabilities</title>
+  <synopsis>
+    The Mozilla Foundation has reported numerous security vulnerabilities
+    related to Mozilla Thunderbird.
+  </synopsis>
+  <product type="ebuild">Thunderbird</product>
+  <announced>August 03, 2006</announced>
+  <revised>August 03, 2006: 01</revised>
+  <bug>141842</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/mozilla-thunderbird" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.5</unaffected>
+      <vulnerable range="lt">1.5.0.5</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.5</unaffected>
+      <vulnerable range="lt">1.5.0.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Mozilla Thunderbird mail client is a redesign of the Mozilla Mail
+    component. The goal is to produce a cross-platform stand-alone mail
+    application using XUL (XML User Interface Language).
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities have been reported:
+    </p>
+    <ul>
+    <li>Benjamin Smedberg discovered that chrome URLss could be made to
+    reference remote files.</li>
+    <li>Developers in the Mozilla community
+    looked for and fixed several crash bugs to improve the stability of
+    Mozilla clients.</li>
+    <li>"shutdown" reports that cross-site scripting
+    (XSS) attacks could be performed using the construct
+    XPCNativeWrapper(window).Function(...), which created a function that
+    appeared to belong to the window in question even after it had been
+    navigated to the target site.</li>
+    <li>"shutdown" reports that scripts
+    granting the UniversalBrowserRead privilege can leverage that into the
+    equivalent of the far more powerful UniversalXPConnect since they are
+    allowed to "read" into a privileged context.</li>
+    <li>"moz_bug_r_a4"
+    discovered that Named JavaScript functions have a parent object created
+    using the standard Object() constructor (ECMA-specified behavior) and
+    that this constructor can be redefined by script (also ECMA-specified
+    behavior).</li>
+    <li>Igor Bukanov and shutdown found additional places
+    where an untimely garbage collection could delete a temporary object
+    that was in active use.</li>
+    <li>Georgi Guninski found potential
+    integer overflow issues with long strings in the toSource() methods of
+    the Object, Array and String objects as well as string function
+    arguments.</li>
+    <li>H. D. Moore reported a testcase that was able to
+    trigger a race condition where JavaScript garbage collection deleted a
+    temporary variable still being used in the creation of a new Function
+    object.</li>
+    <li>A malicious page can hijack native DOM methods on a
+    document object in another domain, which will run the attacker's script
+    when called by the victim page.</li>
+    <li>Secunia Research has
+    discovered a vulnerability which is caused due to an memory corruption
+    error within the handling of simultaneously happening XPCOM events.
+    This leads to use of a deleted timer object.</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A user can be enticed to open specially crafted URLs, visit webpages
+    containing malicious JavaScript or execute a specially crafted script.
+    These events could lead to the execution of arbitrary code, or the
+    installation of malware on the user's computer.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Thunderbird users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-1.5.0.5&quot;</code>
+    <p>
+    All Mozilla Thunderbird binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-bin-1.5.0.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3113">CVE-2006-3113</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3802">CVE-2006-3802</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3803">CVE-2006-3803</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3804">CVE-2006-3804</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3805">CVE-2006-3805</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3806">CVE-2006-3806</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3807">CVE-2006-3807</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3809">CVE-2006-3809</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3810">CVE-2006-3810</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3811">CVE-2006-3811</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3812">CVE-2006-3812</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 28 Jul 2006 14:37:07 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 28 Jul 2006 18:08:55 +0000">
+    dizzutch
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 03 Aug 2006 16:54:43 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-05.xml b/xml/htdocs/security/en/glsa/glsa-200608-05.xml
new file mode 100644
index 00000000..e96fdf2a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-05.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-05">
+  <title>LibVNCServer: Authentication bypass</title>
+  <synopsis>
+    VNC servers created with LibVNCServer accept insecure protocol types, even
+    when the server does not offer it, resulting in unauthorized access to the
+    server.
+  </synopsis>
+  <product type="ebuild">libvncserver</product>
+  <announced>August 04, 2006</announced>
+  <revised>August 04, 2006: 01</revised>
+  <bug>136916</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-libs/libvncserver" auto="yes" arch="*">
+      <unaffected range="ge">0.8.2</unaffected>
+      <vulnerable range="lt">0.8.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    LibVNCServer is a GPL'ed library for creating VNC servers.
+    </p>
+  </background>
+  <description>
+    <p>
+    LibVNCServer fails to properly validate protocol types effectively
+    letting users decide what protocol to use, such as "Type 1 - None".
+    LibVNCServer will accept this security type, even if it is not offered
+    by the server.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could use this vulnerability to gain unauthorized access
+    with the privileges of the user running the VNC server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All LibVNCServer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/libvncserver-0.8.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2450">CVE-2006-2450</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 29 Jul 2006 16:47:24 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 29 Jul 2006 16:50:23 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 31 Jul 2006 01:51:07 +0000">
+    hlieberman
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-06.xml b/xml/htdocs/security/en/glsa/glsa-200608-06.xml
new file mode 100644
index 00000000..6865b2be
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-06.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-06">
+  <title>Courier MTA: Denial of Service vulnerability</title>
+  <synopsis>
+    Courier MTA has fixed a DoS issue related to usernames containing a "="
+    character.
+  </synopsis>
+  <product type="ebuild">Courier</product>
+  <announced>August 04, 2006</announced>
+  <revised>August 04, 2006: 01</revised>
+  <bug>135005</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-mta/courier" auto="yes" arch="*">
+      <unaffected range="ge">0.53.2</unaffected>
+      <vulnerable range="lt">0.53.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Courier MTA is an integrated mail and groupware server based on open
+    protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    Courier MTA has fixed a security issue relating to usernames containing
+    the "=" character, causing high CPU utilization.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit this vulnerability by sending a specially
+    crafted email to a mail gateway running a vulnerable version of Courier
+    MTA.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Courier MTA users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-mta/courier-0.53.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2659">CVE-2006-2659</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 02 Aug 2006 13:22:29 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 02 Aug 2006 13:22:37 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 02 Aug 2006 13:39:08 +0000">
+    dizzutch
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-07.xml b/xml/htdocs/security/en/glsa/glsa-200608-07.xml
new file mode 100644
index 00000000..431b5b86
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-07.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-07">
+  <title>libTIFF: Multiple vulnerabilities</title>
+  <synopsis>
+    libTIFF contains several vulnerabilities that could result in arbitrary
+    code execution.
+  </synopsis>
+  <product type="ebuild">tiff</product>
+  <announced>August 04, 2006</announced>
+  <revised>August 04, 2006: 01</revised>
+  <bug>142383</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/tiff" auto="yes" arch="*">
+      <unaffected range="ge">3.8.2-r2</unaffected>
+      <vulnerable range="lt">3.8.2-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libTIFF provides support for reading and manipulating TIFF images.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Google Security Team discovered several heap and
+    stack buffer overflows and other flaws in libTIFF. The affected parts
+    include the TIFFFetchShortPair(), TIFFScanLineSize() and
+    EstimateStripByteCounts() functions, and the PixarLog and NeXT RLE
+    decoders.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted TIFF
+    file, resulting in the possible execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libTIFF users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/tiff-3.8.2-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3459">CVE-2006-3459</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3460">CVE-2006-3460</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3461">CVE-2006-3461</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3462">CVE-2006-3462</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3463">CVE-2006-3463</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3464">CVE-2006-3464</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3465">CVE-2006-3465</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 03 Aug 2006 11:25:07 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 04 Aug 2006 09:34:08 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-08.xml b/xml/htdocs/security/en/glsa/glsa-200608-08.xml
new file mode 100644
index 00000000..10f5c5c4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-08.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-08">
+  <title>GnuPG: Integer overflow vulnerability</title>
+  <synopsis>
+    GnuPG is vulnerable to an integer overflow that could lead to the execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">gnupg</product>
+  <announced>August 05, 2006</announced>
+  <revised>August 08, 2006: 02</revised>
+  <bug>142248</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/gnupg" auto="yes" arch="*">
+      <unaffected range="ge">1.4.5</unaffected>
+      <vulnerable range="lt">1.4.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The GNU Privacy Guard, GnuPG, is a free replacement for the PGP suite
+    of cryptographic software.
+    </p>
+  </background>
+  <description>
+    <p>
+    Evgeny Legerov discovered a vulnerability in GnuPG that when certain
+    packets are handled an integer overflow may occur.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By sending a specially crafted email to a user running an affected
+    version of GnuPG, a remote attacker could possibly execute arbitrary
+    code with the permissions of the user running GnuPG.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GnuPG users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;=app-crypt/gnupg-1.4*&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3746">CVE-2006-3746</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 02 Aug 2006 13:24:55 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 02 Aug 2006 13:48:08 +0000">
+    dizzutch
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 05 Aug 2006 11:09:20 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-09.xml b/xml/htdocs/security/en/glsa/glsa-200608-09.xml
new file mode 100644
index 00000000..17c841f7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-09.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-09">
+  <title>MySQL: Denial of Service</title>
+  <synopsis>
+    An authenticated user can crash MySQL through invalid parameters to the
+    date_format function.
+  </synopsis>
+  <product type="ebuild">mysql</product>
+  <announced>August 06, 2006</announced>
+  <revised>August 07, 2006: 02</revised>
+  <bug>142429</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/mysql" auto="yes" arch="*">
+      <unaffected range="ge">4.1.21</unaffected>
+      <unaffected range="lt">4.1.0</unaffected>
+      <vulnerable range="lt">4.1.21</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MySQL is a popular multi-threaded, multi-user SQL server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jean-David Maillefer discovered a format string vulnerability in
+    time.cc where MySQL fails to properly handle specially formatted user
+    input to the date_format function.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By specifying a format string as the first parameter to the date_format
+    function, an authenticated attacker could cause MySQL to crash,
+    resulting in a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MySQL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --verbose --oneshot &quot;&gt;=dev-db/mysql-4.1.21&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3469">CVE-2006-3469</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 06 Aug 2006 17:22:07 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 06 Aug 2006 17:22:38 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 06 Aug 2006 18:32:52 +0000">
+    hlieberman
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-10.xml b/xml/htdocs/security/en/glsa/glsa-200608-10.xml
new file mode 100644
index 00000000..f77af97c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-10.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-10">
+  <title>pike: SQL injection vulnerability</title>
+  <synopsis>
+    A flaw in the input handling could lead to the execution of arbitrary SQL
+    statements in the underlying PostgreSQL database.
+  </synopsis>
+  <product type="ebuild">pike</product>
+  <announced>August 06, 2006</announced>
+  <revised>December 13, 2006: 02</revised>
+  <bug>136065</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/pike" auto="yes" arch="*">
+      <unaffected range="ge">7.6.86</unaffected>
+      <vulnerable range="lt">7.6.86</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Pike is a general purpose programming language, able to be used for
+    multiple tasks.
+    </p>
+  </background>
+  <description>
+    <p>
+    Some input is not properly sanitised before being used in a SQL
+    statement in the underlying PostgreSQL database.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could provide malicious input to a pike program,
+    which might result in the execution of arbitrary SQL statements.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All pike users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/pike-7.6.86&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://secunia.com/advisories/20494/">Secunia Advisory SA20494</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4041">CVE-2006-4041</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 05 Aug 2006 16:54:41 +0000">
+    koon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 05 Aug 2006 16:55:04 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 05 Aug 2006 17:42:54 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-11.xml b/xml/htdocs/security/en/glsa/glsa-200608-11.xml
new file mode 100644
index 00000000..4802ad5f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-11.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-11">
+  <title>Webmin, Usermin: File Disclosure</title>
+  <synopsis>
+    Webmin and Usermin are vulnerable to an arbitrary file disclosure through a
+    specially crafted URL.
+  </synopsis>
+  <product type="ebuild">webmin/usermin</product>
+  <announced>August 06, 2006</announced>
+  <revised>August 06, 2006: 01</revised>
+  <bug>138552</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-admin/webmin" auto="yes" arch="*">
+      <unaffected range="ge">1.290</unaffected>
+      <vulnerable range="lt">1.290</vulnerable>
+    </package>
+    <package name="app-admin/usermin" auto="yes" arch="*">
+      <unaffected range="ge">1.220</unaffected>
+      <vulnerable range="lt">1.220</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Webmin is a web-based interface for Unix-like systems. Usermin is a
+    simplified version of Webmin designed for use by normal users rather
+    than system administrators.
+    </p>
+  </background>
+  <description>
+    <p>
+    A vulnerability in both Webmin and Usermin has been discovered by Kenny
+    Chen, wherein simplify_path is called before the HTML is decoded.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A non-authenticated user can read any file on the server using a
+    specially crafted URL.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    For a temporary workaround, IP Access Control can be setup on Webmin
+    and Usermin.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Webmin users should update to the latest stable version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --verbose --oneshot &quot;&gt;=app-admin/webmin-1.290&quot;</code>
+    <p>
+    All Usermin users should update to the latest stable version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --verbose --oneshot &quot;&gt;=app-admin/usermin-1.220&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3392">CVE-2006-3392</uri>
+  </references>
+  <metadata tag="">
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 06 Aug 2006 17:23:21 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 06 Aug 2006 18:24:45 +0000">
+    hlieberman
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-12.xml b/xml/htdocs/security/en/glsa/glsa-200608-12.xml
new file mode 100644
index 00000000..14a2a871
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-12.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-12">
+  <title>x11vnc: Authentication bypass in included LibVNCServer code</title>
+  <synopsis>
+    VNC servers created with x11vnc accept insecure protocol types, even when
+    the server does not offer it, resulting in the possibility of unauthorized
+    access to the server.
+  </synopsis>
+  <product type="ebuild">x11vnc</product>
+  <announced>August 07, 2006</announced>
+  <revised>August 07, 2006: 01</revised>
+  <bug>142559</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-misc/x11vnc" auto="yes" arch="*">
+      <unaffected range="ge">0.8.1</unaffected>
+      <vulnerable range="lt">0.8.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    x11vnc provides VNC servers for X displays.
+    </p>
+  </background>
+  <description>
+    <p>
+    x11vnc includes vulnerable LibVNCServer code, which fails to properly
+    validate protocol types effectively letting users decide what protocol
+    to use, such as "Type 1 - None" (GLSA-200608-05). x11vnc will accept
+    this security type, even if it is not offered by the server.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could exploit this vulnerability to gain unauthorized
+    access with the privileges of the user running the VNC server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All x11vnc users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-misc/x11vnc-0.8.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2450">CVE-2006-2450</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200608-05.xml">GLSA-200608-05</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 05 Aug 2006 07:18:47 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 05 Aug 2006 16:44:29 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 05 Aug 2006 17:17:11 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-13.xml b/xml/htdocs/security/en/glsa/glsa-200608-13.xml
new file mode 100644
index 00000000..4a71b0db
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-13.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-13">
+  <title>ClamAV: Heap buffer overflow</title>
+  <synopsis>
+    ClamAV is vulnerable to a heap-based buffer overflow resulting in a Denial
+    of Service and potentially remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>August 08, 2006</announced>
+  <revised>August 08, 2006: 02</revised>
+  <bug>143093</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.88.4</unaffected>
+      <vulnerable range="lt">0.88.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ClamAV is a GPL virus scanner.
+    </p>
+  </background>
+  <description>
+    <p>
+    Damian Put has discovered a boundary error in the pefromupx() function
+    used by the UPX extraction module, which unpacks PE Windows executable
+    files. Both the "clamscan" command-line utility and the "clamd" daemon
+    are affected.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By sending a malicious attachment to a mail server running ClamAV, a
+    remote attacker can cause a Denial of Service and potentially the
+    execution of arbitrary code with the permissions of the user running
+    ClamAV.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.88.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.clamav.net/security/0.88.4.html">ClamAV security advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4018">CVE-2006-4018</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 08 Aug 2006 07:45:00 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 08 Aug 2006 09:57:22 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-14.xml b/xml/htdocs/security/en/glsa/glsa-200608-14.xml
new file mode 100644
index 00000000..c79b35da
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-14.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-14">
+  <title>DUMB: Heap buffer overflow</title>
+  <synopsis>
+    A heap-based buffer overflow in DUMB could result in the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">dumb</product>
+  <announced>August 08, 2006</announced>
+  <revised>August 08, 2006: 01</revised>
+  <bug>142387</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/dumb" auto="yes" arch="*">
+      <unaffected range="ge">0.9.3-r1</unaffected>
+      <vulnerable range="lt">0.9.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    DUMB (Dynamic Universal Music Bibliotheque) is an IT, XM, S3M and MOD
+    player library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Luigi Auriemma found a heap-based buffer overflow in the
+    it_read_envelope function which reads the envelope values for volume,
+    pan and pitch of the instruments referenced in a ".it" (Impulse
+    Tracker) file with a large number of nodes.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to load a malicious ".it" (Impulse Tracker) file, an
+    attacker may execute arbitrary code with the rights of the user running
+    the application that uses a vulnerable DUMB library.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users of DUMB should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/dumb-0.9.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3668">CVE-2006-3668</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 05 Aug 2006 16:58:21 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 05 Aug 2006 17:55:25 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 08 Aug 2006 09:58:20 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-15.xml b/xml/htdocs/security/en/glsa/glsa-200608-15.xml
new file mode 100644
index 00000000..59705ba6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-15.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-15">
+  <title>MIT Kerberos 5: Multiple local privilege escalation vulnerabilities</title>
+  <synopsis>
+    Some applications shipped with MIT Kerberos 5 are vulnerable to local
+    privilege escalation.
+  </synopsis>
+  <product type="ebuild">MIT Kerberos 5</product>
+  <announced>August 10, 2006</announced>
+  <revised>August 10, 2006: 01</revised>
+  <bug>143240</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-crypt/mit-krb5" auto="yes" arch="*">
+      <unaffected range="ge">1.4.3-r3</unaffected>
+      <vulnerable range="lt">1.4.3-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MIT Kerberos 5 is a suite of applications that implement the Kerberos
+    network protocol. It is designed to provide strong authentication for
+    client/server applications by using secret-key cryptography.
+    </p>
+  </background>
+  <description>
+    <p>
+    Unchecked calls to setuid() in krshd and v4rcp, as well as unchecked
+    calls to seteuid() in kftpd and in ksu, have been found in the MIT
+    Kerberos 5 program suite and may lead to a local root privilege
+    escalation.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could exploit this vulnerability to execute arbitrary
+    code with elevated privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MIT Kerberos 5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-crypt/mit-krb5-1.4.3-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3083">CVE-2006-3083</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3084">CVE-2006-3084</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 09 Aug 2006 18:31:59 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 09 Aug 2006 20:23:17 +0000">
+    daxomatic
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 10 Aug 2006 14:34:58 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-16.xml b/xml/htdocs/security/en/glsa/glsa-200608-16.xml
new file mode 100644
index 00000000..e84817cd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-16.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-16">
+  <title>Warzone 2100 Resurrection: Multiple buffer overflows</title>
+  <synopsis>
+    Warzone 2100 Resurrection server and client are vulnerable to separate
+    buffer overflows, potentially allowing remote code execution.
+  </synopsis>
+  <product type="ebuild">warzone2100</product>
+  <announced>August 10, 2006</announced>
+  <revised>September 04, 2006: 02</revised>
+  <bug>142389</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-strategy/warzone2100" auto="yes" arch="*">
+      <unaffected range="ge">2.0.4</unaffected>
+      <vulnerable range="le">2.0.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Warzone 2100 Resurrection is a real-time strategy game, developed by
+    Pumpkin Studios and published by Eidos Interactive.
+    </p>
+  </background>
+  <description>
+    <p>
+    Luigi Auriemma discovered two buffer overflow vulnerabilities in
+    Warzone 2100 Resurrection. The recvTextMessage function of the Warzone
+    2100 Resurrection server and the NETrecvFile function of the client use
+    insufficiently sized buffers.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit these vulnerabilities by sending
+    specially crafted input to the server, or enticing a user to load a
+    specially crafted file from a malicious server. This may result in the
+    execution of arbitrary code with the permissions of the user running
+    Warzone 2100 Resurrection.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround for this issue.
+    </p>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Warzone 2100 Resurrection users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-strategy/warzone2100-2.0.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3849">CVE-2006-3849</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 07 Aug 2006 07:47:59 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 07 Aug 2006 07:48:19 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 07 Aug 2006 12:17:00 +0000">
+    dizzutch
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-17.xml b/xml/htdocs/security/en/glsa/glsa-200608-17.xml
new file mode 100644
index 00000000..a29327bd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-17.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-17">
+  <title>libwmf: Buffer overflow vulnerability</title>
+  <synopsis>
+    libwmf is vulnerable to an integer overflow potentially resulting in the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">libwmf</product>
+  <announced>August 10, 2006</announced>
+  <revised>August 10, 2006: 01</revised>
+  <bug>139325</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libwmf" auto="yes" arch="*">
+      <unaffected range="ge">0.2.8.4</unaffected>
+      <vulnerable range="lt">0.2.8.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libwmf is a library for reading and converting vector images in
+    Microsoft's native Windows Metafile Format (WMF).
+    </p>
+  </background>
+  <description>
+    <p>
+    infamous41md discovered that libwmf fails to do proper bounds checking
+    on the MaxRecordSize variable in the WMF file header. This could lead
+    to an head-based buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to open a specially crafted WMF file, a remote
+    attacker could cause a heap-based buffer overflow and execute arbitrary
+    code with the permissions of the user running the application that uses
+    libwmf.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround for this issue.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libwmf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libwmf-0.2.8.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3376">CVE-2006-3376</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 07 Aug 2006 08:01:55 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 07 Aug 2006 12:39:07 +0000">
+    dizzutch
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 08 Aug 2006 11:33:41 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-18.xml b/xml/htdocs/security/en/glsa/glsa-200608-18.xml
new file mode 100644
index 00000000..ddc92b29
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-18.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-18">
+  <title>Net::Server: Format string vulnerability</title>
+  <synopsis>
+    A format string vulnerability has been reported in Net::Server which can be
+    exploited to cause a Denial of Service.
+  </synopsis>
+  <product type="ebuild">net-server</product>
+  <announced>August 10, 2006</announced>
+  <revised>August 10, 2006: 01</revised>
+  <bug>142386</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-perl/net-server" auto="yes" arch="*">
+      <unaffected range="ge">0.88</unaffected>
+      <vulnerable range="lt">0.88</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Net::Server is an extensible, generic Perl server engine. It is used by
+    several Perl applications like Postgrey.
+    </p>
+  </background>
+  <description>
+    <p>
+    The log function of Net::Server does not handle format string
+    specifiers properly before they are sent to syslog.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a specially crafted datastream to an application using
+    Net::Server, an attacker could cause a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Net::Server should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-perl/net-server-0.88&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1127">CVE-2005-1127</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 07 Aug 2006 08:06:01 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 07 Aug 2006 12:30:18 +0000">
+    dizzutch
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 08 Aug 2006 10:05:21 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-19.xml b/xml/htdocs/security/en/glsa/glsa-200608-19.xml
new file mode 100644
index 00000000..91fcb383
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-19.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-19">
+  <title>WordPress: Privilege escalation</title>
+  <synopsis>
+    A flaw in WordPress allows registered WordPress users to elevate
+    privileges.
+  </synopsis>
+  <product type="ebuild">wordpress</product>
+  <announced>August 10, 2006</announced>
+  <revised>December 13, 2006: 02</revised>
+  <bug>142142</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/wordpress" auto="yes" arch="*">
+      <unaffected range="ge">2.0.4</unaffected>
+      <vulnerable range="lt">2.0.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    WordPress is a PHP and MySQL based multiuser blogging system.
+    </p>
+  </background>
+  <description>
+    <p>
+    The WordPress developers have confirmed a vulnerability in capability
+    checking for plugins.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By exploiting a flaw, a user can circumvent WordPress access
+    restrictions when using plugins. The actual impact depends on the
+    configuration of WordPress and may range from trivial to critical,
+    possibly even the execution of arbitrary PHP code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All WordPress users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/wordpress-2.0.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3389">CVE-2006-3389</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3390">CVE-2006-3390</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4028">CVE-2006-4028</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 07 Aug 2006 16:38:11 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 08 Aug 2006 02:48:29 +0000">
+    dizzutch
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 08 Aug 2006 13:15:28 +0000">
+    frilled
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-20.xml b/xml/htdocs/security/en/glsa/glsa-200608-20.xml
new file mode 100644
index 00000000..7a22d363
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-20.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-20">
+  <title>Ruby on Rails: Several vulnerabilities</title>
+  <synopsis>
+    Ruby on Rails has some weaknesses potentially allowing a Denial of Service
+    and maybe the remote execution of arbitrary Ruby scripts.
+  </synopsis>
+  <product type="ebuild">rails</product>
+  <announced>August 14, 2006</announced>
+  <revised>December 13, 2006: 02</revised>
+  <bug>143369</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-ruby/rails" auto="yes" arch="*">
+      <unaffected range="ge">1.1.6</unaffected>
+      <vulnerable range="lt">1.1.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ruby on Rails is an open-source web framework.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Ruby on Rails developers have corrected some weaknesses in
+    action_controller/, relative to the handling of the user input and the
+    LOAD_PATH variable. A remote attacker could inject arbitrary entries
+    into the LOAD_PATH variable and alter the main Ruby on Rails process.
+    The security hole has only been partly solved in version 1.1.5. Version
+    1.1.6 now fully corrects it.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker that would exploit these weaknesses might cause a
+    Denial of Service of the web framework and maybe inject arbitrary Ruby
+    scripts.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ruby on Rails users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-ruby/rails-1.1.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://weblog.rubyonrails.org/2006/8/9/rails-1-1-5-mandatory-security-patch-and-other-tidbits">Ruby on Rails original advisory (1.1.5)</uri>
+    <uri link="http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure">Ruby on Rails update  (1.1.6)</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4111">CVE-2006-4111</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4112">CVE-2006-4112</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 10 Aug 2006 07:34:02 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 10 Aug 2006 14:54:45 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 10 Aug 2006 21:05:59 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-21.xml b/xml/htdocs/security/en/glsa/glsa-200608-21.xml
new file mode 100644
index 00000000..9161435a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-21.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-21">
+  <title>Heimdal: Multiple local privilege escalation vulnerabilities</title>
+  <synopsis>
+    Certain Heimdal components, ftpd and rcp, are vulnerable to a local
+    privilege escalation.
+  </synopsis>
+  <product type="ebuild">Heimdal</product>
+  <announced>August 23, 2006</announced>
+  <revised>August 23, 2006: 01</revised>
+  <bug>143371</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-crypt/heimdal" auto="yes" arch="*">
+      <unaffected range="ge">0.7.2-r3</unaffected>
+      <vulnerable range="lt">0.7.2-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Heimdal is a free implementation of Kerberos 5.
+    </p>
+  </background>
+  <description>
+    <p>
+    The ftpd and rcp applications provided by Heimdal fail to check the
+    return value of calls to seteuid().
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could exploit this vulnerability to execute arbitrary
+    code with elevated privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Heimdal users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-crypt/heimdal-0.7.2-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.pdc.kth.se/heimdal/advisory/2006-08-08/">Official advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3083">CVE-2006-3083</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3084">CVE-2006-3084</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 12 Aug 2006 15:34:55 +0000">
+    koon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 13 Aug 2006 22:34:21 +0000">
+    daxomatic
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 14 Aug 2006 15:19:23 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-22.xml b/xml/htdocs/security/en/glsa/glsa-200608-22.xml
new file mode 100644
index 00000000..697e2546
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-22.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-22">
+  <title>fbida: Arbitrary command execution</title>
+  <synopsis>
+    The fbgs script provided by fbida allows the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">fbida</product>
+  <announced>August 23, 2006</announced>
+  <revised>August 23, 2006: 01</revised>
+  <bug>141684</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/fbida" auto="yes" arch="*">
+      <unaffected range="ge">2.03-r4</unaffected>
+      <vulnerable range="lt">2.03-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    fbida is a collection of image viewers and editors for the framebuffer
+    console and X11. fbgs is a PostScript and PDF viewer for the linux
+    framebuffer console.
+    </p>
+  </background>
+  <description>
+    <p>
+    Toth Andras has discovered a typographic mistake in the "fbgs" script,
+    shipped with fbida if the "fbcon" and "pdf" USE flags are both enabled.
+    This script runs "gs" without the -dSAFER option, thus allowing a
+    PostScript file to execute, delete or create any kind of file on the
+    system.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker can entice a vulnerable user to view a malicious
+    PostScript or PDF file with fbgs, which may result with the execution
+    of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All fbida users with the "fbcon" and "pdf" USE flags both enabled
+    should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/fbida-2.03-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3119">CVE-2006-3119</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 19 Aug 2006 16:25:22 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 21 Aug 2006 14:00:00 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 23 Aug 2006 14:19:22 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-23.xml b/xml/htdocs/security/en/glsa/glsa-200608-23.xml
new file mode 100644
index 00000000..fc223cd3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-23.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-23">
+  <title>Heartbeat: Denial of Service</title>
+  <synopsis>
+    Heartbeat is vulnerable to a Denial of Service which can be triggered by a
+    remote attacker without authentication.
+  </synopsis>
+  <product type="ebuild">heartbeat</product>
+  <announced>August 24, 2006</announced>
+  <revised>September 22, 2006: 02</revised>
+  <bug>141894</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-cluster/heartbeat" auto="yes" arch="*">
+      <unaffected range="ge">2.0.7</unaffected>
+      <unaffected range="rge">1.2.5</unaffected>
+      <vulnerable range="lt">2.0.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Heartbeat is a component of the High-Availability Linux project. It is
+    used to perform death-of-node detection, communications and cluster
+    management.
+    </p>
+  </background>
+  <description>
+    <p>
+    Yan Rong Ge discovered that the peel_netstring() function in
+    cl_netstring.c does not validate the "length" parameter of user input,
+    which can lead to an out-of-bounds memory access when processing
+    certain Heartbeat messages (CVE-2006-3121). Furthermore an unspecified
+    local DoS issue was fixed (CVE-2006-3815).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a malicious UDP Heartbeat message, even before
+    authentication, a remote attacker can crash the master control process
+    of the cluster.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Heartbeat users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose sys-cluster/heartbeat</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3121">CVE-2006-3121</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3815">CVE-2006-3815</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 19 Aug 2006 16:22:39 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 21 Aug 2006 14:22:38 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 23 Aug 2006 14:19:23 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-24.xml b/xml/htdocs/security/en/glsa/glsa-200608-24.xml
new file mode 100644
index 00000000..f5fe1192
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-24.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-24">
+  <title>AlsaPlayer: Multiple buffer overflows</title>
+  <synopsis>
+    AlsaPlayer is vulnerable to multiple buffer overflows which could lead to
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">AlsaPlayer</product>
+  <announced>August 26, 2006</announced>
+  <revised>August 26, 2006: 01</revised>
+  <bug>143402</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/alsaplayer" auto="yes" arch="*">
+      <vulnerable range="le">0.99.76-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    AlsaPlayer is a heavily multithreaded PCM player that tries to utilize
+    ALSA utilities and drivers. As of June 2004, the project is inactive.
+    </p>
+  </background>
+  <description>
+    <p>
+    AlsaPlayer contains three buffer overflows: in the function that
+    handles the HTTP connections, the GTK interface, and the CDDB querying
+    mechanism.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit the first vulnerability by enticing a user to
+    load a malicious URL resulting in the execution of arbitrary code with
+    the permissions of the user running AlsaPlayer.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    AlsaPlayer has been masked in Portage pending the resolution of these
+    issues. AlsaPlayer users are advised to uninstall the package until
+    further notice:
+    </p>
+    <code>
+    # emerge --ask --unmerge &quot;media-sound/alsaplayer&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-4089">CVE-2006-4089</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 18 Aug 2006 15:04:43 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 18 Aug 2006 21:34:55 +0000">
+    hlieberman
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 18 Aug 2006 21:40:51 +0000">
+    hlieberman
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-25.xml b/xml/htdocs/security/en/glsa/glsa-200608-25.xml
new file mode 100644
index 00000000..f6f1715e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-25.xml
@@ -0,0 +1,165 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-25">
+  <title>X.org and some X.org libraries: Local privilege escalations</title>
+  <synopsis>
+    X.org, libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm are vulnerable
+    to local privilege escalations because of unchecked setuid() calls.
+  </synopsis>
+  <product type="ebuild">xorg-x11,xorg-server,xtrans,xload,xinit,xterm,xf86dga,xdm,libX11</product>
+  <announced>August 28, 2006</announced>
+  <revised>December 13, 2006: 02</revised>
+  <bug>135974</bug>
+  <access>local</access>
+  <affected>
+    <package name="x11-apps/xdm" auto="yes" arch="*">
+      <unaffected range="ge">1.0.4-r1</unaffected>
+      <vulnerable range="lt">1.0.4-r1</vulnerable>
+    </package>
+    <package name="x11-apps/xinit" auto="yes" arch="*">
+      <unaffected range="ge">1.0.2-r6</unaffected>
+      <vulnerable range="lt">1.0.2-r6</vulnerable>
+    </package>
+    <package name="x11-apps/xload" auto="yes" arch="*">
+      <unaffected range="ge">1.0.1-r1</unaffected>
+      <vulnerable range="lt">1.0.1-r1</vulnerable>
+    </package>
+    <package name="x11-apps/xf86dga" auto="yes" arch="*">
+      <unaffected range="ge">1.0.1-r1</unaffected>
+      <vulnerable range="lt">1.0.1-r1</vulnerable>
+    </package>
+    <package name="x11-base/xorg-x11" auto="yes" arch="*">
+      <unaffected range="rge">6.8.2-r8</unaffected>
+      <unaffected range="ge">6.9.0-r2</unaffected>
+      <vulnerable range="lt">6.9.0-r2</vulnerable>
+    </package>
+    <package name="x11-base/xorg-server" auto="yes" arch="*">
+      <unaffected range="rge">1.0.2-r6</unaffected>
+      <unaffected range="ge">1.1.0-r1</unaffected>
+      <vulnerable range="lt">1.1.0-r1</vulnerable>
+    </package>
+    <package name="x11-libs/libx11" auto="yes" arch="*">
+      <unaffected range="ge">1.0.1-r1</unaffected>
+      <vulnerable range="lt">1.0.1-r1</vulnerable>
+    </package>
+    <package name="x11-libs/xtrans" auto="yes" arch="*">
+      <unaffected range="ge">1.0.0-r1</unaffected>
+      <vulnerable range="lt">1.0.0-r1</vulnerable>
+    </package>
+    <package name="x11-terms/xterm" auto="yes" arch="*">
+      <unaffected range="ge">215</unaffected>
+      <vulnerable range="lt">215</vulnerable>
+    </package>
+    <package name="app-emulation/emul-linux-x86-xlibs" auto="yes" arch="amd64">
+      <unaffected range="ge">7.0-r2</unaffected>
+      <vulnerable range="lt">7.0-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    X.org is an implementation of the X Window System.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several X.org libraries and X.org itself contain system calls to
+    set*uid() functions, without checking their result.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Local users could deliberately exceed their assigned resource limits
+    and elevate their privileges after an unsuccessful set*uid() system
+    call. This requires resource limits to be enabled on the machine.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All X.Org xdm users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-apps/xdm-1.0.4-r1&quot;</code>
+    <p>
+    All X.Org xinit users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-apps/xinit-1.0.2-r6&quot;</code>
+    <p>
+    All X.Org xload users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-apps/xload-1.0.1-r1&quot;</code>
+    <p>
+    All X.Org xf86dga users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-apps/xf86dga-1.0.1-r1&quot;</code>
+    <p>
+    All X.Org users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-base/xorg-x11-6.9.0-r2&quot;</code>
+    <p>
+    All X.Org X servers users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-base/xorg-server-1.1.0-r1&quot;</code>
+    <p>
+    All X.Org X11 library users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/libx11-1.0.1-r1&quot;</code>
+    <p>
+    All X.Org xtrans library users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/xtrans-1.0.1-r1&quot;</code>
+    <p>
+    All xterm users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-terms/xterm-215&quot;</code>
+    <p>
+    All users of the X11R6 libraries for emulation of 32bit x86 on amd64
+    should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/emul-linux-x86-xlibs-7.0-r2&quot;</code>
+    <p>
+    Please note that the fixed packages have been available for most
+    architectures since June 30th but the GLSA release was held up waiting
+    for the remaining architectures.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://lists.freedesktop.org/archives/xorg/2006-June/016146.html">X.Org security advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4447">CVE-2006-4447</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 16 Aug 2006 08:09:58 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 21 Aug 2006 15:45:11 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 23 Aug 2006 20:02:52 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-26.xml b/xml/htdocs/security/en/glsa/glsa-200608-26.xml
new file mode 100644
index 00000000..92af9282
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-26.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-26">
+  <title>Wireshark: Multiple vulnerabilities</title>
+  <synopsis>
+    Wireshark is vulnerable to several security issues that may lead to a
+    Denial of Service and/or the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">wireshark</product>
+  <announced>August 29, 2006</announced>
+  <revised>August 29, 2006: 01</revised>
+  <bug>144946</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/wireshark" auto="yes" arch="*">
+      <unaffected range="ge">0.99.3</unaffected>
+      <vulnerable range="lt">0.99.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Wireshark is a feature-rich network protocol analyzer.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities have been discovered in Wireshark.
+    Firstly, if the IPsec ESP parser is used it is susceptible to
+    off-by-one errors, this parser is disabled by default; secondly, the
+    SCSI dissector is vulnerable to an unspecified crash; and finally, the
+    Q.2931 dissector of the SSCOP payload may use all the available memory
+    if a port range is configured. By default, no port ranges are
+    configured.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker might be able to exploit these vulnerabilities, resulting
+    in a crash or the execution of arbitrary code with the permissions of
+    the user running Wireshark, possibly the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable the SCSI and Q.2931 dissectors with the "Analyse" and "Enabled
+    protocols" menus. Make sure the ESP decryption is disabled, with the
+    "Edit -> Preferences -> Protocols -> ESP" menu.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Wireshark users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/wireshark-0.99.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4330">CVE-2006-4330</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4331">CVE-2006-4331</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4332">CVE-2006-4332</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4333">CVE-2006-4333</uri>
+    <uri link="http://www.wireshark.org/security/wnpa-sec-2006-02.html">Wireshark official advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 25 Aug 2006 07:36:40 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 26 Aug 2006 14:34:42 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 26 Aug 2006 14:55:04 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-27.xml b/xml/htdocs/security/en/glsa/glsa-200608-27.xml
new file mode 100644
index 00000000..548f8b0a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-27.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-27">
+  <title>Motor: Execution of arbitrary code</title>
+  <synopsis>
+    Motor uses a vulnerable ktools library, which could lead to the execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">motor</product>
+  <announced>August 29, 2006</announced>
+  <revised>August 29, 2006: 01</revised>
+  <bug>135020</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-util/motor" auto="yes" arch="*">
+      <unaffected range="rge">3.3.0-r1</unaffected>
+      <unaffected range="ge">3.4.0-r1</unaffected>
+      <vulnerable range="lt">3.4.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Motor is a text mode based programming environment for Linux, with a
+    syntax highlighting feature, project manager, makefile generator, gcc
+    and gdb front-end, and CVS integration.
+    </p>
+  </background>
+  <description>
+    <p>
+    In November 2005, Zone-H Research reported a boundary error in the
+    ktools library in the VGETSTRING() macro of kkstrtext.h, which may
+    cause a buffer overflow via an overly long input string.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to use a malicious file or input,
+    which could lead to the crash of Motor and possibly the execution of
+    arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Motor 3.3.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-util/motor-3.3.0-r1&quot;</code>
+    <p>
+    All motor 3.4.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-util/motor-3.4.0-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3863">CVE-2005-3863</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 23 Aug 2006 15:20:34 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 26 Aug 2006 14:27:17 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 26 Aug 2006 15:28:41 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200608-28.xml b/xml/htdocs/security/en/glsa/glsa-200608-28.xml
new file mode 100644
index 00000000..ee4b88bc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200608-28.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200608-28">
+  <title>PHP: Arbitary code execution</title>
+  <synopsis>
+    PHP contains a function that, when used, could allow a remote attacker to
+    execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">php</product>
+  <announced>August 29, 2006</announced>
+  <revised>March 29, 2008: 05</revised>
+  <bug>143126</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/php" auto="yes" arch="*">
+      <unaffected range="rge">4.4.3-r1</unaffected>
+      <unaffected range="rge">4.4.4-r4</unaffected>
+      <unaffected range="rge">4.4.6</unaffected>
+      <unaffected range="rge">4.4.7</unaffected>
+      <unaffected range="rge">4.4.8_pre20070816</unaffected>
+      <unaffected range="ge">5.1.4-r6</unaffected>
+      <vulnerable range="lt">5.1.4-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHP is a widely-used general-purpose scripting language that is
+    especially suited for Web development and can be embedded into HTML.
+    </p>
+  </background>
+  <description>
+    <p>
+    The sscanf() PHP function contains an array boundary error that can be
+    exploited to dereference a null pointer. This can possibly allow the
+    bypass of the safe mode protection by executing arbitrary code.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker might be able to exploit this vulnerability in PHP
+    applications making use of the sscanf() function, potentially resulting
+    in the execution of arbitrary code or the execution of scripted
+    contents in the context of the affected site.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHP 4.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/php-4.4.3-r1&quot;</code>
+    <p>
+    All PHP 5.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/php-5.1.4-r6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4020">CVE-2006-4020</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 23 Aug 2006 20:16:18 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 26 Aug 2006 14:28:36 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 26 Aug 2006 15:12:31 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-01.xml b/xml/htdocs/security/en/glsa/glsa-200609-01.xml
new file mode 100644
index 00000000..d5021876
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-01.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-01">
+  <title>Streamripper: Multiple remote buffer overflows</title>
+  <synopsis>
+    Streamripper is vulnerable to multiple remote buffer overflows, leading to
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">streamripper</product>
+  <announced>September 06, 2006</announced>
+  <revised>September 06, 2006: 01</revised>
+  <bug>144861</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/streamripper" auto="yes" arch="*">
+      <unaffected range="ge">1.61.26</unaffected>
+      <vulnerable range="lt">1.61.26</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Streamripper extracts and records individual MP3 file tracks from
+    SHOUTcast streams.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ulf Harnhammar, from the Debian Security Audit Project, has found that
+    Streamripper is vulnerable to multiple stack based buffer overflows
+    caused by improper bounds checking when processing malformed HTTP
+    headers.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to connect to a malicious server, an attacker could
+    execute arbitrary code with the permissions of the user running
+    Streamripper
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Streamripper users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/streamripper-1.61.26&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3124">CVE-2006-3124</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 04 Sep 2006 14:37:38 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 04 Sep 2006 18:11:08 +0000">
+    daxomatic
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 05 Sep 2006 19:33:58 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-02.xml b/xml/htdocs/security/en/glsa/glsa-200609-02.xml
new file mode 100644
index 00000000..125b82d8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-02.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-02">
+  <title>GTetrinet: Remote code execution</title>
+  <synopsis>
+    GTetrinet is vulnerable to a remote buffer overflow, potentially leading to
+    arbitrary code execution.
+  </synopsis>
+  <product type="ebuild">GTetrinet</product>
+  <announced>September 06, 2006</announced>
+  <revised>September 07, 2006: 02</revised>
+  <bug>144867</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-puzzle/gtetrinet" auto="yes" arch="*">
+      <unaffected range="ge">0.7.10</unaffected>
+      <vulnerable range="lt">0.7.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GTetrinet is a networked Tetris clone for GNOME 2.
+    </p>
+  </background>
+  <description>
+    <p>
+    Michael Gehring has found that GTetrinet fails to properly handle array
+    indexes.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker can potentially execute arbitrary code by sending a
+    negative number of players to the server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GTetrinet users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-puzzle/gtetrinet-0.7.10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3125">CVE-2006-3125</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 05 Sep 2006 17:41:35 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 05 Sep 2006 18:25:31 +0000">
+    daxomatic
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 05 Sep 2006 19:36:59 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-03.xml b/xml/htdocs/security/en/glsa/glsa-200609-03.xml
new file mode 100644
index 00000000..2b192ac9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-03.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-03">
+  <title>OpenTTD: Remote Denial of Service</title>
+  <synopsis>
+    The OpenTTD server is vulnerable to a remote Denial of Service.
+  </synopsis>
+  <product type="ebuild">openttd</product>
+  <announced>September 06, 2006</announced>
+  <revised>September 06, 2006: 01</revised>
+  <bug>131010</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-simulation/openttd" auto="yes" arch="*">
+      <unaffected range="ge">0.4.8</unaffected>
+      <vulnerable range="lt">0.4.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenTTD is a clone of Transport Tycoon Deluxe.
+    </p>
+  </background>
+  <description>
+    <p>
+    OpenTTD is vulnerable to a Denial of Service attack due to a flaw in
+    the manner the game server handles errors in command packets.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An authenticated attacker can cause a Denial of Service by sending an
+    invalid error number to a vulnerable OpenTTD server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenTTD users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-simulation/openttd-0.4.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1998">CVE-2006-1998</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1999">CVE-2006-1999</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 05 Sep 2006 13:05:28 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 05 Sep 2006 18:04:07 +0000">
+    daxomatic
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 06 Sep 2006 14:54:55 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-04.xml b/xml/htdocs/security/en/glsa/glsa-200609-04.xml
new file mode 100644
index 00000000..3933da40
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-04.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-04">
+  <title>LibXfont: Multiple integer overflows</title>
+  <synopsis>
+    A buffer overflow was discovered in the PCF font parser, potentially
+    resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">LibXfont</product>
+  <announced>September 06, 2006</announced>
+  <revised>September 06, 2006: 01</revised>
+  <bug>144092</bug>
+  <access>local</access>
+  <affected>
+    <package name="x11-libs/libXfont" auto="yes" arch="*">
+      <unaffected range="ge">1.2.0-r1</unaffected>
+      <vulnerable range="lt">1.2.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libXfont is the X.Org Xfont library, some parts are based on the
+    FreeType code base.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several integer overflows have been found in the PCF font parser.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could possibly execute arbitrary code or crash the
+    Xserver by enticing a user to load a specially crafted PCF font file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not use untrusted PCF Font files.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libXfont users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/libXfont-1.2.0-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3467">CVE-2006-3467</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 31 Aug 2006 17:04:06 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 03 Sep 2006 12:10:42 +0000">
+    daxomatic
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 05 Sep 2006 19:36:43 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-05.xml b/xml/htdocs/security/en/glsa/glsa-200609-05.xml
new file mode 100644
index 00000000..02a10f79
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-05.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-05">
+  <title>OpenSSL, AMD64 x86 emulation base libraries: RSA signature forgery</title>
+  <synopsis>
+    OpenSSL fails to properly validate PKCS #1 v1.5 signatures.
+  </synopsis>
+  <product type="ebuild">openssl</product>
+  <announced>September 07, 2006</announced>
+  <revised>September 08, 2006: 02</revised>
+  <bug>146375</bug>
+  <bug>146438</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/openssl" auto="yes" arch="*">
+      <unaffected range="ge">0.9.7k</unaffected>
+      <vulnerable range="lt">0.9.7k</vulnerable>
+    </package>
+    <package name="app-emulation/emul-linux-x86-baselibs" auto="yes" arch="amd64">
+      <unaffected range="ge">2.5.2</unaffected>
+      <vulnerable range="lt">2.5.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSSL is a toolkit implementing the Secure Sockets Layer, Transport
+    Layer Security protocols and a general-purpose cryptography library.
+    The x86 emulation base libraries for AMD64 contain a vulnerable version
+    of OpenSSL.
+    </p>
+  </background>
+  <description>
+    <p>
+    Daniel Bleichenbacher discovered that it might be possible to forge
+    signatures signed by RSA keys with the exponent of 3.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Since several CAs are using an exponent of 3 it might be possible for
+    an attacker to create a key with a false CA signature.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenSSL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/openssl-0.9.7k&quot;</code>
+    <p>
+    All AMD64 x86 emulation base libraries users should upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/emul-linux-x86-baselibs-2.5.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339">CVE-2006-4339</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 05 Sep 2006 19:16:58 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 06 Sep 2006 10:57:51 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 07 Sep 2006 20:02:33 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-06.xml b/xml/htdocs/security/en/glsa/glsa-200609-06.xml
new file mode 100644
index 00000000..8ebe8a20
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-06.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-06">
+  <title>AdPlug: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple heap and buffer overflows exist in AdPlug.
+  </synopsis>
+  <product type="ebuild">adplug</product>
+  <announced>September 12, 2006</announced>
+  <revised>September 12, 2006: 01</revised>
+  <bug>139593</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-libs/adplug" auto="yes" arch="*">
+      <unaffected range="ge">2.0.1</unaffected>
+      <vulnerable range="lt">2.0.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    AdPlug is a free, cross-platform, and hardware-independent AdLib sound
+    player library.
+    </p>
+  </background>
+  <description>
+    <p>
+    AdPlug is vulnerable to buffer and heap overflows when processing the
+    following types of files: CFF, MTK, DMO, U6M, DTM, and S3M.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to load a specially crafted file, an attacker could
+    execute arbitrary code with the privileges of the user running AdPlug.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All AdPlug users should update to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/adplug-2.0.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.securityfocus.com/archive/1/439432/30/0/threaded">BugTraq Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3581">CVE-2006-3581</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3582">CVE-2006-3582</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 06 Sep 2006 14:38:47 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 06 Sep 2006 23:03:51 +0000">
+    hlieberman
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 12 Sep 2006 00:51:08 +0000">
+    hlieberman
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-07.xml b/xml/htdocs/security/en/glsa/glsa-200609-07.xml
new file mode 100644
index 00000000..2e12744c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-07.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-07">
+  <title>LibXfont, monolithic X.org: Multiple integer overflows</title>
+  <synopsis>
+    Some buffer overflows were discovered in the CID font parser, potentially
+    resulting in the execution of arbitrary code with elevated privileges.
+  </synopsis>
+  <product type="ebuild">libxfont</product>
+  <announced>September 13, 2006</announced>
+  <revised>September 13, 2006: 01</revised>
+  <bug>145513</bug>
+  <access>local and remote</access>
+  <affected>
+    <package name="x11-libs/libXfont" auto="yes" arch="*">
+      <unaffected range="ge">1.2.1</unaffected>
+      <vulnerable range="lt">1.2.1</vulnerable>
+    </package>
+    <package name="x11-base/xorg-x11" auto="yes" arch="*">
+      <unaffected range="ge">7.0</unaffected>
+      <vulnerable range="lt">7.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libXfont is the X.Org Xfont library, some parts are based on the
+    FreeType code base.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several integer overflows have been found in the CID font parser.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this vulnerability by enticing a user
+    to load a malicious font file resulting in the execution of arbitrary
+    code with the permissions of the user running the X server which
+    typically is the root user. A local user could exploit this
+    vulnerability to gain elevated privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable CID-encoded Type 1 fonts by removing the "type1" module and
+    replacing it with the "freetype" module in xorg.conf.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libXfont users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/libXfont-1.2.1&quot;</code>
+    <p>
+    All monolithic X.org users are advised to migrate to modular X.org.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-3739">CVE-2006-3739</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-3740">CVE-2006-3740</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 12 Sep 2006 16:30:32 +0000">
+    frilled
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 12 Sep 2006 18:16:51 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 13 Sep 2006 08:07:36 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-08.xml b/xml/htdocs/security/en/glsa/glsa-200609-08.xml
new file mode 100644
index 00000000..1ff0c297
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-08.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-08">
+  <title>xine-lib: Buffer overflows</title>
+  <synopsis>
+    xine-lib is vulnerable to multiple buffer overflows that could be exploited
+    to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">xine-lib</product>
+  <announced>September 13, 2006</announced>
+  <revised>September 13, 2006: 01</revised>
+  <bug>133520</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/xine-lib" auto="yes" arch="*">
+      <unaffected range="ge">1.1.2-r2</unaffected>
+      <vulnerable range="lt">1.1.2-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xine is a high performance, portable and reusable multimedia playback
+    engine. xine-lib is xine's core engine.
+    </p>
+  </background>
+  <description>
+    <p>
+    xine-lib contains buffer overflows in the processing of AVI.
+    Additionally, xine-lib is vulnerable to a buffer overflow in the HTTP
+    plugin (xineplug_inp_http.so) via a long reply from an HTTP server.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could trigger the buffer overflow vulnerabilities by
+    enticing a user to load a specially crafted AVI file in xine. This
+    might result in the execution of arbitrary code with the rights of the
+    user running xine. Additionally, a remote HTTP server serving a xine
+    client a specially crafted reply could crash xine and possibly execute
+    arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xine-lib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/xine-lib-1.1.2-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2802">CVE-2006-2802</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 31 Aug 2006 17:11:30 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 07 Sep 2006 12:33:52 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 12 Sep 2006 15:13:19 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-09.xml b/xml/htdocs/security/en/glsa/glsa-200609-09.xml
new file mode 100644
index 00000000..04efadcc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-09.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-09">
+  <title>FFmpeg: Buffer overflows</title>
+  <synopsis>
+    FFmpeg is vulnerable to multiple buffer overflows that might be exploited
+    to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">ffmpeg</product>
+  <announced>September 13, 2006</announced>
+  <revised>December 13, 2006: 02</revised>
+  <bug>133520</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/ffmpeg" auto="yes" arch="*">
+      <unaffected range="ge">0.4.9_p20060530</unaffected>
+      <vulnerable range="lt">0.4.9_p20060530</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    FFmpeg is a very fast video and audio converter.
+    </p>
+  </background>
+  <description>
+    <p>
+    FFmpeg contains buffer overflows in the AVI processing code.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could trigger the buffer overflows by enticing a user to
+    load a specially crafted AVI file in an application using the FFmpeg
+    library. This might result in the execution of arbitrary code in the
+    context of the running application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All FFmpeg users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/ffmpeg-0.4.9_p20060530&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4799">CVE-2006-4799</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4800">CVE-2006-4800</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 12 Sep 2006 15:05:01 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 12 Sep 2006 15:13:14 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-10.xml b/xml/htdocs/security/en/glsa/glsa-200609-10.xml
new file mode 100644
index 00000000..b28353a9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-10.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-10">
+  <title>DokuWiki: Arbitrary command execution</title>
+  <synopsis>
+    Vulnerabilities in some accessory scripts of DokuWiki allow remote code
+    execution.
+  </synopsis>
+  <product type="ebuild">dokuwiki</product>
+  <announced>September 14, 2006</announced>
+  <revised>September 14, 2006: 01</revised>
+  <bug>146800</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/dokuwiki" auto="yes" arch="*">
+      <unaffected range="ge">20060309d</unaffected>
+      <vulnerable range="lt">20060309d</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    DokuWiki is a wiki targeted at developer teams, workgroups and small
+    companies. It does not use a database backend.
+    </p>
+  </background>
+  <description>
+    <p>
+    "rgod" discovered that DokuWiki doesn't sanitize the X-FORWARDED-FOR
+    HTTP header, allowing the injection of arbitrary contents - such as PHP
+    commands - into a file. Additionally, the accessory scripts installed
+    in the "bin" DokuWiki directory are vulnerable to directory traversal
+    attacks, allowing to copy and execute the previously injected code.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker may execute arbitrary PHP (and thus probably system)
+    commands with the permissions of the user running the process serving
+    DokuWiki pages.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable remote access to the "bin" subdirectory of the DokuWiki
+    installation. Remove the directory if you don't use the scripts in
+    there.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All DokuWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/dokuwiki-20060309d&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4674">CVE-2006-4674</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4675">CVE-2006-4675</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4679">CVE-2006-4679</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 14 Sep 2006 07:55:18 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 14 Sep 2006 15:09:04 +0000">
+    frilled
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-11.xml b/xml/htdocs/security/en/glsa/glsa-200609-11.xml
new file mode 100644
index 00000000..df5d9fd0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-11.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-11">
+  <title>BIND: Denial of Service</title>
+  <synopsis>
+    ISC BIND contains two vulnerabilities allowing a Denial of Service under
+    certain conditions.
+  </synopsis>
+  <product type="ebuild">bind</product>
+  <announced>September 15, 2006</announced>
+  <revised>September 15, 2006: 01</revised>
+  <bug>146486</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/bind" auto="yes" arch="*">
+      <unaffected range="ge">9.3.2-r4</unaffected>
+      <unaffected range="rge">9.2.6-r4</unaffected>
+      <vulnerable range="lt">9.3.2-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ISC BIND is the Internet Systems Consortium implementation of the
+    Domain Name System (DNS) protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    Queries for SIG records will cause an assertion error if more than one
+    SIG RRset is returned. Additionally, an INSIST failure can be triggered
+    by sending multiple recursive queries if the response to the query
+    arrives after all the clients looking for the response have left the
+    recursion queue.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker having access to a recursive server can crash the server by
+    querying the SIG records where there are multiple SIG RRsets, or by
+    sending many recursive queries in a short time. The exposure can be
+    lowered by restricting the clients that can ask for recursion. An
+    attacker can also crash an authoritative server serving a DNSSEC zone
+    in which there are multiple SIG RRsets.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All BIND 9.3 users should update to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/bind-9.3.2-r4&quot;</code>
+    <p>
+    All BIND 9.2 users should update to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/bind-9.2.6-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4095">CVE-2006-4095</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4096">CVE-2006-4096</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 06 Sep 2006 10:13:53 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 07 Sep 2006 11:28:27 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 14 Sep 2006 22:49:56 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-12.xml b/xml/htdocs/security/en/glsa/glsa-200609-12.xml
new file mode 100644
index 00000000..b434ebf6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-12.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-12">
+  <title>Mailman: Multiple vulnerabilities</title>
+  <synopsis>
+    Mailman has multiple vulnerable that can result in Denial of Service, log
+    file injection and XSS.
+  </synopsis>
+  <product type="ebuild">mailman</product>
+  <announced>September 19, 2006</announced>
+  <revised>September 19, 2006: 01</revised>
+  <bug>139976</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/mailman" auto="yes" arch="*">
+      <unaffected range="ge">2.1.9_rc1</unaffected>
+      <vulnerable range="lt">2.1.9_rc1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mailman is a Python based mailing list server with an extensive web
+    interface.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mailman fails to properly handle standards-breaking RFC 2231 formatted
+    headers. Furthermore, Moritz Naumann discovered several XSS
+    vulnerabilities and a log file injection.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit these vulnerabilities to cause Mailman to
+    stop processing mails, to inject content into the log file or to
+    execute arbitrary scripts running in the context of the administrator
+    or mailing list user's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mailman users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/mailman-2.1.9_rc1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2941">CVE-2006-2941</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2006-3636">CVE-2006-3636</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 14 Sep 2006 10:21:53 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 14 Sep 2006 16:20:16 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 19 Sep 2006 07:26:33 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-13.xml b/xml/htdocs/security/en/glsa/glsa-200609-13.xml
new file mode 100644
index 00000000..dba5730a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-13.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-13">
+  <title>gzip: Multiple vulnerabilities</title>
+  <synopsis>
+    gzip is affected by multiple vulnerabilities, including buffer overflows
+    and infinite loops, possibly allowing the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">gzip</product>
+  <announced>September 23, 2006</announced>
+  <revised>September 23, 2006: 01</revised>
+  <bug>145511</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/gzip" auto="yes" arch="*">
+      <unaffected range="ge">1.3.5-r9</unaffected>
+      <vulnerable range="lt">1.3.5-r9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    gzip, the GNU zip compression utility, is a free and patent
+    unencumbered replacement for the standard compress utility.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Google Security Team has reported multiple
+    vulnerabilities in gzip. A stack buffer modification vulnerability was
+    discovered in the LZH decompression code, where a pathological data
+    stream may result in the modification of stack data such as frame
+    pointer, return address or saved registers. A static buffer underflow
+    was discovered in the pack decompression support, allowing a specially
+    crafted pack archive to underflow a .bss buffer. A static buffer
+    overflow was uncovered in the LZH decompression code, allowing a data
+    stream consisting of pathological huffman codes to overflow a .bss
+    buffer. Multiple infinite loops were also uncovered in the LZH
+    decompression code.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker may create a specially crafted gzip archive, which
+    when decompressed by a user or automated system exectues arbitrary code
+    with the privileges of the user id invoking gzip. The infinite loops
+    may be abused by an attacker to disrupt any automated systems invoking
+    gzip to handle data decompression.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All gzip users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/gzip-1.3.5-r9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4334">CVE-2006-4334</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4335">CVE-2006-4335</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4336">CVE-2006-4336</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4337">CVE-2006-4337</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4338">CVE-2006-4338</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 19 Sep 2006 13:55:56 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 23 Sep 2006 06:36:04 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-14.xml b/xml/htdocs/security/en/glsa/glsa-200609-14.xml
new file mode 100644
index 00000000..980f83b9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-14.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-14">
+  <title>ImageMagick: Multiple Vulnerabilities</title>
+  <synopsis>
+    Multiple buffer overflows have been discovered in ImageMagick, which could
+    potentially result in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Imagemagick</product>
+  <announced>September 26, 2006</announced>
+  <revised>September 26, 2006: 01</revised>
+  <bug>144091</bug>
+  <bug>143533</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/imagemagick" auto="yes" arch="*">
+      <unaffected range="ge">6.2.9.5</unaffected>
+      <vulnerable range="lt">6.2.9.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ImageMagick is a free software suite to manipulate, convert, and create
+    many image formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Google Security Team discovered a stack and heap
+    buffer overflow in the GIMP XCF Image decoder and multiple heap and
+    integer overflows in the SUN bitmap decoder. Damian Put discovered a
+    heap overflow in the SGI image decoder.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker may be able to create a specially crafted image that, when
+    processed with ImageMagick, executes arbitrary code with the privileges
+    of the executing user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ImageMagick users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/imagemagick-6.2.9.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3743">CVE-2006-3743</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3744">CVE-2006-3744</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4144">CVE-2006-4144</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 19 Sep 2006 07:52:00 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 22 Sep 2006 10:27:30 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 25 Sep 2006 18:09:30 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-15.xml b/xml/htdocs/security/en/glsa/glsa-200609-15.xml
new file mode 100644
index 00000000..894b5318
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-15.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-15">
+  <title>GnuTLS: RSA Signature Forgery</title>
+  <synopsis>
+    GnuTLS fails to handle excess data which could allow an attacker to forge a
+    PKCS #1 v1.5 signature.
+  </synopsis>
+  <product type="ebuild">gnutls</product>
+  <announced>September 26, 2006</announced>
+  <revised>September 26, 2006: 01</revised>
+  <bug>147682</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-libs/gnutls" auto="yes" arch="*">
+      <unaffected range="ge">1.4.4</unaffected>
+      <vulnerable range="lt">1.4.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GnuTLS is an implementation of SSL 3.0 and TLS 1.0.
+    </p>
+  </background>
+  <description>
+    <p>
+    verify.c fails to properly handle excess data in
+    digestAlgorithm.parameters field while generating a hash when using an
+    RSA key with exponent 3. RSA keys that use exponent 3 are commonplace.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote attackers could forge PKCS #1 v1.5 signatures that are signed
+    with an RSA key, preventing GnuTLS from correctly verifying X.509 and
+    other certificates that use PKCS.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GnuTLS users should update both packages:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --update --ask --verbose &quot;&gt;=net-libs/gnutls-1.4.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4790">CVE-2006-4790</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 23 Sep 2006 06:35:02 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 25 Sep 2006 13:07:32 +0000">
+    hlieberman
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 25 Sep 2006 18:24:37 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-16.xml b/xml/htdocs/security/en/glsa/glsa-200609-16.xml
new file mode 100644
index 00000000..4378261d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-16.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-16">
+  <title>Tikiwiki: Arbitrary command execution</title>
+  <synopsis>
+    Tikiwiki contains a cross-site scripting (XSS) vulnerability as well as a
+    second vulnerability which may allow remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">tikiwiki</product>
+  <announced>September 26, 2006</announced>
+  <revised>September 26, 2006: 01</revised>
+  <bug>145714</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/tikiwiki" auto="yes" arch="*">
+      <unaffected range="ge">1.9.5</unaffected>
+      <vulnerable range="lt">1.9.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Tikiwiki is a web-based groupware and content management system,
+    developed with PHP, ADOdb and Smarty.
+    </p>
+  </background>
+  <description>
+    <p>
+    A vulnerability in jhot.php allows for an unrestricted file upload to
+    the img/wiki/ directory. Additionally, an XSS exists in the highlight
+    parameter of tiki-searchindex.php.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could execute arbitrary code with the rights of the user
+    running the web server by uploading a file and executing it via a
+    filepath parameter. The XSS could be exploited to inject and execute
+    malicious script code or to steal cookie-based authentication
+    credentials, potentially compromising the victim's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Tikiwiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --oneshot --verbose --ask &quot;&gt;=www-apps/tikiwiki-1.9.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4299">CVE-2006-4299</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4602">CVE-2006-4602</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 19 Sep 2006 09:06:28 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 19 Sep 2006 13:40:09 +0000">
+    hlieberman
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 25 Sep 2006 18:24:26 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-17.xml b/xml/htdocs/security/en/glsa/glsa-200609-17.xml
new file mode 100644
index 00000000..9b10b97e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-17.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-17">
+  <title>OpenSSH: Denial of Service</title>
+  <synopsis>
+    A flaw in the OpenSSH daemon allows remote unauthenticated attackers to
+    cause a Denial of Service.
+  </synopsis>
+  <product type="ebuild">openssh</product>
+  <announced>September 27, 2006</announced>
+  <revised>September 27, 2006: 02</revised>
+  <bug>148228</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/openssh" auto="yes" arch="*">
+      <unaffected range="ge">4.3_p2-r5</unaffected>
+      <vulnerable range="lt">4.3_p2-r5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSSH is a free suite of applications for the SSH protocol, developed
+    and maintained by the OpenBSD project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Google Security Team discovered a Denial of
+    Service vulnerability in the SSH protocol version 1 CRC compensation
+    attack detector.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote unauthenticated attacker may be able to trigger excessive CPU
+    usage by sending a pathological SSH message, denying service to other
+    legitimate users or processes.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    The system administrator may disable SSH protocol version 1 in
+    /etc/ssh/sshd_config.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenSSH users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/openssh-4.3_p2-r5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4924">CVE-2006-4924</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 21 Sep 2006 22:24:46 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 27 Sep 2006 16:06:09 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-18.xml b/xml/htdocs/security/en/glsa/glsa-200609-18.xml
new file mode 100644
index 00000000..98e800c6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-18.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-18">
+  <title>Opera: RSA signature forgery</title>
+  <synopsis>
+    Opera fails to correctly verify certain signatures.
+  </synopsis>
+  <product type="ebuild">opera</product>
+  <announced>September 28, 2006</announced>
+  <revised>September 28, 2006: 02</revised>
+  <bug>147838</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/opera" auto="yes" arch="*">
+      <unaffected range="ge">9.02</unaffected>
+      <vulnerable range="lt">9.02</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Opera is a multi-platform web browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    Opera makes use of OpenSSL, which fails to correctly verify PKCS #1
+    v1.5 RSA signatures signed by a key with exponent 3. Some CAs in
+    Opera's list of trusted signers are using root certificates with
+    exponent 3.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could forge certificates which will appear valid and signed
+    by a trusted CA.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Opera users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/opera-9.02&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.opera.com/support/search/supsearch.dml?index=845">Opera Advisory</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200609-05.xml">GLSA 200609-05</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 27 Sep 2006 07:51:04 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 27 Sep 2006 14:08:17 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 27 Sep 2006 14:32:20 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-19.xml b/xml/htdocs/security/en/glsa/glsa-200609-19.xml
new file mode 100644
index 00000000..64ada8b7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-19.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-19">
+  <title>Mozilla Firefox: Multiple vulnerabilities</title>
+  <synopsis>
+    The Mozilla Foundation has reported numerous vulnerabilities in Mozilla
+    Firefox, including one that may allow execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Firefox</product>
+  <announced>September 28, 2006</announced>
+  <revised>September 28, 2006: 01</revised>
+  <bug>147652</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.7</unaffected>
+      <vulnerable range="lt">1.5.0.7</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.7</unaffected>
+      <vulnerable range="lt">1.5.0.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Firefox is a redesign of the Mozilla Navigator component. The
+    goal is to produce a cross-platform, stand-alone browser application.
+    </p>
+  </background>
+  <description>
+    <p>
+    A number of vulnerabilities were found and fixed in Mozilla Firefox.
+    For details please consult the references below.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    The most severe vulnerability involves enticing a user to visit a
+    malicious website, crashing the browser and executing arbitrary code
+    with the rights of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-1.5.0.7&quot;</code>
+    <p>
+    Users of the binary package should upgrade as well:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-1.5.0.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4253">CVE-2006-4253</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4340">CVE-2006-4340</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4565">CVE-2006-4565</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4566">CVE-2006-4566</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4567">CVE-2006-4567</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4568">CVE-2006-4568</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4569">CVE-2006-4569</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4571">CVE-2006-4571</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 25 Sep 2006 12:31:14 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 25 Sep 2006 12:31:29 +0000">
+    frilled
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200609-20.xml b/xml/htdocs/security/en/glsa/glsa-200609-20.xml
new file mode 100644
index 00000000..e33e9134
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200609-20.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200609-20">
+  <title>DokuWiki: Shell command injection and Denial of Service</title>
+  <synopsis>
+    DokuWiki is vulnerable to shell command injection and Denial of Service
+    attacks when using ImageMagick.
+  </synopsis>
+  <product type="ebuild">dokuwiki</product>
+  <announced>September 28, 2006</announced>
+  <revised>December 13, 2006: 02</revised>
+  <bug>149266</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/dokuwiki" auto="yes" arch="*">
+      <unaffected range="ge">20060309e</unaffected>
+      <vulnerable range="lt">20060309e</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    DokuWiki is a wiki targeted at developer teams, workgroups and small
+    companies. It does not use a database backend.
+    </p>
+  </background>
+  <description>
+    <p>
+    Input validation flaws have been discovered in the image handling of
+    fetch.php if ImageMagick is used, which is not the default method.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit the flaws to execute arbitrary shell
+    commands with the rights of the web server daemon or cause a Denial of
+    Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All DokuWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/dokuwiki-20060309e&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.freelists.org/archives/dokuwiki/09-2006/msg00278.html">DokuWiki Announcement</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5098">CVE-2006-5098</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5099">CVE-2006-5099</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 27 Sep 2006 14:05:04 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 27 Sep 2006 14:54:15 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 28 Sep 2006 14:27:52 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200610-01.xml b/xml/htdocs/security/en/glsa/glsa-200610-01.xml
new file mode 100644
index 00000000..a336c0b1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200610-01.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200610-01">
+  <title>Mozilla Thunderbird: Multiple vulnerabilities</title>
+  <synopsis>
+    The Mozilla Foundation has reported multiple security vulnerabilities
+    related to Mozilla Thunderbird.
+  </synopsis>
+  <product type="ebuild">thunderbird</product>
+  <announced>October 04, 2006</announced>
+  <revised>October 04, 2006: 01</revised>
+  <bug>147653</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/mozilla-thunderbird" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.7</unaffected>
+      <vulnerable range="lt">1.5.0.7</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.7</unaffected>
+      <vulnerable range="lt">1.5.0.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Mozilla Thunderbird mail client is a redesign of the Mozilla Mail
+    component.
+    </p>
+  </background>
+  <description>
+    <p>
+    A number of vulnerabilities have been found and fixed in Mozilla
+    Thunderbird. For details please consult the references below.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    The most severe vulnerabilities might lead to the execution of
+    arbitrary code with the rights of the user running the application.
+    Other vulnerabilities include program crashes and the acceptance of
+    forged certificates.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Thunderbird users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-1.5.0.7&quot;</code>
+    <p>
+    All Mozilla Thunderbird binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-bin-1.5.0.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4253">CVE-2006-4253</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4340">CVE-2006-4340</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4565">CVE-2006-4565</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4566">CVE-2006-4566</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4567">CVE-2006-4567</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4570">CVE-2006-4570</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4571">CVE-2006-4571</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 28 Sep 2006 19:46:25 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 29 Sep 2006 21:05:25 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 30 Sep 2006 21:18:44 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200610-02.xml b/xml/htdocs/security/en/glsa/glsa-200610-02.xml
new file mode 100644
index 00000000..5e9ed685
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200610-02.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200610-02">
+  <title>Adobe Flash Player: Arbitrary code execution</title>
+  <synopsis>
+    Multiple input validation errors have been identified that allow arbitrary
+    code execution on a user's system via the handling of malicious Flash
+    files.
+  </synopsis>
+  <product type="ebuild">Flash</product>
+  <announced>October 04, 2006</announced>
+  <revised>May 28, 2009: 02</revised>
+  <bug>147421</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-plugins/adobe-flash" auto="yes" arch="*">
+      <unaffected range="ge">7.0.68</unaffected>
+      <vulnerable range="lt">7.0.68</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Adobe Flash Player is a renderer for Flash files - commonly used to
+    provide interactive websites, digital experiences and mobile content.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Adobe Flash Player contains multiple unspecified vulnerabilities.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to view a malicious Flash file and
+    execute arbitrary code with the rights of the user running the player.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Adobe Flash Player users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-plugins/adobe-flash-7.0.68&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.adobe.com/support/security/bulletins/apsb06-11.html">Adobe Security Bulletin</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3311">CVE-2006-3311</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3587">CVE-2006-3587</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3588">CVE-2006-3588</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 30 Sep 2006 20:50:53 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 01 Oct 2006 12:49:26 +0000">
+    plasmaroo
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 01 Oct 2006 12:51:08 +0000">
+    plasmaroo
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200610-03.xml b/xml/htdocs/security/en/glsa/glsa-200610-03.xml
new file mode 100644
index 00000000..34d138b1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200610-03.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200610-03">
+  <title>ncompress: Buffer Underflow</title>
+  <synopsis>
+    A buffer underflow vulnerability has been reported in ncompress allowing
+    for the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">ncompress</product>
+  <announced>October 06, 2006</announced>
+  <revised>October 06, 2006: 01</revised>
+  <bug>141728</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/ncompress" auto="yes" arch="*">
+      <unaffected range="ge">4.2.4.1</unaffected>
+      <vulnerable range="lt">4.2.4.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ncompress is a suite of utilities to create and extract
+    Lempel-Ziff-Welch (LZW) compressed archives.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Google Security Team discovered a static buffer
+    underflow in ncompress.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could create a specially crafted LZW archive, that when
+    decompressed by a user or automated system would result in the
+    execution of arbitrary code with the permissions of the user invoking
+    the utility.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ncompress users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/ncompress-4.2.4.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1168">CVE-2006-1168</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 29 Sep 2006 14:20:45 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 02 Oct 2006 10:06:04 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 06 Oct 2006 17:50:24 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200610-04.xml b/xml/htdocs/security/en/glsa/glsa-200610-04.xml
new file mode 100644
index 00000000..cd3ed395
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200610-04.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200610-04">
+  <title>Seamonkey: Multiple vulnerabilities</title>
+  <synopsis>
+    The Seamonkey project has reported multiple security vulnerabilities in the
+    application.
+  </synopsis>
+  <product type="ebuild">seamonkey</product>
+  <announced>October 16, 2006</announced>
+  <revised>October 16, 2006: 01</revised>
+  <bug>147651</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/seamonkey" auto="yes" arch="*">
+      <unaffected range="ge">1.0.5</unaffected>
+      <vulnerable range="lt">1.0.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The SeaMonkey project is a community effort to deliver
+    production-quality releases of code derived from the application
+    formerly known as 'Mozilla Application Suite'.
+    </p>
+  </background>
+  <description>
+    <p>
+    A number of vulnerabilities have been found and fixed in Seamonkey. For
+    details please consult the references below.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    The most severe vulnerability involves enticing a user to visit a
+    malicious website, crashing the application and executing arbitrary
+    code with the rights of the user running Seamonkey.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Seamonkey users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/seamonkey-1.0.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4253">CVE-2006-4253</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4565">CVE-2006-4565</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4566">CVE-2006-4566</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4568">CVE-2006-4568</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4570">CVE-2006-4570</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4571">CVE-2006-4571</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 11 Oct 2006 11:17:26 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 13 Oct 2006 13:40:59 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200610-05.xml b/xml/htdocs/security/en/glsa/glsa-200610-05.xml
new file mode 100644
index 00000000..1ddc79a3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200610-05.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200610-05">
+  <title>CAPI4Hylafax fax receiver: Execution of arbitrary code</title>
+  <synopsis>
+    CAPI4Hylafax allows remote attackers to execute arbitrary commands.
+  </synopsis>
+  <product type="ebuild">capi4hylafax</product>
+  <announced>October 17, 2006</announced>
+  <revised>October 17, 2006: 01</revised>
+  <bug>145982</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/capi4hylafax" auto="yes" arch="*">
+      <unaffected range="ge">01.03.00.99.300.3-r1</unaffected>
+      <vulnerable range="lt">01.03.00.99.300.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CAPI4Hylafax makes it possible to send and receive faxes via CAPI and
+    AVM Fritz!Cards.
+    </p>
+  </background>
+  <description>
+    <p>
+    Lionel Elie Mamane discovered an error in c2faxrecv, which doesn't
+    properly sanitize TSI strings when handling incoming calls.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker can send null (\0) and shell metacharacters in the
+    TSI string from an anonymous fax number, leading to the execution of
+    arbitrary code with the rights of the user running c2faxrecv.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CAPI4Hylafax users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/capi4hylafax-01.03.00.99.300.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3126">CVE-2006-3126</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 11 Oct 2006 11:18:55 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 13 Oct 2006 13:56:18 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 13 Oct 2006 13:57:08 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200610-06.xml b/xml/htdocs/security/en/glsa/glsa-200610-06.xml
new file mode 100644
index 00000000..d8bed652
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200610-06.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200610-06">
+  <title>Mozilla Network Security Service (NSS): RSA signature forgery</title>
+  <synopsis>
+    NSS fails to properly validate PKCS #1 v1.5 signatures.
+  </synopsis>
+  <product type="ebuild">nss</product>
+  <announced>October 17, 2006</announced>
+  <revised>October 17, 2006: 01</revised>
+  <bug>148283</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/nss" auto="yes" arch="*">
+      <unaffected range="ge">3.11.3</unaffected>
+      <vulnerable range="lt">3.11.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Mozilla Network Security Service is a library implementing security
+    features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12,
+    S/MIME and X.509 certificates.
+    </p>
+  </background>
+  <description>
+    <p>
+    Daniel Bleichenbacher discovered that it might be possible to forge
+    signatures signed by RSA keys with the exponent of 3. This affects a
+    number of RSA signature implementations, including Mozilla's NSS.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Since several Certificate Authorities (CAs) are using an exponent of 3
+    it might be possible for an attacker to create a key with a false CA
+    signature. This impacts any software using the NSS library, like the
+    Mozilla products Firefox, Thunderbird and Seamonkey.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All NSS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/nss-3.11.3&quot;</code>
+    <p>
+    Note: As usual after updating a library, you should run
+    'revdep-rebuild' (from the app-portage/gentoolkit package) to ensure
+    that all applications linked to it are properly rebuilt.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339">CVE-2006-4339</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4340">CVE-2006-4340</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 25 Sep 2006 12:57:17 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 03 Oct 2006 18:27:05 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 08 Oct 2006 19:45:16 +0000">
+    frilled
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200610-07.xml b/xml/htdocs/security/en/glsa/glsa-200610-07.xml
new file mode 100644
index 00000000..940320f0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200610-07.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200610-07">
+  <title>Python: Buffer Overflow</title>
+  <synopsis>
+    A buffer overflow in Python's "repr()" function can be exploited to cause a
+    Denial of Service and potentially allows the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">python</product>
+  <announced>October 17, 2006</announced>
+  <revised>February 26, 2007: 03</revised>
+  <bug>149065</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/python" auto="yes" arch="*">
+      <unaffected range="ge">2.4.3-r4</unaffected>
+      <unaffected range="rge">2.3.5-r3</unaffected>
+      <unaffected range="rge">2.3.6</unaffected>
+      <vulnerable range="lt">2.4.3-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Python is an interpreted, interactive, object-oriented, cross-platform
+    programming language.
+    </p>
+  </background>
+  <description>
+    <p>
+    Benjamin C. Wiley Sittler discovered a buffer overflow in Python's
+    "repr()" function when handling UTF-32/UCS-4 encoded strings.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    If a Python application processes attacker-supplied data with the
+    "repr()" function, this could potentially lead to the execution of
+    arbitrary code with the privileges of the affected application or a
+    Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Python users should update to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/python-2.4.3-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4980">CVE-2006-4980</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 27 Sep 2006 19:59:22 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 13 Oct 2006 14:44:47 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 16 Oct 2006 09:21:34 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200610-08.xml b/xml/htdocs/security/en/glsa/glsa-200610-08.xml
new file mode 100644
index 00000000..04a2f54f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200610-08.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200610-08">
+  <title>Cscope: Multiple buffer overflows</title>
+  <synopsis>
+    Cscope is vulnerable to multiple buffer overflows that could lead to the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">cscope</product>
+  <announced>October 20, 2006</announced>
+  <revised>October 20, 2006: 01</revised>
+  <bug>144869</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-util/cscope" auto="yes" arch="*">
+      <unaffected range="ge">15.5.20060927</unaffected>
+      <vulnerable range="lt">15.5.20060927</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cscope is a developer's tool for browsing source code.
+    </p>
+  </background>
+  <description>
+    <p>
+    Unchecked use of strcpy() and *scanf() leads to several buffer
+    overflows.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A user could be enticed to open a carefully crafted file which would
+    allow the attacker to execute arbitrary code with the permissions of
+    the user running Cscope.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cscope users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-util/cscope-15.5.20060927&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4262">CVE-2006-4262</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 18 Oct 2006 20:32:19 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 18 Oct 2006 20:33:33 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200610-09.xml b/xml/htdocs/security/en/glsa/glsa-200610-09.xml
new file mode 100644
index 00000000..dbc22dbe
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200610-09.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200610-09">
+  <title>libmusicbrainz: Multiple buffer overflows</title>
+  <synopsis>
+    Multiple buffer overflows have been found in libmusicbrainz, which could
+    lead to a Denial of Service or possibly the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">libmusicbrainz</product>
+  <announced>October 22, 2006</announced>
+  <revised>October 22, 2006: 01</revised>
+  <bug>144089</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/musicbrainz" auto="yes" arch="*">
+      <unaffected range="ge">2.1.4</unaffected>
+      <vulnerable range="lt">2.1.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libmusicbrainz is a client library used to access MusicBrainz music
+    meta data.
+    </p>
+  </background>
+  <description>
+    <p>
+    Luigi Auriemma reported a possible buffer overflow in the
+    MBHttp::Download function of lib/http.cpp as well as several possible
+    buffer overflows in lib/rdfparse.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could be able to execute arbitrary code or cause
+    Denial of Service by making use of an overly long "Location" header in
+    an HTTP redirect message from a malicious server or a long URL in
+    malicious RDF feeds.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libmusicbrainz users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/musicbrainz-2.1.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4197">CVE-2006-4197</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 18 Oct 2006 12:31:28 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 19 Oct 2006 20:02:01 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 20 Oct 2006 14:53:09 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200610-10.xml b/xml/htdocs/security/en/glsa/glsa-200610-10.xml
new file mode 100644
index 00000000..6414cdb5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200610-10.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200610-10">
+  <title>ClamAV: Multiple Vulnerabilities</title>
+  <synopsis>
+    ClamAV is vulnerable to a heap-based buffer overflow potentially allowing
+    remote execution of arbitrary code and a Denial of Service.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>October 24, 2006</announced>
+  <revised>October 24, 2006: 01</revised>
+  <bug>151561</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.88.5</unaffected>
+      <vulnerable range="lt">0.88.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ClamAV is a GPL virus scanner.
+    </p>
+  </background>
+  <description>
+    <p>
+    Damian Put and an anonymous researcher reported a potential heap-based
+    buffer overflow vulnerability in rebuildpe.c responsible for the
+    rebuilding of an unpacked PE file, and a possible crash in chmunpack.c
+    in the CHM unpacker.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By sending a malicious attachment to a mail server running ClamAV, or
+    providing a malicious file to ClamAV through any other method, a remote
+    attacker could cause a Denial of Service and potentially the execution
+    of arbitrary code with the permissions of the user running ClamAV.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.88.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://sourceforge.net/project/shownotes.php?release_id=455799">Original commit log</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4182">CVE-2006-4182</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 16 Oct 2006 11:34:35 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 24 Oct 2006 14:39:53 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200610-11.xml b/xml/htdocs/security/en/glsa/glsa-200610-11.xml
new file mode 100644
index 00000000..14cfbe97
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200610-11.xml
@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200610-11">
+  <title>OpenSSL: Multiple vulnerabilities</title>
+  <synopsis>
+    OpenSSL contains multiple vulnerabilities including the possible remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">openssl</product>
+  <announced>October 24, 2006</announced>
+  <revised>October 24, 2006: 01</revised>
+  <bug>145510</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/openssl" auto="yes" arch="*">
+      <unaffected range="ge">0.9.8d</unaffected>
+      <unaffected range="rge">0.9.7l</unaffected>
+      <vulnerable range="lt">0.9.8d</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSSL is a toolkit implementing the Secure Sockets Layer, Transport
+    Layer Security protocols and a general-purpose cryptography library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy and Will Drewry, both of the Google Security Team,
+    discovered that the SSL_get_shared_ciphers() function contains a buffer
+    overflow vulnerability, and that the SSLv2 client code contains a flaw
+    leading to a crash. Additionally Dr. Stephen N. Henson found that the
+    ASN.1 handler contains two Denial of Service vulnerabilities: while
+    parsing an invalid ASN.1 structure and while handling certain types of
+    public key.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could trigger the buffer overflow vulnerability by sending
+    a malicious suite of ciphers to an application using the vulnerable
+    function, and thus execute arbitrary code with the rights of the user
+    running the application. An attacker could also consume CPU and/or
+    memory by exploiting the Denial of Service vulnerabilities. Finally a
+    malicious server could crash a SSLv2 client through the SSLv2
+    vulnerability.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenSSL 0.9.8 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/openssl-0.9.8d&quot;</code>
+    <p>
+    All OpenSSL 0.9.7 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/openssl-0.9.7l&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2937">CVE-2006-2937</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2940">CVE-2006-2940</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738">CVE-2006-3738</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4343">CVE-2006-4343</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 28 Sep 2006 15:36:31 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 13 Oct 2006 16:05:39 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 24 Oct 2006 10:05:56 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200610-12.xml b/xml/htdocs/security/en/glsa/glsa-200610-12.xml
new file mode 100644
index 00000000..df158744
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200610-12.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200610-12">
+  <title>Apache mod_tcl: Format string vulnerability</title>
+  <synopsis>
+    A format string vulnerabilty has been found in Apache mod_tcl, which could
+    lead to the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mod_tcl</product>
+  <announced>October 24, 2006</announced>
+  <revised>October 24, 2006: 01</revised>
+  <bug>151359</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apache/mod_tcl" auto="yes" arch="*">
+      <unaffected range="ge">1.0.1</unaffected>
+      <vulnerable range="lt">1.0.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Apache mod_tcl is a TCL interpreting module for the Apache 2.x web
+    server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sparfell discovered format string errors in calls to the set_var
+    function in tcl_cmds.c and tcl_core.c.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit the vulnerability to execute arbitrary
+    code with the rights of the user running the Apache server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mod_tcl users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apache/mod_tcl-1.0.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4154">CVE-2006-4154</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 21 Oct 2006 12:26:41 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 21 Oct 2006 20:37:41 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 23 Oct 2006 14:13:35 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200610-13.xml b/xml/htdocs/security/en/glsa/glsa-200610-13.xml
new file mode 100644
index 00000000..0d0b45d8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200610-13.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200610-13">
+  <title>Cheese Tracker: Buffer Overflow</title>
+  <synopsis>
+    Cheese Tracker contains a buffer overflow allowing the remote execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">cheesetracker</product>
+  <announced>October 26, 2006</announced>
+  <revised>October 26, 2006: 01</revised>
+  <bug>142391</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/cheesetracker" auto="yes" arch="*">
+      <unaffected range="ge">0.9.9-r1</unaffected>
+      <vulnerable range="lt">0.9.9-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cheese Tracker is a Qt-based portable Impulse Tracker clone, a music
+    tracker for the CT, IT, XM and S3M file formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Luigi Auriemma reported that the XM loader of Cheese Tracker contains a
+    buffer overflow vulnerability in the
+    loader_XM::load_intrument_internal() function from
+    loaders/loader_xm.cpp.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could execute arbitrary code with the rights of the user
+    running Cheese Tracker by enticing a user to load a crafted file with
+    large amount of extra data.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cheese Tracker users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/cheesetracker-0.9.9-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3814">CVE-2006-3814</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 20 Oct 2006 07:43:58 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 24 Oct 2006 14:33:27 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 24 Oct 2006 15:18:21 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200610-14.xml b/xml/htdocs/security/en/glsa/glsa-200610-14.xml
new file mode 100644
index 00000000..7e37ebcd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200610-14.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200610-14">
+  <title>PHP: Integer overflow</title>
+  <synopsis>
+    PHP is vulnerable to an integer overflow potentially allowing the remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">php</product>
+  <announced>October 30, 2006</announced>
+  <revised>March 29, 2008: 04</revised>
+  <bug>150261</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/php" auto="yes" arch="*">
+      <unaffected range="rge">4.4.4-r6</unaffected>
+      <unaffected range="rge">4.4.6</unaffected>
+      <unaffected range="rge">4.4.7</unaffected>
+      <unaffected range="rge">4.4.8_pre20070816</unaffected>
+      <unaffected range="ge">5.1.6-r6</unaffected>
+      <vulnerable range="lt">5.1.6-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHP is a widely-used general-purpose scripting language that is
+    especially suited for Web development and can be embedded into HTML.
+    </p>
+  </background>
+  <description>
+    <p>
+    A flaw in the PHP memory handling routines allows an unserialize() call
+    to be executed on non-allocated memory due to a previous integer
+    overflow.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could execute arbitrary code with the rights of the web
+    server user or the user running a vulnerable PHP script.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHP 5.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/php-5.1.6-r6&quot;</code>
+    <p>
+    All PHP 4.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/php-4.4.4-r6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4812">CVE-2006-4812</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 18 Oct 2006 12:42:57 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 18 Oct 2006 18:52:45 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 24 Oct 2006 10:10:01 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200610-15.xml b/xml/htdocs/security/en/glsa/glsa-200610-15.xml
new file mode 100644
index 00000000..629b6000
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200610-15.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200610-15">
+  <title>Asterisk: Multiple vulnerabilities</title>
+  <synopsis>
+    Asterisk is vulnerable to the remote execution of arbitrary code or a
+    Denial of Service.
+  </synopsis>
+  <product type="ebuild">asterisk</product>
+  <announced>October 30, 2006</announced>
+  <revised>January 30, 2007: 02</revised>
+  <bug>144941</bug>
+  <bug>151881</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/asterisk" auto="yes" arch="*">
+      <unaffected range="ge">1.2.13</unaffected>
+      <unaffected range="rge">1.0.12</unaffected>
+      <vulnerable range="lt">1.2.13</vulnerable>
+      <vulnerable range="lt">1.0.12</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Asterisk is an open source implementation of a telephone private branch
+    exchange (PBX).
+    </p>
+  </background>
+  <description>
+    <p>
+    Asterisk contains buffer overflows in channels/chan_mgcp.c from the
+    MGCP driver and in channels/chan_skinny.c from the Skinny channel
+    driver for Cisco SCCP phones. It also dangerously handles
+    client-controlled variables to determine filenames in the Record()
+    function. Finally, the SIP channel driver in channels/chan_sip.c could
+    use more resources than necessary under unspecified circumstances.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could execute arbitrary code by sending a crafted
+    audit endpoint (AUEP) response, by sending an overly large Skinny
+    packet even before authentication, or by making use of format strings
+    specifiers through the client-controlled variables. An attacker could
+    also cause a Denial of Service by resource consumption through the SIP
+    channel driver.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround for the format strings vulnerability at
+    this time. You can comment the lines in /etc/asterisk/mgcp.conf,
+    /etc/asterisk/skinny.conf and /etc/asterisk/sip.conf to deactivate the
+    three vulnerable channel drivers. Please note that the MGCP channel
+    driver is disabled by default.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Asterisk users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/asterisk-1.2.13&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4345">CVE-2006-4345</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4346">CVE-2006-4346</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5444">CVE-2006-5444</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5445">CVE-2006-5445</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 18 Oct 2006 20:57:57 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 21 Oct 2006 20:37:32 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-01.xml b/xml/htdocs/security/en/glsa/glsa-200611-01.xml
new file mode 100644
index 00000000..57f8290e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-01.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-01">
+  <title>Screen: UTF-8 character handling vulnerability</title>
+  <synopsis>
+    Screen contains an error in its UTF-8 character handling code that would
+    allow a remote Denial of Service or possibly the remote execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">screen</product>
+  <announced>November 03, 2006</announced>
+  <revised>November 03, 2006: 01</revised>
+  <bug>152770</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-misc/screen" auto="yes" arch="*">
+      <unaffected range="ge">4.0.3</unaffected>
+      <vulnerable range="lt">4.0.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Screen is a full-screen window manager that multiplexes a physical
+    terminal between several processes, typically interactive shells.
+    </p>
+  </background>
+  <description>
+    <p>
+    cstone and Richard Felker discovered a flaw in Screen's UTF-8 combining
+    character handling.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    The vulnerability can be exploited by writing a special string of
+    characters to a Screen window. A remote attacker could cause a Denial
+    of Service or possibly execute arbitrary code with the privileges of
+    the user running Screen through a program being run inside a Screen
+    session, such as an IRC client or a mail client.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Screen users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-misc/screen-4.0.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4573">CVE-2006-4573</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 27 Oct 2006 12:01:54 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 30 Oct 2006 11:11:00 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-02.xml b/xml/htdocs/security/en/glsa/glsa-200611-02.xml
new file mode 100644
index 00000000..ddad2fa7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-02.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-02">
+  <title>Qt: Integer overflow</title>
+  <synopsis>
+    An integer overflow flaw in the Qt pixmap handling could possibly lead to a
+    Denial of Service or the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">qt</product>
+  <announced>November 06, 2006</announced>
+  <revised>January 09, 2009: 03</revised>
+  <bug>151838</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-libs/qt" auto="yes" arch="*">
+      <unaffected range="ge">4.1.4-r2</unaffected>
+      <unaffected range="rge">3.3.6-r4</unaffected>
+      <unaffected range="rge">3.3.8</unaffected>
+      <unaffected range="rge">3.3.8b</unaffected>
+      <vulnerable range="lt">4.1.4-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Qt is a cross-platform GUI toolkit, which is used e.g. by KDE.
+    </p>
+  </background>
+  <description>
+    <p>
+    An integer overflow flaw has been found in the pixmap handling of Qt.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to open a specially crafted pixmap image in an
+    application using Qt, e.g. Konqueror, a remote attacker could be able
+    to cause an application crash or the execution of arbitrary code with
+    the rights of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Qt 3.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/qt-3.3.6-r4&quot;</code>
+    <p>
+    All Qt 4.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/qt-4.1.4-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4811">CVE-2006-4811</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 01 Nov 2006 16:27:07 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 02 Nov 2006 14:09:09 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 06 Nov 2006 11:05:20 +0000">
+    vorlon078
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-03.xml b/xml/htdocs/security/en/glsa/glsa-200611-03.xml
new file mode 100644
index 00000000..becb4277
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-03.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-03">
+  <title>NVIDIA binary graphics driver: Privilege escalation vulnerability</title>
+  <synopsis>
+    The NVIDIA binary graphics driver is vulnerable to a local privilege
+    escalation through an X session.
+  </synopsis>
+  <product type="ebuild">nvidia-drivers</product>
+  <announced>November 07, 2006</announced>
+  <revised>November 10, 2006: 02</revised>
+  <bug>151635</bug>
+  <access>remote, local</access>
+  <affected>
+    <package name="x11-drivers/nvidia-drivers" auto="yes" arch="*">
+      <unaffected range="ge">1.0.8776</unaffected>
+      <unaffected range="lt">1.0.8762</unaffected>
+      <vulnerable range="lt">1.0.8776</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The NVIDIA binary graphics driver from NVIDIA Corporation provides the
+    kernel module and the GL modules for graphic acceleration on the NVIDIA
+    based graphic cards.
+    </p>
+  </background>
+  <description>
+    <p>
+    Rapid7 reported a boundary error in the NVIDIA binary graphics driver
+    that leads to a buffer overflow in the accelerated rendering
+    functionality.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An X client could trigger the buffer overflow with a maliciously
+    crafted series of glyphs. A remote attacker could also entice a user to
+    open a specially crafted web page, document or X client that will
+    trigger the buffer overflow. This could result in the execution of
+    arbitrary code with root privileges or at least in the crash of the X
+    server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable the accelerated rendering functionality in the Device section
+    of xorg.conf :
+    </p>
+    <code>Option      &quot;RenderAccel&quot; &quot;false&quot;</code>
+  </workaround>
+  <resolution>
+    <p>
+    NVIDIA binary graphics driver users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-drivers/nvidia-drivers-1.0.8776&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5379">CVE-2006-5379</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 24 Oct 2006 09:12:20 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 24 Oct 2006 14:25:34 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 24 Oct 2006 14:27:05 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-04.xml b/xml/htdocs/security/en/glsa/glsa-200611-04.xml
new file mode 100644
index 00000000..73c492db
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-04.xml
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-04">
+  <title>Bugzilla: Multiple Vulnerabilities</title>
+  <synopsis>
+    Bugzilla is vulnerable to cross-site scripting, script injection, and
+    request forgery.
+  </synopsis>
+  <product type="ebuild">bugzilla</product>
+  <announced>November 09, 2006</announced>
+  <revised>November 09, 2006: 01</revised>
+  <bug>151563</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/bugzilla" auto="yes" arch="*">
+      <unaffected range="ge">2.18.6</unaffected>
+      <vulnerable range="lt">2.18.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Bugzilla is a bug tracking system used to allow developers to more
+    easily track outstanding bugs in products.
+    </p>
+  </background>
+  <description>
+    <p>
+    The vulnerabilities identified in Bugzilla are as follows:
+    </p>
+    <ul>
+    <li>Frederic Buclin and Gervase Markham discovered that input passed to
+    various fields throughout Bugzilla were not properly sanitized before
+    being sent back to users (CVE-2006-5453).</li>
+    <li>Frederic Buclin and Josh "timeless" Soref discovered a bug when
+    viewing attachments in diff mode that allows users not of the
+    "insidergroup" to read attachment descriptions. Additionally, it was
+    discovered that the "deadline" field is visible to users who do not
+    belong to the "timetrackinggroup" when bugs are exported to XML
+    (CVE-2006-5454).</li>
+    <li>Gavin Shelley reported that Bugzilla allows certain operations to
+    be performed via HTTP GET and HTTP POST requests without verifying
+    those requests properly (CVE-2006-5455).</li>
+    <li>Max Kanat-Alexander discovered that input passed to
+    showdependencygraph.cgi is not properly sanitized before being returned
+    to users (CVE-2006-5453).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could inject scripts into the content loaded by a user's
+    browser in order to have those scripts executed in a user's browser in
+    the context of the site currently being viewed. This could include
+    gaining access to privileged session information for the site being
+    viewed. Additionally, a user could forge an HTTP request in order to
+    create, modify, or delete bugs within a Bugzilla instance. Lastly, an
+    unauthorized user could view sensitive information about bugs or bug
+    attachments.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Bugzilla users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/bugzilla-2.18.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5453">CVE-2006-5453</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5454">CVE-2006-5454</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5455">CVE-2006-5455</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 04 Nov 2006 19:51:46 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 05 Nov 2006 14:49:56 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 07 Nov 2006 15:44:40 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-05.xml b/xml/htdocs/security/en/glsa/glsa-200611-05.xml
new file mode 100644
index 00000000..054d0942
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-05.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-05">
+  <title>Netkit FTP Server: Privilege escalation</title>
+  <synopsis>
+    An incorrect seteuid() call could allow an FTP user to access some files or
+    directories that would normally be inaccessible.
+  </synopsis>
+  <product type="ebuild">ftpd</product>
+  <announced>November 10, 2006</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>150292</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-ftp/netkit-ftpd" auto="yes" arch="*">
+      <unaffected range="ge">0.17-r4</unaffected>
+      <vulnerable range="lt">0.17-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    net-ftp/netkit-ftpd is the Linux Netkit FTP server with optional SSL support.
+    </p>
+  </background>
+  <description>
+    <p>
+    Paul Szabo reported that an incorrect seteuid() call after the chdir()
+    function can allow an attacker to access a normally forbidden
+    directory, in some very particular circumstances, for example when the
+    NFS-hosted targetted directory is not reachable by the client-side root
+    user. Additionally, some potentially exploitable unchecked setuid()
+    calls were also fixed.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker might craft his home directory to gain access through
+    ftpd to normally forbidden directories like /root, possibly with
+    writing permissions if seteuid() fails and if the ftpd configuration
+    allows that. The unchecked setuid() calls could also lead to a root FTP
+    login, depending on the FTP server configuration.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Netkit FTP Server users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-ftp/netkit-ftpd-0.17-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5778">CVE-2006-5778</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 24 Oct 2006 15:02:54 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 24 Oct 2006 15:03:34 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-06.xml b/xml/htdocs/security/en/glsa/glsa-200611-06.xml
new file mode 100644
index 00000000..b51f2631
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-06.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-06">
+  <title>OpenSSH: Multiple Denial of Service vulnerabilities</title>
+  <synopsis>
+    Several Denial of Service vulnerabilities have been identified in OpenSSH.
+  </synopsis>
+  <product type="ebuild">openssh</product>
+  <announced>November 13, 2006</announced>
+  <revised>November 13, 2006: 01</revised>
+  <bug>149502</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/openssh" auto="yes" arch="*">
+      <unaffected range="ge">4.4_p1-r5</unaffected>
+      <vulnerable range="lt">4.4_p1-r5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSSH is a complete SSH protocol version 1.3, 1.5 and 2.0
+    implementation and includes sftp client and server support.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Google Security Team has discovered a
+    pre-authentication vulnerability, causing sshd to spin until the login
+    grace time has been expired. Mark Dowd found an unsafe signal handler
+    that was vulnerable to a race condition. It has also been discovered
+    that when GSSAPI authentication is enabled, GSSAPI will in certain
+    cases incorrectly abort.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    The pre-authentication and signal handler vulnerabilities can cause a
+    Denial of Service in OpenSSH. The vulnerability in the GSSAPI
+    authentication abort could be used to determine the validity of
+    usernames on some platforms.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenSSH users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/openssh-4.4_p1-r5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5051">CVE-2006-5051</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5052">CVE-2006-5052</uri>
+    <uri link="http://www.openssh.com/txt/release-4.4">OpenSSH Security Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 06 Nov 2006 00:03:31 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 06 Nov 2006 12:18:14 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 06 Nov 2006 19:31:09 +0000">
+    daxomatic
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-07.xml b/xml/htdocs/security/en/glsa/glsa-200611-07.xml
new file mode 100644
index 00000000..84b217f5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-07.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-07">
+  <title>GraphicsMagick: PALM and DCM buffer overflows</title>
+  <synopsis>
+    GraphicsMagick improperly handles PALM and DCM images, potentially
+    resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">graphicsmagick</product>
+  <announced>November 13, 2006</announced>
+  <revised>November 13, 2006: 01</revised>
+  <bug>152668</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/graphicsmagick" auto="yes" arch="*">
+      <unaffected range="ge">1.1.7-r3</unaffected>
+      <vulnerable range="lt">1.1.7-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GraphicsMagick is a collection of tools and libraries which support
+    reading, writing, and manipulating images in many major formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    M. Joonas Pihlaja has reported that a boundary error exists within the
+    ReadDCMImage() function of coders/dcm.c, causing the improper handling
+    of DCM images. Pihlaja also reported that there are several boundary
+    errors in the ReadPALMImage() function of coders/palm.c, similarly
+    causing the improper handling of PALM images.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially crafted DCM or PALM
+    image with GraphicsMagick, and possibly execute arbitrary code with the
+    privileges of the user running GraphicsMagick.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GraphicsMagick users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/graphicsmagick-1.1.7-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5456">CVE-2006-5456</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 06 Nov 2006 14:10:18 +0000">
+    vorlon078
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 06 Nov 2006 23:27:19 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 07 Nov 2006 12:33:19 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-08.xml b/xml/htdocs/security/en/glsa/glsa-200611-08.xml
new file mode 100644
index 00000000..336d84bb
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-08.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-08">
+  <title>RPM: Buffer overflow</title>
+  <synopsis>
+    RPM is vulnerable to a buffer overflow and possibly the execution of
+    arbitrary code when opening specially crafted packages.
+  </synopsis>
+  <product type="ebuild">rpm</product>
+  <announced>November 13, 2006</announced>
+  <revised>November 13, 2006: 01</revised>
+  <bug>154218</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/rpm" auto="yes" arch="*">
+      <unaffected range="ge">4.4.6-r3</unaffected>
+      <vulnerable range="lt">4.4.6-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Red Hat Package Manager (RPM) is a command line driven package
+    management system capable of installing, uninstalling, verifying,
+    querying, and updating computer software packages.
+    </p>
+  </background>
+  <description>
+    <p>
+    Vladimir Mosgalin has reported that when processing certain packages,
+    RPM incorrectly allocates memory for the packages, possibly causing a
+    heap-based buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially crafted RPM package
+    and execute code with the privileges of that user if certain locales
+    are set.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All RPM users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/rpm-4.4.6-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5466">CVE-2006-5466</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 06 Nov 2006 23:03:12 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 06 Nov 2006 23:11:11 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 07 Nov 2006 13:44:27 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-09.xml b/xml/htdocs/security/en/glsa/glsa-200611-09.xml
new file mode 100644
index 00000000..97a02b8e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-09.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-09">
+  <title>libpng: Denial of Service</title>
+  <synopsis>
+    A vulnerability in libpng may allow a remote attacker to crash applications
+    that handle untrusted images.
+  </synopsis>
+  <product type="ebuild">libpng</product>
+  <announced>November 17, 2006</announced>
+  <revised>November 17, 2006: 01</revised>
+  <bug>154380</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libpng" auto="yes" arch="*">
+      <unaffected range="ge">1.2.13</unaffected>
+      <vulnerable range="lt">1.2.13</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libpng is a free ANSI C library used to process and manipulate PNG
+    images.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Audit Team discovered that a
+    vulnerability exists in the sPLT chunk handling code of libpng, a large
+    sPLT chunk may cause an application to attempt to read out of bounds.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft an image that when processed or viewed by
+    an application using libpng causes the application to terminate
+    abnormally.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libpng users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libpng-1.2.13&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5793">CVE-2006-5793</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 10 Nov 2006 11:17:04 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 16 Nov 2006 15:07:26 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-10.xml b/xml/htdocs/security/en/glsa/glsa-200611-10.xml
new file mode 100644
index 00000000..1b22af57
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-10.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-10">
+  <title>WordPress: Multiple vulnerabilities</title>
+  <synopsis>
+    Flaws in WordPress allow a Denial of Service, the disclosure of user
+    metadata and the overwriting of restricted files.
+  </synopsis>
+  <product type="ebuild">wordpress</product>
+  <announced>November 17, 2006</announced>
+  <revised>November 17, 2006: 01</revised>
+  <bug>153303</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/wordpress" auto="yes" arch="*">
+      <unaffected range="ge">2.0.5</unaffected>
+      <vulnerable range="lt">2.0.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    WordPress is a PHP and MySQL based multiuser blogging system.
+    </p>
+  </background>
+  <description>
+    <p>
+    "random" discovered that users can enter serialized objects as strings
+    in their profiles that will be harmful when unserialized. "adapter"
+    found out that user-edit.php fails to effectively deny non-permitted
+    users access to other user's metadata. Additionally, a directory
+    traversal vulnerability in the wp-db-backup module was discovered.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By entering specially crafted strings in his profile, an attacker can
+    crash PHP or even the web server running WordPress. Additionally, by
+    crafting a simple URL, an attacker can read metadata of any other user,
+    regardless of their own permissions. A user with the permission to use
+    the database backup plugin can possibly overwrite files he otherwise
+    has no access to.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All WordPress users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/wordpress-2.0.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5705">CVE-2006-5705</uri>
+    <uri link="http://trac.wordpress.org/ticket/3142">WordPress Ticket 3142</uri>
+    <uri link="http://trac.wordpress.org/ticket/2591">WordPress Ticket 2591</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 08 Nov 2006 12:56:04 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 09 Nov 2006 06:33:42 +0000">
+    frilled
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-11.xml b/xml/htdocs/security/en/glsa/glsa-200611-11.xml
new file mode 100644
index 00000000..883af676
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-11.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-11">
+  <title>TikiWiki: Multiple vulnerabilities</title>
+  <synopsis>
+    TikiWiki allows for the disclosure of MySQL database authentication
+    credentials and for cross-site scripting attacks.
+  </synopsis>
+  <product type="ebuild">tikiwiki</product>
+  <announced>November 20, 2006</announced>
+  <revised>November 20, 2006: 01</revised>
+  <bug>153820</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/tikiwiki" auto="yes" arch="*">
+      <unaffected range="ge">1.9.6</unaffected>
+      <vulnerable range="lt">1.9.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    TikiWiki is an open source content management system written in PHP.
+    </p>
+  </background>
+  <description>
+    <p>
+    In numerous files TikiWiki provides an empty sort_mode parameter,
+    causing TikiWiki to display additional information, including database
+    authentication credentials, in certain error messages. TikiWiki also
+    improperly sanitizes the "url" request variable sent to
+    tiki-featured_link.php.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could cause a database error in various pages of a TikiWiki
+    instance by providing an empty sort_mode request variable, and gain
+    unauthorized access to credentials of the MySQL databases used by
+    TikiWiki. An attacker could also entice a user to browse to a specially
+    crafted URL that could run scripts in the scope of the user's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All TikiWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/tikiwiki-1.9.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5702">CVE-2006-5702</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5703">CVE-2006-5703</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 10 Nov 2006 17:34:20 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 10 Nov 2006 18:20:06 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 13 Nov 2006 22:24:46 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-12.xml b/xml/htdocs/security/en/glsa/glsa-200611-12.xml
new file mode 100644
index 00000000..d6cc4d80
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-12.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-12">
+  <title>Ruby: Denial of Service vulnerability</title>
+  <synopsis>
+    The Ruby cgi.rb CGI library is vulnerable to a Denial of Service attack.
+  </synopsis>
+  <product type="ebuild">ruby</product>
+  <announced>November 20, 2006</announced>
+  <revised>June 11, 2009: 02</revised>
+  <bug>153497</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/ruby" auto="yes" arch="*">
+      <unaffected range="ge">1.8.5-r3</unaffected>
+      <vulnerable range="lt">1.8.5-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ruby is a dynamic, open source programming language with a focus on
+    simplicity and productivity.
+    </p>
+  </background>
+  <description>
+    <p>
+    Zed Shaw, Jeremy Kemper, and Jamis Buck of the Mongrel project reported
+    that the CGI library shipped with Ruby is vulnerable to a remote Denial
+    of Service by an unauthenticated user.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    The vulnerability can be exploited by sending the cgi.rb library an
+    HTTP request with multipart MIME encoding that contains a malformed
+    MIME boundary specifier beginning with "-" instead of "--". Successful
+    exploitation of the vulnerability causes the library to go into an
+    infinite loop waiting for additional nonexistent input.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ruby users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/ruby-1.8.5-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5467">CVE-2006-5467</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 10 Nov 2006 13:03:41 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 15 Nov 2006 21:17:28 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-13.xml b/xml/htdocs/security/en/glsa/glsa-200611-13.xml
new file mode 100644
index 00000000..53744b12
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-13.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-13">
+  <title>Avahi: &quot;netlink&quot; message vulnerability</title>
+  <synopsis>
+    Avahi fails to verify the origin of netlink messages, which could allow
+    local users to spoof network changes.
+  </synopsis>
+  <product type="ebuild">avahi</product>
+  <announced>November 20, 2006</announced>
+  <revised>November 20, 2006: 01</revised>
+  <bug>154322</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-dns/avahi" auto="yes" arch="*">
+      <unaffected range="ge">0.6.15</unaffected>
+      <vulnerable range="lt">0.6.15</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Avahi is a system that facilitates service discovery on a local
+    network.
+    </p>
+  </background>
+  <description>
+    <p>
+    Avahi does not check that the netlink messages come from the kernel
+    instead of a user-space process.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit this vulnerability by crafting malicious
+    netlink messages and trick Avahi to react to fake network changes. This
+    could lead users to connect to untrusted services without knowing.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Avahi users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/avahi-0.6.15&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5461">CVE-2006-5461</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 16 Nov 2006 11:46:25 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 16 Nov 2006 11:47:51 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 20 Nov 2006 08:40:32 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-14.xml b/xml/htdocs/security/en/glsa/glsa-200611-14.xml
new file mode 100644
index 00000000..b24e0720
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-14.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-14">
+  <title>TORQUE: Insecure temporary file creation</title>
+  <synopsis>
+    TORQUE creates temporary files in an insecure manner which could lead to
+    the execution of arbitrary code with elevated privileges.
+  </synopsis>
+  <product type="ebuild">torque</product>
+  <announced>November 20, 2006</announced>
+  <revised>November 24, 2006: 03</revised>
+  <bug>152104</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-cluster/torque" auto="yes" arch="*">
+      <unaffected range="ge">2.1.6</unaffected>
+      <vulnerable range="lt">2.1.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    TORQUE is a resource manager providing control over batch jobs and
+    distributed compute nodes.
+    </p>
+  </background>
+  <description>
+    <p>
+    TORQUE creates temporary files with predictable names. Please note that
+    the TORQUE package shipped in Gentoo Portage is not vulnerable in the
+    default configuration. Only systems with more permissive access rights
+    to the spool directory are vulnerable.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could create links in the temporary file directory,
+    pointing to a valid file somewhere on the filesystem. This could lead
+    to the execution of arbitrary code with elevated privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Ensure that untrusted users don't have write access to the spool
+    directory.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All TORQUE users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-cluster/torque-2.1.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5677">CVE-2006-5677</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 15 Nov 2006 20:45:04 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 16 Nov 2006 11:48:29 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 20 Nov 2006 08:31:55 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-15.xml b/xml/htdocs/security/en/glsa/glsa-200611-15.xml
new file mode 100644
index 00000000..28a2e294
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-15.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-15">
+  <title>qmailAdmin: Buffer overflow</title>
+  <synopsis>
+    qmailAdmin is vulnerable to a buffer overflow that could lead to the remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">qmailadmin</product>
+  <announced>November 21, 2006</announced>
+  <revised>November 21, 2006: 01</revised>
+  <bug>153896</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/qmailadmin" auto="yes" arch="*">
+      <unaffected range="ge">1.2.10</unaffected>
+      <vulnerable range="lt">1.2.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    qmailAdmin is a free software package that provides a web interface for
+    managing a qmail system with virtual domains.
+    </p>
+  </background>
+  <description>
+    <p>
+    qmailAdmin fails to properly handle the "PATH_INFO" variable in
+    qmailadmin.c. The PATH_INFO is a standard CGI environment variable
+    filled with user supplied data.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this vulnerability by sending
+    qmailAdmin a maliciously crafted URL that could lead to the execution
+    of arbitrary code with the permissions of the user running qmailAdmin.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All qmailAdmin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/qmailadmin-1.2.10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1141">CVE-2006-1141</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 15 Nov 2006 21:38:39 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 15 Nov 2006 21:39:01 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 20 Nov 2006 08:53:09 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-16.xml b/xml/htdocs/security/en/glsa/glsa-200611-16.xml
new file mode 100644
index 00000000..f95d9939
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-16.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-16">
+  <title>Texinfo: Buffer overflow</title>
+  <synopsis>
+    Texinfo is vulnerable to a buffer overflow that could lead to the execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">texinfo</product>
+  <announced>November 21, 2006</announced>
+  <revised>November 21, 2006: 01</revised>
+  <bug>154316</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-apps/texinfo" auto="yes" arch="*">
+      <unaffected range="ge">4.8-r5</unaffected>
+      <vulnerable range="lt">4.8-r5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Texinfo is the official documentation system of the GNU project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Miloslav Trmac from Red Hat discovered a buffer overflow in the
+    "readline()" function of texindex.c. The "readline()" function is
+    called by the texi2dvi and texindex commands.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to open a specially crafted Texinfo file, an
+    attacker could execute arbitrary code with the rights of the user
+    running Texinfo.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Texinfo users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/texinfo-4.8-r5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4810">CVE-2006-4810</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 15 Nov 2006 21:23:53 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 15 Nov 2006 21:39:27 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 16 Nov 2006 14:40:00 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-17.xml b/xml/htdocs/security/en/glsa/glsa-200611-17.xml
new file mode 100644
index 00000000..13d5b080
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-17.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-17">
+  <title>fvwm: fvwm-menu-directory fvwm command injection</title>
+  <synopsis>
+    A flaw in fvwm-menu-directory may permit a local attacker to execute
+    arbitrary commands with the privileges of another user.
+  </synopsis>
+  <product type="ebuild">fvwm</product>
+  <announced>November 23, 2006</announced>
+  <revised>November 23, 2006: 01</revised>
+  <bug>155078</bug>
+  <access>local</access>
+  <affected>
+    <package name="x11-wm/fvwm" auto="yes" arch="*">
+      <unaffected range="ge">2.5.18-r1</unaffected>
+      <vulnerable range="lt">2.5.18-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    fvwm is a highly configurable virtual window manager for X11 desktops.
+    fvwm-menu-directory allows fvwm users to browse directories from within
+    fvwm.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Audit Team discovered that
+    fvwm-menu-directory does not sufficiently sanitise directory names
+    prior to generating menus.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker who can convince an fvwm-menu-directory user to browse
+    a directory they control could cause fvwm commands to be executed with
+    the privileges of the fvwm user. Fvwm commands can be used to execute
+    arbitrary shell commands.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All fvwm users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-wm/fvwm-2.5.18-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5969">CVE-2006-5969</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 21 Nov 2006 05:59:03 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 21 Nov 2006 05:59:31 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 21 Nov 2006 11:10:22 +0000">
+    taviso
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-18.xml b/xml/htdocs/security/en/glsa/glsa-200611-18.xml
new file mode 100644
index 00000000..f9479719
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-18.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-18">
+  <title>TIN: Multiple buffer overflows</title>
+  <synopsis>
+    Multiple buffer overflows have been reported in TIN, possibly leading to
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">tin</product>
+  <announced>November 24, 2006</announced>
+  <revised>November 24, 2006: 01</revised>
+  <bug>150229</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-nntp/tin" auto="yes" arch="*">
+      <unaffected range="ge">1.8.2</unaffected>
+      <vulnerable range="lt">1.8.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    TIN is a threaded NNTP and spool based UseNet newsreader for a variety
+    of platforms.
+    </p>
+  </background>
+  <description>
+    <p>
+    Urs Janssen and Aleksey Salow have reported multiple buffer overflows
+    in TIN. Additionally, the OpenPKG project has reported an allocation
+    off-by-one flaw which can lead to a buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a TIN user to read a specially crafted news
+    article, and execute arbitrary code with the rights of the user running
+    TIN.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All TIN users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-nntp/tin-1.8.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.005-tin.html">OpenPKG Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0804">CVE-2006-0804</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 21 Nov 2006 07:44:01 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 21 Nov 2006 07:44:13 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 21 Nov 2006 14:05:36 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-19.xml b/xml/htdocs/security/en/glsa/glsa-200611-19.xml
new file mode 100644
index 00000000..d4145afe
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-19.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-19">
+  <title>ImageMagick: PALM and DCM buffer overflows</title>
+  <synopsis>
+    ImageMagick improperly handles PALM and DCM images, potentially resulting
+    in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">imagemagick</product>
+  <announced>November 24, 2006</announced>
+  <revised>November 24, 2006: 01</revised>
+  <bug>152672</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/imagemagick" auto="yes" arch="*">
+      <unaffected range="ge">6.3.0.5</unaffected>
+      <vulnerable range="lt">6.3.0.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ImageMagick is a software suite to create, edit, and compose bitmap
+    images, that can also read, write, and convert images in many other
+    formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    M. Joonas Pihlaja has reported that a boundary error exists within the
+    ReadDCMImage() function of coders/dcm.c, causing the improper handling
+    of DCM images. Pihlaja also reported that there are several boundary
+    errors in the ReadPALMImage() function of coders/palm.c, similarly
+    causing the improper handling of PALM images.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially crafted DCM or PALM
+    image with ImageMagick, and possibly execute arbitrary code with the
+    privileges of the user running ImageMagick.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ImageMagick users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/imagemagick-6.3.0.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5456">CVE-2006-5456</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 21 Nov 2006 07:20:25 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 22 Nov 2006 15:07:36 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 24 Nov 2006 19:28:35 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-20.xml b/xml/htdocs/security/en/glsa/glsa-200611-20.xml
new file mode 100644
index 00000000..ce58680e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-20.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-20">
+  <title>GNU gv: Stack overflow</title>
+  <synopsis>
+    GNU gv improperly handles user-supplied data possibly allowing for the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">gv</product>
+  <announced>November 24, 2006</announced>
+  <revised>November 24, 2006: 01</revised>
+  <bug>154573</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/gv" auto="yes" arch="*">
+      <unaffected range="ge">3.6.2-r1</unaffected>
+      <vulnerable range="lt">3.6.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GNU gv is a viewer for PostScript and PDF documents.
+    </p>
+  </background>
+  <description>
+    <p>
+    GNU gv does not properly boundary check user-supplied data before
+    copying it into process buffers.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially crafted document
+    with GNU gv and execute arbitrary code with the rights of the user on
+    the system.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All gv users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/gv-3.6.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5864">CVE-2006-5864</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 21 Nov 2006 06:07:37 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 21 Nov 2006 14:27:05 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 24 Nov 2006 20:18:52 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-21.xml b/xml/htdocs/security/en/glsa/glsa-200611-21.xml
new file mode 100644
index 00000000..374b30d9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-21.xml
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-21">
+  <title>Kile: Incorrect backup file permission</title>
+  <synopsis>
+    Kile uses default permissions for backup files, potentially leading to
+    information disclosure.
+  </synopsis>
+  <product type="ebuild">kile</product>
+  <announced>November 27, 2006</announced>
+  <revised>November 27, 2006: 01</revised>
+  <bug>155613</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-editors/kile" auto="yes" arch="*">
+      <unaffected range="ge">1.9.2-r1</unaffected>
+      <vulnerable range="lt">1.9.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Kile is a TeX/LaTeX editor for KDE.
+    </p>
+  </background>
+  <description>
+    <p>
+    Kile fails to set the same permissions on backup files as on the
+    original file. This is similar to CVE-2005-1920.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A kile user may inadvertently grant access to sensitive information.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Kile users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-editors/kile-1.9.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1920">CVE-2005-1920</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 24 Nov 2006 10:25:19 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 27 Nov 2006 07:49:07 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-22.xml b/xml/htdocs/security/en/glsa/glsa-200611-22.xml
new file mode 100644
index 00000000..68ba056d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-22.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-22">
+  <title>Ingo H3: Folder name shell command injection</title>
+  <synopsis>
+    Ingo H3 is vulnerable to arbitrary shell command execution when handling
+    procmail rules.
+  </synopsis>
+  <product type="ebuild">horde-ingo</product>
+  <announced>November 27, 2006</announced>
+  <revised>November 27, 2006: 01</revised>
+  <bug>153927</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/horde-ingo" auto="yes" arch="*">
+      <unaffected range="ge">1.1.2</unaffected>
+      <vulnerable range="lt">1.1.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ingo H3 is a generic frontend for editing Sieve, procmail, maildrop and
+    IMAP filter rules.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ingo H3 fails to properly escape shell metacharacters in procmail
+    rules.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote authenticated attacker could craft a malicious rule which
+    could lead to the execution of arbitrary shell commands on the server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Don't use procmail with Ingo H3.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ingo H3 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-ingo-1.1.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5449">CVE-2006-5449</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 21 Nov 2006 06:42:39 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 24 Nov 2006 19:04:29 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 24 Nov 2006 19:46:46 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-23.xml b/xml/htdocs/security/en/glsa/glsa-200611-23.xml
new file mode 100644
index 00000000..c6a1b0be
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-23.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-23">
+  <title>Mono: Insecure temporary file creation</title>
+  <synopsis>
+    Mono is vulnerable to linking attacks, potentially allowing a local user to
+    overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">mono</product>
+  <announced>November 28, 2006</announced>
+  <revised>November 28, 2006: 01</revised>
+  <bug>150264</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-lang/mono" auto="yes" arch="*">
+      <unaffected range="ge">1.1.13.8.1</unaffected>
+      <vulnerable range="lt">1.1.13.8.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mono provides the necessary software to develop and run .NET client and
+    server applications.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sebastian Krahmer of the SuSE Security Team discovered that the
+    System.CodeDom.Compiler classes of Mono create temporary files with
+    insecure permissions.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create links in the temporary file directory,
+    pointing to a valid file somewhere on the filesystem. When an affected
+    class is called, this could result in the file being overwritten with
+    the rights of the user running the script.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mono users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/mono-1.1.13.8.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5072">CVE-2006-5072</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 24 Nov 2006 09:48:51 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 27 Nov 2006 17:16:01 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 28 Nov 2006 12:13:57 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-24.xml b/xml/htdocs/security/en/glsa/glsa-200611-24.xml
new file mode 100644
index 00000000..ef9845c3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-24.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-24">
+  <title>LHa: Multiple vulnerabilities</title>
+  <synopsis>
+    LHa is affected by several vulnerabilities including the remote execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">lha</product>
+  <announced>November 28, 2006</announced>
+  <revised>November 28, 2006: 01</revised>
+  <bug>151252</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/lha" auto="yes" arch="*">
+      <unaffected range="ge">114i-r6</unaffected>
+      <vulnerable range="lt">114i-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    LHa is a console-based program for packing and unpacking LHarc
+    archives.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Google Security Team discovered several
+    vulnerabilities in the LZH decompression component used by LHa. The
+    make_table function of unlzh.c contains an array index error and a
+    buffer overflow vulnerability. The build_tree function of unpack.c
+    contains a buffer underflow vulnerability. Additionally, unlzh.c
+    contains a code that could run in an infinite loop.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to uncompress a specially crafted archive, a remote
+    attacker could cause a Denial of Service by CPU consumption or execute
+    arbitrary code with the rights of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All LHa users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/lha-114i-r6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4335">CVE-2006-4335</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4336">CVE-2006-4336</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4337">CVE-2006-4337</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4338">CVE-2006-4338</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 24 Nov 2006 21:52:23 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 27 Nov 2006 17:02:28 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 27 Nov 2006 17:07:24 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-25.xml b/xml/htdocs/security/en/glsa/glsa-200611-25.xml
new file mode 100644
index 00000000..d232a14b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-25.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-25">
+  <title>OpenLDAP: Denial of Service vulnerability</title>
+  <synopsis>
+    A flaw in OpenLDAP allows remote unauthenticated attackers to cause a
+    Denial of Service.
+  </synopsis>
+  <product type="ebuild">openldap</product>
+  <announced>November 28, 2006</announced>
+  <revised>November 28, 2006: 01</revised>
+  <bug>154349</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-nds/openldap" auto="yes" arch="*">
+      <unaffected range="ge">2.3.27-r3</unaffected>
+      <unaffected range="rge">2.2.28-r5</unaffected>
+      <unaffected range="rge">2.1.30-r8</unaffected>
+      <vulnerable range="lt">2.3.27-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenLDAP is a suite of LDAP-related applications and development tools.
+    </p>
+  </background>
+  <description>
+    <p>
+    Evgeny Legerov has discovered that the truncation of an incoming
+    authcid longer than 255 characters and ending with a space as the 255th
+    character will lead to an improperly computed name length. This will
+    trigger an assert in the libldap code.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a BIND request with a specially crafted authcid parameter to
+    an OpenLDAP service, a remote attacker can cause the service to crash.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenLDAP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;net-nds/openldap&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5779">CVE-2006-5779</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 27 Nov 2006 13:22:56 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 27 Nov 2006 16:35:57 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 27 Nov 2006 16:37:27 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200611-26.xml b/xml/htdocs/security/en/glsa/glsa-200611-26.xml
new file mode 100644
index 00000000..345d3ef8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200611-26.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200611-26">
+  <title>ProFTPD: Remote execution of arbitrary code</title>
+  <synopsis>
+    ProFTPD is affected by mutiple vulnerabilities allowing for the remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">proftpd</product>
+  <announced>November 30, 2006</announced>
+  <revised>November 30, 2006: 01</revised>
+  <bug>154650</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-ftp/proftpd" auto="yes" arch="*">
+      <unaffected range="ge">1.3.0a</unaffected>
+      <vulnerable range="lt">1.3.0a</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ProFTPD is a highly-configurable FTP server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Evgeny Legerov discovered a stack-based buffer overflow in the
+    s_replace() function in support.c, as well as a buffer overflow in in
+    the mod_tls module. Additionally, an off-by-two error related to the
+    CommandBufferSize configuration directive was reported.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An authenticated attacker could exploit the s_replace() vulnerability
+    by uploading a crafted .message file or sending specially crafted
+    commands to the server, possibly resulting in the execution of
+    arbitrary code with the rights of the user running ProFTPD. An
+    unauthenticated attacker could send specially crafted data to the
+    server with mod_tls enabled which could result in the execution of
+    arbitrary code with the rights of the user running ProFTPD. Finally,
+    the off-by-two error related to the CommandBufferSize configuration
+    directive was fixed - exploitability of this error is disputed. Note
+    that the default configuration on Gentoo is to run ProFTPD as an
+    unprivileged user, and has mod_tls disabled.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ProFTPD users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-ftp/proftpd-1.3.0a&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5815">CVE-2006-5815</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6170">CVE-2006-6170</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6171">CVE-2006-6171 (disputed)</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 28 Nov 2006 20:50:41 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 29 Nov 2006 12:52:56 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 30 Nov 2006 22:38:58 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-01.xml b/xml/htdocs/security/en/glsa/glsa-200612-01.xml
new file mode 100644
index 00000000..70533c46
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-01.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-01">
+  <title>wv library: Multiple integer overflows</title>
+  <synopsis>
+    The wv library is vulnerable to multiple integer overflows which could lead
+    to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">wv library</product>
+  <announced>December 07, 2006</announced>
+  <revised>December 07, 2006: 01</revised>
+  <bug>153800</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/wv" auto="yes" arch="*">
+      <unaffected range="ge">1.2.3-r1</unaffected>
+      <vulnerable range="lt">1.2.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    wv is a library for conversion of MS Word DOC and RTF files.
+    </p>
+  </background>
+  <description>
+    <p>
+    The wv library fails to do proper arithmetic checks in multiple places,
+    possibly leading to integer overflows.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could craft a malicious file that, when handled with the wv
+    library, could lead to the execution of arbitrary code with the
+    permissions of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All wv library users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/wv-1.2.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4513">CVE-2006-4513</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 24 Nov 2006 19:24:02 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 24 Nov 2006 19:46:34 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-02.xml b/xml/htdocs/security/en/glsa/glsa-200612-02.xml
new file mode 100644
index 00000000..593f5d6a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-02.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-02">
+  <title>xine-lib: Buffer overflow</title>
+  <synopsis>
+    xine-lib is vulnerable to a buffer overflow in the Real Media input plugin,
+    which could lead to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">xine-lib</product>
+  <announced>December 09, 2006</announced>
+  <revised>December 09, 2006: 01</revised>
+  <bug>156645</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/xine-lib" auto="yes" arch="*">
+      <unaffected range="ge">1.1.2-r3</unaffected>
+      <vulnerable range="lt">1.1.2-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xine is a portable and reusable multimedia playback engine. xine-lib is
+    xine's core engine.
+    </p>
+  </background>
+  <description>
+    <p>
+    A possible buffer overflow has been reported in the Real Media input
+    plugin.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit this vulnerability by enticing a user into
+    loading a specially crafted stream with xine or an application using
+    xine-lib. This can lead to a Denial of Service and possibly the
+    execution of arbitrary code with the rights of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xine-lib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/xine-lib-1.1.2-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6172">CVE-2006-6172</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 03 Dec 2006 14:51:06 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 07 Dec 2006 10:43:19 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 09 Dec 2006 07:44:10 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-03.xml b/xml/htdocs/security/en/glsa/glsa-200612-03.xml
new file mode 100644
index 00000000..9c6ed7d4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-03.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-03">
+  <title>GnuPG: Multiple vulnerabilities</title>
+  <synopsis>
+    GnuPG is vulnerable to a buffer overflow and an erroneous function pointer
+    dereference that can result in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">gnupg</product>
+  <announced>December 10, 2006</announced>
+  <revised>December 10, 2006: 02</revised>
+  <bug>156476</bug>
+  <bug>156947</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/gnupg" auto="yes" arch="*">
+      <unaffected range="ge">1.4.6</unaffected>
+      <vulnerable range="lt">1.4.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The GNU Privacy Guard, GnuPG, is a free replacement for the PGP suite
+    of cryptographic software.
+    </p>
+  </background>
+  <description>
+    <p>
+    Hugh Warrington has reported a boundary error in GnuPG, in the
+    "ask_outfile_name()" function from openfile.c: the
+    make_printable_string() function could return a string longer than
+    expected. Additionally, Tavis Ormandy of the Gentoo Security Team
+    reported a design error in which a function pointer can be incorrectly
+    dereferenced.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to interactively use GnuPG on a
+    crafted file and trigger the boundary error, which will result in a
+    buffer overflow. They could also entice a user to process a signed or
+    encrypted file with gpg or gpgv, possibly called through another
+    application like a mail client, to trigger the dereference error. Both
+    of these vulnerabilities would result in the execution of arbitrary
+    code with the permissions of the user running GnuPG. gpg-agent, gpgsm
+    and other tools are not affected.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GnuPG users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;=app-crypt/gnupg-1.4*&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6169">CVE-2006-6169</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6235">CVE-2006-6235</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 07 Dec 2006 11:29:58 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 08 Dec 2006 11:06:22 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 09 Dec 2006 21:41:04 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-04.xml b/xml/htdocs/security/en/glsa/glsa-200612-04.xml
new file mode 100644
index 00000000..f2024ff5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-04.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-04">
+  <title>ModPlug: Multiple buffer overflows</title>
+  <synopsis>
+    ModPlug contains several boundary errors that could lead to buffer
+    overflows resulting in the possible execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">libmodplug</product>
+  <announced>December 10, 2006</announced>
+  <revised>December 10, 2006: 01</revised>
+  <bug>143404</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libmodplug" auto="yes" arch="*">
+      <unaffected range="ge">0.8-r1</unaffected>
+      <vulnerable range="lt">0.8-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ModPlug is a library for playing MOD-like music.
+    </p>
+  </background>
+  <description>
+    <p>
+    Luigi Auriemma has reported various boundary errors in load_it.cpp and
+    a boundary error in the "CSoundFile::ReadSample()" function in
+    sndfile.cpp.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker can entice a user to read crafted modules or ITP
+    files, which may trigger a buffer overflow resulting in the execution
+    of arbitrary code with the privileges of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ModPlug users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libmodplug-0.8-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4192">CVE-2006-4192</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 05 Dec 2006 19:55:31 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 07 Dec 2006 10:06:27 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 08 Dec 2006 13:57:46 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-05.xml b/xml/htdocs/security/en/glsa/glsa-200612-05.xml
new file mode 100644
index 00000000..8b84ec4b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-05.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-05">
+  <title>KOffice shared libraries: Heap corruption</title>
+  <synopsis>
+    An integer overflow in koffice-libs allows for a Denial of Service and
+    possibly the execution of arbitrary code when viewing malicious PowerPoint
+    files.
+  </synopsis>
+  <product type="ebuild">koffice-libs</product>
+  <announced>December 10, 2006</announced>
+  <revised>December 10, 2006: 01</revised>
+  <bug>155914</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/koffice-libs" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0</unaffected>
+      <vulnerable range="lt">1.5.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KOffice is an integrated office suite for KDE. koffice-libs is a
+    package containing shared librares used by KOffice programs.
+    </p>
+  </background>
+  <description>
+    <p>
+    Kees Cook of Ubuntu discovered that 'KLaola::readBigBlockDepot()' in
+    klaola.cc fills 'num_of_bbd_blocks' while reading a .ppt (PowerPoint)
+    file without proper sanitizing, resulting in an integer overflow
+    subsequently overwriting the heap with parts of the file being read.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to open a specially crafted PowerPoint file, an
+    attacker could crash the application and possibly execute arbitrary
+    code with the rights of the user running KOffice.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All koffice-libs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/koffice-libs-1.5.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6120">CVE-2006-6120</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 01 Dec 2006 20:55:38 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 01 Dec 2006 21:30:45 +0000">
+    frilled
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 10 Dec 2006 13:39:48 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-06.xml b/xml/htdocs/security/en/glsa/glsa-200612-06.xml
new file mode 100644
index 00000000..bfb73e47
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-06.xml
@@ -0,0 +1,102 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-06">
+  <title>Mozilla Thunderbird: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been identified in Mozilla Thunderbird.
+  </synopsis>
+  <product type="ebuild">mozilla-thunderbird</product>
+  <announced>December 10, 2006</announced>
+  <revised>December 10, 2006: 01</revised>
+  <bug>154448</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/mozilla-thunderbird" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.8</unaffected>
+      <vulnerable range="lt">1.5.0.8</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.8</unaffected>
+      <vulnerable range="lt">1.5.0.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Thunderbird is a popular open-source email client from the
+    Mozilla Project.
+    </p>
+  </background>
+  <description>
+    <p>
+    It has been identified that Mozilla Thunderbird improperly handles
+    Script objects while they are being executed, allowing them to be
+    modified during execution. JavaScript is disabled in Mozilla
+    Thunderbird by default. Mozilla Thunderbird has also been found to be
+    vulnerable to various potential buffer overflows. Lastly, the binary
+    release of Mozilla Thunderbird is vulnerable to a low exponent RSA
+    signature forgery issue because it is bundled with a vulnerable version
+    of NSS.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could entice a user to view a specially crafted email that
+    causes a buffer overflow and again executes arbitrary code or causes a
+    Denial of Service. An attacker could also entice a user to view an
+    email containing specially crafted JavaScript and execute arbitrary
+    code with the rights of the user running Mozilla Thunderbird. It is
+    important to note that JavaScript is off by default in Mozilla
+    Thunderbird, and enabling it is strongly discouraged. It is also
+    possible for an attacker to create SSL/TLS or email certificates that
+    would not be detected as invalid by the binary release of Mozilla
+    Thunderbird, raising the possibility for Man-in-the-Middle attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Users upgrading to the following releases of Mozilla Thunderbird should
+    note that this version of Mozilla Thunderbird has been found to not
+    display certain messages in some cases.
+    </p>
+    <p>
+    <br></br>
+    <br></br> All Mozilla Thunderbird users should upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-1.5.0.8&quot;</code>
+    <p>
+    All Mozilla Thunderbird binary release users should upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-bin-1.5.0.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5462">CVE-2006-5462</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5463">CVE-2006-5463</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5464">CVE-2006-5464</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5747">CVE-2006-5747</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5748">CVE-2006-5748</uri>
+    <uri link="https://bugzilla.mozilla.org/show_bug.cgi?id=360409">Mozilla Thunderbird Email Loss Bug</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 21 Nov 2006 06:10:05 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 21 Nov 2006 06:10:22 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 21 Nov 2006 13:53:32 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-07.xml b/xml/htdocs/security/en/glsa/glsa-200612-07.xml
new file mode 100644
index 00000000..23e531e2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-07.xml
@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-07">
+  <title>Mozilla Firefox: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been reported in Mozilla Firefox.
+  </synopsis>
+  <product type="ebuild">mozilla-firefox</product>
+  <announced>December 10, 2006</announced>
+  <revised>December 10, 2006: 01</revised>
+  <bug>154434</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.8</unaffected>
+      <vulnerable range="lt">1.5.0.8</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.8</unaffected>
+      <vulnerable range="lt">1.5.0.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Firefox is a popular open-source web browser from the Mozilla
+    Project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mozilla Firefox improperly handles Script objects while they are being
+    executed. Mozilla Firefox has also been found to be vulnerable to
+    various possible buffer overflows. Lastly, the binary release of
+    Mozilla Firefox is vulnerable to a low exponent RSA signature forgery
+    issue because it is bundled with a vulnerable version of NSS.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to view specially crafted JavaScript
+    and execute arbitrary code with the rights of the user running Mozilla
+    Firefox. An attacker could also entice a user to view a specially
+    crafted web page that causes a buffer overflow and again executes
+    arbitrary code. It is also possible for an attacker to make up SSL/TLS
+    certificates that would not be detected as invalid by the binary
+    release of Mozilla Firefox, raising the possibility for
+    Man-in-the-Middle attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-1.5.0.8&quot;</code>
+    <p>
+    All Mozilla Firefox binary release users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-1.5.0.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5462">CVE-2006-5462</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5463">CVE-2006-5463</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5464">CVE-2006-5464</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5747">CVE-2006-5747</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5748">CVE-2006-5748</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 21 Nov 2006 06:11:10 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 21 Nov 2006 06:11:37 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 21 Nov 2006 13:30:11 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-08.xml b/xml/htdocs/security/en/glsa/glsa-200612-08.xml
new file mode 100644
index 00000000..7087856f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-08.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-08">
+  <title>SeaMonkey: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been identified in the SeaMonkey project.
+  </synopsis>
+  <product type="ebuild">seamonkey</product>
+  <announced>December 10, 2006</announced>
+  <revised>December 10, 2006: 01</revised>
+  <bug>154449</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/seamonkey" auto="yes" arch="*">
+      <unaffected range="ge">1.0.6</unaffected>
+      <vulnerable range="lt">1.0.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The SeaMonkey project is a community effort to deliver
+    production-quality releases of code derived from the application
+    formerly known as 'Mozilla Application Suite'.
+    </p>
+  </background>
+  <description>
+    <p>
+    The SeaMonkey project is vulnerable to arbitrary JavaScript bytecode
+    execution and arbitrary code execution.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could entice a user to load malicious JavaScript or a
+    malicious web page with a SeaMonkey application and execute arbitrary
+    code with the rights of the user running those products. It is
+    important to note that in the SeaMonkey email client, JavaScript is
+    disabled by default.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SeaMonkey users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/seamonkey-1.0.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5462">CVE-2006-5462</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5463">CVE-2006-5463</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5464">CVE-2006-5464</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5747">CVE-2006-5747</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5748">CVE-2006-5748</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 21 Nov 2006 06:08:42 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 21 Nov 2006 13:46:12 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 10 Dec 2006 19:01:27 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-09.xml b/xml/htdocs/security/en/glsa/glsa-200612-09.xml
new file mode 100644
index 00000000..3821daf9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-09.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-09">
+  <title>MadWifi: Kernel driver buffer overflow</title>
+  <synopsis>
+    MadWifi is vulnerable to a buffer overflow that could potentially lead to
+    the remote execution of arbitrary code with root privileges.
+  </synopsis>
+  <product type="ebuild">madwifi-ng</product>
+  <announced>December 10, 2006</announced>
+  <revised>December 10, 2006: 01</revised>
+  <bug>157449</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-wireless/madwifi-ng" auto="yes" arch="*">
+      <unaffected range="ge">0.9.2.1</unaffected>
+      <vulnerable range="lt">0.9.2.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MadWifi (Multiband Atheros Driver for Wireless Fidelity) provides a
+    Linux kernel device driver for Atheros-based Wireless LAN devices.
+    </p>
+  </background>
+  <description>
+    <p>
+    Laurent Butti, Jerome Raznieski and Julien Tinnes reported a buffer
+    overflow in the encode_ie() and the giwscan_cb() functions from
+    ieee80211_wireless.c.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send specially crafted wireless WPA packets
+    containing malicious RSN Information Headers (IE) that could
+    potentially lead to the remote execution of arbitrary code as the root
+    user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MadWifi users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-wireless/madwifi-ng-0.9.2.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6332">CVE-2006-6332</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 07 Dec 2006 19:16:43 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 07 Dec 2006 22:47:16 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 10 Dec 2006 21:00:26 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-10.xml b/xml/htdocs/security/en/glsa/glsa-200612-10.xml
new file mode 100644
index 00000000..fcb66ed5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-10.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-10">
+  <title>Tar: Directory traversal vulnerability</title>
+  <synopsis>
+    Tar is vulnerable to directory traversal possibly allowing for the
+    overwriting of arbitrary files.
+  </synopsis>
+  <product type="ebuild">tar</product>
+  <announced>December 11, 2006</announced>
+  <revised>December 11, 2006: 01</revised>
+  <bug>155901</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/tar" auto="yes" arch="*">
+      <unaffected range="ge">1.16-r2</unaffected>
+      <vulnerable range="lt">1.16-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Tar program provides the ability to create and manipulate tar
+    archives.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tar does not properly extract archive elements using the GNUTYPE_NAMES
+    record name, allowing files to be created at arbitrary locations using
+    symlinks. Once a symlink is extracted, files after the symlink in the
+    archive will be extracted to the destination of the symlink.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to extract a specially crafted tar
+    archive, possibly allowing for the overwriting of arbitrary files on
+    the system extracting the archive.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Tar users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/tar-1.16-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6097">CVE-2006-6097</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 07 Dec 2006 10:14:08 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 10 Dec 2006 20:35:35 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 11 Dec 2006 17:59:09 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-11.xml b/xml/htdocs/security/en/glsa/glsa-200612-11.xml
new file mode 100644
index 00000000..b40ac2a3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-11.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-11">
+  <title>AMD64 x86 emulation base libraries: OpenSSL multiple vulnerabilities</title>
+  <synopsis>
+    OpenSSL contains multiple vulnerabilities including the possible execution
+    of remote arbitrary code.
+  </synopsis>
+  <product type="ebuild">emul-linux-x86-baselibs</product>
+  <announced>December 11, 2006</announced>
+  <revised>December 11, 2006: 01</revised>
+  <bug>152640</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-emulation/emul-linux-x86-baselibs" auto="yes" arch="amd64">
+      <unaffected range="ge">2.5.5</unaffected>
+      <vulnerable range="lt">2.5.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSSL is a toolkit implementing the Secure Sockets Layer, Transport
+    Layer Security protocols and a general-purpose cryptography library.
+    The x86 emulation base libraries for AMD64 contain a vulnerable version
+    of OpenSSL.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy and Will Drewry, both of the Google Security Team,
+    discovered that the SSL_get_shared_ciphers() function contains a buffer
+    overflow vulnerability, and that the SSLv2 client code contains a flaw
+    leading to a crash. Additionally, Dr. Stephen N. Henson found that the
+    ASN.1 handler contains two Denial of Service vulnerabilities: while
+    parsing an invalid ASN.1 structure and while handling certain types of
+    public key.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could trigger the buffer overflow by sending a malicious
+    suite of ciphers to an application using the vulnerable function, and
+    thus execute arbitrary code with the rights of the user running the
+    application. An attacker could also consume CPU and/or memory by
+    exploiting the Denial of Service vulnerabilities. Finally, a malicious
+    server could crash a SSLv2 client through the SSLv2 vulnerability.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All AMD64 x86 emulation base libraries users should upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/emul-linux-x86-baselibs-2.5.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2937">CVE-2006-2937</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2940">CVE-2006-2940</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738">CVE-2006-3738</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4343">CVE-2006-4343</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 24 Oct 2006 10:04:50 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 11 Dec 2006 23:29:14 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-12.xml b/xml/htdocs/security/en/glsa/glsa-200612-12.xml
new file mode 100644
index 00000000..684c6b20
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-12.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-12">
+  <title>F-PROT Antivirus: Multiple vulnerabilities</title>
+  <synopsis>
+    F-Prot Antivirus contains a buffer overflow and other unspecified
+    vulnerabilities, possibly allowing the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">f-prot</product>
+  <announced>December 12, 2006</announced>
+  <revised>December 12, 2006: 01</revised>
+  <bug>157612</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/f-prot" auto="yes" arch="*">
+      <unaffected range="ge">4.6.7</unaffected>
+      <vulnerable range="lt">4.6.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    F-Prot Antivirus is a FRISK Software antivirus program that can used
+    with procmail.
+    </p>
+  </background>
+  <description>
+    <p>
+    F-Prot Antivirus version 4.6.7 fixes a heap-based buffer overflow, an
+    infinite loop, and other unspecified vulnerabilities.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Among other weaker impacts, a remote attacker could send an e-mail
+    containing a malicious file that would trigger the buffer overflow
+    vulnerability and execute arbitrary code with the privileges of the
+    user running F-Prot, which may be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All F-Prot users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/f-prot-4.6.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6293">CVE-2006-6293</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6294">CVE-2006-6294</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6352">CVE-2006-6352</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 11 Dec 2006 17:16:15 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 11 Dec 2006 20:51:14 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 11 Dec 2006 23:24:00 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-13.xml b/xml/htdocs/security/en/glsa/glsa-200612-13.xml
new file mode 100644
index 00000000..d8b98e1c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-13.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-13">
+  <title>libgsf: Buffer overflow</title>
+  <synopsis>
+    libgsf improperly allocates memory allowing for a heap overflow and
+    possibly the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">libgsf</product>
+  <announced>December 12, 2006</announced>
+  <revised>December 12, 2006: 01</revised>
+  <bug>156693</bug>
+  <access>remote</access>
+  <affected>
+    <package name="gnome-extra/libgsf" auto="yes" arch="*">
+      <unaffected range="ge">1.14.2</unaffected>
+      <vulnerable range="lt">1.14.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The GNOME Structured File Library is an I/O library that can read and
+    write common file types and handle structured formats that provide
+    file-system-in-a-file semantics.
+    </p>
+  </background>
+  <description>
+    <p>
+    "infamous41md" has discovered that the "ole_init_info" function may
+    allocate too little memory for storing the contents of an OLE document,
+    resulting in a heap buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially crafted OLE
+    document, and possibly execute arbitrary code with the rights of the
+    user opening the document.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libgsf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=gnome-extra/libgsf-1.14.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4514">CVE-2006-4514</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 10 Dec 2006 19:48:29 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 10 Dec 2006 20:34:33 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 11 Dec 2006 18:08:22 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-14.xml b/xml/htdocs/security/en/glsa/glsa-200612-14.xml
new file mode 100644
index 00000000..98466e99
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-14.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-14">
+  <title>Trac: Cross-site request forgery</title>
+  <synopsis>
+    Trac allows remote attackers to execute unauthorized actions as other
+    users.
+  </synopsis>
+  <product type="ebuild">trac</product>
+  <announced>December 12, 2006</announced>
+  <revised>December 12, 2006: 01</revised>
+  <bug>154574</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/trac" auto="yes" arch="*">
+      <unaffected range="ge">0.10.1</unaffected>
+      <vulnerable range="lt">0.10.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Trac is a wiki and issue tracking system for software development
+    projects.
+    </p>
+  </background>
+  <description>
+    <p>
+    Trac allows users to perform certain tasks via HTTP requests without
+    performing correct validation on those requests.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    An attacker could entice an authenticated user to browse to a specially
+    crafted URL, allowing the attacker to execute actions in the Trac
+    instance as if they were the user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Trac users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/trac-0.10.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5848">CVE-2006-5848</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5878">CVE-2006-5878</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 06 Dec 2006 06:01:31 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 07 Dec 2006 10:06:43 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 11 Dec 2006 18:17:55 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-15.xml b/xml/htdocs/security/en/glsa/glsa-200612-15.xml
new file mode 100644
index 00000000..e6d0ef63
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-15.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-15">
+  <title>McAfee VirusScan: Insecure DT_RPATH</title>
+  <synopsis>
+    McAfee VirusScan for Linux is distributed with an insecure DT_RPATH,
+    potentially allowing a remote attacker to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">vlnx</product>
+  <announced>December 14, 2006</announced>
+  <revised>December 14, 2006: 01</revised>
+  <bug>156989</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/vlnx" auto="yes" arch="*">
+      <vulnerable range="le">4510e</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    McAfee VirusScan for Linux is a commercial antivirus solution for
+    Linux.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jakub Moc of Gentoo Linux discovered that McAfee VirusScan was
+    distributed with an insecure DT_RPATH which included the current
+    working directory, rather than $ORIGIN which was probably intended.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could entice a VirusScan user to scan an arbitrary file and
+    execute arbitrary code with the privileges of the VirusScan user by
+    tricking the dynamic loader into loading an untrusted ELF DSO. An
+    automated system, such as a mail scanner, may be subverted to execute
+    arbitrary code with the privileges of the process invoking VirusScan.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not scan files or execute VirusScan from an untrusted working
+    directory.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    As VirusScan verifies that it has not been modified before executing,
+    it is not possible to correct the DT_RPATH. Furthermore, this would
+    violate the license that VirusScan is distributed under. For this
+    reason, the package has been masked in Portage pending the resolution
+    of this issue.
+    </p>
+    <code>
+    # emerge --ask --verbose --unmerge &quot;app-antivirus/vlnx&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6474">CVE-2006-6474</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 11 Dec 2006 18:55:04 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 11 Dec 2006 21:23:39 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-16.xml b/xml/htdocs/security/en/glsa/glsa-200612-16.xml
new file mode 100644
index 00000000..06bdd0fd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-16.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-16">
+  <title>Links: Arbitrary Samba command execution</title>
+  <synopsis>
+    Links does not properly validate "smb://" URLs, making it vulnerable to the
+    execution of arbitrary Samba commands.
+  </synopsis>
+  <product type="ebuild">links</product>
+  <announced>December 14, 2006</announced>
+  <revised>December 14, 2006: 01</revised>
+  <bug>157028</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/links" auto="yes" arch="*">
+      <unaffected range="ge">2.1_pre26</unaffected>
+      <vulnerable range="lt">2.1_pre26</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Links is a web browser running in both graphics and text modes.
+    </p>
+  </background>
+  <description>
+    <p>
+    Teemu Salmela discovered that Links does not properly validate "smb://"
+    URLs when it runs smbclient commands.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to browse to a specially crafted
+    "smb://" URL and execute arbitrary Samba commands, which would allow
+    the overwriting of arbitrary local files or the upload or the download
+    of arbitrary files. This vulnerability can be exploited only if
+    "smbclient" is installed on the victim's computer, which is provided by
+    the "samba" Gentoo package.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Links users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/links-2.1_pre26&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5925">CVE-2006-5925</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 10 Dec 2006 21:05:34 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 12 Dec 2006 00:14:43 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 13 Dec 2006 14:10:35 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-17.xml b/xml/htdocs/security/en/glsa/glsa-200612-17.xml
new file mode 100644
index 00000000..0bb36115
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-17.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-17">
+  <title>GNU Radius: Format string vulnerability</title>
+  <synopsis>
+    A format string vulnerabilty has been found in GNU Radius, which could lead
+    to the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">gnuradius</product>
+  <announced>December 14, 2006</announced>
+  <revised>December 14, 2006: 01</revised>
+  <bug>156376</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dialup/gnuradius" auto="yes" arch="*">
+      <unaffected range="ge">1.4</unaffected>
+      <vulnerable range="lt">1.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GNU Radius is a GNU version of Radius, a server for remote user
+    authentication and accounting.
+    </p>
+  </background>
+  <description>
+    <p>
+    A format string vulnerability was found in the sqllog function from the
+    SQL accounting code for radiusd. That function is only used if one or
+    more of the "postgresql", "mysql" or "odbc" USE flags are enabled,
+    which is not the default, except for the "server" 2006.1 and 2007.0
+    profiles which enable the "mysql" USE flag.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An unauthenticated remote attacker could execute arbitrary code with
+    the privileges of the user running radiusd, which may be the root user.
+    It is important to note that there is no default GNU Radius user for
+    Gentoo systems because no init script is provided with the package.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GNU Radius users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dialup/gnuradius-1.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4181">CVE-2006-4181</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 11 Dec 2006 16:15:45 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 11 Dec 2006 20:51:18 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 11 Dec 2006 22:14:11 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-18.xml b/xml/htdocs/security/en/glsa/glsa-200612-18.xml
new file mode 100644
index 00000000..75500e4d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-18.xml
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-18">
+  <title>ClamAV: Denial of Service</title>
+  <synopsis>
+    ClamAV is vulnerable to Denial of Service.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>December 18, 2006</announced>
+  <revised>December 18, 2006: 01</revised>
+  <bug>157698</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.88.7</unaffected>
+      <vulnerable range="lt">0.88.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ClamAV is a GPL virus scanner.
+    </p>
+  </background>
+  <description>
+    <p>
+    Hendrik Weimer discovered that ClamAV fails to properly handle deeply
+    nested MIME multipart/mixed content.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By sending a specially crafted email with deeply nested MIME
+    multipart/mixed content an attacker could cause ClamAV to crash.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.88.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6481">CVE-2006-6481</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 16 Dec 2006 18:27:28 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 18 Dec 2006 19:01:42 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-19.xml b/xml/htdocs/security/en/glsa/glsa-200612-19.xml
new file mode 100644
index 00000000..de5a3eef
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-19.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-19">
+  <title>pam_ldap: Authentication bypass vulnerability</title>
+  <synopsis>
+    pam_ldap contains a vulnerability that may allow a remote user with a
+    locked account to gain unauthorized system access.
+  </synopsis>
+  <product type="ebuild">pam_ldap</product>
+  <announced>December 20, 2006</announced>
+  <revised>December 20, 2006: 01</revised>
+  <bug>153916</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-auth/pam_ldap" auto="yes" arch="*">
+      <unaffected range="ge">183</unaffected>
+      <vulnerable range="lt">183</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    pam_ldap is a Pluggable Authentication Module which allows
+    authentication against LDAP directories.
+    </p>
+  </background>
+  <description>
+    <p>
+    Steve Rigler discovered that pam_ldap does not correctly handle
+    "PasswordPolicyResponse" control responses from an LDAP directory. This
+    causes the pam_authenticate() function to always succeed, even if the
+    previous authentication failed.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A locked user may exploit this vulnerability to bypass the LDAP
+    authentication mechanism, possibly gaining unauthorized access to the
+    system.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All pam_ldap users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-auth/pam_ldap-183&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5170">CVE-2006-5170</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 19 Dec 2006 16:57:27 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 19 Dec 2006 16:58:04 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-20.xml b/xml/htdocs/security/en/glsa/glsa-200612-20.xml
new file mode 100644
index 00000000..a3153d5b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-20.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-20">
+  <title>imlib2: Multiple vulnerabilities</title>
+  <synopsis>
+    imlib2 contains several vulnerabilities that could lead to the remote
+    execution of arbitrary code or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">imlib2</product>
+  <announced>December 20, 2006</announced>
+  <revised>December 20, 2006: 01</revised>
+  <bug>154216</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/imlib2" auto="yes" arch="*">
+      <unaffected range="ge">1.3.0</unaffected>
+      <vulnerable range="lt">1.3.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    imlib2 is an advanced replacement for image manipulation libraries such
+    as libXpm. It is utilized by numerous programs, including gkrellm and
+    several window managers, to display images.
+    </p>
+  </background>
+  <description>
+    <p>
+    M. Joonas Pihlaja discovered several buffer overflows in loader_argb.c,
+    loader_png.c, loader_lbm.c, loader_jpeg.c, loader_tiff.c, loader_tga.c,
+    loader_pnm.c and an out-of-bounds memory read access in loader_tga.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker can entice a user to process a specially crafted JPG, ARGB,
+    PNG, LBM, PNM, TIFF, or TGA image with an "imlib2*" binary or another
+    application using the imlib2 libraries. Successful exploitation of the
+    buffer overflows causes the execution of arbitrary code with the
+    permissions of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All imlib2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/imlib2-1.3.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4806">CVE-2006-4806</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4807">CVE-2006-4807</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4808">CVE-2006-4808</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4809">CVE-2006-4809</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 15 Dec 2006 16:10:27 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 18 Dec 2006 20:15:32 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 19 Dec 2006 16:42:29 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200612-21.xml b/xml/htdocs/security/en/glsa/glsa-200612-21.xml
new file mode 100644
index 00000000..b9f8fc38
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200612-21.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200612-21">
+  <title>Ruby: Denial of Service vulnerability</title>
+  <synopsis>
+    The Ruby cgi.rb CGI library is vulnerable to a Denial of Service attack.
+  </synopsis>
+  <product type="ebuild">ruby</product>
+  <announced>December 20, 2006</announced>
+  <revised>December 20, 2006: 01</revised>
+  <bug>157048</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/ruby" auto="yes" arch="*">
+      <unaffected range="ge">1.8.5_p2</unaffected>
+      <vulnerable range="lt">1.8.5_p2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ruby is a dynamic, open source programming language with a focus on
+    simplicity and productivity.
+    </p>
+  </background>
+  <description>
+    <p>
+    The read_multipart function of the CGI library shipped with Ruby
+    (cgi.rb) does not properly check boundaries in MIME multipart content.
+    This is a different issue than GLSA 200611-12.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    The vulnerability can be exploited by sending the cgi.rb library a
+    crafted HTTP request with multipart MIME encoding that contains a
+    malformed MIME boundary specifier. Successful exploitation of the
+    vulnerability causes the library to go into an infinite loop.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ruby users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/ruby-1.8.5_p2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6303">CVE-2006-6303</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 19 Dec 2006 16:20:14 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 19 Dec 2006 16:20:29 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-01.xml b/xml/htdocs/security/en/glsa/glsa-200701-01.xml
new file mode 100644
index 00000000..d49d2a45
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-01.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-01">
+  <title>DenyHosts: Denial of Service</title>
+  <synopsis>
+    DenyHosts does not correctly parse log entries, potentially causing a
+    remote Denial of Service.
+  </synopsis>
+  <product type="ebuild">denyhosts</product>
+  <announced>January 03, 2007</announced>
+  <revised>January 03, 2007: 01</revised>
+  <bug>157163</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-admin/denyhosts" auto="yes" arch="*">
+      <unaffected range="ge">2.6</unaffected>
+      <vulnerable range="lt">2.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    DenyHosts is designed to monitor SSH servers for repeated failed login
+    attempts.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Audit Team discovered that
+    DenyHosts used an incomplete regular expression to parse failed login
+    attempts.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote unauthenticated attacker can add arbitrary hosts to the
+    blacklist by attempting to login with a specially crafted username. An
+    attacker may use this to prevent legitimate users from accessing a host
+    remotely.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All DenyHosts users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/denyhosts-2.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6301">CVE-2006-6301</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 18 Dec 2006 22:34:37 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 01 Jan 2007 14:18:29 +0000">
+    taviso
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-02.xml b/xml/htdocs/security/en/glsa/glsa-200701-02.xml
new file mode 100644
index 00000000..ac181ec9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-02.xml
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-02">
+  <title>Mozilla Firefox: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been reported in Mozilla Firefox, some of
+    which may allow the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mozilla-firefox</product>
+  <announced>January 04, 2007</announced>
+  <revised>January 04, 2007: 01</revised>
+  <bug>156023</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.9</unaffected>
+      <vulnerable range="lt">1.5.0.9</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.9</unaffected>
+      <vulnerable range="lt">1.5.0.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Firefox is a popular open-source web browser from the Mozilla
+    Project.
+    </p>
+  </background>
+  <description>
+    <p>
+    An anonymous researcher found evidence of memory corruption in the way
+    Mozilla Firefox handles certain types of SVG comment DOM nodes.
+    Additionally, Frederik Reiss discovered a heap-based buffer overflow in
+    the conversion of a CSS cursor. Other issues with memory corruption
+    were also fixed. Mozilla Firefox also contains less severe
+    vulnerabilities involving JavaScript and Java.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to view a specially crafted web page
+    that will trigger one of the vulnerabilities, possibly leading to the
+    execution of arbitrary code. It is also possible for an attacker to
+    perform cross-site scripting attacks, leading to the exposure of
+    sensitive information, like user credentials.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds for all the issues at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-1.5.0.9&quot;</code>
+    <p>
+    All Mozilla Firefox binary release users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-1.5.0.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6497">CVE-2006-6497</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6498">CVE-2006-6498</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6499">CVE-2006-6499</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6500">CVE-2006-6500</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6501">CVE-2006-6501</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6502">CVE-2006-6502</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6503">CVE-2006-6503</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6504">CVE-2006-6504</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6506">CVE-2006-6506</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6507">CVE-2006-6507</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 28 Dec 2006 15:30:23 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 28 Dec 2006 16:10:02 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-03.xml b/xml/htdocs/security/en/glsa/glsa-200701-03.xml
new file mode 100644
index 00000000..7ca05a20
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-03.xml
@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-03">
+  <title>Mozilla Thunderbird: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been reported in Mozilla Thunderbird, some of
+    which may allow the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mozilla-thunderbird</product>
+  <announced>January 04, 2007</announced>
+  <revised>January 04, 2007: 01</revised>
+  <bug>158571</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/mozilla-thunderbird" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.9</unaffected>
+      <vulnerable range="lt">1.5.0.9</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.9</unaffected>
+      <vulnerable range="lt">1.5.0.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Thunderbird is a popular open-source email client from the
+    Mozilla Project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Georgi Guninski and David Bienvenu discovered buffer overflows in the
+    processing of long "Content-Type:" and long non-ASCII MIME headers.
+    Additionally, Frederik Reiss discovered a heap-based buffer overflow in
+    the conversion of a CSS cursor. Different vulnerabilities involving
+    memory corruption in the browser engine were also fixed. Mozilla
+    Thunderbird also contains less severe vulnerabilities involving
+    JavaScript and Java.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could entice a user to view a specially crafted email that
+    will trigger one of these vulnerabilities, possibly leading to the
+    execution of arbitrary code. An attacker could also perform cross-site
+    scripting attacks, leading to the exposure of sensitive information,
+    like user credentials. Note that the execution of JavaScript or Java
+    applets is disabled by default and enabling it is strongly discouraged.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds for all the issues at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Thunderbird users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-1.5.0.9&quot;</code>
+    <p>
+    All Mozilla Thunderbird binary release users should upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-bin-1.5.0.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6497">CVE-2006-6497</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6500">CVE-2006-6500</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6501">CVE-2006-6501</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6502">CVE-2006-6502</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6503">CVE-2006-6503</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6505">CVE-2006-6505</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 28 Dec 2006 15:51:07 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 28 Dec 2006 16:10:06 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-04.xml b/xml/htdocs/security/en/glsa/glsa-200701-04.xml
new file mode 100644
index 00000000..16a03ad5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-04.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-04">
+  <title>SeaMonkey: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been reported in the SeaMonkey project, some
+    of which may allow the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">seamonkey</product>
+  <announced>January 10, 2007</announced>
+  <revised>January 10, 2007: 01</revised>
+  <bug>158576</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/seamonkey" auto="yes" arch="*">
+      <unaffected range="ge">1.0.7</unaffected>
+      <vulnerable range="lt">1.0.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The SeaMonkey project is a community effort to deliver
+    production-quality releases of code derived from the application
+    formerly known as the 'Mozilla Application Suite'.
+    </p>
+  </background>
+  <description>
+    <p>
+    An anonymous researcher found evidence of memory corruption in the way
+    SeaMonkey handles certain types of SVG comment DOM nodes. Georgi
+    Guninski and David Bienvenu discovered buffer overflows in the
+    processing of long "Content-Type:" and long non-ASCII MIME email
+    headers. Additionally, Frederik Reiss discovered a heap-based buffer
+    overflow in the conversion of a CSS cursor. Several other issues with
+    memory corruption were also fixed. SeaMonkey also contains less severe
+    vulnerabilities involving JavaScript and Java.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could entice a user to load malicious JavaScript or a
+    malicious web page with a SeaMonkey application, possibly leading to
+    the execution of arbitrary code with the rights of the user running
+    those products. An attacker could also perform cross-site scripting
+    attacks, leading to the exposure of sensitive information, like user
+    credentials. Note that the execution of JavaScript or Java applets is
+    disabled by default in the SeaMonkey email client, and enabling it is
+    strongly discouraged.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There are no known workarounds for all the issues at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SeaMonkey users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/seamonkey-1.0.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6497">CVE-2006-6497</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6498">CVE-2006-6498</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6499">CVE-2006-6499</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6500">CVE-2006-6500</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6501">CVE-2006-6501</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6502">CVE-2006-6502</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6503">CVE-2006-6503</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6504">CVE-2006-6504</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6505">CVE-2006-6505</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 28 Dec 2006 16:02:48 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 10 Jan 2007 21:26:08 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-05.xml b/xml/htdocs/security/en/glsa/glsa-200701-05.xml
new file mode 100644
index 00000000..55e9b1de
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-05.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-05">
+  <title>KDE kfile JPEG info plugin: Denial of Service</title>
+  <synopsis>
+    The KDE kfile JPEG info plugin of kdegraphics could enter an endless loop
+    leading to a Denial of Service.
+  </synopsis>
+  <product type="ebuild">kdegraphics-kfile-plugins</product>
+  <announced>January 12, 2007</announced>
+  <revised>January 12, 2007: 01</revised>
+  <bug>155949</bug>
+  <access>remote</access>
+  <affected>
+    <package name="kde-base/kdegraphics-kfile-plugins" auto="yes" arch="*">
+      <unaffected range="ge">3.5.5-r1</unaffected>
+      <vulnerable range="lt">3.5.5-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The KDE kfile-info JPEG plugin provides meta-information about JPEG
+    files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Marcus Meissner of the SUSE security team discovered a stack overflow
+    vulnerability in the code processing EXIF information in the kfile JPEG
+    info plugin.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to view a specially crafted JPEG
+    image with a KDE application like Konqueror or digiKam, leading to a
+    Denial of Service by an infinite recursion.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All KDE users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kdegraphics-kfile-plugins-3.5.5-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6297">CVE-2006-6297</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 22 Dec 2006 08:45:31 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 28 Dec 2006 16:52:12 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 12 Jan 2007 13:14:10 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-06.xml b/xml/htdocs/security/en/glsa/glsa-200701-06.xml
new file mode 100644
index 00000000..a90195db
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-06.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-06">
+  <title>w3m: Format string vulnerability</title>
+  <synopsis>
+    w3m does not correctly handle format string specifiers in SSL certificates.
+  </synopsis>
+  <product type="ebuild">w3m</product>
+  <announced>January 12, 2007</announced>
+  <revised>January 12, 2007: 01</revised>
+  <bug>159145</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/w3m" auto="yes" arch="*">
+      <unaffected range="ge">0.5.1-r4</unaffected>
+      <vulnerable range="lt">0.5.1-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    w3m is a multi-platform text-based web browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    w3m in -dump or -backend mode does not correctly handle printf() format
+    string specifiers in the Common Name (CN) field of an X.509 SSL
+    certificate.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to visit a malicious website that would
+    load a specially crafted X.509 SSL certificate containing "%n" or other
+    format string specifiers, possibly resulting in the execution of
+    arbitrary code with the rights of the user running w3m.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All w3m users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/w3m-0.5.1-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6772">CVE-2006-6772</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 11 Jan 2007 00:57:23 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 11 Jan 2007 11:00:25 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-07.xml b/xml/htdocs/security/en/glsa/glsa-200701-07.xml
new file mode 100644
index 00000000..49997936
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-07.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-07">
+  <title>OpenOffice.org: EMF/WMF file handling vulnerabilities</title>
+  <synopsis>
+    A truncation error and integer overflows in the EMF/WMF file handling of
+    OpenOffice.org could be exploited to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">openoffice</product>
+  <announced>January 12, 2007</announced>
+  <revised>January 12, 2007: 01</revised>
+  <bug>159951</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/openoffice-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.1.0</unaffected>
+      <vulnerable range="lt">2.1.0</vulnerable>
+    </package>
+    <package name="app-office/openoffice" auto="yes" arch="*">
+      <unaffected range="ge">2.0.4</unaffected>
+      <vulnerable range="lt">2.0.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenOffice.org is an open source office productivity suite, including
+    word processing, spreadsheet, presentation, drawing, data charting,
+    formula editing, and file conversion facilities.
+    </p>
+  </background>
+  <description>
+    <p>
+    John Heasman of NGSSoftware has discovered integer overflows in the
+    EMR_POLYPOLYGON and EMR_POLYPOLYGON16 processing and an error within
+    the handling of META_ESCAPE records.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit these vulnerabilities to cause heap overflows
+    and potentially execute arbitrary code with the privileges of the user
+    running OpenOffice.org by enticing the user to open a document
+    containing a malicious WMF/EMF file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround known at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenOffice.org binary users should update to version 2.1.0 or
+    later:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-bin-2.1.0&quot;</code>
+    <p>
+    All OpenOffice.org users should update to version 2.0.4 or later:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-2.0.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5870">CVE-2006-5870</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 09 Jan 2007 18:48:36 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 09 Jan 2007 19:06:14 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 12 Jan 2007 12:16:11 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-08.xml b/xml/htdocs/security/en/glsa/glsa-200701-08.xml
new file mode 100644
index 00000000..5f4c82a9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-08.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-08">
+  <title>Opera: Two remote code execution vulnerabilities</title>
+  <synopsis>
+    Two vulnerabilities may allow the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">opera</product>
+  <announced>January 12, 2007</announced>
+  <revised>January 12, 2007: 01</revised>
+  <bug>160369</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/opera" auto="yes" arch="*">
+      <unaffected range="ge">9.10</unaffected>
+      <vulnerable range="lt">9.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Opera is a multi-platform web browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    Christoph Deal discovered that JPEG files with a specially crafted DHT
+    marker can be exploited to cause a heap overflow. Furthermore, an
+    anonymous person discovered that Opera does not correctly handle
+    objects passed to the "createSVGTransformFromMatrix()" function.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could potentially exploit the vulnerabilities to execute
+    arbitrary code with the privileges of the user running Opera by
+    enticing a victim to open a specially crafted JPEG file or a website
+    containing malicious JavaScript code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    The vendor recommends disabling JavaScript to avoid the
+    "createSVGTransformFromMatrix" vulnerability. There is no known
+    workaround for the other vulnerability.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Opera users should update to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/opera-9.10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.opera.com/support/search/supsearch.dml?index=851">Opera Advisory (createSVGTransformFromMatrix)</uri>
+    <uri link="http://www.opera.com/support/search/supsearch.dml?index=852">Opera Advisory (JPEG)</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0126">CVE-2007-0126</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0127">CVE-2007-0127</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 09 Jan 2007 12:37:33 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 09 Jan 2007 12:37:44 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 09 Jan 2007 18:43:10 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-09.xml b/xml/htdocs/security/en/glsa/glsa-200701-09.xml
new file mode 100644
index 00000000..d74811e8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-09.xml
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-09">
+  <title>oftpd: Denial of Service</title>
+  <synopsis>
+    An assertion in oftpd could lead to a denial of service vulnerability.
+  </synopsis>
+  <product type="ebuild">oftpd</product>
+  <announced>January 15, 2007</announced>
+  <revised>January 15, 2007: 01</revised>
+  <bug>159178</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-ftp/oftpd" auto="yes" arch="*">
+      <unaffected range="ge">0.3.7-r3</unaffected>
+      <vulnerable range="lt">0.3.7-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    oftpd is a small, anonymous only ftp daemon.
+    </p>
+  </background>
+  <description>
+    <p>
+    By specifying an unsupported address family in the arguments to a LPRT
+    or LPASV command, an assertion in oftpd will cause the daemon to abort.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote, unauthenticated attackers may be able to terminate any oftpd
+    process, denying service to legitimate users.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All oftpd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-ftp/oftpd-0.3.7-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6767">CVE-2006-6767</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 14 Jan 2007 22:33:02 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 14 Jan 2007 23:05:10 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-10.xml b/xml/htdocs/security/en/glsa/glsa-200701-10.xml
new file mode 100644
index 00000000..f2b8e829
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-10.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-10">
+  <title>WordPress: Multiple vulnerabilities</title>
+  <synopsis>
+    WordPress is vulnerable to SQL injection, information disclosure, and
+    cross-site scripting attacks.
+  </synopsis>
+  <product type="ebuild">wordpress</product>
+  <announced>January 15, 2007</announced>
+  <revised>January 15, 2007: 01</revised>
+  <bug>159229</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/wordpress" auto="yes" arch="*">
+      <unaffected range="ge">2.0.6</unaffected>
+      <vulnerable range="lt">2.0.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    WordPress is a popular personal publishing platform with a web
+    interface.
+    </p>
+  </background>
+  <description>
+    <p>
+    When decoding trackbacks with alternate character sets, WordPress does
+    not correctly sanitize the entries before further modifying a SQL
+    query. WordPress also displays different error messages in wp-login.php
+    based upon whether or not a user exists. David Kierznowski has
+    discovered that WordPress fails to properly sanitize recent file
+    information in /wp-admin/templates.php before sending that information
+    to a browser.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could inject arbitrary SQL into WordPress database queries.
+    An attacker could also determine if a WordPress user existed by trying
+    to login as that user, better facilitating brute force attacks. Lastly,
+    an attacker authenticated to view the administrative section of a
+    WordPress instance could try to edit a file with a malicious filename;
+    this may cause arbitrary HTML or JavaScript to be executed in users'
+    browsers viewing /wp-admin/templates.php.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All WordPress users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/wordpress-2.0.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6808">CVE-2006-6808</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0107">CVE-2007-0107</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0109">CVE-2007-0109</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 08 Jan 2007 10:45:23 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 09 Jan 2007 13:32:54 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 12 Jan 2007 13:12:39 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-11.xml b/xml/htdocs/security/en/glsa/glsa-200701-11.xml
new file mode 100644
index 00000000..f09c2b64
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-11.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-11">
+  <title>Kronolith: Local file inclusion</title>
+  <synopsis>
+    Kronolith contains a flaw that could allow the execution of arbitrary
+    files.
+  </synopsis>
+  <product type="ebuild">horde-kronolith</product>
+  <announced>January 16, 2007</announced>
+  <revised>January 16, 2007: 01</revised>
+  <bug>156627</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/horde-kronolith" auto="yes" arch="*">
+      <unaffected range="ge">2.1.4</unaffected>
+      <vulnerable range="lt">2.1.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Kronolith is a web-based calendar which relies on the Horde Framework
+    for integration with other applications.
+    </p>
+  </background>
+  <description>
+    <p>
+    Kronolith contains a mistake in lib/FBView.php where a raw, unfiltered
+    string is used instead of a sanitized string to view local files.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    An authenticated attacker could craft an HTTP GET request that uses
+    directory traversal techniques to execute any file on the web server as
+    PHP code, which could allow information disclosure or arbitrary code
+    execution with the rights of the user running the PHP application
+    (usually the webserver user).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All horde-kronolith users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-kronolith-2.1.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6175">CVE-2006-6175</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 14 Jan 2007 17:58:37 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 14 Jan 2007 21:54:17 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 15 Jan 2007 12:41:09 +0000">
+    aetius
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-12.xml b/xml/htdocs/security/en/glsa/glsa-200701-12.xml
new file mode 100644
index 00000000..5f896df3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-12.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-12">
+  <title>Mono: Information disclosure</title>
+  <synopsis>
+    Mono does not properly sanitize pathnames allowing unauthorized information
+    disclosure.
+  </synopsis>
+  <product type="ebuild">mono</product>
+  <announced>January 16, 2007</announced>
+  <revised>January 17, 2007: 02</revised>
+  <bug>159886</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/mono" auto="yes" arch="*">
+      <unaffected range="ge">1.2.2.1</unaffected>
+      <vulnerable range="lt">1.2.2.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mono provides the necessary software to develop and run .NET client and
+    server applications on various platforms.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jose Ramon Palanco has discovered that the System.Web class in the XSP
+    for the ASP.NET server 1.1 through 2.0 in Mono does not properly
+    validate or sanitize local pathnames which could allow server-side file
+    content disclosure.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    An attacker could append a space character to a URI and obtain
+    unauthorized access to the source code of server-side files. An
+    attacker could also read credentials by requesting Web.Config%20 from a
+    Mono server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mono users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/mono-1.2.2.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6104">CVE-2006-6104</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 14 Jan 2007 18:42:16 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 14 Jan 2007 21:54:13 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 15 Jan 2007 00:17:42 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-13.xml b/xml/htdocs/security/en/glsa/glsa-200701-13.xml
new file mode 100644
index 00000000..18a28efd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-13.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-13">
+  <title>Fetchmail: Denial of Service and password disclosure</title>
+  <synopsis>
+    Fetchmail has been found to have numerous vulnerabilities allowing for
+    Denial of Service and password disclosure.
+  </synopsis>
+  <product type="ebuild">fetchmail</product>
+  <announced>January 22, 2007</announced>
+  <revised>January 22, 2007: 01</revised>
+  <bug>160463</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/fetchmail" auto="yes" arch="*">
+      <unaffected range="ge">6.3.6</unaffected>
+      <vulnerable range="lt">6.3.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Fetchmail is a remote mail retrieval and forwarding utility.
+    </p>
+  </background>
+  <description>
+    <p>
+    Neil Hoggarth has discovered that when delivering messages to a message
+    delivery agent by means of the "mda" option, Fetchmail passes a NULL
+    pointer to the ferror() and fflush() functions when refusing a message.
+    Isaac Wilcox has discovered numerous means of plain-text password
+    disclosure due to errors in secure connection establishment.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could deliver a message via Fetchmail to a message delivery
+    agent configured to refuse the message, and crash the Fetchmail
+    process. SMTP and LMTP delivery modes are not affected by this
+    vulnerability. An attacker could also perform a Man-in-the-Middle
+    attack, and obtain plain-text authentication credentials of users
+    connecting to a Fetchmail process.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All fetchmail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/fetchmail-6.3.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5867">CVE-2006-5867</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5974">CVE-2006-5974</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 15 Jan 2007 23:33:39 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 16 Jan 2007 17:08:58 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 18 Jan 2007 02:05:45 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-14.xml b/xml/htdocs/security/en/glsa/glsa-200701-14.xml
new file mode 100644
index 00000000..78234654
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-14.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-14">
+  <title>Mod_auth_kerb: Denial of Service</title>
+  <synopsis>
+    Mod_auth_kerb is vulnerable to a buffer overflow possibly allowing a Denial
+    of Service.
+  </synopsis>
+  <product type="ebuild">mod_auth_kerb</product>
+  <announced>January 22, 2007</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>155782</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apache/mod_auth_kerb" auto="yes" arch="*">
+      <unaffected range="ge">5.0_rc7-r1</unaffected>
+      <vulnerable range="lt">5.0_rc7-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mod_auth_kerb is an Apache authentication module using Kerberos.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mod_auth_kerb improperly handles component byte encoding in the
+    der_get_oid() function, allowing for a buffer overflow to occur if
+    there are no components which require more than one byte for encoding.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could try to access a Kerberos protected resource on an
+    Apache server with an incorrectly configured service principal and
+    crash the server process. It is important to note that this buffer
+    overflow is not known to allow for the execution of code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mod_auth_kerb users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apache/mod_auth_kerb-5.0_rc7-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5989">CVE-2006-5989</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 17 Jan 2007 22:33:24 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 17 Jan 2007 22:40:53 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 18 Jan 2007 01:47:32 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-15.xml b/xml/htdocs/security/en/glsa/glsa-200701-15.xml
new file mode 100644
index 00000000..ad2822cb
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-15.xml
@@ -0,0 +1,99 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-15">
+  <title>Sun JDK/JRE: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple unspecified vulnerabilities have been identified in Sun Java
+    Development Kit (JDK) and Java Runtime Environment (JRE).
+  </synopsis>
+  <product type="ebuild">java</product>
+  <announced>January 22, 2007</announced>
+  <revised>July 16, 2008: 04</revised>
+  <bug>158659</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/sun-jdk" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.09</unaffected>
+      <unaffected range="rge">1.4.2.18</unaffected>
+      <unaffected range="rge">1.4.2.17</unaffected>
+      <unaffected range="rge">1.4.2.15</unaffected>
+      <unaffected range="rge">1.4.2.14</unaffected>
+      <unaffected range="rge">1.4.2.13</unaffected>
+      <vulnerable range="lt">1.5.0.09</vulnerable>
+    </package>
+    <package name="dev-java/sun-jre-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.09</unaffected>
+      <unaffected range="rge">1.4.2.18</unaffected>
+      <unaffected range="rge">1.4.2.17</unaffected>
+      <unaffected range="rge">1.4.2.15</unaffected>
+      <unaffected range="rge">1.4.2.14</unaffected>
+      <unaffected range="rge">1.4.2.13</unaffected>
+      <vulnerable range="lt">1.5.0.09</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Sun Java Development Kit (JDK) and the Sun Java Runtime Environment
+    (JRE) provide the Sun Java platform.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Evans has discovered multiple buffer overflows in Sun JDK and Sun
+    JRE possibly related to various AWT or font layout functions. Tom
+    Hawtin has discovered an unspecified vulnerability in Sun JDK and Sun
+    JRE relating to unintended applet data access. He has also discovered
+    multiple other unspecified vulnerabilities in Sun JDK and Sun JRE
+    allowing unintended Java applet or application resource acquisition.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to run a specially crafted Java applet
+    or application that could read, write, or execute local files with the
+    privileges of the user running the JVM; access data maintained in other
+    Java applets; or escalate the privileges of the currently running Java
+    applet or application allowing for unauthorized access to system
+    resources.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Sun Java Development Kit users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;dev-java/sun-jdk&quot;</code>
+    <p>
+    All Sun Java Runtime Environment users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;dev-java/sun-jre-bin&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6731">CVE-2006-6731</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6736">CVE-2006-6736</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6737">CVE-2006-6737</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6745">CVE-2006-6745</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 12 Jan 2007 22:36:56 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 14 Jan 2007 21:54:21 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 15 Jan 2007 01:12:01 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-16.xml b/xml/htdocs/security/en/glsa/glsa-200701-16.xml
new file mode 100644
index 00000000..c464b483
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-16.xml
@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-16">
+  <title>Adobe Acrobat Reader: Multiple vulnerabilities</title>
+  <synopsis>
+    Adobe Acrobat Reader is vulnerable to remote code execution, Denial of
+    Service, and cross-site scripting attacks.
+  </synopsis>
+  <product type="ebuild">acroread</product>
+  <announced>January 22, 2007</announced>
+  <revised>January 22, 2007: 01</revised>
+  <bug>159874</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/acroread" auto="yes" arch="*">
+      <unaffected range="ge">7.0.9</unaffected>
+      <vulnerable range="lt">7.0.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Adobe Acrobat Reader is a PDF reader released by Adobe.
+    </p>
+  </background>
+  <description>
+    <p>
+    Adobe Acrobat Reader in stand-alone mode is vulnerable to remote code
+    execution via heap corruption when loading a specially crafted PDF
+    file.
+    </p>
+    <p>
+    The browser plugin released with Adobe Acrobat Reader (nppdf.so) does
+    not properly handle URLs, and crashes if given a URL that is too long.
+    The plugin does not correctly handle JavaScript, and executes
+    JavaScript that is given as a GET variable to the URL of a PDF file.
+    Lastly, the plugin does not properly handle the FDF, xml, xfdf AJAX
+    request parameters following the # character in a URL, allowing for
+    multiple cross-site scripting vulnerabilities.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially crafted PDF file
+    and execute arbitrary code with the rights of the user running Adobe
+    Acrobat Reader. An attacker could also entice a user to browse to a
+    specially crafted URL and either crash the Adobe Acrobat Reader browser
+    plugin, execute arbitrary JavaScript in the context of the user's
+    browser, or inject arbitrary HTML or JavaScript into the document being
+    viewed by the user. Note that users who have emerged Adobe Acrobat
+    Reader with the "nsplugin" USE flag disabled are not vulnerable to
+    issues with the Adobe Acrobat Reader browser plugin.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Adobe Acrobat Reader users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/acroread-7.0.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5857">CVE-2006-5857</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0044">CVE-2007-0044</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0045">CVE-2007-0045</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0046">CVE-2007-0046</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0048">CVE-2007-0048</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 14 Jan 2007 12:10:48 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 15 Jan 2007 00:45:48 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 22 Jan 2007 12:38:29 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-17.xml b/xml/htdocs/security/en/glsa/glsa-200701-17.xml
new file mode 100644
index 00000000..9f18d646
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-17.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-17">
+  <title>libgtop: Privilege escalation</title>
+  <synopsis>
+    libgtop improperly handles filenames, possibly allowing for the execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">libgtop</product>
+  <announced>January 23, 2007</announced>
+  <revised>January 23, 2007: 01</revised>
+  <bug>162169</bug>
+  <access>local</access>
+  <affected>
+    <package name="gnome-base/libgtop" auto="yes" arch="*">
+      <unaffected range="ge">2.14.6</unaffected>
+      <vulnerable range="lt">2.14.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libgtop facilitates the libgtop_daemon, which is used by GNOME to
+    obtain information about remote systems.
+    </p>
+  </background>
+  <description>
+    <p>
+    Liu Qishuai discovered that glibtop_get_proc_map_s() in
+    sysdeps/linux/procmap.c does not properly allocate memory for storing a
+    filename, allowing certain filenames to cause the buffer to overflow on
+    the stack.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By tricking a victim into executing an application that uses the
+    libgtop library (e.g. libgtop_daemon or gnome-system-monitor), a local
+    attacker could specify a specially crafted filename to be used by
+    libgtop causing a buffer overflow and possibly execute arbitrary code
+    with the rights of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libgtop users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=gnome-base/libgtop-2.14.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0235">CVE-2007-0235</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 17 Jan 2007 22:40:30 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 18 Jan 2007 17:24:28 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 22 Jan 2007 12:14:40 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-18.xml b/xml/htdocs/security/en/glsa/glsa-200701-18.xml
new file mode 100644
index 00000000..03cd64b1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-18.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-18">
+  <title>xine-ui: Format string vulnerabilities</title>
+  <synopsis>
+    xine-ui improperly handles format strings, possibly allowing for the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">xine-ui</product>
+  <announced>January 23, 2007</announced>
+  <revised>January 23, 2007: 01</revised>
+  <bug>161558</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/xine-ui" auto="yes" arch="*">
+      <unaffected range="ge">0.99.5_pre20060716</unaffected>
+      <vulnerable range="lt">0.99.5_pre20060716</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xine-ui is a skin-based user interface for xine. xine is a free
+    multimedia player. It plays CDs, DVDs, and VCDs, and can also decode
+    other common multimedia formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Due to the improper handling and use of format strings, the
+    errors_create_window() function in errors.c does not safely write data
+    to memory.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially crafted media file
+    with xine-ui, and possibly execute arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xine-ui users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/xine-ui-0.99.5_pre20060716&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0254">CVE-2007-0254</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 17 Jan 2007 22:36:36 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 17 Jan 2007 22:40:52 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 18 Jan 2007 01:55:17 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-19.xml b/xml/htdocs/security/en/glsa/glsa-200701-19.xml
new file mode 100644
index 00000000..e47c4fce
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-19.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-19">
+  <title>OpenLDAP: Insecure usage of /tmp during installation</title>
+  <synopsis>
+    A shell script commonly released with OpenLDAP makes insecure usage of
+    files in /tmp during the emerge process.
+  </synopsis>
+  <product type="ebuild">openldap</product>
+  <announced>January 23, 2007</announced>
+  <revised>March 11, 2007: 02</revised>
+  <bug>159508</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-nds/openldap" auto="yes" arch="*">
+      <unaffected range="ge">2.1.30-r10</unaffected>
+      <unaffected range="ge">2.2.28-r7</unaffected>
+      <unaffected range="ge">2.3.30-r2</unaffected>
+      <vulnerable range="lt">2.1.30-r10</vulnerable>
+      <vulnerable range="lt">2.2.28-r7</vulnerable>
+      <vulnerable range="lt">2.3.30-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenLDAP Software is an open source implementation of the Lightweight
+    Directory Access Protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Team has discovered that the
+    file gencert.sh distributed with the Gentoo ebuild for OpenLDAP does
+    not exit upon the existence of a directory in /tmp during installation
+    allowing for directory traversal.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A local attacker could create a symbolic link in /tmp and potentially
+    overwrite arbitrary system files upon a privileged user emerging
+    OpenLDAP.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenLDAP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;net-nds/openldap&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0476">CVE-2007-0476</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 13 Jan 2007 21:20:49 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 14 Jan 2007 21:54:19 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 15 Jan 2007 00:28:23 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-20.xml b/xml/htdocs/security/en/glsa/glsa-200701-20.xml
new file mode 100644
index 00000000..28c18231
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-20.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-20">
+  <title>Centericq: Remote buffer overflow in LiveJournal handling</title>
+  <synopsis>
+    Centericq does not properly handle communications with the LiveJournal
+    service, allowing for the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">centericq</product>
+  <announced>January 24, 2007</announced>
+  <revised>January 24, 2007: 01</revised>
+  <bug>160793</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/centericq" auto="yes" arch="*">
+      <vulnerable range="le">4.21.0-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Centericq is a text mode menu-driven and window-driven instant
+    messaging interface.
+    </p>
+  </background>
+  <description>
+    <p>
+    When interfacing with the LiveJournal service, Centericq does not
+    appropriately allocate memory for incoming data, in some cases creating
+    a buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to connect to an unofficial LiveJournal
+    server causing Centericq to read specially crafted data from the
+    server, which could lead to the execution of arbitrary code with the
+    rights of the user running Centericq.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Currently, Centericq is unmaintained. As such, Centericq has been
+    masked in Portage until it is again maintained.
+    </p>
+    <code>
+    # emerge --ask --verbose --unmerge &quot;net-im/centericq&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0160">CVE-2007-0160</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 14 Jan 2007 18:03:01 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 14 Jan 2007 21:54:11 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 18 Jan 2007 02:19:00 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-21.xml b/xml/htdocs/security/en/glsa/glsa-200701-21.xml
new file mode 100644
index 00000000..c7f4e564
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-21.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-21">
+  <title>MIT Kerberos 5: Arbitrary Remote Code Execution</title>
+  <synopsis>
+    Multiple vulnerabilities in MIT Kerberos 5 could potentially result in the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mit-krb5</product>
+  <announced>January 24, 2007</announced>
+  <revised>January 24, 2007: 01</revised>
+  <bug>158810</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/mit-krb5" auto="yes" arch="*">
+      <unaffected range="ge">1.5.2</unaffected>
+      <vulnerable range="lt">1.5.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MIT Kerberos 5 is a suite of applications that implement the Kerberos
+    network protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Kerberos administration daemon, and possibly other applications
+    using the GSS-API or RPC libraries, could potentially call a function
+    pointer in a freed heap buffer, or attempt to free an uninitialized
+    pointer.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker may be able to crash an affected application, or
+    potentially execute arbitrary code with root privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MIT Kerberos 5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-crypt/mit-krb5-1.5.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6143">CVE-2006-6143</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6144">CVE-2006-6144</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 12 Jan 2007 22:46:59 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 14 Jan 2007 23:13:19 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 22 Jan 2007 12:38:46 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-22.xml b/xml/htdocs/security/en/glsa/glsa-200701-22.xml
new file mode 100644
index 00000000..1a2e577e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-22.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-22">
+  <title>Squid: Multiple Denial of Service vulnerabilities</title>
+  <synopsis>
+    Two vulnerabilities have been found in Squid which make it susceptible to
+    Denial of Service attacks.
+  </synopsis>
+  <product type="ebuild">squid</product>
+  <announced>January 25, 2007</announced>
+  <revised>January 25, 2007: 01</revised>
+  <bug>162364</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-proxy/squid" auto="yes" arch="*">
+      <unaffected range="ge">2.6.7</unaffected>
+      <vulnerable range="lt">2.6.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Squid is a multi-protocol proxy server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Squid fails to correctly handle ftp:// URI's. There is also an error in
+    the external_acl queue which can cause an infinite looping condition.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could attempt to retrieve a specially crafted URI via a
+    Squid server causing the service to crash. If an attacker could
+    generate a sufficiently high load on the Squid services, they could
+    cause a Denial of Service by forcing Squid into an infinite loop.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Squid users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-proxy/squid-2.6.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0247">CVE-2007-0247</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0248">CVE-2007-0248</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 22 Jan 2007 16:59:17 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 23 Jan 2007 10:26:06 +0000">
+    hyakuhei
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 24 Jan 2007 12:52:50 +0000">
+    hyakuhei
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-23.xml b/xml/htdocs/security/en/glsa/glsa-200701-23.xml
new file mode 100644
index 00000000..5a4af2f6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-23.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-23">
+  <title>Cacti: Command execution and SQL injection</title>
+  <synopsis>
+    Cacti has three vulnerabilities that could allow shell command execution or
+    SQL injection.
+  </synopsis>
+  <product type="ebuild">cacti</product>
+  <announced>January 26, 2007</announced>
+  <revised>January 26, 2007: 01</revised>
+  <bug>159278</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/cacti" auto="yes" arch="*">
+      <unaffected range="ge">0.8.6i-r1</unaffected>
+      <vulnerable range="lt">0.8.6i-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cacti is a web-based network graphing and reporting tool.
+    </p>
+  </background>
+  <description>
+    <p>
+    rgod discovered that the Cacti cmd.php and copy_cacti_user.php scripts
+    do not properly control access to the command shell, and are remotely
+    accessible by unauthenticated users. This allows SQL injection via
+    cmd.php and copy_cacti_user.php URLs. Further, the results from the
+    injected SQL query are not properly sanitized before being passed to a
+    command shell. The vulnerabilities require that the
+    "register_argc_argv" option is enabled, which is the Gentoo default.
+    Also, a number of similar problems in other scripts were reported.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    These vulnerabilties can result in the execution of arbitrary shell
+    commands or information disclosure via crafted SQL queries.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cacti users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/cacti-0.8.6i-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6799">CVE-2006-6799</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 12 Jan 2007 22:58:24 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 16 Jan 2007 02:39:11 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 17 Jan 2007 22:17:59 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-24.xml b/xml/htdocs/security/en/glsa/glsa-200701-24.xml
new file mode 100644
index 00000000..e61e0c93
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-24.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-24">
+  <title>VLC media player: Format string vulnerability</title>
+  <synopsis>
+    VLC media player improperly handles format strings, allowing for the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">vlc</product>
+  <announced>January 26, 2007</announced>
+  <revised>January 26, 2007: 01</revised>
+  <bug>159845</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/vlc" auto="yes" arch="*">
+      <unaffected range="ge">0.8.6-r1</unaffected>
+      <vulnerable range="lt">0.8.6-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    VLC media player is a multimedia player for various audio and video
+    formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Kevin Finisterre has discovered that when handling media locations,
+    various functions throughout VLC media player make improper use of
+    format strings.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially crafted media
+    location or M3U file with VLC media player, and execute arbitrary code
+    on the system with the rights of the user running VLC media player.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All VLC media player users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/vlc-0.8.6-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0017">CVE-2007-0017</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 15 Jan 2007 23:30:46 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 16 Jan 2007 17:08:55 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 18 Jan 2007 02:10:51 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-25.xml b/xml/htdocs/security/en/glsa/glsa-200701-25.xml
new file mode 100644
index 00000000..35b38102
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-25.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-25">
+  <title>X.Org X server: Multiple vulnerabilities</title>
+  <synopsis>
+    Sean Larsson from iDefense Labs has found multiple vulnerabilities in the
+    DBE and Render extensions.
+  </synopsis>
+  <product type="ebuild">X.Org</product>
+  <announced>January 27, 2007</announced>
+  <revised>February 26, 2007: 02</revised>
+  <bug>157421</bug>
+  <access>local</access>
+  <affected>
+    <package name="x11-base/xorg-server" auto="yes" arch="*">
+      <unaffected range="ge">1.1.1-r4</unaffected>
+      <vulnerable range="lt">1.1.1-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The X Window System is a graphical windowing system based on a
+    client/server model.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple memory corruption vulnerabilities have been found in the
+    ProcDbeGetVisualInfo() and the ProcDbeSwapBuffers() of the DBE
+    extension, and ProcRenderAddGlyphs() in the Render extension.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could execute arbitrary code with the privileges of
+    the user running the X server, typically root.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable the DBE extension by removing the "Load dbe" directive in the
+    Module section of xorg.conf, and explicitly disable the Render
+    extension with ' Option "RENDER" "disable" ' in the Extensions section.
+    </p>
+    <p>
+    Note: This could affect the functionality of some applications.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All X.Org X server users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-base/xorg-server-1.1.1-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6101">CVE-2006-6101</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6102">CVE-2006-6102</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6103">CVE-2006-6103</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 23 Jan 2007 12:31:17 +0000">
+    daxomatic
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 24 Jan 2007 15:54:52 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-26.xml b/xml/htdocs/security/en/glsa/glsa-200701-26.xml
new file mode 100644
index 00000000..7e7fe5a5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-26.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-26">
+  <title>KSirc: Denial of Service vulnerability</title>
+  <synopsis>
+    KSirc is vulnerable to a Denial of Service attack.
+  </synopsis>
+  <product type="ebuild">ksirc</product>
+  <announced>January 29, 2007</announced>
+  <revised>January 30, 2007: 01</revised>
+  <bug>159658</bug>
+  <access>remote</access>
+  <affected>
+    <package name="kde-base/ksirc" auto="yes" arch="*">
+      <unaffected range="ge">3.5.5-r1</unaffected>
+      <vulnerable range="lt">3.5.5-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KSirc is the default KDE IRC client.
+    </p>
+  </background>
+  <description>
+    <p>
+    KSirc fails to check the size of an incoming PRIVMSG string sent from
+    an IRC server during the connection process.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious IRC server could send a long PRIVMSG string to the KSirc
+    client causing an assertion failure and the dereferencing of a null
+    pointer, resulting in a crash.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All KSirc users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/ksirc-3.5.5-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6811">CVE-2006-6811</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 24 Jan 2007 20:03:08 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 24 Jan 2007 20:03:22 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 25 Jan 2007 11:44:16 +0000">
+    hyakuhei
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-27.xml b/xml/htdocs/security/en/glsa/glsa-200701-27.xml
new file mode 100644
index 00000000..54f4328a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-27.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-27">
+  <title>ELinks: Arbitrary Samba command execution</title>
+  <synopsis>
+    ELinks does not properly validate "smb://" URLs, making it vulnerable to
+    the execution of arbitrary Samba commands.
+  </synopsis>
+  <product type="ebuild">elinks</product>
+  <announced>January 30, 2007</announced>
+  <revised>January 30, 2007: 01</revised>
+  <bug>155358</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/elinks" auto="yes" arch="*">
+      <unaffected range="ge">0.11.2</unaffected>
+      <vulnerable range="lt">0.11.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ELinks is a text mode web browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    Teemu Salmela discovered an error in the validation code of "smb://"
+    URLs used by ELinks, the same issue as reported in GLSA 200612-16
+    concerning Links.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to browse to a specially crafted
+    "smb://" URL and execute arbitrary Samba commands, which would allow
+    the overwriting of arbitrary local files or the upload or download of
+    arbitrary files. This vulnerability can be exploited only if
+    "smbclient" is installed on the victim's computer, which is provided by
+    the "samba" Gentoo package.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ELinks users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/elinks-0.11.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5925">CVE-2006-5925</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 30 Jan 2007 10:52:21 +0000">
+    hyakuhei
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 30 Jan 2007 11:02:26 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200701-28.xml b/xml/htdocs/security/en/glsa/glsa-200701-28.xml
new file mode 100644
index 00000000..f81fd6e9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200701-28.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200701-28">
+  <title>thttpd: Unauthenticated remote file access</title>
+  <synopsis>
+    The default configuration of the Gentoo thttpd package potentially allows
+    unauthenticated access to system files when used with newer versions of
+    baselayout.
+  </synopsis>
+  <product type="ebuild">thttpd</product>
+  <announced>January 31, 2007</announced>
+  <revised>March 11, 2007: 02</revised>
+  <bug>142047</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/thttpd" auto="yes" arch="*">
+      <unaffected range="ge">2.25b-r6</unaffected>
+      <vulnerable range="lt">2.25b-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    thttpd is a webserver designed to be simple, small, and fast.
+    </p>
+  </background>
+  <description>
+    <p>
+    thttpd is vulnerable to an underlying change made to the
+    start-stop-daemon command in the current stable Gentoo baselayout
+    package (version 1.12.6). In the new version, the start-stop-daemon
+    command performs a "chdir /" command just before starting the thttpd
+    process. In the Gentoo default configuration, this causes thttpd to
+    start with the document root set to "/", the sytem root directory.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    When thttpd starts with the document root set to the system root
+    directory, all files on the system that are readable by the thttpd
+    process can be remotely accessed by unauthenticated users.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Alter the THTTPD_OPTS variable in /etc/conf.d/thttpd to include the
+    "-d" option to specify the document root. Alternatively, modify the
+    THTTPD_OPTS variable in /etc/conf.d/thttpd to specify a thttpd.conf
+    file using the "-C" option, and then configure the "dir=" directive in
+    that thttpd.conf file.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All thttpd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/thttpd-2.25b-r5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0664">CVE-2007-0664</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 26 Jan 2007 12:41:44 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 27 Jan 2007 17:49:26 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 31 Jan 2007 21:45:13 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200702-01.xml b/xml/htdocs/security/en/glsa/glsa-200702-01.xml
new file mode 100644
index 00000000..0cdbf211
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200702-01.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200702-01">
+  <title>Samba: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple flaws exist in the Samba suite of programs, the most serious of
+    which could result in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">samba</product>
+  <announced>February 13, 2007</announced>
+  <revised>February 13, 2007: 01</revised>
+  <bug>165549</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-fs/samba" auto="yes" arch="*">
+      <unaffected range="ge">3.0.24</unaffected>
+      <vulnerable range="lt">3.0.24</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Samba is a suite of SMB and CIFS client/server programs for UNIX.
+    </p>
+  </background>
+  <description>
+    <p>
+    A format string vulnerability exists in the VFS module when handling
+    AFS file systems and an infinite loop has been discovered when handling
+    file rename operations.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A user with permission to write to a shared AFS file system may be able
+    to compromise the smbd process and execute arbitrary code with the
+    permissions of the daemon. The infinite loop could be abused to consume
+    excessive resources on the smbd host, denying service to legitimate
+    users.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Samba users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-fs/samba-3.0.24&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://samba.org/samba/security/CVE-2007-0452.html">CVE-2007-0452</uri>
+    <uri link="http://samba.org/samba/security/CVE-2007-0454.html">CVE-2007-0454</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 09 Feb 2007 15:08:23 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 10 Feb 2007 23:53:19 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 12 Feb 2007 23:21:02 +0000">
+    taviso
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200702-02.xml b/xml/htdocs/security/en/glsa/glsa-200702-02.xml
new file mode 100644
index 00000000..6c40f999
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200702-02.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200702-02">
+  <title>ProFTPD: Local privilege escalation</title>
+  <synopsis>
+    A flaw in ProFTPD may allow a local attacker to obtain root privileges.
+  </synopsis>
+  <product type="ebuild">proftpd</product>
+  <announced>February 13, 2007</announced>
+  <revised>February 13, 2007: 01</revised>
+  <bug>158122</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-ftp/proftpd" auto="yes" arch="*">
+      <unaffected range="ge">1.3.1_rc1</unaffected>
+      <vulnerable range="lt">1.3.1_rc1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ProFTPD is a powerful, configurable, and free FTP daemon.
+    </p>
+  </background>
+  <description>
+    <p>
+    A flaw exists in the mod_ctrls module of ProFTPD, normally used to
+    allow FTP server administrators to configure the daemon at runtime.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An FTP server administrator permitted to interact with mod_ctrls could
+    potentially compromise the ProFTPD process and execute arbitrary code
+    with the privileges of the FTP Daemon, which is normally the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable mod_ctrls, or ensure only trusted users can access this
+    feature.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ProFTPD users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-ftp/proftpd-1.3.1_rc1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6563">CVE-2006-6563</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 10 Feb 2007 19:05:16 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 10 Feb 2007 23:53:16 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 12 Feb 2007 23:07:04 +0000">
+    taviso
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200702-03.xml b/xml/htdocs/security/en/glsa/glsa-200702-03.xml
new file mode 100644
index 00000000..54706b97
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200702-03.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200702-03">
+  <title>Snort: Denial of Service</title>
+  <synopsis>
+    Snort contains a vulnerability in the rule matching algorithm that could
+    result in a Denial of Service.
+  </synopsis>
+  <product type="ebuild">snort</product>
+  <announced>February 13, 2007</announced>
+  <revised>February 13, 2007: 01</revised>
+  <bug>161632</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/snort" auto="yes" arch="*">
+      <unaffected range="ge">2.6.1.2</unaffected>
+      <vulnerable range="lt">2.6.1.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Snort is a widely deployed intrusion detection program.
+    </p>
+  </background>
+  <description>
+    <p>
+    Randy Smith, Christian Estan and Somesh Jha discovered that the rule
+    matching algorithm of Snort can be exploited in a way known as a
+    "backtracking attack" to perform numerous time-consuming operations.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted network packets, which
+    would result in the cessation of the detections and the consumption of
+    the CPU resources.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Snort users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/snort-2.6.1.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6931">CVE-2006-6931</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 10 Feb 2007 19:01:49 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 12 Feb 2007 22:41:30 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 12 Feb 2007 23:29:42 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200702-04.xml b/xml/htdocs/security/en/glsa/glsa-200702-04.xml
new file mode 100644
index 00000000..b144d9e9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200702-04.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200702-04">
+  <title>RAR, UnRAR: Buffer overflow</title>
+  <synopsis>
+    RAR and UnRAR contain a buffer overflow allowing the execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">rar, unrar</product>
+  <announced>February 13, 2007</announced>
+  <revised>February 14, 2007: 02</revised>
+  <bug>166440</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/rar" auto="yes" arch="*">
+      <unaffected range="ge">3.7.0_beta1</unaffected>
+      <vulnerable range="lt">3.7.0_beta1</vulnerable>
+    </package>
+    <package name="app-arch/unrar" auto="yes" arch="*">
+      <unaffected range="ge">3.7.3</unaffected>
+      <vulnerable range="lt">3.7.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    RAR and UnRAR provide command line interfaces for compressing and
+    decompressing RAR files.
+    </p>
+  </background>
+  <description>
+    <p>
+    RAR and UnRAR contain a boundary error when processing
+    password-protected archives that could result in a stack-based buffer
+    overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to process a specially crafted
+    password-protected archive and execute arbitrary code with the rights
+    of the user uncompressing the archive.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All UnRAR users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/unrar-3.7.3&quot;</code>
+    <p>
+    All RAR users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/rar-3.7.0_beta1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0855">CVE-2007-0855</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 12 Feb 2007 15:25:34 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 12 Feb 2007 23:14:14 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 13 Feb 2007 23:24:39 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200702-05.xml b/xml/htdocs/security/en/glsa/glsa-200702-05.xml
new file mode 100644
index 00000000..8f600601
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200702-05.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200702-05">
+  <title>Fail2ban: Denial of Service</title>
+  <synopsis>
+    A flaw in Fail2ban may allow remote attackers to deny access to arbitrary
+    hosts.
+  </synopsis>
+  <product type="ebuild">fail2ban</product>
+  <announced>February 16, 2007</announced>
+  <revised>February 16, 2007: 01</revised>
+  <bug>157166</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/fail2ban" auto="yes" arch="*">
+      <unaffected range="ge">0.6.2</unaffected>
+      <vulnerable range="lt">0.6.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Fail2ban monitors log files for failed authentication attempts and can
+    block hosts responsible for repeated attacks.
+    </p>
+  </background>
+  <description>
+    <p>
+    A flaw in the method used to parse log entries allows remote,
+    unauthenticated attackers to forge authentication attempts from other
+    hosts.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker can add arbitrary hosts to the block list, denying
+    legitimate users access to a resource.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Fail2ban users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/fail2ban-0.6.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6302">CVE-2006-6302</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 12 Feb 2007 22:35:11 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 12 Feb 2007 22:42:08 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 12 Feb 2007 22:56:35 +0000">
+    taviso
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200702-06.xml b/xml/htdocs/security/en/glsa/glsa-200702-06.xml
new file mode 100644
index 00000000..401e6090
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200702-06.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200702-06">
+  <title>BIND: Denial of Service</title>
+  <synopsis>
+    ISC BIND contains two vulnerabilities allowing a Denial of Service under
+    certain conditions.
+  </synopsis>
+  <product type="ebuild">bind</product>
+  <announced>February 17, 2007</announced>
+  <revised>February 17, 2007: 01</revised>
+  <bug>163692</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/bind" auto="yes" arch="*">
+      <unaffected range="ge">9.3.4</unaffected>
+      <unaffected range="rge">9.2.8</unaffected>
+      <vulnerable range="lt">9.3.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ISC BIND is the Internet Systems Consortium implementation of the
+    Domain Name System (DNS) protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    An unspecified improper usage of an already freed context has been
+    reported. Additionally, an assertion error could be triggered in the
+    DNSSEC validation of some responses to type ANY queries with multiple
+    RRsets.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could crash the server through unspecified vectors
+    or, if DNSSEC validation is enabled, by sending certain crafted ANY
+    queries.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time for the first issue. The
+    DNSSEC validation Denial of Service can be prevented by disabling
+    DNSSEC validation until the upgrade to a fixed version. Note that
+    DNSSEC validation is disabled on a default configuration.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ISC BIND 9.3 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/bind-9.3.4&quot;</code>
+    <p>
+    All ISC BIND 9.2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/bind-9.2.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0493">CVE-2007-0493</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0494">CVE-2007-0494</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 16 Feb 2007 09:07:21 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 16 Feb 2007 17:39:52 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 17 Feb 2007 15:53:00 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200702-07.xml b/xml/htdocs/security/en/glsa/glsa-200702-07.xml
new file mode 100644
index 00000000..83ad751f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200702-07.xml
@@ -0,0 +1,108 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200702-07">
+  <title>Sun JDK/JRE: Execution of arbitrary code</title>
+  <synopsis>
+    Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) contain a
+    memory corruption flaw that allows the applets to gain elevated privileges
+    potentially leading to the execute of arbitrary code.
+  </synopsis>
+  <product type="ebuild">java</product>
+  <announced>February 17, 2007</announced>
+  <revised>July 16, 2008: 05</revised>
+  <bug>162511</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/sun-jdk" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.10</unaffected>
+      <unaffected range="rge">1.4.2.18</unaffected>
+      <unaffected range="rge">1.4.2.17</unaffected>
+      <unaffected range="rge">1.4.2.15</unaffected>
+      <unaffected range="rge">1.4.2.14</unaffected>
+      <unaffected range="rge">1.4.2.13</unaffected>
+      <vulnerable range="lt">1.5.0.10</vulnerable>
+      <vulnerable range="lt">1.4.2.13</vulnerable>
+    </package>
+    <package name="dev-java/sun-jre-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.10</unaffected>
+      <unaffected range="rge">1.4.2.18</unaffected>
+      <unaffected range="rge">1.4.2.17</unaffected>
+      <unaffected range="rge">1.4.2.15</unaffected>
+      <unaffected range="rge">1.4.2.14</unaffected>
+      <unaffected range="rge">1.4.2.13</unaffected>
+      <vulnerable range="lt">1.5.0.10</vulnerable>
+      <vulnerable range="lt">1.4.2.13</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Sun Java Development Kit (JDK) and the Sun Java Runtime Environment
+    (JRE) provide the Sun Java platform.
+    </p>
+  </background>
+  <description>
+    <p>
+    A anonymous researcher discovered that an error in the handling of a
+    GIF image with a zero width field block leads to a memory corruption
+    flaw.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to run a specially crafted Java applet
+    or application that would load a crafted GIF image, which could result
+    in escalation of privileges and unauthorized access to system
+    resources.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Sun Java Development Kit 1.5 users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jdk-1.5.0.10&quot;</code>
+    <p>
+    All Sun Java Development Kit 1.4 users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;=dev-java/sun-jdk-1.4.2*&quot;</code>
+    <p>
+    All Sun Java Runtime Environment 1.5 users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jre-bin-1.5.0.10&quot;</code>
+    <p>
+    All Sun Java Runtime Environment 1.4 users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;=dev-java/sun-jre-bin-1.4.2*&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0243">CVE-2007-0243</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 10 Feb 2007 19:27:14 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 10 Feb 2007 23:53:12 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 12 Feb 2007 23:55:24 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200702-08.xml b/xml/htdocs/security/en/glsa/glsa-200702-08.xml
new file mode 100644
index 00000000..fc5859d8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200702-08.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200702-08">
+  <title>AMD64 x86 emulation Sun's J2SE Development Kit: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple unspecified vulnerabilities have been identified in Sun Java
+    Development Kit (JDK) and Sun Java Runtime Environment (JRE).
+  </synopsis>
+  <product type="ebuild">java</product>
+  <announced>February 17, 2007</announced>
+  <revised>May 28, 2009: 02</revised>
+  <bug>159547</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-emulation/emul-linux-x86-java" auto="yes" arch="amd64">
+      <unaffected range="ge">1.5.0.10</unaffected>
+      <unaffected range="rge">1.4.2.19</unaffected>
+      <vulnerable range="lt">1.5.0.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Sun Java Development Kit (JDK) and the Sun Java Runtime Environment
+    (JRE) provide the Sun Java platform. The x86 emulation Sun's J2SE
+    Development Kit for AMD64 contains a vulnerable version of Sun's JDK.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Evans has discovered multiple buffer overflows in Sun JDK and Sun
+    JRE possibly related to various AWT or font layout functions. Tom
+    Hawtin has discovered an unspecified vulnerability in Sun JDK and Sun
+    JRE relating to unintended applet data access. He has also discovered
+    multiple other unspecified vulnerabilities in Sun JDK and Sun JRE
+    allowing unintended Java applet or application resource acquisition.
+    Additionally, a memory corruption error has been found in the handling
+    of GIF images with zero width field blocks.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to run a specially crafted Java applet
+    or application that could read, write, or execute local files with the
+    privileges of the user running the JVM, access data maintained in other
+    Java applets, or escalate the privileges of the currently running Java
+    applet or application allowing for unauthorized access to system
+    resources.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All AMD64 x86 emulation Sun's J2SE Development Kit users should upgrade
+    to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/emul-linux-x86-java-1.5.0.10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6731">CVE-2006-6731</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6736">CVE-2006-6736</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6737">CVE-2006-6737</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6745">CVE-2006-6745</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0243">CVE-2007-0243</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 12 Feb 2007 22:34:40 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 12 Feb 2007 22:42:06 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 12 Feb 2007 22:57:40 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200702-09.xml b/xml/htdocs/security/en/glsa/glsa-200702-09.xml
new file mode 100644
index 00000000..e29d5ab0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200702-09.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200702-09">
+  <title>Nexuiz: Multiple vulnerabilities</title>
+  <synopsis>
+    Two separate vulnerabilities have been found in Nexuiz allowing the remote
+    execution of arbitrary code and a Denial of Service.
+  </synopsis>
+  <product type="ebuild">nexuiz</product>
+  <announced>February 25, 2007</announced>
+  <revised>February 25, 2007: 01</revised>
+  <bug>166044</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-fps/nexuiz" auto="yes" arch="*">
+      <unaffected range="ge">2.2.1</unaffected>
+      <vulnerable range="lt">2.2.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Nexuiz is a multi-player FPS game which uses a modified version of the
+    Quake 1 engine.
+    </p>
+  </background>
+  <description>
+    <p>
+    Nexuiz fails to correctly validate input within "clientcommands". There
+    is also a failure to correctly handle connection attempts from remote
+    hosts.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Using a specially crafted "clientcommand" a remote attacker can cause a
+    buffer overflow in Nexuiz which could result in the execution of
+    arbitrary code. Additionally, there is a Denial of Service
+    vulnerability in Nexuiz allowing an attacker to cause Nexuiz to crash
+    or to run out of resources by overloading it with specially crafted
+    connection requests.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Nexuiz users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-fps/nexuiz-2.2.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6609">CVE-2006-6609</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6610">CVE-2006-6610</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 10 Feb 2007 22:20:41 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 10 Feb 2007 23:53:08 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 15 Feb 2007 16:20:20 +0000">
+    hyakuhei
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200702-10.xml b/xml/htdocs/security/en/glsa/glsa-200702-10.xml
new file mode 100644
index 00000000..fa52ac06
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200702-10.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200702-10">
+  <title>UFO2000: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been found in the network components of
+    UFO2000 that could result in the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">ufo2000</product>
+  <announced>February 25, 2007</announced>
+  <revised>February 25, 2007: 01</revised>
+  <bug>142392</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-strategy/ufo2000" auto="yes" arch="*">
+      <unaffected range="ge">0.7.1062</unaffected>
+      <vulnerable range="lt">0.7.1062</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    UFO2000 is a multi-player, turn-based tactical simulation.
+    </p>
+  </background>
+  <description>
+    <p>
+    Five vulnerabilities were found: a buffer overflow in recv_add_unit();
+    a problem with improperly trusting user-supplied string information in
+    decode_stringmap(); several issues with array manipulation via various
+    commands during play; an SQL injection in server_protocol.cpp; and
+    finally, a second buffer overflow in recv_map_data().
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could send crafted network traffic as part of a
+    multi-player game that could result in remote code execution on the
+    remote opponent or the server. A remote attacker could also run
+    arbitrary SQL queries against the server account database, and perform
+    a Denial of Service on a remote opponent by causing the game to crash.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    UFO2000 currently depends on the dumb-0.9.2 library, which has been
+    removed from portage due to security problems (GLSA 200608-14) .
+    Because of this, UFO2000 has been masked, and we recommend unmerging
+    the package until the next beta release can remove the dependency on
+    dumb.
+    </p>
+    <code>
+    # emerge --ask --verbose --unmerge ufo2000</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3788">CVE-2006-3788</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3789">CVE-2006-3789</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3790">CVE-2006-3790</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3791">CVE-2006-3791</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3792">CVE-2006-3792</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200608-14.xml">GLSA 200608-14</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 10 Feb 2007 19:42:06 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 14 Feb 2007 03:39:23 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 19 Feb 2007 21:24:04 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200702-11.xml b/xml/htdocs/security/en/glsa/glsa-200702-11.xml
new file mode 100644
index 00000000..d6ea4e34
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200702-11.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200702-11">
+  <title>MPlayer: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow was found in MPlayer's RTSP plugin that could lead to a
+    Denial of Service or arbitrary code execution.
+  </synopsis>
+  <product type="ebuild">MPlayer</product>
+  <announced>February 27, 2007</announced>
+  <revised>February 27, 2007: 01</revised>
+  <bug>159727</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/mplayer" auto="yes" arch="*">
+      <unaffected range="ge">1.0_rc1-r2</unaffected>
+      <vulnerable range="lt">1.0_rc1-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MPlayer is a media player capable of playing multiple media formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    When checking for matching asm rules in the asmrp.c code, the results
+    are stored in a fixed-size array without boundary checks which may
+    allow a buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker can entice a user to connect to a manipulated RTSP server
+    resulting in a Denial of Service and possibly execution of arbitrary
+    code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MPlayer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/mplayer-1.0_rc1-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.mplayerhq.hu/design7/news.html#vuln14">Original Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6172">CVE-2006-6172</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 12 Feb 2007 12:10:45 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 13 Feb 2007 11:54:03 +0000">
+    daxomatic
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 13 Feb 2007 12:06:52 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200702-12.xml b/xml/htdocs/security/en/glsa/glsa-200702-12.xml
new file mode 100644
index 00000000..604aa882
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200702-12.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200702-12">
+  <title>CHMlib: User-assisted remote execution of arbitrary code</title>
+  <synopsis>
+    A memory corruption vulnerability in CHMlib could lead to the remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">CHMlib</product>
+  <announced>February 27, 2007</announced>
+  <revised>May 20, 2008: 02</revised>
+  <bug>163989</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/chmlib" auto="yes" arch="*">
+      <unaffected range="ge">0.39</unaffected>
+      <vulnerable range="lt">0.39</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CHMlib is a library for the MS CHM (Compressed HTML) file format plus
+    extracting and HTTP server utils.
+    </p>
+  </background>
+  <description>
+    <p>
+    When certain CHM files that contain tables and objects stored in pages
+    are parsed by CHMlib, an unsanitized value is passed to the alloca()
+    function resulting in a shift of the stack pointer to arbitrary memory
+    locations.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially crafted CHM file,
+    resulting in the execution of arbitrary code with the permissions of
+    the user viewing the file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CHMlib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/chmlib-0.39&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=468">Original Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0619">CVE-2007-0619</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 10 Feb 2007 21:22:08 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 10 Feb 2007 23:53:10 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 13 Feb 2007 11:35:38 +0000">
+    daxomatic
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-01.xml b/xml/htdocs/security/en/glsa/glsa-200703-01.xml
new file mode 100644
index 00000000..14def5e7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-01.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-01">
+  <title>Snort: Remote execution of arbitrary code</title>
+  <synopsis>
+    The Snort DCE/RPC preprocessor contains a buffer overflow that could result
+    in the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">snort</product>
+  <announced>February 23, 2007</announced>
+  <revised>March 02, 2007: 02</revised>
+  <bug>167730</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/snort" auto="yes" arch="*">
+      <unaffected range="ge">2.6.1.3</unaffected>
+      <vulnerable range="lt">2.6.1.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Snort is a widely deployed intrusion detection program.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Snort DCE/RPC preprocessor does not properly reassemble certain
+    types of fragmented SMB and DCE/RPC packets.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send specially crafted fragmented SMB or
+    DCE/RPC packets, without the need to finish the TCP handshake, that
+    would trigger a stack-based buffer overflow while being reassembled.
+    This could lead to the execution of arbitrary code with the permissions
+    of the user running the Snort preprocessor.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable the DCE/RPC processor by commenting the 'preprocessor dcerpc'
+    section in /etc/snort/snort.conf .
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Snort users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/snort-2.6.1.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5276">CVE-2006-5276</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 23 Feb 2007 17:25:01 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 27 Feb 2007 18:06:20 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-02.xml b/xml/htdocs/security/en/glsa/glsa-200703-02.xml
new file mode 100644
index 00000000..3d2f1665
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-02.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-02">
+  <title>SpamAssassin: Long URI Denial of Service</title>
+  <synopsis>
+    SpamAssassin is vulnerable to a Denial of Service attack.
+  </synopsis>
+  <product type="ebuild">spamassassin</product>
+  <announced>March 02, 2007</announced>
+  <revised>March 02, 2007: 01</revised>
+  <bug>166969</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-filter/spamassassin" auto="yes" arch="*">
+      <unaffected range="ge">3.1.8</unaffected>
+      <vulnerable range="lt">3.1.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SpamAssassin is an extensible email filter used to identify junk email.
+    </p>
+  </background>
+  <description>
+    <p>
+    SpamAssassin does not correctly handle very long URIs when scanning
+    emails.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could cause SpamAssassin to consume large amounts of CPU
+    and memory resources by sending one or more emails containing very long
+    URIs.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SpamAssassin users should upgrade to the latest version.
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-filter/spamassassin-3.1.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0451">CVE-2007-0451</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 25 Feb 2007 19:43:02 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 25 Feb 2007 19:46:27 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 26 Feb 2007 18:49:30 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-03.xml b/xml/htdocs/security/en/glsa/glsa-200703-03.xml
new file mode 100644
index 00000000..4366fd02
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-03.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-03">
+  <title>ClamAV: Denial of Service</title>
+  <synopsis>
+    ClamAV contains two vulnerabilities allowing a Denial of Service.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>March 02, 2007</announced>
+  <revised>March 02, 2007: 01</revised>
+  <bug>167201</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.90</unaffected>
+      <vulnerable range="lt">0.90</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ClamAV is a GPL virus scanner.
+    </p>
+  </background>
+  <description>
+    <p>
+    An anonymous researcher discovered a file descriptor leak error in the
+    processing of CAB archives and a lack of validation of the "id"
+    parameter string used to create local files when parsing MIME headers.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker can send several crafted CAB archives with a
+    zero-length record header that will fill the available file descriptors
+    until no other is available, which will prevent ClamAV from scanning
+    most archives. An attacker can also send an email with specially
+    crafted MIME headers to overwrite local files with the permissions of
+    the user running ClamAV, such as the virus database file, which could
+    prevent ClamAV from detecting any virus.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    The first vulnerability can be prevented by refusing any file of type
+    CAB, but there is no known workaround for the second issue.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.90&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0897">CVE-2007-0897</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0898">CVE-2007-0898</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 26 Feb 2007 22:43:01 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 27 Feb 2007 13:49:10 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 02 Mar 2007 00:24:54 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-04.xml b/xml/htdocs/security/en/glsa/glsa-200703-04.xml
new file mode 100644
index 00000000..42e3be6e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-04.xml
@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-04">
+  <title>Mozilla Firefox: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been reported in Mozilla Firefox, some of
+    which may allow user-assisted arbitrary remote code execution.
+  </synopsis>
+  <product type="ebuild">mozilla-firefox</product>
+  <announced>March 02, 2007</announced>
+  <revised>March 02, 2007: 01</revised>
+  <bug>165555</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="rge">1.5.0.10</unaffected>
+      <unaffected range="ge">2.0.0.2</unaffected>
+      <vulnerable range="lt">2.0.0.2</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="rge">1.5.0.10</unaffected>
+      <unaffected range="ge">2.0.0.2</unaffected>
+      <vulnerable range="lt">2.0.0.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Firefox is a popular open-source web browser from the Mozilla
+    Project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tom Ferris reported a heap-based buffer overflow involving wide SVG
+    stroke widths that affects Mozilla Firefox 2 only. Various researchers
+    reported some errors in the JavaScript engine potentially leading to
+    memory corruption. Mozilla Firefox also contains minor vulnerabilities
+    involving cache collision and unsafe pop-up restrictions, filtering or
+    CSS rendering under certain conditions.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to view a specially crafted web page
+    that will trigger one of the vulnerabilities, possibly leading to the
+    execution of arbitrary code. It is also possible for an attacker to
+    spoof the address bar, steal information through cache collision,
+    bypass the local files protection mechanism with pop-ups, or perform
+    cross-site scripting attacks, leading to the exposure of sensitive
+    information, like user credentials.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time for all of these issues, but
+    most of them can be avoided by disabling JavaScript.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Users upgrading to the following releases of Mozilla Firefox should
+    note that this upgrade has been found to lose the saved passwords file
+    in some cases. The saved passwords are encrypted and stored in the
+    'signons.txt' file of ~/.mozilla/ and we advise our users to save that
+    file before performing the upgrade.
+    </p>
+    <p>
+    All Mozilla Firefox 1.5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-1.5.0.10&quot;</code>
+    <p>
+    All Mozilla Firefox 1.5 binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-1.5.0.10&quot;</code>
+    <p>
+    All Mozilla Firefox 2.0 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-2.0.0.2&quot;</code>
+    <p>
+    All Mozilla Firefox 2.0 binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-2.0.0.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6077">CVE-2006-6077</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0775">CVE-2007-0775</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0776">CVE-2007-0776</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0777">CVE-2007-0777</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0778">CVE-2007-0778</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0779">CVE-2007-0779</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0780">CVE-2007-0780</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0800">CVE-2007-0800</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0801">CVE-2007-0801</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0981">CVE-2007-0981</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0995">CVE-2007-0995</uri>
+    <uri link="https://bugzilla.mozilla.org/show_bug.cgi?id=360493#c366">Mozilla password loss bug</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 27 Feb 2007 18:38:44 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 01 Mar 2007 15:14:03 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 01 Mar 2007 15:15:57 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-05.xml b/xml/htdocs/security/en/glsa/glsa-200703-05.xml
new file mode 100644
index 00000000..f3b1d5d8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-05.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-05">
+  <title>Mozilla Suite: Multiple vulnerabilities</title>
+  <synopsis>
+    Several vulnerabilities exist in the Mozilla Suite, which is no longer
+    supported by the Mozilla project.
+  </synopsis>
+  <product type="ebuild">mozilla</product>
+  <announced>March 03, 2007</announced>
+  <revised>March 03, 2007: 01</revised>
+  <bug>135257</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla" auto="yes" arch="*">
+      <vulnerable range="le">1.7.13</vulnerable>
+    </package>
+    <package name="www-client/mozilla-bin" auto="yes" arch="*">
+      <vulnerable range="le">1.7.13</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Mozilla Suite is a popular all-in-one web browser that includes a
+    mail and news reader.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several vulnerabilities ranging from code execution with elevated
+    privileges to information leaks affect the Mozilla Suite.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to browse to a specially crafted
+    website or open a specially crafted mail that could trigger some of the
+    vulnerabilities, potentially allowing execution of arbitrary code,
+    denials of service, information leaks, or cross-site scripting attacks
+    leading to the robbery of cookies of authentication credentials.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Most of the issues, but not all of them, can be prevented by disabling
+    the HTML rendering in the mail client and JavaScript on every
+    application.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    The Mozilla Suite is no longer supported and has been masked after some
+    necessary changes on all the other ebuilds which used to depend on it.
+    Mozilla Suite users should unmerge www-client/mozilla or
+    www-client/mozilla-bin, and switch to a supported product, like
+    SeaMonkey, Thunderbird or Firefox.
+    </p>
+    <code>
+    
+    # emerge --unmerge &quot;www-client/mozilla&quot;
+    
+    # emerge --unmerge &quot;www-client/mozilla-bin&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.mozilla.org/projects/security/known-vulnerabilities.html#Mozilla">Official Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 23 Feb 2007 17:38:03 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 27 Feb 2007 15:55:16 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 27 Feb 2007 15:58:20 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-06.xml b/xml/htdocs/security/en/glsa/glsa-200703-06.xml
new file mode 100644
index 00000000..84fe3d0e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-06.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-06">
+  <title>AMD64 x86 emulation Qt library: Integer overflow</title>
+  <synopsis>
+    The AMD64 x86 emulation Qt library makes use of an insecure version of the
+    Qt library, potentially allowing for the remote execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">emul-linux-x86-qtlibs</product>
+  <announced>March 04, 2007</announced>
+  <revised>March 04, 2007: 01</revised>
+  <bug>153704</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-emulation/emul-linux-x86-qtlibs" auto="yes" arch="*">
+      <unaffected range="ge">10.0</unaffected>
+      <vulnerable range="lt">10.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The AMD64 x86 emulation Qt library for AMD64 emulates the x86 (32-bit)
+    Qt library on the AMD64 (64-bit) architecture.
+    </p>
+  </background>
+  <description>
+    <p>
+    An integer overflow flaw has been found in the pixmap handling of Qt,
+    making the AMD64 x86 emulation Qt library vulnerable as well.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to open a specially crafted pixmap image in an
+    application using the AMD64 x86 emulation Qt library, a remote attacker
+    could cause an application crash or the remote execution of arbitrary
+    code with the rights of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All AMD64 x86 emulation Qt library users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/emul-linux-x86-qtlibs-10.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200611-02.xml">GLSA 200611-02</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4811">CVE-2006-4811</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 17 Feb 2007 23:37:01 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 18 Feb 2007 00:18:57 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 27 Feb 2007 16:14:33 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-07.xml b/xml/htdocs/security/en/glsa/glsa-200703-07.xml
new file mode 100644
index 00000000..13c09401
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-07.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-07">
+  <title>STLport: Possible remote execution of arbitrary code</title>
+  <synopsis>
+    Two buffer overflows have been discovered in STLport possibly leading to
+    the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">STLport</product>
+  <announced>March 06, 2007</announced>
+  <revised>March 06, 2007: 01</revised>
+  <bug>165837</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/STLport" auto="yes" arch="*">
+      <unaffected range="ge">5.0.3</unaffected>
+      <vulnerable range="lt">5.0.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    STLport is a multi-platform C++ Standard Library implementation.
+    </p>
+  </background>
+  <description>
+    <p>
+    Two buffer overflows have been discovered, one in "print floats" and
+    one in the rope constructor.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Both of the buffer overflows could result in the remote execution of
+    arbitrary code. Please note that the exploitability of the
+    vulnerabilities depends on how the library is used by other software
+    programs.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All STLport users should upgrade to the latest version.
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/STLport-5.0.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0803">CVE-2007-0803</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 12 Feb 2007 07:45:45 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 18 Feb 2007 12:07:38 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 18 Feb 2007 22:45:11 +0000">
+    aetius
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-08.xml b/xml/htdocs/security/en/glsa/glsa-200703-08.xml
new file mode 100644
index 00000000..e85c39d3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-08.xml
@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-08">
+  <title>SeaMonkey: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been reported in SeaMonkey, some of which may
+    allow user-assisted arbitrary remote code execution.
+  </synopsis>
+  <product type="ebuild">seamonkey</product>
+  <announced>March 09, 2007</announced>
+  <revised>March 09, 2007: 01</revised>
+  <bug>165555</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/seamonkey" auto="yes" arch="*">
+      <unaffected range="ge">1.1.1</unaffected>
+      <vulnerable range="lt">1.1.1</vulnerable>
+    </package>
+    <package name="www-client/seamonkey-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.1.1</unaffected>
+      <vulnerable range="lt">1.1.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The SeaMonkey project is a community effort to deliver
+    production-quality releases of code derived from the application
+    formerly known as the 'Mozilla Application Suite'.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tom Ferris reported a heap-based buffer overflow involving wide SVG
+    stroke widths that affects SeaMonkey. Various researchers reported some
+    errors in the JavaScript engine potentially leading to memory
+    corruption. SeaMonkey also contains minor vulnerabilities involving
+    cache collision and unsafe pop-up restrictions, filtering or CSS
+    rendering under certain conditions. All those vulnerabilities are the
+    same as in GLSA 200703-04 affecting Mozilla Firefox.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to view a specially crafted web page or
+    to read a specially crafted email that will trigger one of the
+    vulnerabilities, possibly leading to the execution of arbitrary code.
+    It is also possible for an attacker to spoof the address bar, steal
+    information through cache collision, bypass the local file protection
+    mechanism with pop-ups, or perform cross-site scripting attacks,
+    leading to the exposure of sensitive information, such as user
+    credentials.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time for all of these issues, but
+    most of them can be avoided by disabling JavaScript. Note that the
+    execution of JavaScript is disabled by default in the SeaMonkey email
+    client, and enabling it is strongly discouraged.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Users upgrading to the following release of SeaMonkey should note that
+    the corresponding Mozilla Firefox upgrade has been found to lose the
+    saved passwords file in some cases. The saved passwords are encrypted
+    and stored in the 'signons.txt' file of ~/.mozilla/ and we advise our
+    users to save that file before performing the upgrade.
+    </p>
+    <p>
+    All SeaMonkey users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/seamonkey-1.1.1&quot;</code>
+    <p>
+    All SeaMonkey binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/seamonkey-bin-1.1.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6077">CVE-2006-6077</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0775">CVE-2007-0775</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0776">CVE-2007-0776</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0777">CVE-2007-0777</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0778">CVE-2007-0778</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0779">CVE-2007-0779</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0780">CVE-2007-0780</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0800">CVE-2007-0800</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0801">CVE-2007-0801</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0981">CVE-2007-0981</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0995">CVE-2007-0995</uri>
+    <uri link="https://bugzilla.mozilla.org/show_bug.cgi?id=360493#c366">Mozilla Password Loss Bug</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 04 Mar 2007 00:05:48 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 09 Mar 2007 22:48:00 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-09.xml b/xml/htdocs/security/en/glsa/glsa-200703-09.xml
new file mode 100644
index 00000000..405643b7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-09.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-09">
+  <title>Smb4K: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been identified in Smb4K.
+  </synopsis>
+  <product type="ebuild">smb4k</product>
+  <announced>March 09, 2007</announced>
+  <revised>March 09, 2007: 01</revised>
+  <bug>156152</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-misc/smb4k" auto="yes" arch="*">
+      <unaffected range="ge">0.6.10a</unaffected>
+      <vulnerable range="lt">0.6.10a</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Smb4K is a SMB/CIFS (Windows) share browser for KDE.
+    </p>
+  </background>
+  <description>
+    <p>
+    Kees Cook of the Ubuntu Security Team has identified multiple
+    vulnerabilities in Smb4K.
+    </p>
+    <ul><li>The writeFile() function of
+    smb4k/core/smb4kfileio.cpp makes insecure usage of temporary
+    files.</li>
+    <li>The writeFile() function also stores the contents of
+    the sudoers file with incorrect permissions, allowing for the file's
+    contents to be world-readable.</li>
+    <li>The createLockFile() and
+    removeLockFile() functions improperly handle lock files, possibly
+    allowing for a race condition in file handling.</li>
+    <li>The smb4k_kill
+    utility distributed with Smb4K allows any user in the sudoers group to
+    kill any process on the system.</li>
+    <li>Lastly, there is the potential
+    for multiple stack overflows when any Smb4K utility is used with the
+    sudo command.</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could gain unauthorized access to arbitrary files via
+    numerous attack vectors. In some cases to obtain this unauthorized
+    access, an attacker would have to be a member of the sudoers list.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Smb4K users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/smb4k-0.6.10a&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0472">CVE-2007-0472</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0473">CVE-2007-0473</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0474">CVE-2007-0474</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0475">CVE-2007-0475</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 12 Feb 2007 22:36:28 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 12 Feb 2007 22:42:10 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 27 Feb 2007 15:26:26 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-10.xml b/xml/htdocs/security/en/glsa/glsa-200703-10.xml
new file mode 100644
index 00000000..24fc38bd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-10.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-10">
+  <title>KHTML: Cross-site scripting (XSS) vulnerability</title>
+  <synopsis>
+    The KHTML component shipped with the KDE libraries is prone to a cross-site
+    scripting (XSS) vulnerability.
+  </synopsis>
+  <product type="ebuild">kdelibs</product>
+  <announced>March 10, 2007</announced>
+  <revised>March 10, 2007: 01</revised>
+  <bug>165606</bug>
+  <access>remote</access>
+  <affected>
+    <package name="kde-base/kdelibs" auto="yes" arch="*">
+      <unaffected range="ge">3.5.5-r8</unaffected>
+      <vulnerable range="lt">3.5.5-r8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDE is a feature-rich graphical desktop environment for Linux and
+    Unix-like Operating Systems. KHTML is the HTML interpreter used in
+    Konqueror and other parts of KDE.
+    </p>
+  </background>
+  <description>
+    <p>
+    The KHTML code allows for the execution of JavaScript code located
+    inside the "Title" HTML element, a related issue to the Safari error
+    found by Jose Avila.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    When viewing a HTML page that renders unsanitized attacker-supplied
+    input in the page title, Konqueror and other parts of KDE will execute
+    arbitrary JavaScript code contained in the page title, allowing for the
+    theft of browser session data or cookies.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All KDElibs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kdelibs-3.5.5-r8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0537">CVE-2007-0537</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0478">CVE-2007-0478</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 27 Feb 2007 16:04:07 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 27 Feb 2007 16:19:36 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-11.xml b/xml/htdocs/security/en/glsa/glsa-200703-11.xml
new file mode 100644
index 00000000..243fcf0b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-11.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-11">
+  <title>Amarok: User-assisted remote execution of arbitrary code</title>
+  <synopsis>
+    The Magnatune component shipped with Amarok is vulnerable to the injection
+    of arbitrary shell code from a malicious Magnatune server.
+  </synopsis>
+  <product type="ebuild">amarok</product>
+  <announced>March 13, 2007</announced>
+  <revised>March 13, 2007: 01</revised>
+  <bug>166901</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/amarok" auto="yes" arch="*">
+      <unaffected range="ge">1.4.5-r1</unaffected>
+      <vulnerable range="lt">1.4.5-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Amarok is an advanced music player.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Magnatune downloader doesn't quote the "m_currentAlbumFileName"
+    parameter while calling the "unzip" shell command.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A compromised or malicious Magnatune server can remotely execute
+    arbitrary shell code with the rights of the user running Amarok on a
+    client that have previously registered for buying music.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not use the Magnatune component of Amarok.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Amarok users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/amarok-1.4.5-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://secunia.com/advisories/24159">SA24159</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 23 Feb 2007 17:45:23 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 27 Feb 2007 13:56:19 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 27 Feb 2007 14:11:31 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-12.xml b/xml/htdocs/security/en/glsa/glsa-200703-12.xml
new file mode 100644
index 00000000..e4fda3a7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-12.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-12">
+  <title>SILC Server: Denial of Service</title>
+  <synopsis>
+    SILC Server is affected by a Denial of Service vulnerability.
+  </synopsis>
+  <product type="ebuild">silc-server</product>
+  <announced>March 14, 2007</announced>
+  <revised>March 14, 2007: 01</revised>
+  <bug>169599</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/silc-server" auto="yes" arch="*">
+      <unaffected range="ge">1.0.2-r1</unaffected>
+      <vulnerable range="lt">1.0.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SILC Server is a server for the Secure Internet Live Conferencing
+    (SILC) protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    Frank Benkstein discovered a possible NULL pointer dereference in
+    apps/silcd/command.c if a new channel is created without specifying a
+    valid hmac or cipher algorithm name.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could cause the server to crash, resulting in a
+    Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SILC Server users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/silc-server-1.0.2-r1&quot;</code>
+  </resolution>
+  <references/>
+  <metadata tag="requester" timestamp="Wed, 07 Mar 2007 14:35:02 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 07 Mar 2007 14:57:46 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 07 Mar 2007 15:20:03 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-13.xml b/xml/htdocs/security/en/glsa/glsa-200703-13.xml
new file mode 100644
index 00000000..1255db92
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-13.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-13">
+  <title>SSH Communications Security's Secure Shell Server: SFTP privilege escalation</title>
+  <synopsis>
+    The SSH Secure Shell Server SFTP function is vulnerable to privilege
+    escalation.
+  </synopsis>
+  <product type="ebuild">net-misc/ssh</product>
+  <announced>March 14, 2007</announced>
+  <revised>March 14, 2007: 01</revised>
+  <bug>168584</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/ssh" auto="yes" arch="*">
+      <vulnerable range="lt">4.3.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The SSH Secure Shell Server from SSH Communications Security
+    (www.ssh.com) is a commercial SSH implementation available free for
+    non-commercial use.
+    </p>
+  </background>
+  <description>
+    <p>
+    The SSH Secure Shell Server contains a format string vulnerability in
+    the SFTP code that handles file transfers (scp2 and sftp2). In some
+    situations, this code passes the accessed filename to the system log.
+    During this operation, an unspecified error could allow uncontrolled
+    stack access.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An authenticated system user may be able to exploit this vulnerability
+    to bypass command restrictions, or run commands as another user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    This package is currently masked, there is no upgrade path for the
+    3.2.x version, and a license must be purchased in order to update to a
+    non-vulnerable version. Because of this, we recommend unmerging this
+    package:
+    </p>
+    <code>
+    # emerge --ask --verbose --unmerge net-misc/ssh</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0705">CVE-2006-0705</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 05 Mar 2007 21:03:07 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 07 Mar 2007 14:57:32 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 09 Mar 2007 13:16:30 +0000">
+    aetius
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-14.xml b/xml/htdocs/security/en/glsa/glsa-200703-14.xml
new file mode 100644
index 00000000..42b31306
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-14.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-14">
+  <title>Asterisk: SIP Denial of Service</title>
+  <synopsis>
+    Asterisk is vulnerable to Denial of Service in the SIP channel.
+  </synopsis>
+  <product type="ebuild">asterisk</product>
+  <announced>March 16, 2007</announced>
+  <revised>March 16, 2007: 01</revised>
+  <bug>169616</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/asterisk" auto="yes" arch="*">
+      <unaffected range="ge">1.2.14-r1</unaffected>
+      <unaffected range="rge">1.0.12-r1</unaffected>
+      <vulnerable range="lt">1.2.14-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Asterisk is an open source implementation of a telephone private branch
+    exchange (PBX).
+    </p>
+  </background>
+  <description>
+    <p>
+    The MU Security Research Team discovered that Asterisk contains a
+    NULL-pointer dereferencing error in the SIP channel when handling
+    request messages.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could cause an Asterisk server listening for SIP
+    messages to crash by sending a specially crafted SIP request message.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Asterisk users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose net-misc/asterisk</code>
+    <p>
+    Note: Asterisk 1.0.x is no longer supported upstream so users should
+    consider upgrading to Asterisk 1.2.x.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1306">CVE-2007-1306</uri>
+    <uri link="http://labs.musecurity.com/advisories/MU-200703-01.txt">MU-200703-01</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 16 Mar 2007 07:59:58 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 16 Mar 2007 10:36:56 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-15.xml b/xml/htdocs/security/en/glsa/glsa-200703-15.xml
new file mode 100644
index 00000000..c911a480
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-15.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-15">
+  <title>PostgreSQL: Multiple vulnerabilities</title>
+  <synopsis>
+    PostgreSQL contains two vulnerabilities that could result in a Denial of
+    Service or unauthorized access to certain information.
+  </synopsis>
+  <product type="ebuild">postgresql</product>
+  <announced>March 16, 2007</announced>
+  <revised>May 28, 2009: 04</revised>
+  <bug>165482</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/postgresql" auto="yes" arch="*">
+      <unaffected range="ge">8.0.11</unaffected>
+      <unaffected range="rge">7.4.17</unaffected>
+      <unaffected range="rge">7.4.16</unaffected>
+      <unaffected range="rge">7.3.19</unaffected>
+      <unaffected range="rge">7.3.13</unaffected>
+      <unaffected range="rge">7.3.21</unaffected>
+      <unaffected range="rge">7.4.19</unaffected>
+      <vulnerable range="lt">8.0.11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PostgreSQL is an open source object-relational database management
+    system.
+    </p>
+  </background>
+  <description>
+    <p>
+    PostgreSQL does not correctly check the data types of the SQL function
+    arguments under unspecified circumstances nor the format of the
+    provided tables in the query planner.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote authenticated attacker could send specially crafted queries to
+    the server that could result in a server crash and possibly the
+    unauthorized reading of some database content or arbitrary memory.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PostgreSQL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;dev-db/postgresql&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0555">CVE-2007-0555</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0556">CVE-2007-0556</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 09 Mar 2007 22:33:46 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 12 Mar 2007 16:09:31 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 13 Mar 2007 19:55:02 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-16.xml b/xml/htdocs/security/en/glsa/glsa-200703-16.xml
new file mode 100644
index 00000000..44b92e73
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-16.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-16">
+  <title>Apache JK Tomcat Connector: Remote execution of arbitrary code</title>
+  <synopsis>
+    The Apache Tomcat Connector (mod_jk) contains a buffer overflow
+    vulnerability that could result in the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mod_jk</product>
+  <announced>March 16, 2007</announced>
+  <revised>March 16, 2007: 01</revised>
+  <bug>169433</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apache/mod_jk" auto="yes" arch="*">
+      <unaffected range="ge">1.2.21-r1</unaffected>
+      <vulnerable range="lt">1.2.21-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP server is a very widely used web server. mod_jk
+    provides the JK module for connecting Tomcat and Apache using the ajp13
+    protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    ZDI reported an unsafe memory copy in mod_jk that was discovered by an
+    anonymous researcher in the map_uri_to_worker function of
+    native/common/jk_uri_worker_map.c .
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker can send a long URL request to an Apache server using
+    Tomcat. That can trigger the vulnerability and lead to a stack-based
+    buffer overflow, which could result in the execution of arbitrary code
+    with the permissions of the Apache user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Apache Tomcat users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apache/mod_jk-1.2.21-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0774">CVE-2007-0774</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 06 Mar 2007 16:08:28 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 14 Mar 2007 00:11:00 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 14 Mar 2007 20:16:09 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-17.xml b/xml/htdocs/security/en/glsa/glsa-200703-17.xml
new file mode 100644
index 00000000..65d25d4f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-17.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-17">
+  <title>ulogd: Remote execution of arbitrary code</title>
+  <synopsis>
+    ulogd contains a possible buffer overflow potentially allowing for the
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">ulogd</product>
+  <announced>March 18, 2007</announced>
+  <revised>March 18, 2007: 01</revised>
+  <bug>161882</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-admin/ulogd" auto="yes" arch="*">
+      <unaffected range="ge">1.23-r1</unaffected>
+      <vulnerable range="lt">1.23-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ulogd is a userspace daemon for netfilter related logging.
+    </p>
+  </background>
+  <description>
+    <p>
+    SUSE reported unspecified buffer overflows in ulogd involving the
+    calculation of string lengths.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could trigger a possible buffer overflow through
+    unspecified vectors, potentially leading to the remote execution of
+    arbitrary code with the rights of the user running the ulogd daemon, or
+    more probably leading to the crash of the daemon.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ulogd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/ulogd-1.23-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0460">CVE-2007-0460</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 14 Mar 2007 07:34:19 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 16 Mar 2007 12:57:18 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 18 Mar 2007 21:32:10 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-18.xml b/xml/htdocs/security/en/glsa/glsa-200703-18.xml
new file mode 100644
index 00000000..db6519a9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-18.xml
@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-18">
+  <title>Mozilla Thunderbird: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been reported in Mozilla Thunderbird, some of
+    which may allow user-assisted arbitrary remote code execution.
+  </synopsis>
+  <product type="ebuild">mozilla-thunderbird</product>
+  <announced>March 18, 2007</announced>
+  <revised>March 18, 2007: 01</revised>
+  <bug>165555</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/mozilla-thunderbird" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.10</unaffected>
+      <vulnerable range="lt">1.5.0.10</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.10</unaffected>
+      <vulnerable range="lt">1.5.0.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Thunderbird is a popular open-source email client from the
+    Mozilla Project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Georgi Guninski reported a possible integer overflow in the code
+    handling text/enhanced or text/richtext MIME emails. Additionally,
+    various researchers reported errors in the JavaScript engine
+    potentially leading to memory corruption. Additionally, the binary
+    version of Mozilla Thunderbird includes a vulnerable NSS library which
+    contains two possible buffer overflows involving the SSLv2 protocol.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to read a specially crafted email that
+    could trigger one of the vulnerabilities, some of them being related to
+    Mozilla Thunderbird's handling of JavaScript, possibly leading to the
+    execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time for all of these issues, but
+    some of them can be avoided by disabling JavaScript. Note that the
+    execution of JavaScript is disabled by default and enabling it is
+    strongly discouraged.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Thunderbird users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-1.5.0.10&quot;</code>
+    <p>
+    All Mozilla Thunderbird binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-bin-1.5.0.10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0008">CVE-2007-0008</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0009">CVE-2007-0009</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0775">CVE-2007-0775</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0776">CVE-2007-0776</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0777">CVE-2007-0777</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1282">CVE-2007-1282</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 13 Mar 2007 23:29:16 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 14 Mar 2007 00:11:26 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-19.xml b/xml/htdocs/security/en/glsa/glsa-200703-19.xml
new file mode 100644
index 00000000..ab2a3f34
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-19.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-19">
+  <title>LTSP: Authentication bypass in included LibVNCServer code</title>
+  <synopsis>
+    LTSP includes a version of libVNCServer that is vulnerable to an
+    authentication bypass.
+  </synopsis>
+  <product type="ebuild">ltsp</product>
+  <announced>March 18, 2007</announced>
+  <revised>March 18, 2007: 01</revised>
+  <bug>142661</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/ltsp" auto="yes" arch="*">
+      <unaffected range="ge">4.2-r1</unaffected>
+      <vulnerable range="lt">4.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Linux Terminal Server Project adds thin-client support to Linux
+    servers.
+    </p>
+  </background>
+  <description>
+    <p>
+    The LTSP server includes vulnerable LibVNCServer code, which fails to
+    properly validate protocol types effectively letting users decide what
+    protocol to use, such as "Type 1 - None" (GLSA-200608-05). The LTSP VNC
+    server will accept this security type, even if it is not offered by the
+    server.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could exploit this vulnerability to gain unauthorized
+    access with the privileges of the user running the VNC server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All LTSP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/ltsp-4.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2450">CVE-2006-2450</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200608-05.xml">GLSA 200608-05</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 10 Feb 2007 19:11:34 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 10 Feb 2007 23:53:14 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 27 Feb 2007 02:25:26 +0000">
+    aetius
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-20.xml b/xml/htdocs/security/en/glsa/glsa-200703-20.xml
new file mode 100644
index 00000000..3bae4852
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-20.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-20">
+  <title>LSAT: Insecure temporary file creation</title>
+  <synopsis>
+    LSAT insecurely creates temporary files which can lead to symlink attacks
+    allowing a local user to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">lsat</product>
+  <announced>March 18, 2007</announced>
+  <revised>May 11, 2007: 02</revised>
+  <bug>159542</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-admin/lsat" auto="yes" arch="*">
+      <unaffected range="ge">0.9.5</unaffected>
+      <vulnerable range="lt">0.9.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Linux Security Auditing Tool (LSAT) is a post install security
+    auditor which checks many system configurations and local network
+    settings on the system for common security or configuration errors and
+    for packages that are not needed.
+    </p>
+  </background>
+  <description>
+    <p>
+    LSAT insecurely writes in /tmp with a predictable filename.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A local attacker could create symbolic links in the temporary files
+    directory, pointing to a valid file somewhere on the filesystem. When
+    the LSAT script is executed, this would result in the file being
+    overwritten with the rights of the user running the software, which
+    could be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All lsat users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/lsat-0.9.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1500">CVE-2007-1500</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 15 Mar 2007 22:15:51 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 16 Mar 2007 10:34:49 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 16 Mar 2007 11:42:45 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-21.xml b/xml/htdocs/security/en/glsa/glsa-200703-21.xml
new file mode 100644
index 00000000..5f953be5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-21.xml
@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-21">
+  <title>PHP: Multiple vulnerabilities</title>
+  <synopsis>
+    PHP contains several vulnerabilities including a heap buffer overflow,
+    potentially leading to the remote execution of arbitrary code under certain
+    conditions.
+  </synopsis>
+  <product type="ebuild">php</product>
+  <announced>March 20, 2007</announced>
+  <revised>March 29, 2008: 03</revised>
+  <bug>153911</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/php" auto="yes" arch="*">
+      <unaffected range="ge">5.2.1-r3</unaffected>
+      <unaffected range="rge">5.1.6-r11</unaffected>
+      <unaffected range="rge">4.4.6</unaffected>
+      <unaffected range="rge">4.4.7</unaffected>
+      <unaffected range="rge">4.4.8_pre20070816</unaffected>
+      <vulnerable range="lt">5.2.1-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHP is a widely-used general-purpose scripting language that is
+    especially suited for Web development and can be embedded into HTML.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several vulnerabilities were found in PHP by the Hardened-PHP Project
+    and other researchers. These vulnerabilities include a heap-based
+    buffer overflow in htmlentities() and htmlspecialchars() if called with
+    UTF-8 parameters, and an off-by-one error in str_ireplace(). Other
+    vulnerabilities were also found in the PHP4 branch, including possible
+    overflows, stack corruptions and a format string vulnerability in the
+    *print() functions on 64 bit systems.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Remote attackers might be able to exploit these issues in PHP
+    applications making use of the affected functions, potentially
+    resulting in the execution of arbitrary code, Denial of Service,
+    execution of scripted contents in the context of the affected site,
+    security bypass or information leak.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;dev-lang/php&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5465">CVE-2006-5465</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0906">CVE-2007-0906</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0907">CVE-2007-0907</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0908">CVE-2007-0908</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0909">CVE-2007-0909</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0910">CVE-2007-0910</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0911">CVE-2007-0911</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0988">CVE-2007-0988</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1286">CVE-2007-1286</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1375">CVE-2007-1375</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1376">CVE-2007-1376</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1380">CVE-2007-1380</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1383">CVE-2007-1383</uri>
+    <uri link="http://www.php.net/releases/4_4_5.php">PHP 4.4.5 Release Announcement</uri>
+    <uri link="http://www.php.net/releases/5_2_1.php">PHP 5.2.1 Release Announcement</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 14 Mar 2007 13:36:33 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 16 Mar 2007 10:54:22 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 16 Mar 2007 11:47:58 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-22.xml b/xml/htdocs/security/en/glsa/glsa-200703-22.xml
new file mode 100644
index 00000000..29cb55e7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-22.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-22">
+  <title>Mozilla Network Security Service: Remote execution of arbitrary code</title>
+  <synopsis>
+    The Mozilla Network Security Services libraries are vulnerable to two
+    buffer overflows that could result in the remote execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">nss</product>
+  <announced>March 20, 2007</announced>
+  <revised>March 20, 2007: 01</revised>
+  <bug>165555</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/nss" auto="yes" arch="*">
+      <unaffected range="ge">3.11.5</unaffected>
+      <vulnerable range="lt">3.11.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Mozilla Network Security Service is a library implementing security
+    features like SSL v2/v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12,
+    S/MIME and X.509 certificates.
+    </p>
+  </background>
+  <description>
+    <p>
+    iDefense has reported two potential buffer overflow vulnerabilities
+    found by researcher "regenrecht" in the code implementing the SSLv2
+    protocol.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send a specially crafted SSL master key to a
+    server using NSS for the SSLv2 protocol, or entice a user to connect to
+    a malicious server with a client-side application using NSS like one of
+    the Mozilla products. This could trigger the vulnerabilities and result
+    in the possible execution of arbitrary code with the rights of the
+    vulnerable application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable the SSLv2 protocol in the applications using NSS.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All NSS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/nss-3.11.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0008">CVE-2007-0008</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0009">CVE-2007-0009</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 13 Mar 2007 23:41:07 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 16 Mar 2007 11:51:35 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-23.xml b/xml/htdocs/security/en/glsa/glsa-200703-23.xml
new file mode 100644
index 00000000..6023907b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-23.xml
@@ -0,0 +1,92 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-23">
+  <title>WordPress: Multiple vulnerabilities</title>
+  <synopsis>
+    Wordpress contains several cross-site scripting, cross-site request forgery
+    and information leak vulnerabilities.
+  </synopsis>
+  <product type="ebuild">wordpress</product>
+  <announced>March 20, 2007</announced>
+  <revised>March 20, 2007: 01</revised>
+  <bug>168529</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/wordpress" auto="yes" arch="*">
+      <vulnerable range="le">2.1.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    WordPress is a popular personal publishing platform with a web
+    interface.
+    </p>
+  </background>
+  <description>
+    <p>
+    WordPress contains cross-site scripting or cross-site scripting forgery
+    vulnerabilities reported by:
+    </p>
+    <ul><li>g30rg3_x in the "year"
+    parameter of the wp_title() function</li>
+    <li>Alexander Concha in the
+    "demo" parameter of wp-admin/admin.php</li>
+    <li>Samenspender and Stefan
+    Friedli in the "post" parameter of wp-admin/post.php and
+    wp-admin/page.php, in the "cat_ID" parameter of wp-admin/categories.php
+    and in the "c" parameter of wp-admin/comment.php</li>
+    <li>PsychoGun in
+    the "file" parameter of wp-admin/templates.php</li>
+    </ul> <p>
+    </p>
+    <p>
+    Additionally, WordPress prints the full PHP script paths in some error
+    messages.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    The cross-site scripting vulnerabilities can be triggered to steal
+    browser session data or cookies. A remote attacker can entice a user to
+    browse to a specially crafted web page that can trigger the cross-site
+    request forgery vulnerability and perform arbitrary WordPress actions
+    with the permissions of the user. Additionally, the path disclosure
+    vulnerability could help an attacker to perform other attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time for all these
+    vulnerabilities.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Due to the numerous recently discovered vulnerabilities in WordPress,
+    this package has been masked in the portage tree. All WordPress users
+    are advised to unmerge it.
+    </p>
+    <code>
+    
+    # emerge --unmerge &quot;www-apps/wordpress&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1049">CVE-2007-1049</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1230">CVE-2007-1230</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1244">CVE-2007-1244</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1409">CVE-2007-1409</uri>
+    <uri link="http://secunia.com/advisories/24430/">SA 24430</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 09 Mar 2007 22:36:03 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 17 Mar 2007 15:44:31 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 20 Mar 2007 11:36:10 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-24.xml b/xml/htdocs/security/en/glsa/glsa-200703-24.xml
new file mode 100644
index 00000000..305d3982
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-24.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-24">
+  <title>mgv: Stack overflow in included gv code</title>
+  <synopsis>
+    mgv improperly handles user-supplied data possibly allowing for the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mgv</product>
+  <announced>March 26, 2007</announced>
+  <revised>March 26, 2007: 01</revised>
+  <bug>154645</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/mgv" auto="yes" arch="*">
+      <vulnerable range="le">3.1.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    mgv is a Postscript viewer with a Motif interface, based on Ghostview
+    and GNU gv.
+    </p>
+  </background>
+  <description>
+    <p>
+    mgv includes code from gv that does not properly boundary check
+    user-supplied data before copying it into process buffers.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially crafted Postscript
+    document with mgv and possibly execute arbitrary code with the rights
+    of the user running mgv.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    mgv is currently unmaintained, and the mgv website no longer exists. As
+    such, the mgv package has been masked in Portage. We recommend that
+    users select an alternate Postscript viewer such as ghostview or
+    GSview, and unmerge mgv:
+    </p>
+    <code>
+    # emerge --unmerge &quot;app-text/mgv&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5864">CVE-2006-5864</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200611-20.xml">GLSA 200611-20</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 14 Mar 2007 07:32:05 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 20 Mar 2007 02:27:18 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 26 Mar 2007 19:59:57 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-25.xml b/xml/htdocs/security/en/glsa/glsa-200703-25.xml
new file mode 100644
index 00000000..1f974e6c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-25.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-25">
+  <title>Ekiga: Format string vulnerability</title>
+  <synopsis>
+    A format string vulnerability in Ekiga may allow the remote execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">ekiga</product>
+  <announced>March 29, 2007</announced>
+  <revised>May 28, 2009: 02</revised>
+  <bug>167643</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-voip/ekiga" auto="yes" arch="*">
+      <unaffected range="ge">2.0.7</unaffected>
+      <vulnerable range="lt">2.0.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ekiga is an open source VoIP and video conferencing application.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mu Security has discovered that Ekiga fails to implement formatted
+    printing correctly.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could exploit this vulnerability to crash Ekiga and
+    potentially execute arbitrary code by sending a specially crafted Q.931
+    SETUP packet to a victim.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ekiga users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-voip/ekiga-2.0.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1006">CVE-2007-1006</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 05 Mar 2007 17:17:52 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 05 Mar 2007 18:05:22 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 29 Mar 2007 21:26:33 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-26.xml b/xml/htdocs/security/en/glsa/glsa-200703-26.xml
new file mode 100644
index 00000000..2a5dc2fe
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-26.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-26">
+  <title>file: Integer underflow</title>
+  <synopsis>
+    A buffer underflow vulnerability has been reported in file allowing for the
+    user-assisted execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">file</product>
+  <announced>March 30, 2007</announced>
+  <revised>March 30, 2007: 01</revised>
+  <bug>171452</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-apps/file" auto="yes" arch="*">
+      <unaffected range="ge">4.20</unaffected>
+      <vulnerable range="lt">4.20</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    file is a utility that guesses a file format by scanning binary data
+    for patterns.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jean-Sebastien Guay-Leroux reported an integer underflow in
+    file_printf function.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could entice a user to run the "file" program on a
+    specially crafted file that would trigger a heap-based buffer overflow
+    possibly leading to the execution of arbitrary code with the rights of
+    the user running "file". Note that this vulnerability could be also
+    triggered through an automatic file scanner like amavisd-new.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Since file is a system package, all Gentoo users should upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/file-4.20&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1536">CVE-2007-1536</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 24 Mar 2007 17:59:07 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 26 Mar 2007 20:27:32 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 29 Mar 2007 21:14:57 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-27.xml b/xml/htdocs/security/en/glsa/glsa-200703-27.xml
new file mode 100644
index 00000000..fbad2ac9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-27.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-27">
+  <title>Squid: Denial of Service</title>
+  <synopsis>
+    Squid is affected by a Denial of Service vulnerability.
+  </synopsis>
+  <product type="ebuild">squid</product>
+  <announced>March 31, 2007</announced>
+  <revised>March 31, 2007: 01</revised>
+  <bug>171681</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-proxy/squid" auto="yes" arch="*">
+      <unaffected range="ge">2.6.12</unaffected>
+      <vulnerable range="lt">2.6.12</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Squid is a multi-protocol proxy server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Squid incorrectly handles TRACE requests that contain a "Max-Forwards"
+    header field with value "0" in the clientProcessRequest() function.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker can send specially crafted TRACE HTTP requests that
+    will terminate the child process. A quickly repeated attack will lead
+    to a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Squid users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-proxy/squid-2.6.12&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1560">CVE-2007-1560</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 24 Mar 2007 22:35:04 +0000">
+    aetius
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 26 Mar 2007 20:36:04 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 29 Mar 2007 21:14:51 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200703-28.xml b/xml/htdocs/security/en/glsa/glsa-200703-28.xml
new file mode 100644
index 00000000..bf2e218e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200703-28.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200703-28">
+  <title>CUPS: Denial of Service</title>
+  <synopsis>
+    CUPS incorrectly handles partially-negotiated SSL connections allowing for
+    a Denial of Service.
+  </synopsis>
+  <product type="ebuild">cups</product>
+  <announced>March 31, 2007</announced>
+  <revised>March 31, 2007: 01</revised>
+  <bug>170881</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-print/cups" auto="yes" arch="*">
+      <unaffected range="ge">1.2.9</unaffected>
+      <vulnerable range="lt">1.2.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CUPS provides a portable printing layer for UNIX-based operating
+    systems.
+    </p>
+  </background>
+  <description>
+    <p>
+    CUPS does not properly handle partially-negotiated SSL connections.
+    Upon receiving a partially-negotiated SSL connection, CUPS no longer
+    accepts further incoming connections, as the initial connection never
+    times out.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could partially negotiate an SSL connection with a CUPS
+    server, and cause future connections to that server to fail, resulting
+    in a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CUPS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-print/cups-1.2.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0720">CVE-2007-0720</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 29 Mar 2007 14:48:39 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 29 Mar 2007 20:55:23 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 29 Mar 2007 20:58:50 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-01.xml b/xml/htdocs/security/en/glsa/glsa-200704-01.xml
new file mode 100644
index 00000000..b60b8b35
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-01.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-01">
+  <title>Asterisk: Two SIP Denial of Service vulnerabilities</title>
+  <synopsis>
+    Asterisk is vulnerable to two Denial of Service issues in the SIP channel.
+  </synopsis>
+  <product type="ebuild">asterisk</product>
+  <announced>April 02, 2007</announced>
+  <revised>April 02, 2007: 01</revised>
+  <bug>171467</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/asterisk" auto="yes" arch="*">
+      <unaffected range="ge">1.2.14-r2</unaffected>
+      <unaffected range="rge">1.0.12-r2</unaffected>
+      <vulnerable range="lt">1.2.14-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Asterisk is an open source implementation of a telephone private branch
+    exchange (PBX).
+    </p>
+  </background>
+  <description>
+    <p>
+    The Madynes research team at INRIA has discovered that Asterisk
+    contains a null pointer dereferencing error in the SIP channel when
+    handling INVITE messages. Furthermore qwerty1979 discovered that
+    Asterisk 1.2.x fails to properly handle SIP responses with return code
+    0.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could cause an Asterisk server listening for SIP
+    messages to crash by sending a specially crafted SIP message or
+    answering with a 0 return code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Asterisk users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose net-misc/asterisk</code>
+    <p>
+    Note: Asterisk 1.0.x is no longer supported upstream so users should
+    consider upgrading to Asterisk 1.2.x.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1561">CVE-2007-1561</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1594">CVE-2007-1594</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 20 Mar 2007 20:55:47 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 02 Apr 2007 16:33:39 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-02.xml b/xml/htdocs/security/en/glsa/glsa-200704-02.xml
new file mode 100644
index 00000000..8c897336
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-02.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-02">
+  <title>MIT Kerberos 5: Arbitrary remote code execution</title>
+  <synopsis>
+    Multiple vulnerabilities in MIT Kerberos 5 could potentially result in
+    unauthenticated remote root code execution.
+  </synopsis>
+  <product type="ebuild">mit-krb5</product>
+  <announced>April 03, 2007</announced>
+  <revised>April 03, 2007: 01</revised>
+  <bug>171889</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/mit-krb5" auto="yes" arch="*">
+      <unaffected range="ge">1.5.2-r1</unaffected>
+      <vulnerable range="lt">1.5.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MIT Kerberos 5 is a suite of applications that implement the Kerberos
+    network protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Kerberos telnet daemon fails to properly handle usernames allowing
+    unauthorized access to any account (CVE-2007-0956). The Kerberos
+    administration daemon, the KDC and possibly other applications using
+    the MIT Kerberos libraries are vulnerable to the following issues. The
+    krb5_klog_syslog function from the kadm5 library fails to properly
+    validate input leading to a stack overflow (CVE-2007-0957). The GSS-API
+    library is vulnerable to a double-free attack (CVE-2007-1216).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By exploiting the telnet vulnerability a remote attacker may obtain
+    access with root privileges. The remaining vulnerabilities may allow an
+    authenticated remote attacker to execute arbitrary code with root
+    privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MIT Kerberos 5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-crypt/mit-krb5-1.5.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0956">CVE-2007-0956</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0957">CVE-2007-0957</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1216">CVE-2007-1216</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 02 Apr 2007 16:29:27 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 03 Apr 2007 20:30:58 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-03.xml b/xml/htdocs/security/en/glsa/glsa-200704-03.xml
new file mode 100644
index 00000000..777d72df
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-03.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-03">
+  <title>OpenAFS: Privilege escalation</title>
+  <synopsis>
+    OpenAFS is subject to a design flaw that could allow privilege escalation
+    on the client.
+  </synopsis>
+  <product type="ebuild">openafs</product>
+  <announced>April 03, 2007</announced>
+  <revised>April 03, 2007: 01</revised>
+  <bug>171662</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-fs/openafs" auto="yes" arch="*">
+      <unaffected range="ge">1.4.4</unaffected>
+      <vulnerable range="lt">1.4.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenAFS is a distributed network filesystem.
+    </p>
+  </background>
+  <description>
+    <p>
+    Benjamin Bennett discovered that the OpenAFS client contains a design
+    flaw where cache managers do not use authenticated server connections
+    when performing actions not requested by a user.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    If setuid is enabled on the client cells, an attacker can supply a fake
+    FetchStatus reply that sets setuid and root ownership of a file being
+    executed. This could provide root access on the client. Remote attacks
+    may be possible if an attacker can entice a user to execute a known
+    file. Note that setuid is enabled by default in versions of OpenAFS
+    prior to 1.4.4.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable the setuid functionality on all client cells. This is now the
+    default configuration in OpenAFS.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenAFS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-fs/openafs-1.4.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1507">CVE-2007-1507</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 25 Mar 2007 06:35:01 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 28 Mar 2007 13:53:51 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 03 Apr 2007 22:29:30 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-04.xml b/xml/htdocs/security/en/glsa/glsa-200704-04.xml
new file mode 100644
index 00000000..34b8121a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-04.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-04">
+  <title>OpenPBS: Multiple vulnerabilities</title>
+  <synopsis>
+    OpenPBS contains unspecified vulnerabilities which may allow for the remote
+    execution of arbitrary code or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">openpbs</product>
+  <announced>April 03, 2007</announced>
+  <revised>April 03, 2007: 01</revised>
+  <bug>153495</bug>
+  <access>remote, local</access>
+  <affected>
+    <package name="sys-cluster/openpbs" auto="yes" arch="*">
+      <vulnerable range="le">2.3.16-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenPBS is the original version of the Portable Batch System. It is a
+    flexible batch queueing system developed for NASA in the early to
+    mid-1990s.
+    </p>
+  </background>
+  <description>
+    <p>
+    SUSE reported vulnerabilities due to unspecified errors in OpenPBS.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By unspecified attack vectors an attacker might be able execute
+    arbitrary code with the privileges of the user running openpbs, which
+    might be the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    OpenPBS has been masked in the Portage tree for replacement by Torque.
+    All OpenPBS users should unmerge OpenPBS and switch to Torque.
+    </p>
+    <code>
+    
+    # emerge --ask --unmerge sys-cluster/openpbs
+    # emerge --sync
+    # emerge --ask --verbose sys-cluster/torque</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5616">CVE-2006-5616</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 26 Mar 2007 23:17:18 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 27 Mar 2007 16:50:56 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 29 Mar 2007 21:14:48 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-05.xml b/xml/htdocs/security/en/glsa/glsa-200704-05.xml
new file mode 100644
index 00000000..13cca9e8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-05.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-05">
+  <title>zziplib: Buffer Overflow</title>
+  <synopsis>
+    The zziplib library contains a buffer overflow vulnerability that could
+    lead to user-assisted remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">zziplib</product>
+  <announced>April 03, 2007</announced>
+  <revised>April 03, 2007: 01</revised>
+  <bug>171441</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/zziplib" auto="yes" arch="*">
+      <unaffected range="ge">0.13.49</unaffected>
+      <vulnerable range="lt">0.13.49</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The zziplib library is a lightweight library for extracting data from
+    files archived in a single zip file.
+    </p>
+  </background>
+  <description>
+    <p>
+    dmcox dmcox discovered a boundary error in the zzip_open_shared_io()
+    function from zzip/file.c .
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to run a zziplib function with an
+    overly long string as an argument which would trigger the buffer
+    overflow and may lead to the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All zziplib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/zziplib-0.13.49&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1614">CVE-2007-1614</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 24 Mar 2007 20:39:36 +0000">
+    aetius
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 26 Mar 2007 21:59:00 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 29 Mar 2007 21:14:54 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-06.xml b/xml/htdocs/security/en/glsa/glsa-200704-06.xml
new file mode 100644
index 00000000..ca61e1ff
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-06.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-06">
+  <title>Evince: Stack overflow in included gv code</title>
+  <synopsis>
+    Evince improperly handles user-supplied data possibly allowing for the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">evince</product>
+  <announced>April 06, 2007</announced>
+  <revised>April 06, 2007: 01</revised>
+  <bug>156573</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/evince" auto="yes" arch="*">
+      <unaffected range="ge">0.6.1-r3</unaffected>
+      <vulnerable range="lt">0.6.1-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Evince is a document viewer for multiple document formats, including
+    PostScript.
+    </p>
+  </background>
+  <description>
+    <p>
+    Evince includes code from GNU gv that does not properly boundary check
+    user-supplied data before copying it into process buffers.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially crafted PostScript
+    document with Evince and possibly execute arbitrary code with the
+    rights of the user running Evince.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Evince users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/evince-0.6.1-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5864">CVE-2006-5864</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200611-20.xml">GLSA-200611-20</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 29 Mar 2007 16:08:33 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 02 Apr 2007 13:26:04 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 03 Apr 2007 22:29:26 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-07.xml b/xml/htdocs/security/en/glsa/glsa-200704-07.xml
new file mode 100644
index 00000000..5d799980
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-07.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-07">
+  <title>libwpd: Multiple vulnerabilities</title>
+  <synopsis>
+    libwpd is vulnerable to several heap overflows and an integer overflow.
+  </synopsis>
+  <product type="ebuild">libwpd</product>
+  <announced>April 06, 2007</announced>
+  <revised>April 06, 2007: 01</revised>
+  <bug>169675</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/libwpd" auto="yes" arch="*">
+      <unaffected range="ge">0.8.9</unaffected>
+      <vulnerable range="lt">0.8.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libwpd is a library used to convert Wordperfect documents into other
+    formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    libwpd contains heap-based overflows in two functions that convert
+    WordPerfect document tables. In addition, it contains an integer
+    overflow in a text-conversion function.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to convert a specially crafted
+    WordPerfect file, resulting in a crash or possibly the execution of
+    arbitrary code with the rights of the user running libwpd.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libwpd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/libwpd-0.8.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0002">CVE-2007-0002</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1466">CVE-2007-1466</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 02 Apr 2007 22:18:42 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 03 Apr 2007 12:29:29 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 03 Apr 2007 22:29:58 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-08.xml b/xml/htdocs/security/en/glsa/glsa-200704-08.xml
new file mode 100644
index 00000000..9a808784
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-08.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-08">
+  <title>DokuWiki: Cross-site scripting vulnerability</title>
+  <synopsis>
+    DokuWiki is vulnerable to a cross-site scripting attack.
+  </synopsis>
+  <product type="ebuild">dokuwiki</product>
+  <announced>April 12, 2007</announced>
+  <revised>April 12, 2007: 01</revised>
+  <bug>163781</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/dokuwiki" auto="yes" arch="*">
+      <unaffected range="ge">20061106</unaffected>
+      <vulnerable range="lt">20061106</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    DokuWiki is a simple to use wiki aimed at creating documentation.
+    </p>
+  </background>
+  <description>
+    <p>
+    DokuWiki does not sanitize user input to the GET variable 'media' in
+    the fetch.php file.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    An attacker could entice a user to click a specially crafted link and
+    inject CRLF characters into the variable. This would allow the creation
+    of new lines or fields in the returned HTTP Response header, which
+    would permit the attacker to execute arbitrary scripts in the context
+    of the user's browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Replace the following line in lib/exe/fetch.php:
+    </p>
+    <code>$MEDIA = getID('media',false); // no cleaning - maybe external</code>
+    <p>
+    with
+    </p>
+    <code>$MEDIA = preg_replace('/[\x00-\x1F]+/s','',getID('media',false));</code>
+  </workaround>
+  <resolution>
+    <p>
+    All DokuWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/dokuwiki-20061106&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6965">CVE-2006-6965</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 02 Apr 2007 22:16:33 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 03 Apr 2007 13:45:23 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 03 Apr 2007 22:29:45 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-09.xml b/xml/htdocs/security/en/glsa/glsa-200704-09.xml
new file mode 100644
index 00000000..55c923d8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-09.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-09">
+  <title>xine-lib: Heap-based buffer overflow</title>
+  <synopsis>
+    xine-lib is vulnerable to a heap-based buffer overflow.
+  </synopsis>
+  <product type="ebuild">xine-lib</product>
+  <announced>April 14, 2007</announced>
+  <revised>April 14, 2007: 01</revised>
+  <bug>170208</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/xine-lib" auto="yes" arch="x86">
+      <unaffected range="ge">1.1.4-r2</unaffected>
+      <vulnerable range="lt">1.1.4-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xine-lib is the core library package for the xine media player.
+    </p>
+  </background>
+  <description>
+    <p>
+    xine-lib does not check boundaries on data being read into buffers from
+    DMO video files in code that is shared with MPlayer
+    (DMO_VideoDecoder.c).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to play a specially crafted DMO video
+    file with a player using xine-lib, potentially resulting in the
+    execution of arbitrary code with the privileges of the user running the
+    player.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xine-lib users on the x86 platform should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/xine-lib-1.1.4-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1246">CVE-2007-1246</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 22 Mar 2007 17:27:51 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 02 Apr 2007 15:54:20 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 03 Apr 2007 22:28:59 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-10.xml b/xml/htdocs/security/en/glsa/glsa-200704-10.xml
new file mode 100644
index 00000000..efc692eb
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-10.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-10">
+  <title>Inkscape: Two format string vulnerabilities</title>
+  <synopsis>
+    Two format string vulnerabilities have been discovered in Inkscape,
+    allowing for user-assisted execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">Inkscape</product>
+  <announced>April 16, 2007</announced>
+  <revised>April 16, 2007: 01</revised>
+  <bug>171799</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/inkscape" auto="yes" arch="*">
+      <unaffected range="ge">0.45.1</unaffected>
+      <vulnerable range="lt">0.45.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Inkscape is a vector graphics editor, using Scalable Vector Graphics
+    (SVG) Format.
+    </p>
+  </background>
+  <description>
+    <p>
+    Kees Cook has discovered two vulnerabilities in Inkscape. The
+    application does not properly handle format string specifiers in some
+    dialog boxes. Inkscape is also vulnerable to another format string
+    error in its Jabber whiteboard protocol.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted URI,
+    possibly leading to execution of arbitrary code with the privileges of
+    the user running Inkscape.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Inkscape users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/inkscape-0.45.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1463">CVE-2007-1463</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1464">CVE-2007-1464</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 09 Apr 2007 20:15:01 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 11 Apr 2007 18:16:25 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-11.xml b/xml/htdocs/security/en/glsa/glsa-200704-11.xml
new file mode 100644
index 00000000..116e7a6a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-11.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-11">
+  <title>Vixie Cron: Denial of Service</title>
+  <synopsis>
+    The Gentoo implementation of Vixie Cron is vulnerable to a local Denial of
+    Service.
+  </synopsis>
+  <product type="ebuild">vixie-cron</product>
+  <announced>April 16, 2007</announced>
+  <revised>April 16, 2007: 01</revised>
+  <bug>164466</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-process/vixie-cron" auto="yes" arch="*">
+      <unaffected range="ge">4.1-r10</unaffected>
+      <vulnerable range="lt">4.1-r10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Vixie Cron is a command scheduler with extended syntax over cron.
+    </p>
+  </background>
+  <description>
+    <p>
+    During an internal audit, Raphael Marichez of the Gentoo Linux Security
+    Team found that Vixie Cron has weak permissions set on Gentoo, allowing
+    for a local user to create hard links to system and users cron files,
+    while a st_nlink check in database.c will generate a superfluous error.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    Depending on the partitioning scheme and the "cron" group membership, a
+    malicious local user can create hard links to system or users cron
+    files that will trigger the st_link safety check and prevent the
+    targeted cron file from being run from the next restart or database
+    reload.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Vixie Cron users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-process/vixie-cron-4.1-r10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1856">CVE-2007-1856</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 13 Apr 2007 15:58:28 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 13 Apr 2007 21:36:24 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 16 Apr 2007 18:10:18 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-12.xml b/xml/htdocs/security/en/glsa/glsa-200704-12.xml
new file mode 100644
index 00000000..4d6a5170
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-12.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-12">
+  <title>OpenOffice.org: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in OpenOffice.org, allowing
+    for remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">OpenOffice.org</product>
+  <announced>April 16, 2007</announced>
+  <revised>April 16, 2007: 01</revised>
+  <bug>170828</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/openoffice" auto="yes" arch="*">
+      <unaffected range="ge">2.1.0-r1</unaffected>
+      <vulnerable range="lt">2.1.0-r1</vulnerable>
+    </package>
+    <package name="app-office/openoffice-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.2.0</unaffected>
+      <vulnerable range="lt">2.2.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenOffice.org is an open source office productivity suite, including
+    word processing, spreadsheet, presentation, drawing, data charting,
+    formula editing, and file conversion facilities.
+    </p>
+  </background>
+  <description>
+    <p>
+    John Heasman of NGSSoftware has discovered a stack-based buffer
+    overflow in the StarCalc parser and an input validation error when
+    processing metacharacters in a link. Also OpenOffice.Org includes code
+    from libwpd making it vulnerable to heap-based overflows when
+    converting WordPerfect document tables (GLSA 200704-07).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    document, possibly leading to execution of arbitrary code with the
+    rights of the user running OpenOffice.org.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenOffice.org users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-2.1.0-r1&quot;</code>
+    <p>
+    All OpenOffice.org binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-bin-2.2.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0002">CVE-2007-0002</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0238">CVE-2007-0238</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0239">CVE-2007-0239</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200704-07.xml">GLSA-200704-07</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 11 Apr 2007 10:02:01 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 11 Apr 2007 18:10:31 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 11 Apr 2007 18:15:09 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-13.xml b/xml/htdocs/security/en/glsa/glsa-200704-13.xml
new file mode 100644
index 00000000..24762ce6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-13.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-13">
+  <title>File: Denial of Service</title>
+  <synopsis>
+    A vulnerability has been discovered in file allowing for a denial of
+    service.
+  </synopsis>
+  <product type="ebuild">file</product>
+  <announced>April 17, 2007</announced>
+  <revised>September 17, 2007: 02</revised>
+  <bug>174217</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-apps/file" auto="yes" arch="*">
+      <unaffected range="ge">4.21-r1</unaffected>
+      <vulnerable range="eq">4.21</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    file is a utility that identifies a file format by scanning binary data
+    for patterns.
+    </p>
+  </background>
+  <description>
+    <p>
+    Conor Edberg discovered an error in the way file processes a specific
+    regular expression.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted file,
+    using excessive CPU ressources and possibly leading to a Denial of
+    Service. Note that this vulnerability could be also triggered through
+    an automatic file scanner like amavisd-new.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All file users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/file-4.20-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2026">CVE-2007-2026</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 11 Apr 2007 22:06:47 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 12 Apr 2007 13:54:28 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 13 Apr 2007 12:18:04 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-14.xml b/xml/htdocs/security/en/glsa/glsa-200704-14.xml
new file mode 100644
index 00000000..fce94652
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-14.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-14">
+  <title>FreeRADIUS: Denial of Service</title>
+  <synopsis>
+    A memory leak has been discovered in FreeRADIUS, possibly allowing for a
+    Denial of Service.
+  </synopsis>
+  <product type="ebuild">FreeRADIUS</product>
+  <announced>April 17, 2007</announced>
+  <revised>April 17, 2007: 01</revised>
+  <bug>174292</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dialup/freeradius" auto="yes" arch="*">
+      <unaffected range="ge">1.1.6</unaffected>
+      <vulnerable range="lt">1.1.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    FreeRADIUS is an open source RADIUS authentication server
+    implementation.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Coverity Scan project has discovered a memory leak within the
+    handling of certain malformed Diameter format values inside an EAP-TTLS
+    tunnel.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send a large amount of specially crafted
+    packets to a FreeRADIUS server using EAP-TTLS authentication and
+    exhaust all memory, possibly resulting in a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All FreeRADIUS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dialup/freeradius-1.1.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2028">CVE-2007-2028</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 13 Apr 2007 07:08:42 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 13 Apr 2007 11:53:35 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 13 Apr 2007 12:22:49 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-15.xml b/xml/htdocs/security/en/glsa/glsa-200704-15.xml
new file mode 100644
index 00000000..e1708ab9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-15.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-15">
+  <title>MadWifi: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in the MadWifi driver,
+    possibly leading to a Denial of Service and information disclosure.
+  </synopsis>
+  <product type="ebuild">Madwifi-ng</product>
+  <announced>April 17, 2007</announced>
+  <revised>April 21, 2007: 02</revised>
+  <bug>173434</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-wireless/madwifi-ng" auto="yes" arch="*">
+      <unaffected range="ge">0.9.3</unaffected>
+      <vulnerable range="lt">0.9.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The MadWifi driver provides support for Atheros based IEEE 802.11
+    Wireless Lan cards.
+    </p>
+  </background>
+  <description>
+    <p>
+    The driver does not properly process Channel Switch Announcement
+    Information Elements, allowing for an abnormal channel change. The
+    ieee80211_input() function does not properly handle AUTH frames and the
+    driver sends unencrypted packets before WPA authentication succeeds.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted AUTH frames to the
+    vulnerable host, resulting in a Denial of Service by crashing the
+    kernel. A remote attacker could gain access to sensitive information
+    about network architecture by sniffing unencrypted packets. A remote
+    attacker could also send a Channel Switch Count less than or equal to
+    one to trigger a channel change, resulting in a communication loss and
+    a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MadWifi users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-wireless/madwifi-ng-0.9.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7178">CVE-2006-7178</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7179">CVE-2006-7179</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7180">CVE-2006-7180</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 11 Apr 2007 12:32:14 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 11 Apr 2007 18:16:05 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-16.xml b/xml/htdocs/security/en/glsa/glsa-200704-16.xml
new file mode 100644
index 00000000..54ccf318
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-16.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-16">
+  <title>Aircrack-ng: Remote execution of arbitrary code</title>
+  <synopsis>
+    Aircrack-ng contains a buffer overflow that could lead to the remote
+    execution of arbitrary code with root privileges.
+  </synopsis>
+  <product type="ebuild">aircrack-ng</product>
+  <announced>April 22, 2007</announced>
+  <revised>April 22, 2007: 01</revised>
+  <bug>174340</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-wireless/aircrack-ng" auto="yes" arch="*">
+      <unaffected range="ge">0.7-r2</unaffected>
+      <vulnerable range="lt">0.7-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Aircrack-ng is an 802.11 WEP and WPA-PSK keys cracking program that can
+    recover keys once enough data packets have been captured.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jonathan So reported that the airodump-ng module does not correctly
+    check the size of 802.11 authentication packets before copying them
+    into a buffer.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could trigger a stack-based buffer overflow by
+    sending a specially crafted 802.11 authentication packet to a user
+    running airodump-ng with the -w (--write) option. This could lead to
+    the remote execution of arbitrary code with the permissions of the user
+    running airodump-ng, which is typically the root user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Aircrack-ng users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-wireless/aircrack-ng-0.7-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2057">CVE-2007-2057</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 13 Apr 2007 21:21:54 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 13 Apr 2007 21:24:05 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 14 Apr 2007 22:00:25 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-17.xml b/xml/htdocs/security/en/glsa/glsa-200704-17.xml
new file mode 100644
index 00000000..dd3b28aa
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-17.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-17">
+  <title>3proxy: Buffer overflow</title>
+  <synopsis>
+    A vulnerability has been discovered in 3proxy allowing for the remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">3proxy</product>
+  <announced>April 22, 2007</announced>
+  <revised>April 22, 2007: 01</revised>
+  <bug>174429</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-proxy/3proxy" auto="yes" arch="*">
+      <unaffected range="ge">0.5.3h</unaffected>
+      <vulnerable range="lt">0.5.3h</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    3proxy is a multi-protocol proxy, including HTTP/HTTPS/FTP and SOCKS
+    support.
+    </p>
+  </background>
+  <description>
+    <p>
+    The 3proxy development team reported a buffer overflow in the logurl()
+    function when processing overly long requests.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send a specially crafted transparent request to
+    the proxy, resulting in the execution of arbitrary code with privileges
+    of the user running 3proxy.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All 3proxy users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-proxy/3proxy-0.5.3h&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2031">CVE-2007-2031</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 18 Apr 2007 05:09:29 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 18 Apr 2007 08:45:40 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 18 Apr 2007 20:45:40 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-18.xml b/xml/htdocs/security/en/glsa/glsa-200704-18.xml
new file mode 100644
index 00000000..b58cbfa6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-18.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-18">
+  <title>Courier-IMAP: Remote execution of arbitrary code</title>
+  <synopsis>
+    A vulnerability has been discovered in Courier-IMAP allowing for remote
+    code execution with root privileges.
+  </synopsis>
+  <product type="ebuild">courier-imap</product>
+  <announced>April 22, 2007</announced>
+  <revised>April 23, 2007: 02</revised>
+  <bug>168196</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/courier-imap" auto="yes" arch="*">
+      <unaffected range="ge">4.0.6-r2</unaffected>
+      <unaffected range="lt">4.0.0</unaffected>
+      <vulnerable range="lt">4.0.6-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Courier-IMAP is an IMAP server which is part of the Courier mail
+    system. It provides access only to maildirs.
+    </p>
+  </background>
+  <description>
+    <p>
+    CJ Kucera has discovered that some Courier-IMAP scripts don't properly
+    handle the XMAILDIR variable, allowing for shell command injection.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send specially crafted login credentials to a
+    Courier-IMAP server instance, possibly leading to remote code execution
+    with root privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Courier-IMAP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/courier-imap-4.0.6-r2&quot;</code>
+  </resolution>
+  <references/>
+  <metadata tag="requester" timestamp="Thu, 12 Apr 2007 14:15:03 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 12 Apr 2007 14:15:17 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 16 Apr 2007 21:50:11 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-19.xml b/xml/htdocs/security/en/glsa/glsa-200704-19.xml
new file mode 100644
index 00000000..2cd47532
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-19.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-19">
+  <title>Blender: User-assisted remote execution of arbitrary code</title>
+  <synopsis>
+    A vulnerability has been discovered in Blender allowing for user-assisted
+    arbitrary code execution.
+  </synopsis>
+  <product type="ebuild">Blender</product>
+  <announced>April 23, 2007</announced>
+  <revised>April 23, 2007: 01</revised>
+  <bug>168907</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/blender" auto="yes" arch="*">
+      <unaffected range="ge">2.43</unaffected>
+      <vulnerable range="lt">2.43</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Blender is a 3D creation, animation and publishing program.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Cornelius of Secunia Research discovered an insecure use of the
+    "eval()" function in kmz_ImportWithMesh.py.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    Blender file (.kmz or .kml), resulting in the execution of arbitrary
+    Python code with the privileges of the user running Blender.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Blender users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/blender-2.43&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1253">CVE-2007-1253</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 17 Apr 2007 18:07:32 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 18 Apr 2007 09:36:27 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 18 Apr 2007 20:46:11 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-20.xml b/xml/htdocs/security/en/glsa/glsa-200704-20.xml
new file mode 100644
index 00000000..87472532
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-20.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-20">
+  <title>NAS: Multiple vulnerabilities</title>
+  <synopsis>
+    The Network Audio System is vulnerable to a buffer overflow that could
+    result in the execution of arbitrary code with root privileges.
+  </synopsis>
+  <product type="ebuild">NAS</product>
+  <announced>April 23, 2007</announced>
+  <revised>April 23, 2007: 01</revised>
+  <bug>171428</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/nas" auto="yes" arch="*">
+      <unaffected range="ge">1.8b</unaffected>
+      <vulnerable range="lt">1.8b</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    NAS is a network transparent, client/server audio transport system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Luigi Auriemma has discovered multiple vulnerabilities in NAS, some of
+    which include a buffer overflow in the function accept_att_local(), an
+    integer overflow in the function ProcAuWriteElement(), and a null
+    pointer error in the function ReadRequestFromClient().
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker having access to the NAS daemon could send an overly long
+    slave name to the server, leading to the execution of arbitrary code
+    with root privileges. A remote attacker could also send a specially
+    crafted packet containing an invalid client ID, which would crash the
+    server and result in a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All NAS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/nas-1.8b&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1543">CVE-2007-1543</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1544">CVE-2007-1544</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1545">CVE-2007-1545</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1546">CVE-2007-1546</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1547">CVE-2007-1547</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 02 Apr 2007 13:48:29 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 02 Apr 2007 15:19:59 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 12 Apr 2007 14:16:06 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-21.xml b/xml/htdocs/security/en/glsa/glsa-200704-21.xml
new file mode 100644
index 00000000..accb406a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-21.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-21">
+  <title>ClamAV: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in ClamAV allowing for the
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">ClamAV</product>
+  <announced>April 24, 2007</announced>
+  <revised>April 24, 2007: 01</revised>
+  <bug>174375</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.90.2</unaffected>
+      <vulnerable range="lt">0.90.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ClamAV is a GPL virus scanner.
+    </p>
+  </background>
+  <description>
+    <p>
+    iDefense Labs have reported a stack-based buffer overflow in the
+    cab_unstore() function when processing negative values in .cab files.
+    Multiple file descriptor leaks have also been reported in chmunpack.c,
+    pdf.c and dblock.c when processing .chm files.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send a specially crafted CHM file to the
+    scanner, possibly resulting in the remote execution of arbitrary code
+    with the privileges of the user running ClamAV.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.90.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1745">CVE-2007-1745</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1997">CVE-2007-1997</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 14 Apr 2007 22:33:19 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 19 Apr 2007 10:34:20 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 22 Apr 2007 20:58:42 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-22.xml b/xml/htdocs/security/en/glsa/glsa-200704-22.xml
new file mode 100644
index 00000000..b751315d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-22.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-22">
+  <title>BEAST: Denial of Service</title>
+  <synopsis>
+    A vulnerability has been discovered in BEAST allowing for a Denial of
+    Service.
+  </synopsis>
+  <product type="ebuild">BEAST</product>
+  <announced>April 27, 2007</announced>
+  <revised>April 27, 2007: 01</revised>
+  <bug>163146</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-sound/beast" auto="yes" arch="*">
+      <unaffected range="ge">0.7.1</unaffected>
+      <vulnerable range="lt">0.7.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    BEdevilled Audio SysTem is an audio compositor, supporting a wide range
+    of audio formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    BEAST, which is installed as setuid root, fails to properly check
+    whether it can drop privileges accordingly if seteuid() fails due to a
+    user exceeding assigned resource limits.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A local user could exceed his resource limit in order to prevent the
+    seteuid() call from succeeding. This may lead BEAST to keep running
+    with root privileges. Then, the local user could use the "save as"
+    dialog box to overwrite any file on the vulnerable system, potentially
+    leading to a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All BEAST users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/beast-0.7.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2916">CVE-2006-2916</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4447">CVE-2006-4447</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 04 Apr 2007 08:02:22 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 04 Apr 2007 18:26:01 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 06 Apr 2007 18:26:41 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200704-23.xml b/xml/htdocs/security/en/glsa/glsa-200704-23.xml
new file mode 100644
index 00000000..677ae69d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200704-23.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200704-23">
+  <title>capi4k-utils: Buffer overflow</title>
+  <synopsis>
+    capi4k-utils is vulnerable to a buffer overflow in the bufprint() function.
+  </synopsis>
+  <product type="ebuild">capi4k-utils</product>
+  <announced>April 27, 2007</announced>
+  <revised>April 27, 2007: 01</revised>
+  <bug>170870</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-dialup/capi4k-utils" auto="yes" arch="*">
+      <unaffected range="ge">20050718-r3</unaffected>
+      <vulnerable range="lt">20050718-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    capi4k-utils is a set of utilities for accessing COMMON-ISDN-API
+    software interfaces for ISDN devices.
+    </p>
+  </background>
+  <description>
+    <p>
+    The bufprint() function in capi4k-utils fails to properly check
+    boundaries of data coming from CAPI packets.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could possibly escalate privileges or cause a Denial
+    of Service by sending a crafted CAPI packet.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All capi4k-utils users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dialup/capi4k-utils-20050718-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2007-1217">CVE-2007-1217</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 24 Mar 2007 12:42:52 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 02 Apr 2007 14:51:21 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 03 Apr 2007 22:29:34 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-01.xml b/xml/htdocs/security/en/glsa/glsa-200705-01.xml
new file mode 100644
index 00000000..eb0a68fc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-01.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-01">
+  <title>Ktorrent: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Ktorrent allowing for the
+    remote execution of arbitrary code and a Denial of Service.
+  </synopsis>
+  <product type="ebuild">ktorrent</product>
+  <announced>May 01, 2007</announced>
+  <revised>May 01, 2007: 01</revised>
+  <bug>170303</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-p2p/ktorrent" auto="yes" arch="*">
+      <unaffected range="ge">2.1.3</unaffected>
+      <vulnerable range="lt">2.1.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ktorrent is a Bittorrent client for KDE.
+    </p>
+  </background>
+  <description>
+    <p>
+    Bryan Burns of Juniper Networks discovered a vulnerability in
+    chunkcounter.cpp when processing large or negative idx values, and a
+    directory traversal vulnerability in torrent.cpp.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to download a specially crafted
+    torrent file, possibly resulting in the remote execution of arbitrary
+    code with the privileges of the user running Ktorrent.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ktorrent users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-p2p/ktorrent-2.1.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1384">CVE-2007-1384</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1385">CVE-2007-1385</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1799">CVE-2007-1799</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 24 Apr 2007 19:42:10 +0000">
+    aetius
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 26 Apr 2007 07:58:35 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 26 Apr 2007 07:59:01 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-02.xml b/xml/htdocs/security/en/glsa/glsa-200705-02.xml
new file mode 100644
index 00000000..2b5c77d2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-02.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-02">
+  <title>FreeType: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A vulnerability has been discovered in FreeType allowing for user-assisted
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">freetype</product>
+  <announced>May 01, 2007</announced>
+  <revised>May 27, 2007: 02</revised>
+  <bug>172577</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/freetype" auto="yes" arch="*">
+      <unaffected range="ge">2.1.10-r3</unaffected>
+      <unaffected range="lt">2.0</unaffected>
+      <vulnerable range="lt">2.1.10-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    FreeType is a True Type Font rendering library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Greg MacManus of iDefense Labs has discovered an integer overflow in
+    the function bdfReadCharacters() when parsing BDF fonts.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to use a specially crafted BDF
+    font, possibly resulting in a heap-based buffer overflow and the remote
+    execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All FreeType users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/freetype-2.1.10-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1351">CVE-2007-1351</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 12 Apr 2007 09:19:23 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 12 Apr 2007 09:19:45 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 26 Apr 2007 08:55:44 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-03.xml b/xml/htdocs/security/en/glsa/glsa-200705-03.xml
new file mode 100644
index 00000000..e8bddb67
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-03.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-03">
+  <title>Tomcat: Information disclosure</title>
+  <synopsis>
+    A vulnerability has been discovered in Tomcat that allows for the
+    disclosure of sensitive information.
+  </synopsis>
+  <product type="ebuild">tomcat</product>
+  <announced>May 01, 2007</announced>
+  <revised>May 01, 2007: 01</revised>
+  <bug>173122</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/tomcat" auto="yes" arch="*">
+      <unaffected range="ge">5.5.22</unaffected>
+      <vulnerable range="lt">5.5.22</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Tomcat is the Apache Jakarta Project's official implementation of Java
+    Servlets and Java Server Pages.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tomcat allows special characters like slash, backslash or URL-encoded
+    backslash as a separator, while Apache does not.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker could send a specially crafted URL to the vulnerable
+    Tomcat server, possibly resulting in a directory traversal and read
+    access to arbitrary files with the privileges of the user running
+    Tomcat. Note that this vulnerability can only be exploited when using
+    apache proxy modules like mod_proxy, mod_rewrite or mod_jk.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Tomcat users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/tomcat-5.5.22&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0450">CVE-2007-0450</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 24 Apr 2007 19:49:54 +0000">
+    aetius
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 25 Apr 2007 20:54:19 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 25 Apr 2007 20:54:45 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-04.xml b/xml/htdocs/security/en/glsa/glsa-200705-04.xml
new file mode 100644
index 00000000..d213fd3e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-04.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-04">
+  <title>Apache mod_perl: Denial of Service</title>
+  <synopsis>
+    The mod_perl Apache module is vulnerable to a Denial of Service when
+    processing regular expressions.
+  </synopsis>
+  <product type="ebuild">mod_perl</product>
+  <announced>May 02, 2007</announced>
+  <revised>May 02, 2007: 02</revised>
+  <bug>172676</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apache/mod_perl" auto="yes" arch="*">
+      <unaffected range="ge">2.0.3-r1</unaffected>
+      <unaffected range="rge">1.30</unaffected>
+      <vulnerable range="lt">2.0.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mod_perl is an Apache module that embeds the Perl interpreter within
+    the server, allowing Perl-based web-applications to be created.
+    </p>
+  </background>
+  <description>
+    <p>
+    Alex Solvey discovered that the "path_info" variable used in file
+    RegistryCooker.pm (mod_perl 2.x) or file PerlRun.pm (mod_perl 1.x), is
+    not properly escaped before being processed.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send a specially crafted URL to the vulnerable
+    server, possibly resulting in a massive resource consumption.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mod_perl 1.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apache/mod_perl-1.30&quot;</code>
+    <p>
+    All mod_perl 2.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apache/mod_perl-2.0.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1349">CVE-2007-1349</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 23 Apr 2007 19:53:36 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 24 Apr 2007 15:28:21 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 25 Apr 2007 21:05:17 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-05.xml b/xml/htdocs/security/en/glsa/glsa-200705-05.xml
new file mode 100644
index 00000000..62c68543
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-05.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-05">
+  <title>Quagga: Denial of Service</title>
+  <synopsis>
+    A vulnerability has been discovered in Quagga allowing for a Denial of
+    Service.
+  </synopsis>
+  <product type="ebuild">quagga</product>
+  <announced>May 02, 2007</announced>
+  <revised>May 02, 2007: 01</revised>
+  <bug>174206</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/quagga" auto="yes" arch="*">
+      <unaffected range="ge">0.98.6-r2</unaffected>
+      <vulnerable range="lt">0.98.6-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Quagga is a free routing daemon, supporting RIP, OSPF and BGP
+    protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Quagga development team reported a vulnerability in the BGP routing
+    deamon when processing NLRI attributes inside UPDATE messages.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious peer inside a BGP area could send a specially crafted
+    packet to a Quagga instance, possibly resulting in a crash of the
+    Quagga daemon.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Quagga users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/quagga-0.98.6-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1995">CVE-2007-1995</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 23 Apr 2007 20:01:28 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 25 Apr 2007 21:27:10 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 30 Apr 2007 08:45:01 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-06.xml b/xml/htdocs/security/en/glsa/glsa-200705-06.xml
new file mode 100644
index 00000000..8929a242
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-06.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-06">
+  <title>X.Org X11 library: Multiple integer overflows</title>
+  <synopsis>
+    The X.Org X11 library contains multiple integer overflows, which could lead
+    to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">libx11</product>
+  <announced>May 05, 2007</announced>
+  <revised>May 05, 2007: 01</revised>
+  <bug>172752</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-libs/libX11" auto="yes" arch="*">
+      <unaffected range="ge">1.0.3-r2</unaffected>
+      <vulnerable range="lt">1.0.3-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    X.Org is an implementation of the X Window System. The X.Org X11
+    library provides the X11 protocol library files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple integer overflows have been reported in the XGetPixel()
+    function of the X.Org X11 library.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    By enticing a user to open a specially crafted image, an attacker could
+    cause a Denial of Service or an integer overflow, potentially resulting
+    in the execution of arbitrary code with root privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All X.Org X11 library users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/libX11-1.0.3-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1667">CVE-2007-1667</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 18 Apr 2007 14:52:56 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 20 Apr 2007 16:53:31 +0000">
+    dizzutch
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 23 Apr 2007 12:10:37 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-07.xml b/xml/htdocs/security/en/glsa/glsa-200705-07.xml
new file mode 100644
index 00000000..b18fb45b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-07.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-07">
+  <title>Lighttpd: Two Denials of Service</title>
+  <synopsis>
+    Two vulnerabilities have been discovered in Lighttpd, each allowing for a
+    Denial of Service.
+  </synopsis>
+  <product type="ebuild">lighttpd</product>
+  <announced>May 07, 2007</announced>
+  <revised>May 07, 2007: 01</revised>
+  <bug>174043</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/lighttpd" auto="yes" arch="*">
+      <unaffected range="ge">1.4.14</unaffected>
+      <vulnerable range="lt">1.4.14</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Lighttpd is a lightweight HTTP web server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Robert Jakabosky discovered an infinite loop triggered by a connection
+    abort when Lighttpd processes carriage return and line feed sequences.
+    Marcus Rueckert discovered a NULL pointer dereference when a server
+    running Lighttpd tries to access a file with a mtime of 0.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could upload a specially crafted file to the server
+    or send a specially crafted request and then abort the connection,
+    possibly resulting in a crash or a Denial of Service by CPU
+    consumption.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Lighttpd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/lighttpd-1.4.14&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1869">CVE-2007-1869</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1870">CVE-2007-1870</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 30 Apr 2007 09:09:47 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 01 May 2007 19:04:44 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 06 May 2007 21:36:16 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-08.xml b/xml/htdocs/security/en/glsa/glsa-200705-08.xml
new file mode 100644
index 00000000..76bc55ab
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-08.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-08">
+  <title>GIMP: Buffer overflow</title>
+  <synopsis>
+    GIMP is vulnerable to a buffer overflow which may lead to the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">gimp</product>
+  <announced>May 07, 2007</announced>
+  <revised>May 07, 2007: 01</revised>
+  <bug>176226</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/gimp" auto="yes" arch="*">
+      <unaffected range="ge">2.2.14</unaffected>
+      <vulnerable range="lt">2.2.14</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GIMP is the GNU Image Manipulation Program.
+    </p>
+  </background>
+  <description>
+    <p>
+    Marsu discovered that the "set_color_table()" function in the SUNRAS
+    plugin is vulnerable to a stack-based buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open a specially crafted .RAS file,
+    possibly leading to the execution of arbitrary code with the privileges
+    of the user running GIMP.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GIMP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/gimp-2.2.14&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2356">CVE-2007-2356</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 06 May 2007 21:00:37 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 06 May 2007 21:03:26 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-09.xml b/xml/htdocs/security/en/glsa/glsa-200705-09.xml
new file mode 100644
index 00000000..c803ff73
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-09.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-09">
+  <title>IPsec-Tools: Denial of Service</title>
+  <synopsis>
+    IPsec-Tools contains a vulnerability that allows a remote attacker to crash
+    the IPsec tunnel.
+  </synopsis>
+  <product type="ebuild">ipsec-tools</product>
+  <announced>May 08, 2007</announced>
+  <revised>May 08, 2007: 01</revised>
+  <bug>173219</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-firewall/ipsec-tools" auto="yes" arch="*">
+      <unaffected range="ge">0.6.7</unaffected>
+      <vulnerable range="lt">0.6.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    IPsec-Tools is a port of KAME's implementation of the IPsec utilities.
+    It contains a collection of network monitoring tools, including racoon,
+    ping, and ping6.
+    </p>
+  </background>
+  <description>
+    <p>
+    The isakmp_info_recv() function in src/racoon/isakmp_inf.c does not
+    always check that DELETE (ISAKMP_NPTYPE_D) and NOTIFY (ISAKMP_NPTYPE_N)
+    packets are encrypted.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send a specially crafted IPsec message to one
+    of the two peers during the beginning of phase 1, resulting in the
+    termination of the IPsec exchange.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All IPsec-Tools users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-firewall/ipsec-tools-0.6.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1841">CVE-2007-1841</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 03 May 2007 18:53:19 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 06 May 2007 12:07:13 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 07 May 2007 19:54:14 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-10.xml b/xml/htdocs/security/en/glsa/glsa-200705-10.xml
new file mode 100644
index 00000000..6094732d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-10.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-10">
+  <title>LibXfont, TightVNC: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been reported in libXfont and TightVNC,
+    allowing for the execution of arbitrary code with root privileges.
+  </synopsis>
+  <product type="ebuild">tightvnc, libxfont</product>
+  <announced>May 08, 2007</announced>
+  <revised>May 08, 2007: 01</revised>
+  <bug>172575</bug>
+  <bug>174200</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-misc/tightvnc" auto="yes" arch="*">
+      <unaffected range="ge">1.2.9-r4</unaffected>
+      <vulnerable range="lt">1.2.9-r4</vulnerable>
+    </package>
+    <package name="x11-libs/libXfont" auto="yes" arch="*">
+      <unaffected range="ge">1.2.7-r1</unaffected>
+      <vulnerable range="lt">1.2.7-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    LibXfont is the X.Org font library. TightVNC is a VNC client/server for
+    X displays.
+    </p>
+  </background>
+  <description>
+    <p>
+    The libXfont code is prone to several integer overflows, in functions
+    ProcXCMiscGetXIDList(), bdfReadCharacters() and FontFileInitTable().
+    TightVNC contains a local copy of this code and is also affected.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could use a specially crafted BDF Font to gain root
+    privileges on the vulnerable host.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libXfont users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/libXfont-1.2.7-r1&quot;</code>
+    <p>
+    All TightVNC users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/tightvnc-1.2.9-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1003">CVE-2007-1003</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1351">CVE-2007-1351</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1352">CVE-2007-1352</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 17 Apr 2007 09:12:59 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 23 Apr 2007 12:11:04 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 26 Apr 2007 19:02:32 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-11.xml b/xml/htdocs/security/en/glsa/glsa-200705-11.xml
new file mode 100644
index 00000000..9d2e8e04
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-11.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-11">
+  <title>MySQL: Two Denial of Service vulnerabilities</title>
+  <synopsis>
+    Two Denial of Service vulnerabilities have been discovered in MySQL.
+  </synopsis>
+  <product type="ebuild">MySQL</product>
+  <announced>May 08, 2007</announced>
+  <revised>May 08, 2007: 01</revised>
+  <bug>170126</bug>
+  <bug>171934</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/mysql" auto="yes" arch="*">
+      <unaffected range="ge">5.0.38</unaffected>
+      <unaffected range="lt">5.0</unaffected>
+      <vulnerable range="lt">5.0.38</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MySQL is a popular multi-threaded, multi-user SQL server.
+    </p>
+  </background>
+  <description>
+    <p>
+    mu-b discovered a NULL pointer dereference in item_cmpfunc.cc when
+    processing certain types of SQL requests. Sec Consult also discovered
+    another NULL pointer dereference when sorting certain types of queries
+    on the database metadata.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    In both cases, a remote attacker could send a specially crafted SQL
+    request to the server, possibly resulting in a server crash. Note that
+    the attacker needs the ability to execute SELECT queries.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MySQL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/mysql-5.0.38&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://bugs.mysql.com/bug.php?id=27513">Original Report</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1420">CVE-2007-1420</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 24 Apr 2007 19:47:08 +0000">
+    aetius
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 25 Apr 2007 21:17:16 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 25 Apr 2007 21:17:35 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-12.xml b/xml/htdocs/security/en/glsa/glsa-200705-12.xml
new file mode 100644
index 00000000..eb93181b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-12.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-12">
+  <title>PostgreSQL: Privilege escalation</title>
+  <synopsis>
+    PostgreSQL contains a vulnerability that could result in SQL privilege
+    escalation.
+  </synopsis>
+  <product type="ebuild">postgresql</product>
+  <announced>May 10, 2007</announced>
+  <revised>May 28, 2009: 02</revised>
+  <bug>175791</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/postgresql" auto="yes" arch="*">
+      <unaffected range="ge">8.0.13</unaffected>
+      <unaffected range="rge">7.4.17</unaffected>
+      <unaffected range="rge">7.3.19</unaffected>
+      <unaffected range="rge">7.3.21</unaffected>
+      <unaffected range="rge">7.4.19</unaffected>
+      <vulnerable range="lt">8.0.13</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PostgreSQL is an open source object-relational database management
+    system.
+    </p>
+  </background>
+  <description>
+    <p>
+    An error involving insecure search_path settings in the SECURITY
+    DEFINER functions has been reported in PostgreSQL.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    If allowed to call a SECURITY DEFINER function, an attacker could gain
+    the SQL privileges of the owner of the called function.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PostgreSQL users should upgrade to the latest version and fix their
+    SECURITY DEFINER functions:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;dev-db/postgresql&quot;</code>
+    <p>
+    In order to fix the SECURITY DEFINER functions, PostgreSQL users are
+    advised to refer to the PostgreSQL documentation: <uri
+    link="http://www.postgresql.org/docs/techdocs.77">http://www.postgresql
+    .org/docs/techdocs.77</uri>
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2138">CVE-2007-2138</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 03 May 2007 18:37:29 +0000">
+    aetius
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 06 May 2007 22:14:19 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 08 May 2007 06:08:11 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-13.xml b/xml/htdocs/security/en/glsa/glsa-200705-13.xml
new file mode 100644
index 00000000..9d0cbff7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-13.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-13">
+  <title>ImageMagick: Multiple buffer overflows</title>
+  <synopsis>
+    Multiple integer overflows have been discovered in ImageMagick allowing for
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">imagemagick</product>
+  <announced>May 10, 2007</announced>
+  <revised>June 07, 2007: 02</revised>
+  <bug>152672</bug>
+  <bug>159567</bug>
+  <bug>173186</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/imagemagick" auto="yes" arch="*">
+      <unaffected range="ge">6.3.3</unaffected>
+      <vulnerable range="lt">6.3.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ImageMagick is a collection of tools allowing various manipulations on
+    image files.
+    </p>
+  </background>
+  <description>
+    <p>
+    iDefense Labs has discovered multiple integer overflows in ImageMagick
+    in the functions ReadDCMImage() and ReadXWDImage(), that are used to
+    process DCM and XWD files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open specially crafted XWD or DCM
+    file, resulting in heap-based buffer overflows and possibly the
+    execution of arbitrary code with the privileges of the user running
+    ImageMagick. Note that this user may be httpd or any other account used
+    by applications relying on the ImageMagick tools to automatically
+    process images.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ImageMagick users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/imagemagick-6.3.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1797">CVE-2007-1797</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 30 Apr 2007 13:08:15 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 01 May 2007 19:04:55 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 06 May 2007 21:19:41 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-14.xml b/xml/htdocs/security/en/glsa/glsa-200705-14.xml
new file mode 100644
index 00000000..dcc64d2e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-14.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-14">
+  <title>XScreenSaver: Privilege escalation</title>
+  <synopsis>
+    XScreenSaver allows local users to bypass authentication under certain
+    configurations.
+  </synopsis>
+  <product type="ebuild">xscreensaver</product>
+  <announced>May 13, 2007</announced>
+  <revised>May 13, 2007: 01</revised>
+  <bug>176584</bug>
+  <access>local</access>
+  <affected>
+    <package name="x11-misc/xscreensaver" auto="yes" arch="*">
+      <unaffected range="ge">5.02</unaffected>
+      <vulnerable range="lt">5.02</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    XScreenSaver is a widely used screen saver collection shipped on
+    systems running the X11 Window System.
+    </p>
+  </background>
+  <description>
+    <p>
+    XScreenSaver incorrectly handles the results of the getpwuid() function
+    in drivers/lock.c when using directory servers during a network outage.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local user can crash XScreenSaver by preventing network connectivity
+    if the system uses a remote directory service for credentials such as
+    NIS or LDAP, which will unlock the screen.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All XScreenSaver users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-misc/xscreensaver-5.02&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1859">CVE-2007-1859</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 08 May 2007 10:52:36 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 08 May 2007 15:43:15 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 13 May 2007 21:32:41 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-15.xml b/xml/htdocs/security/en/glsa/glsa-200705-15.xml
new file mode 100644
index 00000000..a2b2e7a1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-15.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-15">
+  <title>Samba: Multiple vulnerabilities</title>
+  <synopsis>
+    Samba contains multiple vulnerabilities potentially resulting in the
+    execution of arbitrary code with root privileges.
+  </synopsis>
+  <product type="ebuild">samba</product>
+  <announced>May 15, 2007</announced>
+  <revised>May 15, 2007: 01</revised>
+  <bug>177029</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-fs/samba" auto="yes" arch="*">
+      <unaffected range="ge">3.0.24-r2</unaffected>
+      <vulnerable range="lt">3.0.24-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Samba is a suite of SMB and CIFS client/server programs for UNIX.
+    </p>
+  </background>
+  <description>
+    <p>
+    Samba contains a logical error in the smbd daemon when translating
+    local SID to user names (CVE-2007-2444). Furthermore, Samba contains
+    several bugs when parsing NDR encoded RPC parameters (CVE-2007-2446).
+    Lastly, Samba fails to properly sanitize remote procedure input
+    provided via Microsoft Remote Procedure Calls (CVE-2007-2447).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit these vulnerabilities to gain root
+    privileges via various vectors.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Samba users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-fs/samba-3.0.24-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2444">CVE-2007-2444</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2446">CVE-2007-2446</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2447">CVE-2007-2447</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 14 May 2007 17:44:45 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 15 May 2007 12:42:21 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-16.xml b/xml/htdocs/security/en/glsa/glsa-200705-16.xml
new file mode 100644
index 00000000..ef91d43d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-16.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-16">
+  <title>PhpWiki: Remote execution of arbitrary code</title>
+  <synopsis>
+    A vulnerability has been discovered in PhpWiki allowing for the remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">phpwiki</product>
+  <announced>May 17, 2007</announced>
+  <revised>May 17, 2007: 01</revised>
+  <bug>174451</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phpwiki" auto="yes" arch="*">
+      <unaffected range="ge">1.3.10-r3</unaffected>
+      <vulnerable range="lt">1.3.10-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PhpWiki is an open source content management system written in PHP.
+    </p>
+  </background>
+  <description>
+    <p>
+    Harold Hallikainen has reported that the Upload page fails to properly
+    check the extension of a file.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could upload a specially crafted PHP file to the
+    vulnerable server, resulting in the execution of arbitrary PHP code
+    with the privileges of the user running PhpWiki.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PhpWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/phpwiki-1.3.10-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2024">CVE-2007-2024</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2025">CVE-2007-2025</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 10 May 2007 13:26:06 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 11 May 2007 14:10:41 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 14 May 2007 18:47:51 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-17.xml b/xml/htdocs/security/en/glsa/glsa-200705-17.xml
new file mode 100644
index 00000000..de5b0ef9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-17.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-17">
+  <title>Apache mod_security: Rule bypass</title>
+  <synopsis>
+    A vulnerability has been discovered in mod_security, allowing a remote
+    attacker to bypass rules.
+  </synopsis>
+  <product type="ebuild">mod_security</product>
+  <announced>May 17, 2007</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>169778</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apache/mod_security" auto="yes" arch="*">
+      <unaffected range="ge">2.1.1</unaffected>
+      <vulnerable range="lt">2.1.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    mod_security is an Apache module designed for enhancing the security of
+    the Apache web server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Esser discovered that mod_security processes NULL characters as
+    terminators in POST requests using the
+    application/x-www-form-urlencoded encoding type, while other parsers
+    used in web applications do not.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker could send a specially crafted POST request, possibly
+    bypassing the module ruleset and leading to the execution of arbitrary
+    code in the scope of the web server with the rights of the user running
+    the web server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mod_security users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apache/mod_security-2.1.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1359">CVE-2007-1359</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 11 May 2007 23:14:33 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 13 May 2007 04:49:45 +0000">
+    shellsage
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 13 May 2007 13:46:57 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-18.xml b/xml/htdocs/security/en/glsa/glsa-200705-18.xml
new file mode 100644
index 00000000..88550686
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-18.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-18">
+  <title>PPTPD: Denial of Service attack</title>
+  <synopsis>
+    A vulnerability has been reported in PPTPD which could lead to a Denial of
+    Service.
+  </synopsis>
+  <product type="ebuild">pptpd</product>
+  <announced>May 20, 2007</announced>
+  <revised>May 20, 2007: 01</revised>
+  <bug>176936</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dialup/pptpd" auto="yes" arch="*">
+      <unaffected range="ge">1.3.4</unaffected>
+      <vulnerable range="lt">1.3.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PPTPD is a Point-to-Point Tunnelling Protocol Daemon for Linux.
+    </p>
+  </background>
+  <description>
+    <p>
+    James Cameron from HP has reported a vulnerability in PPTPD caused by
+    malformed GRE packets.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit this vulnerability to cause a Denial of
+    Service on the PPTPD connection.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PPTPD users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dialup/pptpd-1.3.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0244">CVE-2007-0244</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 11 May 2007 07:06:10 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 11 May 2007 07:14:40 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 14 May 2007 17:58:13 +0000">
+    dizzutch
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-19.xml b/xml/htdocs/security/en/glsa/glsa-200705-19.xml
new file mode 100644
index 00000000..0d1918eb
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-19.xml
@@ -0,0 +1,104 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-19">
+  <title>PHP: Multiple vulnerabilities</title>
+  <synopsis>
+    PHP contains several vulnerabilities including buffer and integer overflows
+    which could under certain conditions lead to the remote execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">php</product>
+  <announced>May 26, 2007</announced>
+  <revised>March 29, 2008: 02</revised>
+  <bug>169372</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/php" auto="yes" arch="*">
+      <unaffected range="rge">4.4.7</unaffected>
+      <unaffected range="rge">4.4.8_pre20070816</unaffected>
+      <unaffected range="ge">5.2.2</unaffected>
+      <vulnerable range="lt">5.2.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHP is a widely-used general-purpose scripting language that is
+    especially suited for Web development and can be embedded into HTML.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several vulnerabilities were found in PHP, most of them during the
+    Month Of PHP Bugs (MOPB) by Stefan Esser. The most severe of these
+    vulnerabilities are integer overflows in wbmp.c from the GD library
+    (CVE-2007-1001) and in the substr_compare() PHP 5 function
+    (CVE-2007-1375). Ilia Alshanetsky also reported a buffer overflow in
+    the make_http_soap_request() and in the user_filter_factory_create()
+    functions (CVE-2007-2510, CVE-2007-2511), and Stanislav Malyshev
+    discovered another buffer overflow in the bundled XMLRPC library
+    (CVE-2007-1864). Additionally, the session_regenerate_id() and the
+    array_user_key_compare() functions contain a double-free vulnerability
+    (CVE-2007-1484, CVE-2007-1521). Finally, there exist implementation
+    errors in the Zend engine, in the mb_parse_str(), the unserialize() and
+    the mail() functions and other elements.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Remote attackers might be able to exploit these issues in PHP
+    applications making use of the affected functions, potentially
+    resulting in the execution of arbitrary code, Denial of Service,
+    execution of scripted contents in the context of the affected site,
+    security bypass or information leak.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHP 5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/php-5.2.2&quot;</code>
+    <p>
+    All PHP 4 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/php-4.4.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1001">CVE-2007-1001</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1285">CVE-2007-1285</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1286">CVE-2007-1286</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1484">CVE-2007-1484</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1521">CVE-2007-1521</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1583">CVE-2007-1583</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1700">CVE-2007-1700</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1701">CVE-2007-1701</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1711">CVE-2007-1711</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1717">CVE-2007-1717</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1718">CVE-2007-1718</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1864">CVE-2007-1864</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1900">CVE-2007-1900</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2509">CVE-2007-2509</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2510">CVE-2007-2510</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2511">CVE-2007-2511</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 20 May 2007 07:27:54 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 20 May 2007 07:28:08 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 21 May 2007 21:15:17 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-20.xml b/xml/htdocs/security/en/glsa/glsa-200705-20.xml
new file mode 100644
index 00000000..f8436581
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-20.xml
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-20">
+  <title>Blackdown Java: Applet privilege escalation</title>
+  <synopsis>
+    The Blackdown JDK and the Blackdown JRE suffer from the multiple
+    unspecified vulnerabilities that already affected the Sun JDK and JRE.
+  </synopsis>
+  <product type="ebuild">blackdown-jdk,blackdown-jre</product>
+  <announced>May 26, 2007</announced>
+  <revised>May 26, 2007: 01</revised>
+  <bug>161835</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/blackdown-jdk" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2.03-r14</unaffected>
+      <vulnerable range="lt">1.4.2.03-r14</vulnerable>
+    </package>
+    <package name="dev-java/blackdown-jre" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2.03-r14</unaffected>
+      <vulnerable range="lt">1.4.2.03-r14</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Blackdown provides implementations of the Java Development Kit (JDK)
+    and the Java Runtime Environment (JRE).
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Evans has discovered multiple buffer overflows in the Sun JDK and
+    the Sun JRE possibly related to various AWT and font layout functions.
+    Tom Hawtin has discovered an unspecified vulnerability in the Sun JDK
+    and the Sun JRE relating to unintended applet data access. He has also
+    discovered multiple other unspecified vulnerabilities in the Sun JDK
+    and the Sun JRE allowing unintended Java applet or application resource
+    acquisition. Additionally, a memory corruption error has been found in
+    the handling of GIF images with zero width field blocks.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to run a specially crafted Java applet
+    or application that could read, write, or execute local files with the
+    privileges of the user running the JVM, access data maintained in other
+    Java applets, or escalate the privileges of the currently running Java
+    applet or application allowing for unauthorized access to system
+    resources.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable the "nsplugin" USE flag in order to prevent web applets from
+    being run.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Since there is no fixed update from Blackdown and since the flaw only
+    occurs in the applets, the "nsplugin" USE flag has been masked in the
+    portage tree. Emerge the ebuild again in order to fix the
+    vulnerability. Another solution is to switch to another Java
+    implementation such as the Sun implementation (dev-java/sun-jdk and
+    dev-java/sun-jre-bin).
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;dev-java/blackdown-jdk&quot;
+    # emerge --ask --oneshot --verbose &quot;dev-java/blackdown-jre&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6731">CVE-2006-6731</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6736">CVE-2006-6736</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6737">CVE-2006-6737</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6745">CVE-2006-6745</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 03 May 2007 18:56:59 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 06 May 2007 22:34:22 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 21 May 2007 21:16:03 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-21.xml b/xml/htdocs/security/en/glsa/glsa-200705-21.xml
new file mode 100644
index 00000000..c6ec3438
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-21.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-21">
+  <title>MPlayer: Two buffer overflows</title>
+  <synopsis>
+    Two vulnerabilities have been discovered in MPlayer, each one could lead to
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mplayer</product>
+  <announced>May 30, 2007</announced>
+  <revised>October 12, 2007: 02</revised>
+  <bug>168917</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/mplayer" auto="yes" arch="*">
+      <unaffected range="ge">1.0.20070321</unaffected>
+      <unaffected range="lt">1.0</unaffected>
+      <vulnerable range="lt">1.0.20070321</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MPlayer is a media player incuding support for a wide range of audio
+    and video formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    A buffer overflow has been reported in the DMO_VideoDecoder_Open()
+    function in file loader/dmo/DMO_VideoDecoder.c. Another buffer overflow
+    has been reported in the DS_VideoDecoder_Open() function in file
+    loader/dshow/DS_VideoDecoder.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted video
+    file, potentially resulting in the execution of arbitrary code with the
+    privileges of the user running MPlayer.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MPlayer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/mplayer-1.0.20070321&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1246">CVE-2007-1246</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1387">CVE-2007-1387</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200704-09.xml">GLSA 200704-09</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 20 May 2007 07:29:09 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 20 May 2007 07:29:20 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 21 May 2007 13:01:40 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-22.xml b/xml/htdocs/security/en/glsa/glsa-200705-22.xml
new file mode 100644
index 00000000..9b8ea179
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-22.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-22">
+  <title>FreeType: Buffer overflow</title>
+  <synopsis>
+    A vulnerability has been discovered in FreeType allowing for the execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">freetype</product>
+  <announced>May 30, 2007</announced>
+  <revised>May 30, 2007: 01</revised>
+  <bug>179161</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/freetype" auto="yes" arch="*">
+      <unaffected range="ge">2.3.4-r2</unaffected>
+      <unaffected range="lt">2.0</unaffected>
+      <vulnerable range="lt">2.3.4-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    FreeType is a True Type Font rendering library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Victor Stinner discovered a heap-based buffer overflow in the function
+    Get_VMetrics() in src/truetype/ttgload.c when processing TTF files with
+    a negative n_points attribute.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted TTF
+    file, possibly resulting in the execution of arbitrary code with the
+    privileges of the user running FreeType.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All FreeType users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/freetype-2.3.4-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2754">CVE-2007-2754</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 22 May 2007 15:08:56 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 22 May 2007 15:38:03 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 27 May 2007 16:46:08 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-23.xml b/xml/htdocs/security/en/glsa/glsa-200705-23.xml
new file mode 100644
index 00000000..2afaad39
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-23.xml
@@ -0,0 +1,102 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-23">
+  <title>Sun JDK/JRE: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been identified in Sun Java Development Kit
+    (JDK) and Java Runtime Environment (JRE).
+  </synopsis>
+  <product type="ebuild">sun-jdk,sun-jre-bin</product>
+  <announced>May 31, 2007</announced>
+  <revised>May 28, 2009: 05</revised>
+  <bug>176675</bug>
+  <bug>178851</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/sun-jdk" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.11</unaffected>
+      <unaffected range="rge">1.4.2.14</unaffected>
+      <unaffected range="rge">1.4.2.15</unaffected>
+      <unaffected range="rge">1.4.2.19</unaffected>
+      <vulnerable range="lt">1.5.0.11</vulnerable>
+    </package>
+    <package name="dev-java/sun-jre-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.6.0.01</unaffected>
+      <unaffected range="rge">1.5.0.16</unaffected>
+      <unaffected range="rge">1.5.0.15</unaffected>
+      <unaffected range="rge">1.5.0.12</unaffected>
+      <unaffected range="rge">1.5.0.11</unaffected>
+      <unaffected range="rge">1.4.2.18</unaffected>
+      <unaffected range="rge">1.4.2.17</unaffected>
+      <unaffected range="rge">1.4.2.15</unaffected>
+      <unaffected range="rge">1.4.2.14</unaffected>
+      <unaffected range="rge">1.4.2.19</unaffected>
+      <unaffected range="rge">1.5.0.17</unaffected>
+      <unaffected range="rge">1.5.0.18</unaffected>
+      <vulnerable range="lt">1.6.0.01</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Sun Java Development Kit (JDK) and the Sun Java Runtime Environment
+    (JRE) provide the Sun Java platform.
+    </p>
+  </background>
+  <description>
+    <p>
+    An unspecified vulnerability involving an "incorrect use of system
+    classes" was reported by the Fujitsu security team. Additionally, Chris
+    Evans from the Google Security Team reported an integer overflow
+    resulting in a buffer overflow in the ICC parser used with JPG or BMP
+    files, and an incorrect open() call to /dev/tty when processing certain
+    BMP files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to run a specially crafted Java
+    class or applet that will trigger one of the vulnerabilities. This
+    could lead to the execution of arbitrary code outside of the Java
+    sandbox and of the Java security restrictions, or crash the Java
+    application or the browser.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Sun Java Development Kit users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;dev-java/sun-jdk&quot;</code>
+    <p>
+    All Sun Java Runtime Environment users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;dev-java/sun-jre-bin&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2435">CVE-2007-2435</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2788">CVE-2007-2788</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2789">CVE-2007-2789</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 21 May 2007 03:51:23 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 27 May 2007 22:03:03 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 31 May 2007 08:44:39 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-24.xml b/xml/htdocs/security/en/glsa/glsa-200705-24.xml
new file mode 100644
index 00000000..6f822d88
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-24.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-24">
+  <title>libpng: Denial of Service</title>
+  <synopsis>
+    A vulnerability in libpng may allow a remote attacker to crash applications
+    that handle untrusted images.
+  </synopsis>
+  <product type="ebuild">libpng</product>
+  <announced>May 31, 2007</announced>
+  <revised>May 31, 2007: 01</revised>
+  <bug>178004</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libpng" auto="yes" arch="*">
+      <unaffected range="ge">1.2.17</unaffected>
+      <vulnerable range="lt">1.2.17</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libpng is a free ANSI C library used to process and manipulate PNG
+    images.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mats Palmgren fixed an error in file pngrutil.c in which the trans[]
+    array might be not allocated because of images with a bad tRNS chunk
+    CRC value.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft an image that when processed or viewed by
+    an application using libpng causes the application to terminate
+    abnormally.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Please note that due to separate bugs in libpng 1.2.17, Gentoo does not
+    provide libpng-1.2.17 but libpng-1.2.18. All libpng users should
+    upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libpng-1.2.18&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2445">CVE-2007-2445</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 27 May 2007 07:35:26 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 27 May 2007 13:49:05 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 31 May 2007 08:41:58 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200705-25.xml b/xml/htdocs/security/en/glsa/glsa-200705-25.xml
new file mode 100644
index 00000000..94699600
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200705-25.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200705-25">
+  <title>file: Integer overflow</title>
+  <synopsis>
+    An integer overflow vulnerability has been reported in file allowing for
+    the user-assisted execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">file</product>
+  <announced>May 31, 2007</announced>
+  <revised>June 01, 2007: 02</revised>
+  <bug>179583</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-apps/file" auto="yes" arch="x86 ppc hppa">
+      <unaffected range="ge">4.21</unaffected>
+      <vulnerable range="lt">4.21</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    file is a utility that guesses a file format by scanning binary data
+    for patterns.
+    </p>
+  </background>
+  <description>
+    <p>
+    Colin Percival from FreeBSD reported that the previous fix for the
+    file_printf() buffer overflow introduced a new integer overflow.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could entice a user to run the file program on an
+    overly large file (more than 1Gb) that would trigger an integer
+    overflow on 32-bit systems, possibly leading to the execution of
+    arbitrary code with the rights of the user running file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Since file is a system package, all Gentoo users should upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/file-4.21&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2799">CVE-2007-2799</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 28 May 2007 10:04:58 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 31 May 2007 06:59:45 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200706-01.xml b/xml/htdocs/security/en/glsa/glsa-200706-01.xml
new file mode 100644
index 00000000..d7bf5d43
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200706-01.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200706-01">
+  <title>libexif: Integer overflow vulnerability</title>
+  <synopsis>
+    libexif fails to handle Exif (EXchangeable Image File) data inputs, making
+    it vulnerable to an integer overflow.
+  </synopsis>
+  <product type="ebuild">libexif</product>
+  <announced>June 05, 2007</announced>
+  <revised>June 05, 2007: 01</revised>
+  <bug>178081</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libexif" auto="yes" arch="*">
+      <unaffected range="ge">0.6.15</unaffected>
+      <vulnerable range="lt">0.6.15</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libexif is a library for parsing, editing and saving Exif data.
+    </p>
+  </background>
+  <description>
+    <p>
+    Victor Stinner reported an integer overflow in the
+    exif_data_load_data_entry() function from file exif-data.c while
+    handling Exif data.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to process a file with specially
+    crafted Exif extensions with an application making use of libexif,
+    which will trigger the integer overflow and potentially execute
+    arbitrary code or crash the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libexif users should upgrade to the latest version. Please note
+    that users upgrading from "&lt;=media-libs/libexif-0.6.13" should also run
+    revdep-rebuild after their upgrade.
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libexif-0.6.15&quot;
+    # revdep-rebuild --library=/usr/lib/libexif.so</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2645">CVE-2007-2645</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 05 Jun 2007 18:50:35 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 03 Jun 2007 06:19:11 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200706-02.xml b/xml/htdocs/security/en/glsa/glsa-200706-02.xml
new file mode 100644
index 00000000..5f8ee0a4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200706-02.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200706-02">
+  <title>Evolution: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A vulnerability has been discovered in Evolution allowing for the execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">evolution</product>
+  <announced>June 06, 2007</announced>
+  <revised>June 06, 2007: 01</revised>
+  <bug>170879</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/evolution" auto="yes" arch="*">
+      <unaffected range="ge">2.8.3-r2</unaffected>
+      <vulnerable range="lt">2.8.3-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Evolution is the mail client of the GNOME desktop environment.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ulf Harnhammar from Secunia Research has discovered a format string
+    error in the write_html() function in the file
+    calendar/gui/e-cal-component-memo-preview.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    shared memo, possibly resulting in the execution of arbitrary code with
+    the privileges of the user running Evolution.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Evolution users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/evolution-2.8.3-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1002">CVE-2007-1002</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 02 Jun 2007 07:29:21 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 03 Jun 2007 18:06:03 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 06 Jun 2007 20:42:46 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200706-03.xml b/xml/htdocs/security/en/glsa/glsa-200706-03.xml
new file mode 100644
index 00000000..adc00ab2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200706-03.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200706-03">
+  <title>ELinks: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A vulnerability has been discovered in ELinks allowing for the
+    user-assisted execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">elinks</product>
+  <announced>June 06, 2007</announced>
+  <revised>June 06, 2007: 01</revised>
+  <bug>177512</bug>
+  <access>local</access>
+  <affected>
+    <package name="www-client/elinks" auto="yes" arch="*">
+      <unaffected range="ge">0.11.2-r1</unaffected>
+      <vulnerable range="lt">0.11.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ELinks is a text-mode web browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    Arnaud Giersch discovered that the "add_filename_to_string()" function
+    in file intl/gettext/loadmsgcat.c uses an untrusted relative path,
+    allowing for a format string attack with a malicious .po file.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could entice a user to run ELinks in a specially
+    crafted directory environment containing a malicious ".po" file,
+    possibly resulting in the execution of arbitrary code with the
+    privileges of the user running ELinks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ELinks users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/elinks-0.11.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2027">CVE-2007-2027</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 03 Jun 2007 06:18:54 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 03 Jun 2007 06:19:11 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 03 Jun 2007 17:56:00 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200706-04.xml b/xml/htdocs/security/en/glsa/glsa-200706-04.xml
new file mode 100644
index 00000000..d9306c44
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200706-04.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200706-04">
+  <title>MadWifi: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in MadWifi, possibly allowing
+    for the execution of arbitrary code or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">madwifi-ng</product>
+  <announced>June 11, 2007</announced>
+  <revised>June 11, 2007: 01</revised>
+  <bug>179532</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-wireless/madwifi-ng" auto="yes" arch="*">
+      <unaffected range="ge">0.9.3.1</unaffected>
+      <vulnerable range="lt">0.9.3.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The MadWifi driver provides support for Atheros based IEEE 802.11
+    Wireless Lan cards.
+    </p>
+  </background>
+  <description>
+    <p>
+    Md Sohail Ahmad from AirTight Networks has discovered a divison by zero
+    in the ath_beacon_config() function (CVE-2007-2830). The vendor has
+    corrected an input validation error in the
+    ieee80211_ioctl_getwmmparams() and ieee80211_ioctl_getwmmparams()
+    functions(CVE-207-2831), and an input sanitization error when parsing
+    nested 802.3 Ethernet frame lengths (CVE-2007-2829).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could send specially crafted packets to a vulnerable host
+    to exploit one of these vulnerabilities, possibly resulting in the
+    execution of arbitrary code with root privileges, or a Denial of
+    Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MadWifi users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-wireless/madwifi-ng-0.9.3.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2829">CVE-2007-2829</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2830">CVE-2007-2830</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2831">CVE-2007-2831</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 08 Jun 2007 06:19:00 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 10 Jun 2007 14:16:00 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 10 Jun 2007 14:16:10 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200706-05.xml b/xml/htdocs/security/en/glsa/glsa-200706-05.xml
new file mode 100644
index 00000000..64d7a37f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200706-05.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200706-05">
+  <title>ClamAV: Multiple Denials of Service</title>
+  <synopsis>
+    ClamAV contains several vulnerabilities leading to a Denial of Service.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>June 15, 2007</announced>
+  <revised>June 15, 2007: 01</revised>
+  <bug>178082</bug>
+  <access>remote, local</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.90.3</unaffected>
+      <vulnerable range="lt">0.90.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ClamAV is a GPL virus scanner.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several vulnerabilities were discovered in ClamAV by various
+    researchers:
+    </p>
+    <ul><li>Victor Stinner (INL) discovered that the OLE2
+    parser may enter in an infinite loop (CVE-2007-2650).</li>
+    <li>A
+    boundary error was also reported by an anonymous researcher in the file
+    unsp.c, which might lead to a buffer overflow (CVE-2007-3023).</li>
+    <li>The file unrar.c contains a heap-based buffer overflow via a
+    modified vm_codesize value from a RAR file (CVE-2007-3123).</li>
+    <li>The RAR parsing engine can be bypassed via a RAR file with a header
+    flag value of 10 (CVE-2007-3122).</li>
+    <li>The cli_gentempstream()
+    function from clamdscan creates temporary files with insecure
+    permissions (CVE-2007-3024).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send a specially crafted file to the scanner,
+    possibly triggering one of the vulnerabilities. The two buffer
+    overflows are reported to only cause Denial of Service. This would lead
+    to a Denial of Service by CPU consumption or a crash of the scanner.
+    The insecure temporary file creation vulnerability could be used by a
+    local user to access sensitive data.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.90.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2650">CVE-2007-2650</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3023">CVE-2007-3023</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3024">CVE-2007-3024</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3122">CVE-2007-3122</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3123">CVE-2007-3123</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 08 Jun 2007 06:17:07 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 10 Jun 2007 18:13:18 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 10 Jun 2007 18:15:09 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200706-06.xml b/xml/htdocs/security/en/glsa/glsa-200706-06.xml
new file mode 100644
index 00000000..adb269ec
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200706-06.xml
@@ -0,0 +1,149 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200706-06">
+  <title>Mozilla products: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been reported in Mozilla Firefox,
+    Thunderbird, SeaMonkey and XULRunner, some of which may allow user-assisted
+    arbitrary remote code execution.
+  </synopsis>
+  <product type="ebuild">mozilla-firefox,mozilla-thunderbird,mozilla-firefox-bin,mozilla-thunderbird-bin,seamonkey,seamonkey-bin,xulrunner</product>
+  <announced>June 19, 2007</announced>
+  <revised>June 19, 2007: 01</revised>
+  <bug>180436</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.4</unaffected>
+      <vulnerable range="lt">2.0.0.4</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.4</unaffected>
+      <vulnerable range="lt">2.0.0.4</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.4</unaffected>
+      <unaffected range="rge">1.5.0.12</unaffected>
+      <vulnerable range="lt">2.0.0.4</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.4</unaffected>
+      <unaffected range="rge">1.5.0.12</unaffected>
+      <vulnerable range="lt">2.0.0.4</vulnerable>
+    </package>
+    <package name="www-client/seamonkey" auto="yes" arch="*">
+      <unaffected range="ge">1.1.2</unaffected>
+      <vulnerable range="lt">1.1.2</vulnerable>
+    </package>
+    <package name="www-client/seamonkey-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.1.2</unaffected>
+      <vulnerable range="lt">1.1.2</vulnerable>
+    </package>
+    <package name="net-libs/xulrunner" auto="yes" arch="*">
+      <unaffected range="ge">1.8.1.4</unaffected>
+      <vulnerable range="lt">1.8.1.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Firefox is an open-source web browser from the Mozilla Project,
+    and Mozilla Thunderbird an email client. The SeaMonkey project is a
+    community effort to deliver production-quality releases of code derived
+    from the application formerly known as the 'Mozilla Application Suite'.
+    XULRunner is a Mozilla runtime package that can be used to bootstrap
+    XUL+XPCOM applications like Firefox and Thunderbird.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mozilla developers fixed several bugs involving memory corruption
+    through various vectors (CVE-2007-2867, CVE-2007-2868). Additionally,
+    several errors leading to crash, memory exhaustion or CPU consumption
+    were fixed (CVE-2007-1362, CVE-2007-2869). Finally, errors related to
+    the APOP protocol (CVE-2007-1558), XSS prevention (CVE-2007-2870) and
+    spoofing prevention (CVE-2007-2871) were fixed.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to view a specially crafted web
+    page that will trigger one of the vulnerabilities, possibly leading to
+    the execution of arbitrary code or a Denial of Service. It is also
+    possible for an attacker to spoof the address bar or other browser
+    elements, obtain sensitive APOP information, or perform cross-site
+    scripting attacks, leading to the exposure of sensitive information,
+    like user credentials.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-2.0.0.4&quot;</code>
+    <p>
+    All Mozilla Firefox binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-2.0.0.4&quot;</code>
+    <p>
+    All Mozilla Thunderbird users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-2.0.0.4&quot;</code>
+    <p>
+    All Mozilla Thunderbird binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-bin-2.0.0.4&quot;</code>
+    <p>
+    All SeaMonkey users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/seamonkey-1.1.2&quot;</code>
+    <p>
+    All SeaMonkey binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/seamonkey-bin-1.1.2&quot;</code>
+    <p>
+    All XULRunner users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/xulrunner-1.8.1.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1362">CVE-2007-1362</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1558">CVE-2007-1558</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2867">CVE-2007-2867</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2868">CVE-2007-2868</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2869">CVE-2007-2869</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2870">CVE-2007-2870</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2871">CVE-2007-2871</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 07 Jun 2007 21:58:45 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 11 Jun 2007 22:03:24 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 19 Jun 2007 21:03:22 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200706-07.xml b/xml/htdocs/security/en/glsa/glsa-200706-07.xml
new file mode 100644
index 00000000..14595836
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200706-07.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200706-07">
+  <title>PHProjekt: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in PHProjekt, allowing for
+    the execution of arbitrary PHP and SQL code, and cross-site scripting
+    attacks.
+  </synopsis>
+  <product type="ebuild">phprojekt</product>
+  <announced>June 19, 2007</announced>
+  <revised>June 19, 2007: 01</revised>
+  <bug>170905</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phprojekt" auto="yes" arch="*">
+      <unaffected range="ge">5.2.1</unaffected>
+      <vulnerable range="lt">5.2.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHProjekt is a project management and coordination tool written in PHP.
+    </p>
+  </background>
+  <description>
+    <p>
+    Alexios Fakos from n.runs AG has discovered multiple vulnerabilities in
+    PHProjekt, including the execution of arbitrary SQL commands using
+    unknown vectors (CVE-2007-1575), the execution of arbitrary PHP code
+    using an unrestricted file upload (CVE-2007-1639), cross-site request
+    forgeries using different modules (CVE-2007-1638), and a cross-site
+    scripting attack using unkown vectors (CVE-2007-1576).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An authenticated user could elevate their privileges by exploiting the
+    vulnerabilities described above. Note that the magic_quotes_gpc PHP
+    configuration setting must be set to "off" to exploit these
+    vulnerabilities.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHProjekt users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/phprojekt-5.2.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1575">CVE-2007-1575</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1576">CVE-2007-1576</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1638">CVE-2007-1638</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1639">CVE-2007-1639</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 07 Jun 2007 21:18:57 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 10 Jun 2007 13:59:19 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 10 Jun 2007 13:59:28 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200706-08.xml b/xml/htdocs/security/en/glsa/glsa-200706-08.xml
new file mode 100644
index 00000000..22cf7e65
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200706-08.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200706-08">
+  <title>emul-linux-x86-java: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in emul-linux-x86-java,
+    possibly resulting in the execution of arbitrary code or a Denial of
+    Service.
+  </synopsis>
+  <product type="ebuild">emul-linux-x86-java</product>
+  <announced>June 26, 2007</announced>
+  <revised>May 28, 2009: 03</revised>
+  <bug>178962</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-emulation/emul-linux-x86-java" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.11</unaffected>
+      <unaffected range="rge">1.4.2.16</unaffected>
+      <unaffected range="rge">1.4.2.17</unaffected>
+      <unaffected range="rge">1.4.2.19</unaffected>
+      <vulnerable range="lt">1.5.0.11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    emul-linux-x86-java is the 32 bit version of the Sun's J2SE Development
+    Kit.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Evans of the Google Security Team has discovered an integer
+    overflow in the ICC parser, and another vulnerability in the BMP
+    parser. An unspecified vulnerability involving an "incorrect use of
+    system classes" was reported by the Fujitsu security team.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    image, possibly resulting in the execution of arbitrary code with the
+    privileges of the user running Emul-linux-x86-java. They also could
+    entice a user to open a specially crafted BMP image, resulting in a
+    Denial of Service. Note that these vulnerabilities may also be
+    triggered by a tool processing image files automatically.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Emul-linux-x86-java users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/emul-linux-x86-java-1.5.0.11&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2435">CVE-2007-2435</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2788">CVE-2007-2788</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2789">CVE-2007-2789</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 07 Jun 2007 21:24:22 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 10 Jun 2007 14:32:58 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 10 Jun 2007 14:33:07 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200706-09.xml b/xml/htdocs/security/en/glsa/glsa-200706-09.xml
new file mode 100644
index 00000000..af5a4068
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200706-09.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200706-09">
+  <title>libexif: Buffer overflow</title>
+  <synopsis>
+    libexif does not properly handle image EXIF information, possibly allowing
+    for the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">libexif</product>
+  <announced>June 26, 2007</announced>
+  <revised>June 26, 2007: 01</revised>
+  <bug>181922</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libexif" auto="yes" arch="*">
+      <unaffected range="ge">0.6.16</unaffected>
+      <vulnerable range="lt">0.6.16</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libexif is a library for parsing, editing and saving EXIF metadata from
+    images.
+    </p>
+  </background>
+  <description>
+    <p>
+    iDefense Labs have discovered that the exif_data_load_data_entry()
+    function in libexif/exif-data.c improperly handles integer data while
+    working with an image with many EXIF components, allowing an integer
+    overflow possibly leading to a heap-based buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user of an application making use of a
+    vulnerable version of libexif to load a specially crafted image file,
+    possibly resulting in a crash of the application or the execution of
+    arbitrary code with the rights of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libexif users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libexif-0.6.16&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4168">CVE-2006-4168</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 16 Jun 2007 06:17:21 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 16 Jun 2007 06:17:44 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 19 Jun 2007 02:58:18 +0000">
+    shellsage
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200707-01.xml b/xml/htdocs/security/en/glsa/glsa-200707-01.xml
new file mode 100644
index 00000000..328e2259
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200707-01.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200707-01">
+  <title>Firebird: Buffer overflow</title>
+  <synopsis>
+    A vulnerability has been discovered in Firebird, allowing for the execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">firebird</product>
+  <announced>July 01, 2007</announced>
+  <revised>July 01, 2007: 01</revised>
+  <bug>181811</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/firebird" auto="yes" arch="*">
+      <unaffected range="ge">2.0.1</unaffected>
+      <vulnerable range="lt">2.0.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Firebird is an open source relational database that runs on Linux,
+    Windows, and various UNIX systems.
+    </p>
+  </background>
+  <description>
+    <p>
+    Cody Pierce from TippingPoint DVLabs has discovered a buffer overflow
+    when processing "connect" requests with an overly large "p_cnct_count"
+    value.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An unauthenticated remote attacker could send a specially crafted
+    request to a vulnerable server, possibly resulting in the execution of
+    arbitrary code with the privileges of the user running Firebird.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Firebird users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/firebird-2.0.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3181">CVE-2007-3181</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 25 Jun 2007 19:06:37 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 26 Jun 2007 18:04:58 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200707-02.xml b/xml/htdocs/security/en/glsa/glsa-200707-02.xml
new file mode 100644
index 00000000..35d3cf10
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200707-02.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200707-02">
+  <title>OpenOffice.org: Two buffer overflows</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in OpenOffice.org, allowing
+    for the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">openoffice</product>
+  <announced>July 02, 2007</announced>
+  <revised>July 02, 2007: 01</revised>
+  <bug>181773</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/openoffice" auto="yes" arch="*">
+      <unaffected range="ge">2.2.1</unaffected>
+      <vulnerable range="lt">2.2.1</vulnerable>
+    </package>
+    <package name="app-office/openoffice-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.2.1</unaffected>
+      <vulnerable range="lt">2.2.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenOffice.org is an open source office productivity suite, including
+    word processing, spreadsheet, presentation, drawing, data charting,
+    formula editing, and file conversion facilities.
+    </p>
+  </background>
+  <description>
+    <p>
+    John Heasman of NGSSoftware has discovered a heap-based buffer overflow
+    when parsing the "prdata" tag in RTF files where the first token is
+    smaller than the second one (CVE-2007-0245). Additionally, the
+    OpenOffice binary program is shipped with a version of FreeType that
+    contains an integer signedness error in the n_points variable in file
+    truetype/ttgload.c, which was covered by GLSA 200705-22
+    (CVE-2007-2754).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    document, possibly leading to execution of arbitrary code with the
+    rights of the user running OpenOffice.org.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenOffice.org users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-2.2.1&quot;</code>
+    <p>
+    All OpenOffice.org binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-bin-2.2.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0245">CVE-2007-0245</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2754">CVE-2007-2754</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200705-22.xml">GLSA 200705-22</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 25 Jun 2007 15:57:23 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 25 Jun 2007 15:57:59 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200707-03.xml b/xml/htdocs/security/en/glsa/glsa-200707-03.xml
new file mode 100644
index 00000000..b88057ae
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200707-03.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200707-03">
+  <title>Evolution: User-assisted remote execution of arbitrary code</title>
+  <synopsis>
+    The IMAP client of Evolution contains a vulnerability potentially leading
+    to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">evolution-data-server</product>
+  <announced>July 02, 2007</announced>
+  <revised>July 02, 2007: 01</revised>
+  <bug>182011</bug>
+  <access>remote</access>
+  <affected>
+    <package name="gnome-extra/evolution-data-server" auto="yes" arch="*">
+      <unaffected range="ge">1.8.3-r5</unaffected>
+      <unaffected range="rge">1.6.2-r1</unaffected>
+      <vulnerable range="lt">1.8.3-r5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Evolution is the mail client of the GNOME desktop environment. Camel is
+    the Evolution Data Server module that handles mail functions.
+    </p>
+  </background>
+  <description>
+    <p>
+    The imap_rescan() function of the file camel-imap-folder.c does not
+    properly sanitize the "SEQUENCE" response sent by an IMAP server before
+    being used to index arrays.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious or compromised IMAP server could trigger the vulnerability
+    and execute arbitrary code with the permissions of the user running
+    Evolution.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Evolution users should upgrade evolution-data-server to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;gnome-extra/evolution-data-server&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3257">CVE-2007-3257</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 20 Jun 2007 15:13:37 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 25 Jun 2007 16:19:12 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 25 Jun 2007 16:19:36 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200707-04.xml b/xml/htdocs/security/en/glsa/glsa-200707-04.xml
new file mode 100644
index 00000000..11230aba
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200707-04.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200707-04">
+  <title>GNU C Library: Integer overflow</title>
+  <synopsis>
+    An integer overflow in the dynamic loader, ld.so, could result in the
+    execution of arbitrary code with escalated privileges.
+  </synopsis>
+  <product type="ebuild">glibc</product>
+  <announced>July 03, 2007</announced>
+  <revised>July 03, 2007: 01</revised>
+  <bug>183844</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-libs/glibc" auto="yes" arch="x86">
+      <unaffected range="ge">2.5-r4</unaffected>
+      <vulnerable range="lt">2.5-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The GNU C library is the standard C library used by Gentoo Linux
+    systems. It provides programs with basic facilities and interfaces to
+    system calls. ld.so is the dynamic linker which prepares dynamically
+    linked programs for execution by resolving runtime dependencies and
+    related functions.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Team discovered a flaw in
+    the handling of the hardware capabilities mask by the dynamic loader.
+    If a mask is specified with a high population count, an integer
+    overflow could occur when allocating memory.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    As the hardware capabilities mask is honored by the dynamic loader
+    during the execution of suid and sgid programs, in theory this
+    vulnerability could result in the execution of arbitrary code with root
+    privileges. This update is provided as a precaution against currently
+    unknown attack vectors.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-libs/glibc-2.5-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3508">CVE-2007-3508</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 01 Jul 2007 18:20:09 +0000">
+    taviso
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 03 Jul 2007 13:34:58 +0000">
+    taviso
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200707-05.xml b/xml/htdocs/security/en/glsa/glsa-200707-05.xml
new file mode 100644
index 00000000..2a711c3b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200707-05.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200707-05">
+  <title>Webmin, Usermin: Cross-site scripting vulnerabilities</title>
+  <synopsis>
+    Webmin and Usermin are vulnerable to cross-site scripting vulnerabilities
+    (XSS).
+  </synopsis>
+  <product type="ebuild">webmin/usermin</product>
+  <announced>July 05, 2007</announced>
+  <revised>July 05, 2007: 01</revised>
+  <bug>181385</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-admin/webmin" auto="yes" arch="*">
+      <unaffected range="ge">1.350</unaffected>
+      <vulnerable range="lt">1.350</vulnerable>
+    </package>
+    <package name="app-admin/usermin" auto="yes" arch="*">
+      <unaffected range="ge">1.280</unaffected>
+      <vulnerable range="lt">1.280</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Webmin is a web-based administrative interface for Unix-like systems.
+    Usermin is a simplified version of Webmin designed for use by normal
+    users rather than system administrators.
+    </p>
+  </background>
+  <description>
+    <p>
+    The pam_login.cgi file does not properly sanitize user input before
+    sending it back as output to the user.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    An unauthenticated attacker could entice a user to browse a specially
+    crafted URL, allowing for the execution of script code in the context
+    of the user's browser and for the theft of browser credentials. This
+    may permit the attacker to login to Webmin or Usermin with the user's
+    permissions.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Webmin users should update to the latest stable version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --verbose --oneshot &quot;&gt;=app-admin/webmin-1.350&quot;</code>
+    <p>
+    All Usermin users should update to the latest stable version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --verbose --oneshot &quot;&gt;=app-admin/usermin-1.280&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3156">CVE-2007-3156</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 25 Jun 2007 19:12:36 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 29 Jun 2007 13:33:55 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200707-06.xml b/xml/htdocs/security/en/glsa/glsa-200707-06.xml
new file mode 100644
index 00000000..4c233d9d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200707-06.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200707-06">
+  <title>XnView: Stack-based buffer overflow</title>
+  <synopsis>
+    XnView is vulnerable to a stack-based buffer overflow and possible remote
+    code execution when handling XPM image files.
+  </synopsis>
+  <product type="ebuild">xnview</product>
+  <announced>July 11, 2007</announced>
+  <revised>July 11, 2007: 01</revised>
+  <bug>175670</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-misc/xnview" auto="yes" arch="x86">
+      <vulnerable range="lt">1.70</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    XnView is software to view and convert graphics files. XPixMap (XPM) is
+    a simple ascii-based graphics format.
+    </p>
+  </background>
+  <description>
+    <p>
+    XnView is vulnerable to a stack-based buffer overflow while processing
+    an XPM file with an overly long section string (greater than 1024
+    bytes).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to view a specially crafted XPM file
+    with XnView that could trigger the vulnerability and possibly execute
+    arbitrary code with the rights of the user running XnView.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    No update appears to be forthcoming from the XnView developer and
+    XnView is proprietary, so the XnView package has been masked in
+    Portage. We recommend that users select an alternate graphics viewer
+    and conversion utility, and unmerge XnView:
+    </p>
+    <code>
+    # emerge --unmerge xnview</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2194">CVE-2007-2194</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 01 Jul 2007 10:38:47 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 02 Jul 2007 18:12:51 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 11 Jul 2007 19:39:42 +0000">
+    DerCorny
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200707-07.xml b/xml/htdocs/security/en/glsa/glsa-200707-07.xml
new file mode 100644
index 00000000..7d4c1e4f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200707-07.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200707-07">
+  <title>MPlayer: Multiple buffer overflows</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in MPlayer, possibly allowing
+    for the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mplayer</product>
+  <announced>July 24, 2007</announced>
+  <revised>October 12, 2007: 03</revised>
+  <bug>181097</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/mplayer" auto="yes" arch="*">
+      <unaffected range="ge">1.0.20070622</unaffected>
+      <unaffected range="lt">1.0</unaffected>
+      <vulnerable range="lt">1.0.20070622</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MPlayer is a media player incuding support for a wide range of audio
+    and video formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Cornelius and Reimar Doffinger of Secunia Research discovered
+    several boundary errors in the functions cddb_query_parse(),
+    cddb_parse_matches_list() and cddb_read_parse(), each allowing for a
+    stack-based buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted file
+    with malicious CDDB entries, possibly resulting in the execution of
+    arbitrary code with the privileges of the user running MPlayer.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MPlayer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/mplayer-1.0.20070622&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2948">CVE-2007-2948</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 15 Jul 2007 07:30:30 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 17 Jul 2007 18:47:22 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 17 Jul 2007 18:48:15 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200707-08.xml b/xml/htdocs/security/en/glsa/glsa-200707-08.xml
new file mode 100644
index 00000000..09d8e562
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200707-08.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200707-08">
+  <title>NVClock: Insecure file usage</title>
+  <synopsis>
+    A vulnerability has been discovered in NVClock, allowing for the execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">nvclock</product>
+  <announced>July 24, 2007</announced>
+  <revised>July 24, 2007: 01</revised>
+  <bug>184071</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-video/nvclock" auto="yes" arch="*">
+      <unaffected range="ge">0.7-r2</unaffected>
+      <vulnerable range="lt">0.7-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    NVClock is an utility for changing NVidia graphic chipsets internal
+    frequency.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Gentoo Linux Security Team discovered that NVClock
+    makes usage of an insecure temporary file in the /tmp directory.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create a specially crafted temporary file in
+    /tmp to execute arbitrary code with the privileges of the user running
+    NVCLock.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All NVClock users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/nvclock-0.7-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3531">CVE-2007-3531</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 15 Jul 2007 09:48:09 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 17 Jul 2007 18:59:19 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 17 Jul 2007 18:59:32 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200707-09.xml b/xml/htdocs/security/en/glsa/glsa-200707-09.xml
new file mode 100644
index 00000000..a67f7145
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200707-09.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200707-09">
+  <title>GIMP: Multiple integer overflows</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in GIMP, allowing for the
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">gimp</product>
+  <announced>July 25, 2007</announced>
+  <revised>July 25, 2007: 01</revised>
+  <bug>182047</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/gimp" auto="yes" arch="*">
+      <unaffected range="ge">2.2.16</unaffected>
+      <vulnerable range="lt">2.2.16</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GIMP is the GNU Image Manipulation Program.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sean Larsson from iDefense Labs discovered multiple integer overflows
+    in various GIMP plugins (CVE-2006-4519). Stefan Cornelius from Secunia
+    Research discovered an integer overflow in the
+    seek_to_and_unpack_pixeldata() function when processing PSD files
+    (CVE-2007-2949).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted image
+    file, possibly resulting in the execution of arbitrary code with the
+    privileges of the user running GIMP.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GIMP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/gimp-2.2.16&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4519">CVE-2006-4519</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2949">CVE-2007-2949</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 11 Jul 2007 20:14:16 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 15 Jul 2007 18:21:17 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 15 Jul 2007 18:21:44 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200707-10.xml b/xml/htdocs/security/en/glsa/glsa-200707-10.xml
new file mode 100644
index 00000000..4a2b1e41
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200707-10.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200707-10">
+  <title>Festival: Privilege elevation</title>
+  <synopsis>
+    A vulnerability has been discovered in Festival, allowing for a local
+    privilege escalation.
+  </synopsis>
+  <product type="ebuild">festival</product>
+  <announced>July 25, 2007</announced>
+  <revised>July 25, 2007: 01</revised>
+  <bug>170477</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-accessibility/festival" auto="yes" arch="*">
+      <unaffected range="ge">1.95_beta-r4</unaffected>
+      <vulnerable range="lt">1.95_beta-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Festival is a text-to-speech accessibility program.
+    </p>
+  </background>
+  <description>
+    <p>
+    Konstantine Shirow reported a vulnerability in default Gentoo
+    configurations of Festival. The daemon is configured to run with root
+    privileges and to listen on localhost, without requiring a password.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could gain root privileges by connecting to the daemon
+    and execute arbitrary commands.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Set a password in the configuration file /etc/festival/server.scm by
+    adding the line: (set! server_passwd password)
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Festival users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-accessibility/festival-1.95_beta-r4&quot;</code>
+  </resolution>
+  <references/>
+  <metadata tag="submitter" timestamp="Wed, 25 Jul 2007 09:41:45 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 25 Jul 2007 21:25:25 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200707-11.xml b/xml/htdocs/security/en/glsa/glsa-200707-11.xml
new file mode 100644
index 00000000..c794c6c2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200707-11.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200707-11">
+  <title>MIT Kerberos 5: Arbitrary remote code execution</title>
+  <synopsis>
+    Multiple vulnerabilities in MIT Kerberos 5 could potentially result in
+    remote code execution with root privileges by unauthenticated users.
+  </synopsis>
+  <product type="ebuild">mit-krb5</product>
+  <announced>July 25, 2007</announced>
+  <revised>July 25, 2007: 01</revised>
+  <bug>183338</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/mit-krb5" auto="yes" arch="*">
+      <unaffected range="ge">1.5.2-r3</unaffected>
+      <vulnerable range="lt">1.5.2-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MIT Kerberos 5 is a suite of applications that implement the Kerberos
+    network protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    kadmind is affected by multiple vulnerabilities in the RPC library
+    shipped with MIT Kerberos 5. It fails to properly handle zero-length
+    RPC credentials (CVE-2007-2442) and the RPC library can write past the
+    end of the stack buffer (CVE-2007-2443). Furthermore kadmind fails to
+    do proper bounds checking (CVE-2007-2798).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote unauthenticated attacker could exploit these vulnerabilities
+    to execute arbitrary code with root privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MIT Kerberos 5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-crypt/mit-krb5-1.5.2-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2442">CVE-2007-2442</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2443">CVE-2007-2443</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2798">CVE-2007-2798</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 15 Jul 2007 07:39:18 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 16 Jul 2007 20:11:47 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 17 Jul 2007 17:56:29 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200707-12.xml b/xml/htdocs/security/en/glsa/glsa-200707-12.xml
new file mode 100644
index 00000000..d6f03f58
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200707-12.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200707-12">
+  <title>VLC media player: Format string vulnerabilities</title>
+  <synopsis>
+    A vulnerability has been discovered in VLC media player, allowing for the
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">vlc</product>
+  <announced>July 28, 2007</announced>
+  <revised>July 28, 2007: 01</revised>
+  <bug>182389</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/vlc" auto="yes" arch="*">
+      <unaffected range="ge">0.8.6c</unaffected>
+      <vulnerable range="lt">0.8.6c</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    VLC media player is a multimedia player for various audio and video
+    formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    David Thiel from iSEC Partners Inc. discovered format string errors in
+    various plugins when parsing data. The affected plugins include Vorbis,
+    Theora, CDDA and SAP.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted media
+    file, possibly resulting in the execution of arbitrary code with the
+    privileges of the user running VLC media player.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All VLC media player users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/vlc-0.8.6c&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3316">CVE-2007-3316</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 14 Jul 2007 21:42:20 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 15 Jul 2007 18:31:02 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 15 Jul 2007 18:31:47 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200707-13.xml b/xml/htdocs/security/en/glsa/glsa-200707-13.xml
new file mode 100644
index 00000000..c3df6f5d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200707-13.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200707-13">
+  <title>Fail2ban: Denial of Service</title>
+  <synopsis>
+    Fail2ban is vulnerable to a Denial of Service attack.
+  </synopsis>
+  <product type="ebuild">fail2ban</product>
+  <announced>July 28, 2007</announced>
+  <revised>January 09, 2008: 02</revised>
+  <bug>181214</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/fail2ban" auto="yes" arch="*">
+      <unaffected range="ge">0.8.0-r1</unaffected>
+      <vulnerable range="lt">0.8.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Fail2ban is a tool for parsing log files and banning IP addresses which
+    make too many password failures.
+    </p>
+  </background>
+  <description>
+    <p>
+    A vulnerability has been discovered in Fail2ban when parsing log files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted SSH login banners to the
+    vulnerable host, which would prevent any ssh connection to the host and
+    result in a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Fail2ban users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/fail2ban-0.8.0-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4321">CVE-2007-4321</uri>
+    <uri link="http://www.ossec.net/en/attacking-loganalysis.html#fail2ban">Original advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 03 Jul 2007 22:02:25 +0000">
+    aetius
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 15 Jul 2007 18:12:05 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 15 Jul 2007 18:13:27 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200707-14.xml b/xml/htdocs/security/en/glsa/glsa-200707-14.xml
new file mode 100644
index 00000000..dec9c075
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200707-14.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200707-14">
+  <title>tcpdump: Integer overflow</title>
+  <synopsis>
+    A vulnerability has been discovered in tcpdump, allowing for the execution
+    of arbitrary code, possibly with root privileges.
+  </synopsis>
+  <product type="ebuild">tcpdump</product>
+  <announced>July 28, 2007</announced>
+  <revised>July 28, 2007: 01</revised>
+  <bug>184815</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/tcpdump" auto="yes" arch="*">
+      <unaffected range="ge">3.9.5-r3</unaffected>
+      <vulnerable range="lt">3.9.5-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    tcpdump is a tool for capturing and inspecting network traffic.
+    </p>
+  </background>
+  <description>
+    <p>
+    mu-b from Digital Labs discovered that the return value of a snprintf()
+    call is not properly checked before being used. This could lead to an
+    integer overflow.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send specially crafted BGP packets on a network
+    being monitored with tcpdump, possibly resulting in the execution of
+    arbitrary code with the privileges of the user running tcpdump, which
+    is usually root.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All tcpdump users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/tcpdump-3.9.5-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3798">CVE-2007-3798</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 14 Jul 2007 22:01:53 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 17 Jul 2007 18:00:19 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 17 Jul 2007 18:48:59 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200708-01.xml b/xml/htdocs/security/en/glsa/glsa-200708-01.xml
new file mode 100644
index 00000000..17f72bcc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200708-01.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200708-01">
+  <title>Macromedia Flash Player: Remote arbitrary code execution</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Macromedia Flash Player,
+    allowing for the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">adobe-flash</product>
+  <announced>August 08, 2007</announced>
+  <revised>May 28, 2009: 02</revised>
+  <bug>185141</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-plugins/adobe-flash" auto="yes" arch="*">
+      <unaffected range="ge">9.0.48.0</unaffected>
+      <vulnerable range="lt">9.0.48.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Macromedia Flash Player is a renderer for the popular SWF file type
+    which is commonly used to provide interactive websites, digital
+    experiences and mobile content.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mark Hills discovered some errors when interacting with a browser for
+    keystrokes handling (CVE-2007-2022). Stefano Di Paola and Giorgio Fedon
+    from Minded Security discovered a boundary error when processing FLV
+    files (CVE-2007-3456). An input validation error when processing HTTP
+    referrers has also been reported (CVE-2007-3457).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted file,
+    possibly leading to the execution of arbitrary code with the privileges
+    of the user running the Macromedia Flash Player, or sensitive data
+    access.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Macromedia Flash Player users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-plugins/adobe-flash-9.0.48.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2022">CVE-2007-2022</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3456">CVE-2007-3456</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3457">CVE-2007-3457</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 15 Jul 2007 10:35:19 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 24 Jul 2007 09:40:21 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 24 Jul 2007 09:40:28 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200708-02.xml b/xml/htdocs/security/en/glsa/glsa-200708-02.xml
new file mode 100644
index 00000000..54659680
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200708-02.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200708-02">
+  <title>Xvid: Array indexing vulnerabilities</title>
+  <synopsis>
+    Several array indexing vulnerabilities were discovered in Xvid, possibly
+    allowing for the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">xvid</product>
+  <announced>August 08, 2007</announced>
+  <revised>August 08, 2007: 01</revised>
+  <bug>183145</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/xvid" auto="yes" arch="*">
+      <unaffected range="ge">1.1.3</unaffected>
+      <vulnerable range="lt">1.1.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Xvid is a popular open source video codec licensed under the GPL.
+    </p>
+  </background>
+  <description>
+    <p>
+    Trixter Jack discovered an array indexing error in the
+    get_intra_block() function in the file src/bitstream/mbcoding.c. The
+    get_inter_block_h263() and get_inter_block_mpeg() functions in the same
+    file were also reported as vulnerable.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit these vulnerabilities to execute arbitrary
+    code by tricking a user or automated system into processing a malicious
+    video file with an application that makes use of the Xvid library.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Xvid users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/xvid-1.1.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3329">CVE-2007-3329</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 14 Jul 2007 21:54:33 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 15 Jul 2007 18:56:27 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 16 Jul 2007 07:58:51 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200708-03.xml b/xml/htdocs/security/en/glsa/glsa-200708-03.xml
new file mode 100644
index 00000000..16d8a6d1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200708-03.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200708-03">
+  <title>libarchive (formerly named as bsdtar): Multiple PaX Extension Header Vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities were found in libarchive (formerly named as
+    app-archive/bsdtar), possibly allowing for the execution of arbitrary code
+    or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">libarchive</product>
+  <announced>August 08, 2007</announced>
+  <revised>August 08, 2007: 02</revised>
+  <bug>184984</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/libarchive" auto="yes" arch="*">
+      <unaffected range="ge">2.2.4</unaffected>
+      <vulnerable range="lt">2.2.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libarchive is a library for manipulating different streaming archive
+    formats, including certain tar variants, several cpio formats, and both
+    BSD and GNU ar variants.
+    </p>
+  </background>
+  <description>
+    <p>
+    CPNI, CERT-FI, Tim Kientzle, and Colin Percival reported a buffer
+    overflow (CVE-2007-3641), an infinite loop (CVE-2007-3644), and a NULL
+    pointer dereference (CVE-2007-3645) within the processing of archives
+    having corrupted PaX extension headers.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker can trick a user or automated system to process an archive
+    with malformed PaX extension headers into execute arbitrary code, crash
+    an application using the library, or cause a high CPU load.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libarchive or bsdtar users should upgrade to the latest libarchive
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/libarchive-2.2.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3641">CVE-2007-3641</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3644">CVE-2007-3644</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3645">CVE-2007-3645</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 15 Jul 2007 10:30:41 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 15 Jul 2007 19:19:38 +0000">
+    DerCorny
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 17 Jul 2007 17:56:39 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200708-04.xml b/xml/htdocs/security/en/glsa/glsa-200708-04.xml
new file mode 100644
index 00000000..a66f2d49
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200708-04.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200708-04">
+  <title>ClamAV: Denial of Service</title>
+  <synopsis>
+    A vulnerability has been discovered in ClamAV, allowing for a Denial of
+    Service.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>August 09, 2007</announced>
+  <revised>August 09, 2007: 01</revised>
+  <bug>185013</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.91</unaffected>
+      <vulnerable range="lt">0.91</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ClamAV is a GPL virus scanner.
+    </p>
+  </background>
+  <description>
+    <p>
+    Metaeye Security Group reported a NULL pointer dereference in ClamAV
+    when processing RAR archives.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send a specially crafted RAR archive to the
+    clamd daemon, resulting in a crash and a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.91&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3725">CVE-2007-3725</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 29 Jul 2007 22:16:39 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 04 Aug 2007 17:18:26 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 04 Aug 2007 17:18:43 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200708-05.xml b/xml/htdocs/security/en/glsa/glsa-200708-05.xml
new file mode 100644
index 00000000..3db531df
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200708-05.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200708-05">
+  <title>GD: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in GD, allowing for the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">gd</product>
+  <announced>August 09, 2007</announced>
+  <revised>August 09, 2007: 01</revised>
+  <bug>179154</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/gd" auto="yes" arch="*">
+      <unaffected range="ge">2.0.35</unaffected>
+      <vulnerable range="lt">2.0.35</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GD is a graphic library for fast image creation.
+    </p>
+  </background>
+  <description>
+    <p>
+    Xavier Roche discovered an infinite loop in the gdPngReadData()
+    function when processing a truncated PNG file (CVE-2007-2756). An
+    integer overflow has been discovered in the gdImageCreateTrueColor()
+    function (CVE-2007-3472). An error has been discovered in the function
+    gdImageCreateXbm() function (CVE-2007-3473). Unspecified
+    vulnerabilities have been discovered in the GIF reader (CVE-2007-3474).
+    An error has been discovered when processing a GIF image that has no
+    global color map (CVE-2007-3475). An array index error has been
+    discovered in the file gd_gif_in.c when processing images with an
+    invalid color index (CVE-2007-3476). An error has been discovered in
+    the imagearc() and imagefilledarc() functions when processing overly
+    large angle values (CVE-2007-3477). A race condition has been
+    discovered in the gdImageStringFTEx() function (CVE-2007-3478).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit one of these vulnerabilities to cause a
+    Denial of Service or possibly execute arbitrary code with the
+    privileges of the user running GD.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GD users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/gd-2.0.35&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756">CVE-2007-2756</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3472">CVE-2007-3472</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3473">CVE-2007-3473</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3474">CVE-2007-3474</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3475">CVE-2007-3475</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3476">CVE-2007-3476</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3477">CVE-2007-3477</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3478">CVE-2007-3478</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 20 Jul 2007 21:01:20 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 31 Jul 2007 09:13:14 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 31 Jul 2007 09:13:30 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200708-06.xml b/xml/htdocs/security/en/glsa/glsa-200708-06.xml
new file mode 100644
index 00000000..e3f71c46
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200708-06.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200708-06">
+  <title>Net::DNS: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in the Net::DNS Perl module,
+    allowing for a Denial of Service and a cache poisoning attack.
+  </synopsis>
+  <product type="ebuild">net-dns</product>
+  <announced>August 11, 2007</announced>
+  <revised>August 11, 2007: 01</revised>
+  <bug>184029</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-perl/Net-DNS" auto="yes" arch="*">
+      <unaffected range="ge">0.60</unaffected>
+      <vulnerable range="lt">0.60</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Net::DNS is a Perl implementation of a DNS resolver.
+    </p>
+  </background>
+  <description>
+    <p>
+    hjp discovered an error when handling DNS query IDs which make them
+    partially predictable. Steffen Ullrich discovered an error in the
+    dn_expand() function which could lead to an endless loop.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send a specially crafted DNS request to the
+    server which could result in a Denial of Service with an infinite
+    recursion, or perform a cache poisoning attack.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Net::DNS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-perl/Net-DNS-0.60&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3377">CVE-2007-3377</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3409">CVE-2007-3409</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 16 Jul 2007 13:12:37 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 25 Jul 2007 05:32:52 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 30 Jul 2007 09:51:53 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200708-07.xml b/xml/htdocs/security/en/glsa/glsa-200708-07.xml
new file mode 100644
index 00000000..d3fe6ab7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200708-07.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200708-07">
+  <title>Xfce Terminal: Remote arbitrary code execution</title>
+  <synopsis>
+    A vulnerability has been discovered in the Xfce Terminal program, allowing
+    for the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">terminal</product>
+  <announced>August 11, 2007</announced>
+  <revised>July 12, 2008: 02</revised>
+  <bug>184886</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-terms/terminal" auto="yes" arch="*">
+      <unaffected range="ge">0.2.6_p25931</unaffected>
+      <vulnerable range="lt">0.2.6_p25931</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Xfce Terminal is a console tool for the Xfce desktop environment.
+    </p>
+  </background>
+  <description>
+    <p>
+    Lasse Karkkainen discovered that the function terminal_helper_execute()
+    in file terminal-helper.c does not properly escape the URIs before
+    processing.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted link,
+    possibly leading to the remote execution of arbitrary code with the
+    privileges of the user running Xfce Terminal. Note that the exploit
+    code depends on the browser used to open the crafted link.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Xfce Terminal users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-terms/terminal-0.2.6_p25931&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3770">CVE-2007-3770</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 28 Jul 2007 07:40:26 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 28 Jul 2007 07:40:36 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 31 Jul 2007 08:48:45 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200708-08.xml b/xml/htdocs/security/en/glsa/glsa-200708-08.xml
new file mode 100644
index 00000000..bdd5615f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200708-08.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200708-08">
+  <title>SquirrelMail G/PGP plugin: Arbitrary code execution</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in SquirrelMail, allowing for
+    the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">squirrelmail</product>
+  <announced>August 11, 2007</announced>
+  <revised>August 11, 2007: 01</revised>
+  <bug>185010</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/squirrelmail" auto="yes" arch="*">
+      <unaffected range="ge">1.4.10a-r2</unaffected>
+      <vulnerable range="lt">1.4.10a-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SquirrelMail is a webmail package written in PHP. It supports IMAP and
+    SMTP protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    The functions deletekey(), gpg_check_sign_pgp_mime() and gpg_recv_key()
+    used in the SquirrelMail G/PGP encryption plugin do not properly escape
+    user-supplied data.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An authenticated user could use the plugin to execute arbitrary code on
+    the server, or a remote attacker could send a specially crafted e-mail
+    to a SquirrelMail user, possibly leading to the execution of arbitrary
+    code with the privileges of the user running the underlying web server.
+    Note that the G/PGP plugin is disabled by default.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Enter the SquirrelMail configuration directory
+    (/usr/share/webapps/squirrelmail/version/htdocs/config), then execute
+    the conf.pl script. Select the plugins menu, then select the gpg plugin
+    item number in the "Installed Plugins" list to disable it. Press S to
+    save your changes, then Q to quit.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SquirrelMail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/squirrelmail-1.4.10a-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1924">CVE-2005-1924</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4169">CVE-2006-4169</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 20 Jul 2007 20:59:21 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 23 Jul 2007 13:21:57 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 23 Jul 2007 13:22:43 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200708-09.xml b/xml/htdocs/security/en/glsa/glsa-200708-09.xml
new file mode 100644
index 00000000..3c00063a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200708-09.xml
@@ -0,0 +1,153 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200708-09">
+  <title>Mozilla products: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been reported in Mozilla Firefox,
+    Thunderbird, SeaMonkey and XULRunner, some of which may allow user-assisted
+    arbitrary remote code execution.
+  </synopsis>
+  <product type="ebuild">mozilla-firefox,mozilla-firefox-bin,seamonkey,seamonkey-bin,mozilla-thunderbird,mozilla-thunderbird-bin,xulrunner</product>
+  <announced>August 14, 2007</announced>
+  <revised>August 14, 2007: 01</revised>
+  <bug>185737</bug>
+  <bug>187205</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.6</unaffected>
+      <vulnerable range="lt">2.0.0.6</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.6</unaffected>
+      <vulnerable range="lt">2.0.0.6</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.6</unaffected>
+      <vulnerable range="lt">2.0.0.6</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.6</unaffected>
+      <vulnerable range="lt">2.0.0.6</vulnerable>
+    </package>
+    <package name="www-client/seamonkey" auto="yes" arch="*">
+      <unaffected range="ge">1.1.4</unaffected>
+      <vulnerable range="lt">1.1.4</vulnerable>
+    </package>
+    <package name="www-client/seamonkey-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.1.4</unaffected>
+      <vulnerable range="lt">1.1.4</vulnerable>
+    </package>
+    <package name="net-libs/xulrunner" auto="yes" arch="*">
+      <unaffected range="ge">1.8.1.6</unaffected>
+      <vulnerable range="lt">1.8.1.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Firefox is an open-source web browser from the Mozilla Project,
+    and Mozilla Thunderbird an email client. The SeaMonkey project is a
+    community effort to deliver production-quality releases of code derived
+    from the application formerly known as the 'Mozilla Application Suite'.
+    XULRunner is a Mozilla runtime package that can be used to bootstrap
+    XUL+XPCOM applications like Firefox and Thunderbird.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mozilla developers fixed several bugs, including an issue with
+    modifying XPCNativeWrappers (CVE-2007-3738), a problem with event
+    handlers executing elements outside of the document (CVE-2007-3737),
+    and a cross-site scripting (XSS) vulnerability (CVE-2007-3736). They
+    also fixed a problem with promiscuous IFRAME access (CVE-2007-3089) and
+    an XULRunner URL spoofing issue with the wyciwyg:// URI and HTTP 302
+    redirects (CVE-2007-3656). Denials of Service involving corrupted
+    memory were fixed in the browser engine (CVE-2007-3734) and the
+    JavaScript engine (CVE-2007-3735). Finally, another XSS vulnerability
+    caused by a regression in the CVE-2007-3089 patch was fixed
+    (CVE-2007-3844).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to view a specially crafted web
+    page that will trigger one of the vulnerabilities, possibly leading to
+    the execution of arbitrary code or a Denial of Service. It is also
+    possible for an attacker to perform cross-site scripting attacks, which
+    could result in the exposure of sensitive information such as login
+    credentials.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-2.0.0.6&quot;</code>
+    <p>
+    All Mozilla Firefox binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-2.0.0.6&quot;</code>
+    <p>
+    All Mozilla Thunderbird users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-2.0.0.6&quot;</code>
+    <p>
+    All Mozilla Thunderbird binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-bin-2.0.0.6&quot;</code>
+    <p>
+    All SeaMonkey users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/seamonkey-1.1.4&quot;</code>
+    <p>
+    All SeaMonkey binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/seamonkey-bin-1.1.4&quot;</code>
+    <p>
+    All XULRunner users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/xulrunner-1.8.1.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3089">CVE-2007-3089</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3656">CVE-2007-3656</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3734">CVE-2007-3734</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3735">CVE-2007-3735</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3736">CVE-2007-3736</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3737">CVE-2007-3737</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3738">CVE-2007-3738</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3844">CVE-2007-3844</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 05 Aug 2007 10:45:13 +0000">
+    aetius
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 05 Aug 2007 10:48:05 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 14 Aug 2007 16:40:39 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200708-10.xml b/xml/htdocs/security/en/glsa/glsa-200708-10.xml
new file mode 100644
index 00000000..a871ecd5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200708-10.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200708-10">
+  <title>MySQL: Denial of Service and information leakage</title>
+  <synopsis>
+    A Denial of Service vulnerability and a table structure information leakage
+    vulnerability were found in MySQL.
+  </synopsis>
+  <product type="ebuild">mysql</product>
+  <announced>August 16, 2007</announced>
+  <revised>August 16, 2007: 01</revised>
+  <bug>185333</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/mysql" auto="yes" arch="*">
+      <unaffected range="ge">5.0.44</unaffected>
+      <vulnerable range="lt">5.0.44</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MySQL is a popular multi-threaded, multi-user SQL server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dormando reported a vulnerability within the handling of password
+    packets in the connection protocol (CVE-2007-3780). Andrei Elkin also
+    found that the "CREATE TABLE LIKE" command didn't require SELECT
+    privileges on the source table (CVE-2007-3781).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote unauthenticated attacker could use the first vulnerability to
+    make the server crash. The second vulnerability can be used by
+    authenticated users to obtain information on tables they are not
+    normally able to access.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MySQL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/mysql-5.0.44&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3780">CVE-2007-3780</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3781">CVE-2007-3781</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 29 Jul 2007 22:18:26 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 12 Aug 2007 20:12:02 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 12 Aug 2007 20:13:00 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200708-11.xml b/xml/htdocs/security/en/glsa/glsa-200708-11.xml
new file mode 100644
index 00000000..35826347
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200708-11.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200708-11">
+  <title>Lighttpd: Multiple vulnerabilities</title>
+  <synopsis>
+    Several vulnerabilities were reported in Lighttpd, most of them allowing a
+    Denial of Service and potentially the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">lighttpd</product>
+  <announced>August 16, 2007</announced>
+  <revised>August 16, 2007: 01</revised>
+  <bug>185442</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/lighttpd" auto="yes" arch="*">
+      <unaffected range="ge">1.4.16</unaffected>
+      <vulnerable range="lt">1.4.16</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Lighttpd is a lightweight HTTP web server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Esser discovered errors with evidence of memory corruption in
+    the code parsing the headers. Several independent researchers also
+    reported errors involving the handling of HTTP headers, the mod_auth
+    and mod_scgi modules, and the limitation of active connections.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker can trigger any of these vulnerabilities by sending
+    malicious data to the server, which may lead to a crash or memory
+    exhaustion, and potentially the execution of arbitrary code.
+    Additionally, access-deny settings can be evaded by appending a final /
+    to a URL.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Lighttpd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/lighttpd-1.4.16&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3946">CVE-2007-3946</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3947">CVE-2007-3947</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3948">CVE-2007-3948</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3949">CVE-2007-3949</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3950">CVE-2007-3950</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 17 Jul 2007 18:07:17 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 12 Aug 2007 21:28:06 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 15 Aug 2007 05:43:43 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200708-12.xml b/xml/htdocs/security/en/glsa/glsa-200708-12.xml
new file mode 100644
index 00000000..6bbd1f5a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200708-12.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200708-12">
+  <title>Wireshark: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Wireshark, allowing for
+    the remote execution of arbitrary code and a Denial of Service.
+  </synopsis>
+  <product type="ebuild">wireshark</product>
+  <announced>August 16, 2007</announced>
+  <revised>August 16, 2007: 01</revised>
+  <bug>183520</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/wireshark" auto="yes" arch="*">
+      <unaffected range="ge">0.99.6</unaffected>
+      <vulnerable range="lt">0.99.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Wireshark is a network protocol analyzer with a graphical front-end.
+    </p>
+  </background>
+  <description>
+    <p>
+    Wireshark doesn't properly handle chunked encoding in HTTP responses
+    (CVE-2007-3389), iSeries capture files (CVE-2007-3390), certain types
+    of DCP ETSI packets (CVE-2007-3391), and SSL or MMS packets
+    (CVE-2007-3392). An off-by-one error has been discovered in the
+    DHCP/BOOTP dissector when handling DHCP-over-DOCSIS packets
+    (CVE-2007-3393).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted packets on a network
+    being monitored with Wireshark, possibly resulting in the execution of
+    arbitrary code with the privileges of the user running Wireshark which
+    might be the root user, or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    In order to prevent root compromise, take network captures with tcpdump
+    and analyze them running Wireshark as a least privileged user.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Wireshark users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/wireshark-0.99.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3389">CVE-2007-3389</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3390">CVE-2007-3390</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3391">CVE-2007-3391</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3392">CVE-2007-3392</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3393">CVE-2007-3393</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 24 Jul 2007 10:55:17 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 25 Jul 2007 05:32:32 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 12 Aug 2007 20:22:11 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200708-13.xml b/xml/htdocs/security/en/glsa/glsa-200708-13.xml
new file mode 100644
index 00000000..1d36d1ef
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200708-13.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200708-13">
+  <title>BIND: Weak random number generation</title>
+  <synopsis>
+    The ISC BIND random number generator uses a weak algorithm, making it
+    easier to guess the next query ID and perform a DNS cache poisoning attack.
+  </synopsis>
+  <product type="ebuild">bind</product>
+  <announced>August 18, 2007</announced>
+  <revised>August 18, 2007: 01</revised>
+  <bug>186556</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/bind" auto="yes" arch="*">
+      <unaffected range="ge">9.4.1_p1</unaffected>
+      <vulnerable range="lt">9.4.1_p1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ISC BIND is the Internet Systems Consortium implementation of the
+    Domain Name System (DNS) protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    Amit Klein from Trusteer reported that the random number generator of
+    ISC BIND leads, half the time, to predictable (1 chance to 8) query IDs
+    in the resolver routine or in zone transfer queries (CVE-2007-2926).
+    Additionally, the default configuration file has been strengthen with
+    respect to the allow-recursion{} and the allow-query{} options
+    (CVE-2007-2925).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker can use this weakness by sending queries for a domain
+    he handles to a resolver (directly to a recursive server, or through
+    another process like an email processing) and then observing the
+    resulting IDs of the iterative queries. The attacker will half the time
+    be able to guess the next query ID, then perform cache poisoning by
+    answering with those guessed IDs, while spoofing the UDP source address
+    of the reply. Furthermore, with empty allow-recursion{} and
+    allow-query{} options, the default configuration allowed anybody to
+    make recursive queries and query the cache.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time for the random generator
+    weakness. The allow-recursion{} and allow-query{} options should be set
+    to trusted hosts only in /etc/bind/named.conf, thus preventing several
+    security risks.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ISC BIND users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/bind-9.4.1_p1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925">CVE-2007-2925</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926">CVE-2007-2926</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 05 Aug 2007 10:40:49 +0000">
+    aetius
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 13 Aug 2007 23:06:16 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 14 Aug 2007 23:00:40 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200708-14.xml b/xml/htdocs/security/en/glsa/glsa-200708-14.xml
new file mode 100644
index 00000000..be60801a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200708-14.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200708-14">
+  <title>NVIDIA drivers: Denial of Service</title>
+  <synopsis>
+    A vulnerability has been discovered in the NVIDIA graphic drivers, allowing
+    for a Denial of Service.
+  </synopsis>
+  <product type="ebuild">nvidia-drivers</product>
+  <announced>August 19, 2007</announced>
+  <revised>October 11, 2007: 03</revised>
+  <bug>183567</bug>
+  <access>local</access>
+  <affected>
+    <package name="x11-drivers/nvidia-drivers" auto="yes" arch="*">
+      <unaffected range="ge">71.86.01</unaffected>
+      <unaffected range="rge">1.0.7185</unaffected>
+      <unaffected range="rge">1.0.9639</unaffected>
+      <vulnerable range="eq">100.14.06</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The NVIDIA drivers provide support for NVIDIA graphic boards.
+    </p>
+  </background>
+  <description>
+    <p>
+    Gregory Shikhman discovered that the default Gentoo setup of NVIDIA
+    drivers creates the /dev/nvidia* with insecure file permissions.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could send arbitrary values into the devices, possibly
+    resulting in hardware damage on the graphic board or a Denial of
+    Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All NVIDIA drivers users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;x11-drivers/nvidia-drivers&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3532">CVE-2007-3532</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 28 Jul 2007 07:38:56 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 28 Jul 2007 07:39:35 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 12 Aug 2007 20:41:51 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200708-15.xml b/xml/htdocs/security/en/glsa/glsa-200708-15.xml
new file mode 100644
index 00000000..d7fad8e1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200708-15.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200708-15">
+  <title>Apache mod_jk: Directory traversal</title>
+  <synopsis>
+    A directory traversal vulnerability has been discovered in Apache mod_jk.
+  </synopsis>
+  <product type="ebuild">mod_jk</product>
+  <announced>August 19, 2007</announced>
+  <revised>August 19, 2007: 01</revised>
+  <bug>186218</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apache/mod_jk" auto="yes" arch="*">
+      <unaffected range="ge">1.2.23</unaffected>
+      <vulnerable range="lt">1.2.23</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Apache mod_jk is a connector for the Tomcat web server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Apache mod_jk decodes the URL within Apache before passing them to
+    Tomcat, which decodes them a second time.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker could browse a specially crafted URL on an Apache
+    server running mod_jk, possibly gaining access to restricted resources.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Apache mod_jk users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apache/mod_jk-1.2.23&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1860">CVE-2007-1860</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 29 Jul 2007 22:06:43 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 29 Jul 2007 22:08:30 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 12 Aug 2007 21:01:34 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200708-16.xml b/xml/htdocs/security/en/glsa/glsa-200708-16.xml
new file mode 100644
index 00000000..cf79ae3c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200708-16.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200708-16">
+  <title>Qt: Multiple format string vulnerabilities</title>
+  <synopsis>
+    Format string vulnerabilities in Qt 3 may lead to the remote execution of
+    arbitrary code in some Qt applications.
+  </synopsis>
+  <product type="ebuild">qt</product>
+  <announced>August 22, 2007</announced>
+  <revised>August 22, 2007: 01</revised>
+  <bug>185446</bug>
+  <access>remote, local</access>
+  <affected>
+    <package name="x11-libs/qt" auto="yes" arch="*">
+      <unaffected range="ge">3.3.8-r3</unaffected>
+      <vulnerable range="lt">3.3.8-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Qt is a cross-platform GUI framework, which is used e.g. by KDE.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tim Brown of Portcullis Computer Security Ltd and Dirk Mueller of KDE
+    reported multiple format string errors in qWarning() calls in files
+    qtextedit.cpp, qdatatable.cpp, qsqldatabase.cpp, qsqlindex.cpp,
+    qsqlrecord.cpp, qglobal.cpp, and qsvgdevice.cpp.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could trigger one of the vulnerabilities by causing a Qt
+    application to parse specially crafted text, which may lead to the
+    execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Qt 3 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;=x11-libs/qt-3*&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3388">CVE-2007-3388</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 15 Aug 2007 17:25:28 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 15 Aug 2007 17:25:45 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 19 Aug 2007 22:38:33 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200708-17.xml b/xml/htdocs/security/en/glsa/glsa-200708-17.xml
new file mode 100644
index 00000000..1ddd1b56
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200708-17.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200708-17">
+  <title>Opera: Multiple vulnerabilities</title>
+  <synopsis>
+    Opera contain several vulnerabilities, some of which may allow the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">opera</product>
+  <announced>August 22, 2007</announced>
+  <revised>August 22, 2007: 01</revised>
+  <bug>185497</bug>
+  <bug>188987</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/opera" auto="yes" arch="*">
+      <unaffected range="ge">9.23</unaffected>
+      <vulnerable range="lt">9.23</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Opera is a multi-platform web browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    An error known as "a virtual function call on an invalid pointer" has
+    been discovered in the JavaScript engine (CVE-2007-4367). Furthermore,
+    iDefense Labs reported that an already-freed pointer may be still used
+    under unspecified circumstances in the BitTorrent support
+    (CVE-2007-3929). At last, minor other errors have been discovered,
+    relative to memory read protection (Opera Advisory 861) and URI
+    displays (CVE-2007-3142, CVE-2007-3819).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could trigger the BitTorrent vulnerability by
+    enticing a user into starting a malicious BitTorrent download, and
+    execute arbitrary code through unspecified vectors. Additionally, a
+    specially crafted JavaScript may trigger the "virtual function"
+    vulnerability. The JavaScript engine can also access previously freed
+    but uncleaned memory. Finally, a user can be fooled with a too long
+    HTTP server name that does not fit the dialog box, or a URI containing
+    whitespaces.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time for all these
+    vulnerabilities.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Opera users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/opera-9.23&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3142">CVE-2007-3142</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3819">CVE-2007-3819</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3929">CVE-2007-3929</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4367">CVE-2007-4367</uri>
+    <uri link="http://www.opera.com/support/search/view/861/">Opera Advisory 861</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 29 Jul 2007 20:48:46 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 29 Jul 2007 20:48:57 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 20 Aug 2007 09:59:22 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200709-01.xml b/xml/htdocs/security/en/glsa/glsa-200709-01.xml
new file mode 100644
index 00000000..a667068b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200709-01.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200709-01">
+  <title>MIT Kerberos 5: Multiple vulnerabilities</title>
+  <synopsis>
+    Two vulnerabilites have been found in MIT Kerberos 5, which could allow a
+    remote unauthenticated user to execute arbitrary code with root privileges.
+  </synopsis>
+  <product type="ebuild">mit-krb5</product>
+  <announced>September 11, 2007</announced>
+  <revised>September 11, 2007: 01</revised>
+  <bug>191301</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/mit-krb5" auto="yes" arch="*">
+      <unaffected range="ge">1.5.3-r1</unaffected>
+      <vulnerable range="lt">1.5.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MIT Kerberos 5 is a suite of applications that implement the Kerberos
+    network protocol. kadmind is the MIT Kerberos 5 administration daemon.
+    </p>
+  </background>
+  <description>
+    <p>
+    A stack buffer overflow (CVE-2007-3999) has been reported in
+    svcauth_gss_validate() of the RPC library of kadmind. Another
+    vulnerability (CVE-2007-4000) has been found in
+    kadm5_modify_policy_internal(), which does not check the return values
+    of krb5_db_get_policy() correctly.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    The RPC related vulnerability can be exploited by a remote
+    unauthenticated attacker to execute arbitrary code with root privileges
+    on the host running kadmind. The second vulnerability requires the
+    remote attacker to be authenticated and to have "modify policy"
+    privileges. It could then also allow for the remote execution of
+    arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MIT Kerberos 5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-crypt/mit-krb5-1.5.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3999">CVE-2007-3999</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4000">CVE-2007-4000</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 08 Sep 2007 22:29:04 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 09 Sep 2007 19:22:20 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 10 Sep 2007 18:34:17 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200709-02.xml b/xml/htdocs/security/en/glsa/glsa-200709-02.xml
new file mode 100644
index 00000000..40824244
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200709-02.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200709-02">
+  <title>KVIrc: Remote arbitrary code execution</title>
+  <synopsis>
+    A vulnerability has been discovered in KVIrc, allowing for the remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">kvirc</product>
+  <announced>September 13, 2007</announced>
+  <revised>September 13, 2007: 01</revised>
+  <bug>183174</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-irc/kvirc" auto="yes" arch="*">
+      <unaffected range="ge">3.2.6_pre20070714</unaffected>
+      <vulnerable range="lt">3.2.6_pre20070714</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KVIrc is a free portable IRC client based on Qt.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Cornelius from Secunia Research discovered that the
+    "parseIrcUrl()" function in file src/kvirc/kernel/kvi_ircurl.cpp does
+    not properly sanitise parts of the URI when building the command for
+    KVIrc's internal script system.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    irc:// URI, possibly leading to the remote execution of arbitrary code
+    with the privileges of the user running KVIrc. Successful exploitation
+    requires that KVIrc is registered as the default handler for irc:// or
+    similar URIs.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All KVIrc users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-irc/kvirc-3.2.6_pre20070714&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2951">CVE-2007-2951</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 06 Aug 2007 14:12:16 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 19 Aug 2007 18:59:16 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 20 Aug 2007 11:26:17 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200709-03.xml b/xml/htdocs/security/en/glsa/glsa-200709-03.xml
new file mode 100644
index 00000000..5fe88724
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200709-03.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200709-03">
+  <title>Streamripper: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow vulnerability has been discovered in Streamripper,
+    allowing for user-assisted execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">streamripper</product>
+  <announced>September 13, 2007</announced>
+  <revised>September 13, 2007: 01</revised>
+  <bug>188698</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/streamripper" auto="yes" arch="*">
+      <unaffected range="ge">1.62.2</unaffected>
+      <vulnerable range="lt">1.62.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Streamripper is a tool for extracting and recording mp3 files from a
+    Shoutcast stream.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Rohlf discovered several boundary errors in the
+    httplib_parse_sc_header() function when processing HTTP headers.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to connect to a malicious
+    streaming server, resulting in the execution of arbitrary code with the
+    privileges of the user running Streamripper.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Streamripper users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/streamripper-1.62.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4337">CVE-2007-4337</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 24 Aug 2007 09:30:52 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 24 Aug 2007 09:31:49 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 08 Sep 2007 15:35:27 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200709-04.xml b/xml/htdocs/security/en/glsa/glsa-200709-04.xml
new file mode 100644
index 00000000..50ba1454
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200709-04.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200709-04">
+  <title>po4a: Insecure temporary file creation</title>
+  <synopsis>
+    A vulnerability has been discovered in po4a, allowing for a symlink attack.
+  </synopsis>
+  <product type="ebuild">po4a</product>
+  <announced>September 13, 2007</announced>
+  <revised>September 13, 2007: 01</revised>
+  <bug>189440</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-text/po4a" auto="yes" arch="*">
+      <unaffected range="ge">0.32-r1</unaffected>
+      <vulnerable range="lt">0.32-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    po4a is a set of tools for helping with the translation of
+    documentation.
+    </p>
+  </background>
+  <description>
+    <p>
+    The po4a development team reported a race condition in the gettextize()
+    function when creating the file "/tmp/gettextization.failed.po".
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could perform a symlink attack, possibly overwriting
+    files with the permissions of the user running po4a.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All po4a users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/po4a-0.32-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4462">CVE-2007-4462</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 28 Aug 2007 20:28:00 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 28 Aug 2007 20:28:12 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 08 Sep 2007 16:20:41 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200709-05.xml b/xml/htdocs/security/en/glsa/glsa-200709-05.xml
new file mode 100644
index 00000000..0d719601
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200709-05.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200709-05">
+  <title>RealPlayer: Buffer overflow</title>
+  <synopsis>
+    RealPlayer is vulnerable to a buffer overflow allowing for execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">realplayer</product>
+  <announced>September 14, 2007</announced>
+  <revised>September 14, 2007: 01</revised>
+  <bug>183421</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/realplayer" auto="yes" arch="*">
+      <unaffected range="ge">10.0.9</unaffected>
+      <vulnerable range="lt">10.0.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    RealPlayer is a multimedia player capable of handling multiple
+    multimedia file formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    A stack-based buffer overflow vulnerability has been reported in the
+    SmilTimeValue::parseWallClockValue() function in smlprstime.cpp when
+    handling HH:mm:ss.f type time formats.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to open a specially crafted SMIL (Synchronized
+    Multimedia Integration Language) file, an attacker could be able to
+    execute arbitrary code with the privileges of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All RealPlayer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/realplayer-10.0.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3410">CVE-2007-3410</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 29 Aug 2007 10:19:49 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 29 Aug 2007 10:19:58 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 09 Sep 2007 20:21:51 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200709-06.xml b/xml/htdocs/security/en/glsa/glsa-200709-06.xml
new file mode 100644
index 00000000..a34702bf
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200709-06.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200709-06">
+  <title>flac123: Buffer overflow</title>
+  <synopsis>
+    flac123 is affected by a buffer overflow vulnerability, which could allow
+    for the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">flac123</product>
+  <announced>September 14, 2007</announced>
+  <revised>September 14, 2007: 01</revised>
+  <bug>186220</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/flac123" auto="yes" arch="*">
+      <unaffected range="ge">0.0.11</unaffected>
+      <vulnerable range="lt">0.0.11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    flac123 is a command-line application for playing FLAC audio files.
+    </p>
+  </background>
+  <description>
+    <p>
+    A possible buffer overflow vulnerability has been reported in the
+    local__vcentry_parse_value() function in vorbiscomment.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to play a specially crafted audio file,
+    which could lead to the execution of arbitrary code with the privileges
+    of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All flac123 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/flac123-0.0.11&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3507">CVE-2007-3507</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 29 Aug 2007 10:21:26 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 29 Aug 2007 11:36:53 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 11 Sep 2007 15:39:45 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200709-07.xml b/xml/htdocs/security/en/glsa/glsa-200709-07.xml
new file mode 100644
index 00000000..301eae1f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200709-07.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200709-07">
+  <title>Eggdrop: Buffer overflow</title>
+  <synopsis>
+    A remote stack-based buffer overflow has been discovered in Eggdrop.
+  </synopsis>
+  <product type="ebuild">eggdrop</product>
+  <announced>September 15, 2007</announced>
+  <revised>September 26, 2007: 02</revised>
+  <bug>179354</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-irc/eggdrop" auto="yes" arch="*">
+      <unaffected range="ge">1.6.18-r3</unaffected>
+      <vulnerable range="lt">1.6.18-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Eggdrop is an IRC bot extensible with C or Tcl.
+    </p>
+  </background>
+  <description>
+    <p>
+    Bow Sineath discovered a boundary error in the file
+    mod/server.mod/servrmsg.c when processing overly long private messages
+    sent by an IRC server.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice an Eggdrop user to connect the bot to a
+    malicious server, possibly resulting in the execution of arbitrary code
+    on the host running Eggdrop.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Eggdrop users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-irc/eggdrop-1.6.18-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2807">CVE-2007-2807</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 23 Aug 2007 09:04:09 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 23 Aug 2007 09:04:22 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 07 Sep 2007 09:43:27 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200709-08.xml b/xml/htdocs/security/en/glsa/glsa-200709-08.xml
new file mode 100644
index 00000000..3e5d7b09
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200709-08.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200709-08">
+  <title>id3lib: Insecure temporary file creation</title>
+  <synopsis>
+    A vulnerability has been discovered in id3lib allowing local users to
+    overwrite arbitrary files via a symlink attack.
+  </synopsis>
+  <product type="ebuild">id3lib</product>
+  <announced>September 15, 2007</announced>
+  <revised>September 15, 2007: 01</revised>
+  <bug>189610</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-libs/id3lib" auto="yes" arch="*">
+      <unaffected range="ge">3.8.3-r6</unaffected>
+      <vulnerable range="lt">3.8.3-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    id3lib is an open-source, cross-platform software development library
+    for reading, writing, and manipulating ID3v1 and ID3v2 tags.
+    </p>
+  </background>
+  <description>
+    <p>
+    Nikolaus Schulz discovered that the function RenderV2ToFile() in file
+    src/tag_file.cpp creates temporary files in an insecure manner.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit this vulnerability via a symlink attack
+    to overwrite arbitrary files.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All id3lib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/id3lib-3.8.3-r6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4460">CVE-2007-4460</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 13 Sep 2007 20:50:09 +0000">
+    mfleming
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 14 Sep 2007 08:35:20 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200709-09.xml b/xml/htdocs/security/en/glsa/glsa-200709-09.xml
new file mode 100644
index 00000000..bc026cb8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200709-09.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200709-09">
+  <title>GNU Tar: Directory traversal vulnerability</title>
+  <synopsis>
+    A directory traversal vulnerability has been discovered in GNU Tar.
+  </synopsis>
+  <product type="ebuild">tar</product>
+  <announced>September 15, 2007</announced>
+  <revised>September 15, 2007: 01</revised>
+  <bug>189682</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/tar" auto="yes" arch="*">
+      <unaffected range="ge">1.18-r2</unaffected>
+      <vulnerable range="lt">1.18-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The GNU Tar program provides the ability to create tar archives, as
+    well as various other kinds of manipulation.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dmitry V. Levin discovered a directory traversal vulnerability in the
+    contains_dot_dot() function in file src/names.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to extract a specially crafted tar archive, a remote
+    attacker could extract files to arbitrary locations outside of the
+    specified directory with the permissions of the user running GNU Tar.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GNU Tar users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/tar-1.18-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4131">CVE-2007-4131</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 13 Sep 2007 18:11:35 +0000">
+    mfleming
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 13 Sep 2007 18:49:13 +0000">
+    mfleming
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200709-10.xml b/xml/htdocs/security/en/glsa/glsa-200709-10.xml
new file mode 100644
index 00000000..a9467534
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200709-10.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200709-10">
+  <title>PhpWiki: Authentication bypass</title>
+  <synopsis>
+    A vulnerability has been discovered in PhpWiki authentication mechanism.
+  </synopsis>
+  <product type="ebuild">phpwiki</product>
+  <announced>September 18, 2007</announced>
+  <revised>September 18, 2007: 01</revised>
+  <bug>181692</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phpwiki" auto="yes" arch="*">
+      <unaffected range="ge">1.3.14</unaffected>
+      <vulnerable range="lt">1.3.14</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PhpWiki is an application that creates a web site where anyone can edit
+    the pages through HTML forms.
+    </p>
+  </background>
+  <description>
+    <p>
+    The PhpWiki development team reported an authentication error within
+    the file lib/WikiUser/LDAP.php when binding to an LDAP server with an
+    empty password.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker could provide an empty password when authenticating.
+    Depending on the LDAP implementation used, this could bypass the
+    PhpWiki authentication mechanism and grant the attacker access to the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PhpWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/phpwiki-1.3.14&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3193">CVE-2007-3193</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 04 Sep 2007 23:41:27 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 08 Sep 2007 16:22:11 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 15 Sep 2007 20:54:32 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200709-11.xml b/xml/htdocs/security/en/glsa/glsa-200709-11.xml
new file mode 100644
index 00000000..ddf01472
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200709-11.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200709-11">
+  <title>GDM: Local Denial of Service</title>
+  <synopsis>
+    GDM can be crashed by a local user, preventing it from managing future
+    displays.
+  </synopsis>
+  <product type="ebuild">gdm</product>
+  <announced>September 18, 2007</announced>
+  <revised>September 18, 2007: 01</revised>
+  <bug>187919</bug>
+  <access>local</access>
+  <affected>
+    <package name="gnome-base/gdm" auto="yes" arch="*">
+      <unaffected range="ge">2.18.4</unaffected>
+      <unaffected range="rge">2.16.7</unaffected>
+      <vulnerable range="lt">2.18.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GDM is the GNOME display manager.
+    </p>
+  </background>
+  <description>
+    <p>
+    The result of a g_strsplit() call is incorrectly parsed in the files
+    daemon/gdm.c, daemon/gdmconfig.c, gui/gdmconfig.c and
+    gui/gdmflexiserver.c, allowing for a null pointer dereference.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A local user could send a crafted message to /tmp/.gdm_socket that
+    would trigger the null pointer dereference and crash GDM, thus
+    preventing it from managing future displays.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Restrict the write permissions on /tmp/.gdm_socket to trusted users
+    only after each GDM restart.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GDM users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;gnome-base/gdm&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3381">CVE-2007-3381</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 15 Aug 2007 05:40:23 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 15 Aug 2007 05:40:36 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 20 Aug 2007 09:31:53 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200709-12.xml b/xml/htdocs/security/en/glsa/glsa-200709-12.xml
new file mode 100644
index 00000000..ecba5e21
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200709-12.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200709-12">
+  <title>Poppler: Two buffer overflow vulnerabilities</title>
+  <synopsis>
+    Poppler is vulnerable to an integer overflow and a stack overflow.
+  </synopsis>
+  <product type="ebuild">poppler</product>
+  <announced>September 19, 2007</announced>
+  <revised>September 19, 2007: 01</revised>
+  <bug>188863</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/poppler" auto="yes" arch="*">
+      <unaffected range="ge">0.5.4-r2</unaffected>
+      <vulnerable range="lt">0.5.4-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Poppler is a cross-platform PDF rendering library originally based on
+    Xpdf.
+    </p>
+  </background>
+  <description>
+    <p>
+    Poppler and Xpdf are vulnerable to an integer overflow in the
+    StreamPredictor::StreamPredictor function, and a stack overflow in the
+    StreamPredictor::getNextLine function. The original vulnerability was
+    discovered by Maurycy Prodeus. Note: Gentoo's version of Xpdf is
+    patched to use the Poppler library, so the update to Poppler will also
+    fix Xpdf.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to view a specially crafted program with a
+    Poppler-based PDF viewer such as Gentoo's Xpdf, Epdfview, or Evince, a
+    remote attacker could cause an overflow, potentially resulting in the
+    execution of arbitrary code with the privileges of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Poppler users should upgrade to the latest version of Poppler:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/poppler-0.5.4-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3387">CVE-2007-3387</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 29 Aug 2007 12:44:56 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 29 Aug 2007 12:45:03 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 01 Sep 2007 13:10:32 +0000">
+    aetius
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200709-13.xml b/xml/htdocs/security/en/glsa/glsa-200709-13.xml
new file mode 100644
index 00000000..93c764a5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200709-13.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200709-13">
+  <title>rsync: Two buffer overflows</title>
+  <synopsis>
+    Two user-assisted buffer overflow vulnerabilities have been discovered in
+    rsync.
+  </synopsis>
+  <product type="ebuild">rsync</product>
+  <announced>September 20, 2007</announced>
+  <revised>September 20, 2007: 01</revised>
+  <bug>189132</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/rsync" auto="yes" arch="*">
+      <unaffected range="ge">2.6.9-r3</unaffected>
+      <vulnerable range="lt">2.6.9-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    rsync is a file transfer program to keep remote directories
+    synchronized.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sebastian Krahmer from the SUSE Security Team discovered two off-by-one
+    errors in the function "f_name()" in file sender.c when processing
+    overly long directory names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to synchronize a repository
+    containing specially crafted directories, leading to the execution of
+    arbitrary code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All rsync users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/rsync-2.6.9-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4091">CVE-2007-4091</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 08 Sep 2007 22:30:02 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 09 Sep 2007 00:00:07 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 15 Sep 2007 16:04:37 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200709-14.xml b/xml/htdocs/security/en/glsa/glsa-200709-14.xml
new file mode 100644
index 00000000..458ee4b9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200709-14.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200709-14">
+  <title>ClamAV: Multiple vulnerabilities</title>
+  <synopsis>
+    Vulnerabilities have been discovered in ClamAV allowing remote execution of
+    arbitrary code and Denial of Service attacks.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>September 20, 2007</announced>
+  <revised>September 20, 2007: 01</revised>
+  <bug>189912</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.91.2</unaffected>
+      <vulnerable range="lt">0.91.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Clam AntiVirus is an open source (GPL) anti-virus toolkit for UNIX,
+    designed especially for e-mail scanning on mail gateways.
+    </p>
+  </background>
+  <description>
+    <p>
+    Nikolaos Rangos discovered a vulnerability in ClamAV which exists
+    because the recipient address extracted from email messages is not
+    properly sanitized before being used in a call to "popen()" when
+    executing sendmail (CVE-2007-4560). Also, NULL-pointer dereference
+    errors exist within the "cli_scanrtf()" function in libclamav/rtf.c and
+    Stefanos Stamatis discovered a NULL-pointer dereference vulnerability
+    within the "cli_html_normalise()" function in libclamav/htmlnorm.c
+    (CVE-2007-4510).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    The unsanitized recipient address can be exploited to execute arbitrary
+    code with the privileges of the clamav-milter process by sending an
+    email with a specially crafted recipient address to the affected
+    system. Also, the NULL-pointer dereference errors can be exploited to
+    crash ClamAV. Successful exploitation of the latter vulnerability
+    requires that clamav-milter is started with the "black hole" mode
+    activated, which is not enabled by default.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.91.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4510">CVE-2007-4510</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4560">CVE-2007-4560</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 14 Sep 2007 22:57:24 +0000">
+    mfleming
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 15 Sep 2007 12:07:22 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200709-15.xml b/xml/htdocs/security/en/glsa/glsa-200709-15.xml
new file mode 100644
index 00000000..313eaa5e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200709-15.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200709-15">
+  <title>BEA JRockit: Multiple vulnerabilities</title>
+  <synopsis>
+    BEA JRockit contains several vulnerabilities, some of which may allow the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">jrockit-jdk-bin</product>
+  <announced>September 23, 2007</announced>
+  <revised>September 23, 2007: 01</revised>
+  <bug>190686</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/jrockit-jdk-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.11_p1</unaffected>
+      <vulnerable range="lt">1.5.0.11_p1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    BEA JRockit provides tools, utilities, and a complete runtime
+    environment for developing and running applications using the Java
+    programming language.
+    </p>
+  </background>
+  <description>
+    <p>
+    An integer overflow vulnerability exists in the embedded ICC profile
+    image parser (CVE-2007-2788), an unspecified vulnerability exists in
+    the font parsing implementation (CVE-2007-4381), and an error exists
+    when processing XSLT stylesheets contained in XSLT Transforms in XML
+    signatures (CVE-2007-3716), among other vulnerabilities.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could trigger the integer overflow to execute
+    arbitrary code or crash the JVM through a specially crafted file. Also,
+    an attacker could perform unauthorized actions via an applet that
+    grants certain privileges to itself because of the font parsing
+    vulnerability. The error when processing XSLT stylesheets can be
+    exploited to execute arbitrary code. Other vulnerabilities could lead
+    to establishing restricted network connections to certain services,
+    Cross Site Scripting and Denial of Service attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time for all these
+    vulnerabilities.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All BEA JRockit users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/jrockit-jdk-bin-1.5.0.11_p1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2788">CVE-2007-2788</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2789">CVE-2007-2789</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3004">CVE-2007-3004</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3005">CVE-2007-3005</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3503">CVE-2007-3503</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3698">CVE-2007-3698</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3716">CVE-2007-3716</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3922">CVE-2007-3922</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4381">CVE-2007-4381</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 15 Sep 2007 21:57:11 +0000">
+    mfleming
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 17 Sep 2007 12:51:05 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200709-16.xml b/xml/htdocs/security/en/glsa/glsa-200709-16.xml
new file mode 100644
index 00000000..39a99ac5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200709-16.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200709-16">
+  <title>Lighttpd: Buffer overflow</title>
+  <synopsis>
+    Lighttpd is vulnerable to the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">lighttpd</product>
+  <announced>September 27, 2007</announced>
+  <revised>September 27, 2007: 01</revised>
+  <bug>191912</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/lighttpd" auto="yes" arch="*">
+      <unaffected range="ge">1.4.18</unaffected>
+      <vulnerable range="lt">1.4.18</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Lighttpd is a lightweight HTTP web server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mattias Bengtsson and Philip Olausson have discovered a buffer overflow
+    vulnerability in the function fcgi_env_add() in the file mod_fastcgi.c
+    when processing overly long HTTP headers.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send a specially crafted request to the
+    vulnerable Lighttpd server, resulting in the remote execution of
+    arbitrary code with privileges of the user running the web server. Note
+    that mod_fastcgi is disabled in Gentoo's default configuration.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Edit the file /etc/lighttpd/lighttpd.conf and comment the following
+    line: "include mod_fastcgi.conf"
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Lighttpd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/lighttpd-1.4.18&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4727">CVE-2007-4727</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 20 Sep 2007 21:10:23 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 20 Sep 2007 21:10:32 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 22 Sep 2007 16:06:46 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200709-17.xml b/xml/htdocs/security/en/glsa/glsa-200709-17.xml
new file mode 100644
index 00000000..c83b79b5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200709-17.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200709-17">
+  <title>teTeX: Multiple buffer overflows</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in teTeX, allowing for
+    user-assisted execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">tetex</product>
+  <announced>September 27, 2007</announced>
+  <revised>September 27, 2007: 01</revised>
+  <bug>170861</bug>
+  <bug>182055</bug>
+  <bug>188172</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/tetex" auto="yes" arch="*">
+      <unaffected range="ge">3.0_p1-r4</unaffected>
+      <vulnerable range="lt">3.0_p1-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    teTeX is a complete TeX distribution for editing documents.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mark Richters discovered a buffer overflow in the open_sty() function
+    in file mkind.c. Other vulnerabilities have also been discovered in the
+    same file but might not be exploitable (CVE-2007-0650). Tetex also
+    includes vulnerable code from GD library (GLSA 200708-05), and from
+    Xpdf (CVE-2007-3387).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to process a specially crafted
+    PNG, GIF or PDF file, or to execute "makeindex" on an overly long
+    filename. In both cases, this could lead to the remote execution of
+    arbitrary code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All teTeX users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/tetex-3.0_p1-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0650">CVE-2007-0650</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3387">CVE-2007-3387</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200708-05.xml">GLSA-200708-05</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 08 Sep 2007 15:34:16 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 22 Sep 2007 14:17:49 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 27 Sep 2007 21:28:55 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200709-18.xml b/xml/htdocs/security/en/glsa/glsa-200709-18.xml
new file mode 100644
index 00000000..47cae56d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200709-18.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200709-18">
+  <title>Bugzilla: Multiple vulnerabilities</title>
+  <synopsis>
+    Bugzilla contains several vulnerabilities, some of them possibly leading to
+    the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">bugzilla</product>
+  <announced>September 30, 2007</announced>
+  <revised>May 28, 2009: 03</revised>
+  <bug>190112</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/bugzilla" auto="yes" arch="*">
+      <unaffected range="rge">2.20.5</unaffected>
+      <unaffected range="rge">2.22.3</unaffected>
+      <unaffected range="ge">3.0.1</unaffected>
+      <unaffected range="rge">2.22.5</unaffected>
+      <unaffected range="rge">2.20.6</unaffected>
+      <vulnerable range="lt">3.0.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Bugzilla is a web application designed to help with managing software
+    development.
+    </p>
+  </background>
+  <description>
+    <p>
+    Masahiro Yamada found that from the 2.17.1 version, Bugzilla does not
+    properly sanitize the content of the "buildid" parameter when filing
+    bugs (CVE-2007-4543). The next two vulnerabilities only affect Bugzilla
+    2.23.3 or later, hence the stable Gentoo Portage tree does not contain
+    these two vulnerabilities: Loic Minier reported that the
+    "Email::Send::Sendmail()" function does not properly sanitise "from"
+    email information before sending it to the "-f" parameter of
+    /usr/sbin/sendmail (CVE-2007-4538), and Frederic Buclin discovered that
+    the XML-RPC interface does not correctly check permissions in the
+    time-tracking fields (CVE-2007-4539).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could trigger the "buildid" vulnerability by sending
+    a specially crafted form to Bugzilla, leading to a persistent XSS, thus
+    allowing for theft of credentials. With Bugzilla 2.23.3 or later, an
+    attacker could also execute arbitrary code with the permissions of the
+    web server by injecting a specially crafted "from" email address and
+    gain access to normally restricted time-tracking information through
+    the XML-RPC service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Bugzilla users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose www-apps/bugzilla</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4538">CVE-2007-4538</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4539">CVE-2007-4539</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4543">CVE-2007-4543</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 12 Sep 2007 09:19:32 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 13 Sep 2007 16:25:04 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 14 Sep 2007 08:36:10 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-01.xml b/xml/htdocs/security/en/glsa/glsa-200710-01.xml
new file mode 100644
index 00000000..6c346395
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-01.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-01">
+  <title>RPCSEC_GSS library: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow vulnerability has been discovered in librpcsecgss.
+  </synopsis>
+  <product type="ebuild">librcpsecgss</product>
+  <announced>October 04, 2007</announced>
+  <revised>October 04, 2007: 01</revised>
+  <bug>191479</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-libs/librpcsecgss" auto="yes" arch="*">
+      <unaffected range="ge">0.16</unaffected>
+      <vulnerable range="lt">0.16</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    librpcsecgss is an implementation of RPCSEC_GSS for secure RPC
+    communications.
+    </p>
+  </background>
+  <description>
+    <p>
+    A stack based buffer overflow has been discovered in the
+    svcauth_gss_validate() function in file lib/rpc/svc_auth_gss.c when
+    processing an overly long string in a RPC message.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send a specially crafted RPC request to an
+    application relying on this library, e.g NFSv4 or Kerberos
+    (GLSA-200709-01), resulting in the execution of arbitrary code with the
+    privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All librpcsecgss users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/librpcsecgss-0.16&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3999">CVE-2007-3999</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200709-01.xml">GLSA-200709-01</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 09 Sep 2007 19:27:24 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 09 Sep 2007 19:29:01 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 29 Sep 2007 15:36:52 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-02.xml b/xml/htdocs/security/en/glsa/glsa-200710-02.xml
new file mode 100644
index 00000000..89df8630
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-02.xml
@@ -0,0 +1,154 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-02">
+  <title>PHP: Multiple vulnerabilities</title>
+  <synopsis>
+    PHP contains several vulnerabilities including buffer and integer overflows
+    which could lead to the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">php</product>
+  <announced>October 07, 2007</announced>
+  <revised>October 07, 2007: 01</revised>
+  <bug>179158</bug>
+  <bug>180556</bug>
+  <bug>191034</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/php" auto="yes" arch="*">
+      <unaffected range="ge">5.2.4_p20070914-r2</unaffected>
+      <vulnerable range="lt">5.2.4_p20070914-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHP is a widely-used general-purpose scripting language that is
+    especially suited for Web development and can be embedded into HTML.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several vulnerabilities were found in PHP. Mattias Bengtsson and Philip
+    Olausson reported integer overflows in the gdImageCreate() and
+    gdImageCreateTrueColor() functions of the GD library which can cause
+    heap-based buffer overflows (CVE-2007-3996). Gerhard Wagner discovered
+    an integer overflow in the chunk_split() function that can lead to a
+    heap-based buffer overflow (CVE-2007-2872). Its incomplete fix caused
+    incorrect buffer size calculation due to precision loss, also resulting
+    in a possible heap-based buffer overflow (CVE-2007-4661 and
+    CVE-2007-4660). A buffer overflow in the sqlite_decode_binary() of the
+    SQLite extension found by Stefan Esser that was addressed in PHP 5.2.1
+    was not fixed correctly (CVE-2007-1887).
+    </p>
+    <p>
+    Stefan Esser discovered an error in the zend_alter_ini_entry() function
+    handling a memory_limit violation (CVE-2007-4659). Stefan Esser also
+    discovered a flaw when handling interruptions with userspace error
+    handlers that can be exploited to read arbitrary heap memory
+    (CVE-2007-1883). Disclosure of sensitive memory can also be triggered
+    due to insufficient boundary checks in the strspn() and strcspn()
+    functions, an issue discovered by Mattias Bengtsson and Philip Olausson
+    (CVE-2007-4657)
+    </p>
+    <p>
+    Stefan Esser reported incorrect validation in the FILTER_VALIDATE_EMAIL
+    filter of the Filter extension allowing arbitrary email header
+    injection (CVE-2007-1900). NOTE: This CVE was referenced, but not fixed
+    in GLSA 200705-19.
+    </p>
+    <p>
+    Stanislav Malyshev found an error with unknown impact in the
+    money_format() function when processing "%i" and "%n" tokens
+    (CVE-2007-4658). zatanzlatan reported a buffer overflow in the
+    php_openssl_make_REQ() function with unknown impact when providing a
+    manipulated SSL configuration file (CVE-2007-4662). Possible memory
+    corruption when trying to read EXIF data in exif_read_data() and
+    exif_thumbnail() occurred with unknown impact.
+    </p>
+    <p>
+    Several vulnerabilities that allow bypassing of open_basedir and other
+    restrictions were reported, including the glob() function
+    (CVE-2007-4663), the session_save_path(), ini_set(), and error_log()
+    functions which can allow local command execution (CVE-2007-3378),
+    involving the readfile() function (CVE-2007-3007), via the Session
+    extension (CVE-2007-4652), via the MySQL extension (CVE-2007-3997) and
+    in the dl() function which allows loading extensions outside of the
+    specified directory (CVE-2007-4825).
+    </p>
+    <p>
+    Multiple Denial of Service vulnerabilities were discovered, including a
+    long "library" parameter in the dl() function (CVE-2007-4887), in
+    several iconv and xmlrpc functions (CVE-2007-4840 and CVE-2007-4783),
+    in the setlocale() function (CVE-2007-4784), in the glob() and
+    fnmatch() function (CVE-2007-4782 and CVE-2007-3806), a floating point
+    exception in the wordwrap() function (CVE-2007-3998), a stack
+    exhaustion via deeply nested arrays (CVE-2007-4670), an infinite loop
+    caused by a specially crafted PNG image in the png_read_info() function
+    of libpng (CVE-2007-2756) and several issues related to array
+    conversion.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    Remote attackers might be able to exploit these issues in PHP
+    applications making use of the affected functions, potentially
+    resulting in the execution of arbitrary code, Denial of Service,
+    execution of scripted contents in the context of the affected site,
+    security bypass or information leak.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/php-5.2.4_p20070914-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1883">CVE-2007-1883</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1887">CVE-2007-1887</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1900">CVE-2007-1900</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756">CVE-2007-2756</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2872">CVE-2007-2872</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3007">CVE-2007-3007</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3378">CVE-2007-3378</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3806">CVE-2007-3806</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3996">CVE-2007-3996</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3997">CVE-2007-3997</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3998">CVE-2007-3998</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4652">CVE-2007-4652</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4657">CVE-2007-4657</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4658">CVE-2007-4658</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4659">CVE-2007-4659</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4660">CVE-2007-4660</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4661">CVE-2007-4661</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4662">CVE-2007-4662</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4663">CVE-2007-4663</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4670">CVE-2007-4670</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4727">CVE-2007-4727</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4782">CVE-2007-4782</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4783">CVE-2007-4783</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4784">CVE-2007-4784</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4825">CVE-2007-4825</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4840">CVE-2007-4840</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4887">CVE-2007-4887</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200705-19.xml">GLSA 200705-19</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 19 Aug 2007 18:58:47 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 19 Aug 2007 18:58:59 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 27 Sep 2007 00:18:38 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-03.xml b/xml/htdocs/security/en/glsa/glsa-200710-03.xml
new file mode 100644
index 00000000..f0365179
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-03.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-03">
+  <title>libvorbis: Multiple vulnerabilities</title>
+  <synopsis>
+    A buffer overflow vulnerability and several memory corruptions have been
+    discovered in libvorbis.
+  </synopsis>
+  <product type="ebuild">libvorbis</product>
+  <announced>October 07, 2007</announced>
+  <revised>October 07, 2007: 01</revised>
+  <bug>186716</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libvorbis" auto="yes" arch="*">
+      <unaffected range="ge">1.2.0</unaffected>
+      <vulnerable range="lt">1.2.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libvorbis is the reference implementation of the Xiph.org Ogg Vorbis
+    audio file format. It is used by many applications for playback of Ogg
+    Vorbis files.
+    </p>
+  </background>
+  <description>
+    <p>
+    David Thiel of iSEC Partners discovered a heap-based buffer overflow in
+    the _01inverse() function in res0.c and a boundary checking error in
+    the vorbis_info_clear() function in info.c (CVE-2007-3106 and
+    CVE-2007-4029). libvorbis is also prone to several Denial of Service
+    vulnerabilities in form of infinite loops and invalid memory access
+    with unknown impact (CVE-2007-4065 and CVE-2007-4066).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities by enticing a
+    user to open a specially crafted Ogg Vorbis file or network stream with
+    an application using libvorbis. This might lead to the execution of
+    arbitrary code with privileges of the user playing the file or a Denial
+    of Service by a crash or CPU consumption.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libvorbis users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libvorbis-1.2.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3106">CVE-2007-3106</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4029">CVE-2007-4029</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4065">CVE-2007-4065</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4066">CVE-2007-4066</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 04 Sep 2007 23:57:53 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 08 Sep 2007 16:21:39 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 02 Oct 2007 15:39:27 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-04.xml b/xml/htdocs/security/en/glsa/glsa-200710-04.xml
new file mode 100644
index 00000000..40cfe310
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-04.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-04">
+  <title>libsndfile: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow vulnerability has been discovered in libsndfile.
+  </synopsis>
+  <product type="ebuild">libsndfile</product>
+  <announced>October 07, 2007</announced>
+  <revised>October 07, 2007: 01</revised>
+  <bug>192834</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libsndfile" auto="yes" arch="*">
+      <unaffected range="ge">1.0.17-r1</unaffected>
+      <vulnerable range="lt">1.0.17-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libsndfile is a library for reading and writing various formats of
+    audio files including WAV and FLAC.
+    </p>
+  </background>
+  <description>
+    <p>
+    Robert Buchholz of the Gentoo Security team discovered that the
+    flac_buffer_copy() function does not correctly handle FLAC streams with
+    variable block sizes which leads to a heap-based buffer overflow
+    (CVE-2007-4974).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit this vulnerability by enticing a user
+    to open a specially crafted FLAC file or network stream with an
+    application using libsndfile. This might lead to the execution of
+    arbitrary code with privileges of the user playing the file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libsndfile users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libsndfile-1.0.17-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4974">CVE-2007-4974</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 06 Oct 2007 23:14:31 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 07 Oct 2007 18:26:17 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 07 Oct 2007 19:16:11 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-05.xml b/xml/htdocs/security/en/glsa/glsa-200710-05.xml
new file mode 100644
index 00000000..0bc2898f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-05.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-05">
+  <title>QGit: Insecure temporary file creation</title>
+  <synopsis>
+    A vulnerability has been discovered in QGit allowing local users to
+    overwrite arbitrary files and execute arbitrary code with another user's
+    rights.
+  </synopsis>
+  <product type="ebuild">qgit</product>
+  <announced>October 07, 2007</announced>
+  <revised>October 07, 2007: 01</revised>
+  <bug>190697</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-util/qgit" auto="yes" arch="*">
+      <unaffected range="ge">1.5.7</unaffected>
+      <vulnerable range="lt">1.5.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    QGit is a graphical interface to git repositories that allows you to
+    browse revisions history, view patch content and changed files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Raphael Marichez discovered that the DataLoader::doStart() method
+    creates temporary files in an insecure manner and executes them.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could perform a symlink attack, possibly overwriting
+    files or executing arbitrary code with the rights of the user running
+    QGit.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All QGit users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-util/qgit-1.5.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4631">CVE-2007-4631</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 24 Sep 2007 08:55:56 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 24 Sep 2007 08:56:46 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 07 Oct 2007 18:55:10 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-06.xml b/xml/htdocs/security/en/glsa/glsa-200710-06.xml
new file mode 100644
index 00000000..29712a88
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-06.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-06">
+  <title>OpenSSL: Multiple vulnerabilities</title>
+  <synopsis>
+    A buffer underflow vulnerability and an information disclosure
+    vulnerability have been discovered in OpenSSL.
+  </synopsis>
+  <product type="ebuild">openssl</product>
+  <announced>October 07, 2007</announced>
+  <revised>October 07, 2007: 01</revised>
+  <bug>188799</bug>
+  <bug>194039</bug>
+  <access>local, remote</access>
+  <affected>
+    <package name="dev-libs/openssl" auto="yes" arch="*">
+      <unaffected range="ge">0.9.8e-r3</unaffected>
+      <vulnerable range="lt">0.9.8e-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSSL is an implementation of the Secure Socket Layer and Transport
+    Layer Security protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    Moritz Jodeit reported an off-by-one error in the
+    SSL_get_shared_ciphers() function, resulting from an incomplete fix of
+    CVE-2006-3738. A flaw has also been reported in the
+    BN_from_montgomery() function in crypto/bn/bn_mont.c when performing
+    Montgomery multiplication.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker sending a specially crafted packet to an application
+    relying on OpenSSL could possibly execute arbitrary code with the
+    privileges of the user running the application. A local attacker could
+    perform a side channel attack to retrieve the RSA private keys.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenSSL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/openssl-0.9.8e-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738">CVE-2006-3738</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3108">CVE-2007-3108</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5135">CVE-2007-5135</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 10 Sep 2007 06:24:11 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 10 Sep 2007 06:24:24 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 06 Oct 2007 13:14:06 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-07.xml b/xml/htdocs/security/en/glsa/glsa-200710-07.xml
new file mode 100644
index 00000000..fb72ee82
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-07.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-07">
+  <title>Tk: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow vulnerability has been discovered in Tk.
+  </synopsis>
+  <product type="ebuild">tk</product>
+  <announced>October 07, 2007</announced>
+  <revised>October 07, 2007: 01</revised>
+  <bug>192539</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/tk" auto="yes" arch="*">
+      <unaffected range="ge">8.4.15-r1</unaffected>
+      <vulnerable range="lt">8.4.15-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Tk is a toolkit for creating graphical user interfaces.
+    </p>
+  </background>
+  <description>
+    <p>
+    Reinhard Max discovered a boundary error in Tk when processing an
+    interlaced GIF with two frames where the second is smaller than the
+    first one.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted GIF
+    image with a Tk-based software, possibly resulting in the execution of
+    arbitrary code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Tk users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/tk-8.4.15-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4851">CVE-2007-4851</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 25 Sep 2007 09:49:33 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 25 Sep 2007 09:49:45 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 02 Oct 2007 20:07:14 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-08.xml b/xml/htdocs/security/en/glsa/glsa-200710-08.xml
new file mode 100644
index 00000000..439245b0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-08.xml
@@ -0,0 +1,100 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-08">
+  <title>KOffice, KWord, KPDF, KDE Graphics Libraries: Stack-based buffer overflow</title>
+  <synopsis>
+    KPDF includes code from xpdf that is vulnerable to a stack-based buffer
+    overflow.
+  </synopsis>
+  <product type="ebuild">koffice, kword, kdegraphics, kpdf</product>
+  <announced>October 09, 2007</announced>
+  <revised>October 09, 2007: 01</revised>
+  <bug>187139</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/koffice" auto="yes" arch="*">
+      <unaffected range="ge">1.6.3-r1</unaffected>
+      <vulnerable range="lt">1.6.3-r1</vulnerable>
+    </package>
+    <package name="app-office/kword" auto="yes" arch="*">
+      <unaffected range="ge">1.6.3-r1</unaffected>
+      <vulnerable range="lt">1.6.3-r1</vulnerable>
+    </package>
+    <package name="kde-base/kdegraphics" auto="yes" arch="*">
+      <unaffected range="ge">3.5.7-r1</unaffected>
+      <vulnerable range="lt">3.5.7-r1</vulnerable>
+    </package>
+    <package name="kde-base/kpdf" auto="yes" arch="*">
+      <unaffected range="ge">3.5.7-r1</unaffected>
+      <vulnerable range="lt">3.5.7-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KOffice is an integrated office suite for KDE. KWord is the KOffice
+    word processor. KPDF is a KDE-based PDF viewer included in the
+    kdegraphics package.
+    </p>
+  </background>
+  <description>
+    <p>
+    KPDF includes code from xpdf that is vulnerable to an integer overflow
+    in the StreamPredictor::StreamPredictor() function.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted PDF
+    file in KWord or KPDF that would exploit the integer overflow to cause
+    a stack-based buffer overflow in the StreamPredictor::getNextLine()
+    function, possibly resulting in the execution of arbitrary code with
+    the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All KOffice users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/koffice-1.6.3-r1&quot;</code>
+    <p>
+    All KWord users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/kword-1.6.3-r1&quot;</code>
+    <p>
+    All KDE Graphics Libraries users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kdegraphics-3.5.7-r1&quot;</code>
+    <p>
+    All KPDF users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kpdf-3.5.7-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3387">CVE-2007-3387</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 08 Sep 2007 22:26:21 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 08 Sep 2007 23:59:58 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 07 Oct 2007 16:13:55 +0000">
+    aetius
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-09.xml b/xml/htdocs/security/en/glsa/glsa-200710-09.xml
new file mode 100644
index 00000000..572f8d64
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-09.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-09">
+  <title>NX 2.1: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    NX in the 2.1 series uses XFree86 4.3 code which is prone to an integer
+    overflow vulnerability.
+  </synopsis>
+  <product type="ebuild">nx, nxnode</product>
+  <announced>October 09, 2007</announced>
+  <revised>October 09, 2007: 01</revised>
+  <bug>192712</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/nx" auto="yes" arch="*">
+      <unaffected range="ge">3.0.0</unaffected>
+      <vulnerable range="lt">3.0.0</vulnerable>
+    </package>
+    <package name="net-misc/nxnode" auto="yes" arch="*">
+      <unaffected range="ge">3.0.0-r3</unaffected>
+      <vulnerable range="lt">3.0.0-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    NoMachine's NX establishes remote connections to X11 desktops over
+    small bandwidth links. NX and NX Node are the compression core
+    libraries, whereas NX is used by FreeNX and NX Node by the binary-only
+    NX servers.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Evans reported an integer overflow within the FreeType PCF font
+    file parser (CVE-2006-1861). NX and NX Node are vulnerable to this due
+    to shipping XFree86 4.3.0, which includes the vulnerable FreeType code.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these integer overflows by enticing a
+    user to load a specially crafted PCF font file which might lead to the
+    execution of arbitrary code with the privileges of the user on the
+    machine running the NX server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All NX users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/nx-3.0.0&quot;</code>
+    <p>
+    All NX Node users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/nxnode-3.0.0-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1861">CVE-2006-1861</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200607-02.xml">GLSA 200607-02</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 20 Sep 2007 13:00:55 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 20 Sep 2007 13:01:53 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 02 Oct 2007 16:18:36 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-10.xml b/xml/htdocs/security/en/glsa/glsa-200710-10.xml
new file mode 100644
index 00000000..baaa4206
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-10.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-10">
+  <title>SKK Tools: Insecure temporary file creation</title>
+  <synopsis>
+    SKK insecurely creates temporary files.
+  </synopsis>
+  <product type="ebuild">skktools</product>
+  <announced>October 12, 2007</announced>
+  <revised>October 12, 2007: 01</revised>
+  <bug>193121</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-i18n/skktools" auto="yes" arch="*">
+      <unaffected range="ge">1.2-r1</unaffected>
+      <vulnerable range="lt">1.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SKK is a Japanese input method for Emacs.
+    </p>
+  </background>
+  <description>
+    <p>
+    skkdic-expr.c insecurely writes temporary files to a location in the
+    form $TMPDIR/skkdic$PID.{pag,dir,db}, where $PID is the process ID.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the directory where the
+    temporary files are written, pointing to a valid file somewhere on the
+    filesystem that is writable by the user running the SKK software. When
+    SKK writes the temporary file, the target valid file would then be
+    overwritten with the contents of the SKK temporary file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SKK Tools users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-i18n/skktools-1.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3916">CVE-2007-3916</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 20 Sep 2007 19:17:24 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 20 Sep 2007 19:18:40 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 07 Oct 2007 20:45:18 +0000">
+    aetius
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-11.xml b/xml/htdocs/security/en/glsa/glsa-200710-11.xml
new file mode 100644
index 00000000..05d5cea7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-11.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-11">
+  <title>X Font Server: Multiple Vulnerabilities</title>
+  <synopsis>
+    Three vulnerabilities have been discovered in the X Font Server possibly
+    allowing local attackers to gain elevated privileges.
+  </synopsis>
+  <product type="ebuild">xfs</product>
+  <announced>October 12, 2007</announced>
+  <revised>October 12, 2007: 01</revised>
+  <bug>185660</bug>
+  <bug>194606</bug>
+  <access>local</access>
+  <affected>
+    <package name="x11-apps/xfs" auto="yes" arch="*">
+      <unaffected range="ge">1.0.5</unaffected>
+      <vulnerable range="lt">1.0.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The X.Org X11 X Font Server provides a standard mechanism for an X
+    server to communicate with a font renderer.
+    </p>
+  </background>
+  <description>
+    <p>
+    iDefense reported that the xfs init script does not correctly handle a
+    race condition when setting permissions of a temporary file
+    (CVE-2007-3103). Sean Larsson discovered an integer overflow
+    vulnerability in the build_range() function possibly leading to a
+    heap-based buffer overflow when handling "QueryXBitmaps" and
+    "QueryXExtents" protocol requests (CVE-2007-4568). Sean Larsson also
+    discovered an error in the swap_char2b() function possibly leading to a
+    heap corruption when handling the same protocol requests
+    (CVE-2007-4990).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    The first issue would allow a local attacker to change permissions of
+    arbitrary files to be world-writable by performing a symlink attack.
+    The second and third issues would allow a local attacker to execute
+    arbitrary code with privileges of the user running the X Font Server,
+    usually xfs.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All X Font Server users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-apps/xfs-1.0.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3103">CVE-2007-3103</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4568">CVE-2007-4568</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4990">CVE-2007-4990</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 11 Oct 2007 20:30:03 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 11 Oct 2007 21:39:17 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 11 Oct 2007 21:39:34 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-12.xml b/xml/htdocs/security/en/glsa/glsa-200710-12.xml
new file mode 100644
index 00000000..54532bd4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-12.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-12">
+  <title>T1Lib: Buffer overflow</title>
+  <synopsis>
+    T1Lib is vulnerable to a buffer overflow allowing for the user-assisted
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">t1lib</product>
+  <announced>October 12, 2007</announced>
+  <revised>October 12, 2007: 01</revised>
+  <bug>193437</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/t1lib" auto="yes" arch="*">
+      <unaffected range="ge">5.0.2-r1</unaffected>
+      <vulnerable range="lt">5.0.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    T1Lib is a library for rasterizing bitmaps from Adobe Type 1 fonts.
+    </p>
+  </background>
+  <description>
+    <p>
+    Hamid Ebadi discovered a boundary error in the
+    intT1_EnvGetCompletePath() function which can lead to a buffer overflow
+    when processing an overly long filename.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a font file with a
+    specially crafted filename, possibly leading to the execution of
+    arbitrary code with the privileges of the user running the application
+    using T1Lib.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All T1Lib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/t1lib-5.0.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4033">CVE-2007-4033</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 26 Sep 2007 12:38:38 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 26 Sep 2007 12:39:08 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 08 Oct 2007 00:05:38 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-13.xml b/xml/htdocs/security/en/glsa/glsa-200710-13.xml
new file mode 100644
index 00000000..242999a6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-13.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-13">
+  <title>Ampache: Multiple vulnerabilities</title>
+  <synopsis>
+    An SQL injection vulnerability and a possible identity theft have been
+    discovered in Ampache.
+  </synopsis>
+  <product type="ebuild">ampache</product>
+  <announced>October 13, 2007</announced>
+  <revised>October 13, 2007: 01</revised>
+  <bug>189607</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/ampache" auto="yes" arch="*">
+      <unaffected range="ge">3.3.3.5</unaffected>
+      <vulnerable range="lt">3.3.3.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ampache is a PHP-based tool for managing, updating and playing audio
+    files via a web interface.
+    </p>
+  </background>
+  <description>
+    <p>
+    LT discovered that the "match" parameter in albums.php is not properly
+    sanitized before being processed. The Ampache development team also
+    reported an error when handling user sessions.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker could provide malicious input to the application,
+    possibly resulting in the execution of arbitrary SQL code. He could
+    also entice a user to open a specially crafted link to steal the user's
+    session.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ampache users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/ampache-3.3.3.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4437">CVE-2007-4437</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4438">CVE-2007-4438</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 17 Sep 2007 21:08:28 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 17 Sep 2007 21:08:38 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 02 Oct 2007 19:57:29 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-14.xml b/xml/htdocs/security/en/glsa/glsa-200710-14.xml
new file mode 100644
index 00000000..c9b1008c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-14.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-14">
+  <title>DenyHosts: Denial of Service</title>
+  <synopsis>
+    DenyHosts does not correctly parse log entries, potentially causing a
+    remote Denial of Service.
+  </synopsis>
+  <product type="ebuild">denyhosts</product>
+  <announced>October 13, 2007</announced>
+  <revised>October 13, 2007: 01</revised>
+  <bug>181213</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-admin/denyhosts" auto="yes" arch="*">
+      <unaffected range="ge">2.6-r1</unaffected>
+      <vulnerable range="lt">2.6-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    DenyHosts is designed to monitor SSH servers for repeated failed login
+    attempts.
+    </p>
+  </background>
+  <description>
+    <p>
+    Daniel B. Cid discovered that DenyHosts used an incomplete regular
+    expression to parse failed login attempts, a different issue than GLSA
+    200701-01.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote unauthenticated attacker can add arbitrary hosts into the
+    blacklist, including the "all" keyword, by submitting specially crafted
+    version identification strings to the SSH server banner. An attacker
+    may use this to prevent legitimate users from accessing a host
+    remotely.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All DenyHosts users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/denyhosts-2.6-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4323">CVE-2007-4323</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 06 Oct 2007 13:32:04 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 06 Oct 2007 13:32:42 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 07 Oct 2007 22:16:56 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-15.xml b/xml/htdocs/security/en/glsa/glsa-200710-15.xml
new file mode 100644
index 00000000..80b10d28
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-15.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-15">
+  <title>KDM: Local privilege escalation</title>
+  <synopsis>
+    KDM allows logins without password under certain circumstances allowing a
+    local user to gain elevated privileges.
+  </synopsis>
+  <product type="ebuild">KDM</product>
+  <announced>October 14, 2007</announced>
+  <revised>October 14, 2007: 01</revised>
+  <bug>192373</bug>
+  <access>local</access>
+  <affected>
+    <package name="kde-base/kdm" auto="yes" arch="*">
+      <unaffected range="ge">3.5.7-r2</unaffected>
+      <vulnerable range="lt">3.5.7-r2</vulnerable>
+    </package>
+    <package name="kde-base/kdebase" auto="yes" arch="*">
+      <unaffected range="ge">3.5.7-r4</unaffected>
+      <vulnerable range="lt">3.5.7-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDM is the Display Manager for the graphical desktop environment KDE.
+    It is part of the kdebase package.
+    </p>
+  </background>
+  <description>
+    <p>
+    Kees Huijgen discovered an error when checking the credentials which
+    can lead to a login without specifying a password. This only occurs
+    when auto login is configured for at least one user and a password is
+    required to shut down the machine.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could gain root privileges and execute arbitrary
+    commands by logging in as root without specifying root's password.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All KDM users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kdm-3.5.7-r2&quot;</code>
+    <p>
+    All kdebase users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kdebase-3.5.7-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4569">CVE-2007-4569</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 08 Oct 2007 00:34:30 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 08 Oct 2007 00:49:35 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 08 Oct 2007 02:58:05 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-16.xml b/xml/htdocs/security/en/glsa/glsa-200710-16.xml
new file mode 100644
index 00000000..0b128228
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-16.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-16">
+  <title>X.Org X server: Composite local privilege escalation</title>
+  <synopsis>
+    A vulnerability has been discovered in the Composite extension of the X.Org
+    X server, allowing for a local privilege escalation.
+  </synopsis>
+  <product type="ebuild">X.Org</product>
+  <announced>October 14, 2007</announced>
+  <revised>October 14, 2007: 01</revised>
+  <bug>191964</bug>
+  <access>local</access>
+  <affected>
+    <package name="x11-base/xorg-server" auto="yes" arch="*">
+      <unaffected range="ge">1.3.0.0-r1</unaffected>
+      <vulnerable range="lt">1.3.0.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The X Window System is a graphical windowing system based on a
+    client/server model.
+    </p>
+  </background>
+  <description>
+    <p>
+    Aaron Plattner discovered a buffer overflow in the compNewPixmap()
+    function when copying data from a large pixel depth pixmap into a
+    smaller pixel depth pixmap.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could execute arbitrary code with the privileges of
+    the user running the X server, typically root.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable the Composite extension by setting ' Option "Composite"
+    "disable" ' in the Extensions section of xorg.conf.
+    </p>
+    <p>
+    Note: This could affect the functionality of some applications.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All X.Org X server users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-base/xorg-server-1.3.0.0-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4730">CVE-2007-4730</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 02 Oct 2007 20:35:12 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 02 Oct 2007 20:35:33 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 08 Oct 2007 00:30:05 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-17.xml b/xml/htdocs/security/en/glsa/glsa-200710-17.xml
new file mode 100644
index 00000000..ffad8eb9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-17.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-17">
+  <title>Balsa: Buffer overflow</title>
+  <synopsis>
+    Balsa is vulnerable to a buffer overflow allowing for the user-assisted
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">balsa</product>
+  <announced>October 16, 2007</announced>
+  <revised>October 16, 2007: 01</revised>
+  <bug>193179</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/balsa" auto="yes" arch="*">
+      <unaffected range="ge">2.3.20</unaffected>
+      <vulnerable range="lt">2.3.20</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Balsa is a highly configurable email client for GNOME.
+    </p>
+  </background>
+  <description>
+    <p>
+    Evil Ninja Squirrel discovered a stack-based buffer overflow in the
+    ir_fetch_seq() function when receiving a long response to a FETCH
+    command (CVE-2007-5007).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to connect to a malicious or
+    compromised IMAP server, possibly leading to the execution of arbitrary
+    code with the rights of the user running Balsa.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Balsa users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/balsa-2.3.20&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5007">CVE-2007-5007</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 26 Sep 2007 14:01:38 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 26 Sep 2007 14:01:46 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 08 Oct 2007 00:14:17 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-18.xml b/xml/htdocs/security/en/glsa/glsa-200710-18.xml
new file mode 100644
index 00000000..9c381527
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-18.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-18">
+  <title>util-linux: Local privilege escalation</title>
+  <synopsis>
+    The mount and umount programs might allow local attackers to gain root
+    privileges.
+  </synopsis>
+  <product type="ebuild">util-linux</product>
+  <announced>October 18, 2007</announced>
+  <revised>October 18, 2007: 01</revised>
+  <bug>195390</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-apps/util-linux" auto="yes" arch="*">
+      <unaffected range="ge">2.12r-r8</unaffected>
+      <vulnerable range="lt">2.12r-r8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    util-linux is a suite of Linux programs including mount and umount,
+    programs used to mount and unmount filesystems.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ludwig Nussel discovered that the check_special_mountprog() and
+    check_special_umountprog() functions call setuid() and setgid() in the
+    wrong order and do not check the return values, which can lead to
+    privileges being dropped improperly.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker may be able to exploit this vulnerability by using
+    mount helpers such as the mount.nfs program to gain root privileges and
+    run arbitrary commands.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All util-linux users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/util-linux-2.12r-r8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5191">CVE-2007-5191</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 12 Oct 2007 17:17:12 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 12 Oct 2007 17:18:23 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 15 Oct 2007 00:47:53 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-19.xml b/xml/htdocs/security/en/glsa/glsa-200710-19.xml
new file mode 100644
index 00000000..c2ab1f70
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-19.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-19">
+  <title>The Sleuth Kit: Integer underflow</title>
+  <synopsis>
+    An integer underflow vulnerability has been reported in The Sleuth Kit
+    allowing for the user-assisted execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">sleuthkit</product>
+  <announced>October 18, 2007</announced>
+  <revised>October 18, 2007: 01</revised>
+  <bug>181977</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-forensics/sleuthkit" auto="yes" arch="*">
+      <unaffected range="ge">2.0.9</unaffected>
+      <vulnerable range="lt">2.0.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Sleuth Kit is a collection of file system and media management
+    forensic analysis tools.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jean-Sebastien Guay-Leroux reported an integer underflow in the
+    file_printf() function of the "file" utility which is bundled with The
+    Sleuth Kit (CVE-2007-1536, GLSA 200703-26). Note that Gentoo is not
+    affected by the improper fix for this vulnerability (identified as
+    CVE-2007-2799, see GLSA 200705-25) since version 4.20 of "file" was
+    never shipped with The Sleuth Kit ebuilds.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to run The Sleuth Kit on a file
+    system containing a specially crafted file that would trigger a
+    heap-based buffer overflow possibly leading to the execution of
+    arbitrary code with the rights of the user running The Sleuth Kit.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All The Sleuth Kit users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-forensics/sleuthkit-2.0.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1536">CVE-2007-1536</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2799">CVE-2007-2799</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200703-26.xml">GLSA 200703-26</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200705-25.xml">GLSA 200705-25</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 29 Sep 2007 13:59:12 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 29 Sep 2007 13:59:20 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 07 Oct 2007 23:47:34 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-20.xml b/xml/htdocs/security/en/glsa/glsa-200710-20.xml
new file mode 100644
index 00000000..8788be87
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-20.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-20">
+  <title>PDFKit, ImageKits: Buffer overflow</title>
+  <synopsis>
+    PDFKit and ImageKits are vulnerable to an integer overflow and a stack
+    overflow allowing for the user-assisted execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">pdfkit imagekits</product>
+  <announced>October 18, 2007</announced>
+  <revised>October 18, 2007: 01</revised>
+  <bug>188185</bug>
+  <access>remote</access>
+  <affected>
+    <package name="gnustep-libs/pdfkit" auto="yes" arch="*">
+      <vulnerable range="le">0.9_pre062906</vulnerable>
+    </package>
+    <package name="gnustep-libs/imagekits" auto="yes" arch="*">
+      <vulnerable range="le">0.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PDFKit is a framework for rendering of PDF content in GNUstep
+    applications. ImageKits is a collection of frameworks to support
+    imaging in GNUstep applications.
+    </p>
+  </background>
+  <description>
+    <p>
+    Maurycy Prodeus discovered an integer overflow vulnerability possibly
+    leading to a stack-based buffer overflow in the XPDF code which PDFKit
+    is based on. ImageKits also contains a copy of PDFKit.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to view a specially crafted PDF file with a viewer
+    based on ImageKits or PDFKit such as Gentoo's ViewPDF, a remote
+    attacker could cause an overflow, potentially resulting in the
+    execution of arbitrary code with the privileges of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    PDFKit and ImageKits are not maintained upstream, so the packages were
+    masked in Portage. We recommend that users unmerge PDFKit and
+    ImageKits:
+    </p>
+    <code>
+    # emerge --unmerge gnustep-libs/pdfkit
+    # emerge --unmerge gnustep-libs/imagekits</code>
+    <p>
+    As an alternative, users should upgrade their systems to use PopplerKit
+    instead of PDFKit and Vindaloo instead of ViewPDF.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3387">CVE-2007-3387</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200709-12.xml">GLSA 200709-12</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 02 Oct 2007 21:24:54 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 07 Oct 2007 23:31:24 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 09 Oct 2007 18:28:10 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-21.xml b/xml/htdocs/security/en/glsa/glsa-200710-21.xml
new file mode 100644
index 00000000..ce4b1be3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-21.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-21">
+  <title>TikiWiki: Arbitrary command execution</title>
+  <synopsis>
+    Tikiwiki contains a command injection vulnerability which may allow remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">tikiwiki</product>
+  <announced>October 20, 2007</announced>
+  <revised>October 20, 2007: 01</revised>
+  <bug>195503</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/tikiwiki" auto="yes" arch="*">
+      <unaffected range="ge">1.9.8.1</unaffected>
+      <vulnerable range="lt">1.9.8.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    TikiWiki is an open source content management system written in PHP.
+    </p>
+  </background>
+  <description>
+    <p>
+    ShAnKaR reported that input passed to the "f" array parameter in
+    tiki-graph_formula.php is not properly verified before being used to
+    execute PHP functions.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could execute arbitrary code with the rights of the user
+    running the web server by passing a specially crafted parameter string
+    to the tiki-graph_formula.php file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All TikiWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/tikiwiki-1.9.8.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5423">CVE-2007-5423</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 13 Oct 2007 13:08:51 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 17 Oct 2007 22:20:02 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 18 Oct 2007 18:49:04 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-22.xml b/xml/htdocs/security/en/glsa/glsa-200710-22.xml
new file mode 100644
index 00000000..257b1c04
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-22.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-22">
+  <title>TRAMP: Insecure temporary file creation</title>
+  <synopsis>
+    The TRAMP package for GNU Emacs insecurely creates temporary files.
+  </synopsis>
+  <product type="ebuild">tramp</product>
+  <announced>October 20, 2007</announced>
+  <revised>December 30, 2007: 02</revised>
+  <bug>194713</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-emacs/tramp" auto="yes" arch="*">
+      <unaffected range="ge">2.1.10-r2</unaffected>
+      <unaffected range="lt">2.1</unaffected>
+      <vulnerable range="lt">2.1.10-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    TRAMP is a remote file editing package for GNU Emacs, a highly
+    extensible and customizable text editor.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Monnier discovered that the tramp-make-tramp-temp-file()
+    function creates temporary files in an insecure manner.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the directory where the
+    temporary files are written, pointing to a valid file somewhere on the
+    filesystem that is writable by the user running TRAMP. When TRAMP
+    writes the temporary file, the target valid file would then be
+    overwritten with the contents of the TRAMP temporary file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All TRAMP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emacs/tramp-2.1.10-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5377">CVE-2007-5377</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 11 Oct 2007 21:37:14 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 18 Oct 2007 20:15:33 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 18 Oct 2007 20:17:00 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-23.xml b/xml/htdocs/security/en/glsa/glsa-200710-23.xml
new file mode 100644
index 00000000..ae009159
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-23.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-23">
+  <title>Star: Directory traversal vulnerability</title>
+  <synopsis>
+    A directory traversal vulnerability has been discovered in Star.
+  </synopsis>
+  <product type="ebuild">star</product>
+  <announced>October 22, 2007</announced>
+  <revised>October 22, 2007: 01</revised>
+  <bug>189690</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/star" auto="yes" arch="*">
+      <unaffected range="ge">1.5_alpha84</unaffected>
+      <vulnerable range="lt">1.5_alpha84</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Star program provides the ability to create and extract tar
+    archives.
+    </p>
+  </background>
+  <description>
+    <p>
+    Robert Buchholz of the Gentoo Security team discovered a directory
+    traversal vulnerability in the has_dotdot() function which does not
+    identify //.. (slash slash dot dot) sequences in file names inside tar
+    files.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By enticing a user to extract a specially crafted tar archive, a remote
+    attacker could extract files to arbitrary locations outside of the
+    specified directory with the permissions of the user running Star.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Star users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/star-1.5_alpha84&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4134">CVE-2007-4134</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 11 Oct 2007 21:17:08 +0000">
+    aetius
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 15 Oct 2007 01:04:21 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 15 Oct 2007 17:56:09 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-24.xml b/xml/htdocs/security/en/glsa/glsa-200710-24.xml
new file mode 100644
index 00000000..ea05af3a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-24.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-24">
+  <title>OpenOffice.org: Heap-based buffer overflow</title>
+  <synopsis>
+    A heap-based buffer overflow vulnerability has been discovered in
+    OpenOffice.org, allowing for the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">openoffice</product>
+  <announced>October 23, 2007</announced>
+  <revised>October 23, 2007: 01</revised>
+  <bug>192818</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/openoffice" auto="yes" arch="*">
+      <unaffected range="ge">2.3.0</unaffected>
+      <vulnerable range="lt">2.3.0</vulnerable>
+    </package>
+    <package name="app-office/openoffice-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.3.0</unaffected>
+      <vulnerable range="lt">2.3.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenOffice.org is an open source office productivity suite, including
+    word processing, spreadsheet, presentation, drawing, data charting,
+    formula editing, and file conversion facilities.
+    </p>
+  </background>
+  <description>
+    <p>
+    iDefense Labs reported that the TIFF parsing code uses untrusted values
+    to calculate buffer sizes, which can lead to an integer overflow
+    resulting in heap-based buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    document, possibly leading to execution of arbitrary code with the
+    privileges of the user running OpenOffice.org.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenOffice.org users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-2.3.0&quot;</code>
+    <p>
+    All OpenOffice.org binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-bin-2.3.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2834">CVE-2007-2834</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 20 Oct 2007 21:31:00 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 20 Oct 2007 21:31:08 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 21 Oct 2007 10:52:39 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-25.xml b/xml/htdocs/security/en/glsa/glsa-200710-25.xml
new file mode 100644
index 00000000..c27f6b87
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-25.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-25">
+  <title>MLDonkey: Privilege escalation</title>
+  <synopsis>
+    The Gentoo MLDonkey ebuild adds a user to the system with a valid login
+    shell and no password.
+  </synopsis>
+  <product type="ebuild">mldonkey</product>
+  <announced>October 24, 2007</announced>
+  <revised>November 07, 2007: 02</revised>
+  <bug>189412</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-p2p/mldonkey" auto="yes" arch="*">
+      <unaffected range="ge">2.9.0-r3</unaffected>
+      <vulnerable range="lt">2.9.0-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MLDonkey is a peer-to-peer filesharing client that connects to several
+    different peer-to-peer networks, including Overnet and BitTorrent.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Gentoo MLDonkey ebuild adds a user to the system named "p2p" so
+    that the MLDonkey service can run under a user with low privileges.
+    With older Portage versions this user is created with a valid login
+    shell and no password.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could log into a vulnerable system as the p2p user.
+    This would require an installed login service that permitted empty
+    passwords, such as SSH configured with the "PermitEmptyPasswords yes"
+    option, a local login console, or a telnet server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    See Resolution.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Change the p2p user's shell to disallow login. For example, as root run
+    the following command:
+    </p>
+    <code>
+    # usermod -s /bin/false p2p</code>
+    <p>
+    NOTE: updating to the current MLDonkey ebuild will not remove this
+    vulnerability, it must be fixed manually. The updated ebuild is to
+    prevent this problem from occurring in the future.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5714">CVE-2007-5714</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 10 Sep 2007 16:21:11 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 07 Oct 2007 16:40:51 +0000">
+    aetius
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 07 Oct 2007 19:26:05 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-26.xml b/xml/htdocs/security/en/glsa/glsa-200710-26.xml
new file mode 100644
index 00000000..8176b46b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-26.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-26">
+  <title>HPLIP: Privilege escalation</title>
+  <synopsis>
+    The hpssd daemon might allow local attackers to execute arbitrary commands
+    with root privileges.
+  </synopsis>
+  <product type="ebuild">hplip</product>
+  <announced>October 24, 2007</announced>
+  <revised>October 24, 2007: 01</revised>
+  <bug>195565</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-print/hplip" auto="yes" arch="*">
+      <unaffected range="rge">1.7.4a-r2</unaffected>
+      <unaffected range="ge">2.7.9-r1</unaffected>
+      <vulnerable range="lt">2.7.9-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Hewlett-Packard Linux Imaging and Printing system (HPLIP) provides
+    drivers for HP's inkjet and laser printers, scanners and fax machines.
+    It integrates with the Common UNIX Printing System (CUPS) and Scanner
+    Access Now Easy (SANE).
+    </p>
+  </background>
+  <description>
+    <p>
+    Kees Cook from the Ubuntu Security team discovered that the hpssd
+    daemon does not correctly validate user supplied data before passing it
+    to a "popen3()" call.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker may be able to exploit this vulnerability by sending a
+    specially crafted request to the hpssd daemon to execute arbitrary
+    commands with the privileges of the user running hpssd, usually root.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All HPLIP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;net-print/hplip&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5208">CVE-2007-5208</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 21 Oct 2007 20:50:24 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 21 Oct 2007 20:51:40 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 21 Oct 2007 21:46:02 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-27.xml b/xml/htdocs/security/en/glsa/glsa-200710-27.xml
new file mode 100644
index 00000000..00198b2d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-27.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-27">
+  <title>ImageMagick: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in ImageMagick, possibly
+    resulting in arbitrary code execution or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">imagemagick</product>
+  <announced>October 24, 2007</announced>
+  <revised>October 24, 2007: 01</revised>
+  <bug>186030</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/imagemagick" auto="yes" arch="*">
+      <unaffected range="ge">6.3.5.10</unaffected>
+      <vulnerable range="lt">6.3.5.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ImageMagick is a collection of tools and libraries for manipulating
+    various image formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    regenrecht reported multiple infinite loops in functions ReadDCMImage()
+    and ReadXCFImage() (CVE-2007-4985), multiple integer overflows when
+    handling certain types of images (CVE-2007-4986, CVE-2007-4988), and an
+    off-by-one error in the ReadBlobString() function (CVE-2007-4987).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    image, possibly resulting in the remote execution of arbitrary code
+    with the privileges of the user running the application, or an
+    excessive CPU consumption. Note that applications relying on
+    ImageMagick to process images can also trigger the vulnerability.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ImageMagick users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/imagemagick-6.3.5.10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4985">CVE-2007-4985</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4986">CVE-2007-4986</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4987">CVE-2007-4987</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4988">CVE-2007-4988</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 30 Sep 2007 09:56:31 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 06 Oct 2007 12:45:56 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 23 Oct 2007 14:53:02 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-28.xml b/xml/htdocs/security/en/glsa/glsa-200710-28.xml
new file mode 100644
index 00000000..0177a39f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-28.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-28">
+  <title>Qt: Buffer overflow</title>
+  <synopsis>
+    An off-by-one vulnerability has been discovered in Qt, possibly resulting
+    in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">qt</product>
+  <announced>October 25, 2007</announced>
+  <revised>October 25, 2007: 01</revised>
+  <bug>192472</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-libs/qt" auto="yes" arch="*">
+      <unaffected range="ge">3.3.8-r4</unaffected>
+      <vulnerable range="lt">3.3.8-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Qt is a cross-platform GUI framework, which is used e.g. by KDE.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dirk Mueller from the KDE development team discovered a boundary error
+    in file qutfcodec.cpp when processing Unicode strings.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send a specially crafted Unicode string to a
+    vulnerable Qt application, possibly resulting in the remote execution
+    of arbitrary code with the privileges of the user running the
+    application. Note that the boundary error is present but reported to be
+    not exploitable in 4.x series.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Qt 3.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/qt-3.3.8-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4137">CVE-2007-4137</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 15 Sep 2007 12:11:04 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 29 Sep 2007 13:54:49 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 29 Sep 2007 13:54:56 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-29.xml b/xml/htdocs/security/en/glsa/glsa-200710-29.xml
new file mode 100644
index 00000000..7be5d5a8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-29.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-29">
+  <title>Sylpheed, Claws Mail: User-assisted remote execution of arbitrary code</title>
+  <synopsis>
+    A format string error has been discovered in Sylpheed and Claws Mail,
+    potentially leading to the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">sylpheed claws-mail</product>
+  <announced>October 25, 2007</announced>
+  <revised>October 25, 2007: 01</revised>
+  <bug>190104</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/sylpheed" auto="yes" arch="*">
+      <unaffected range="ge">2.4.5</unaffected>
+      <vulnerable range="lt">2.4.5</vulnerable>
+    </package>
+    <package name="mail-client/claws-mail" auto="yes" arch="*">
+      <unaffected range="ge">3.0.0</unaffected>
+      <vulnerable range="lt">3.0.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Sylpheed and Claws Mail are two GTK based e-mail clients.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ulf Harnhammar from Secunia Research discovered a format string error
+    in the inc_put_error() function in file src/inc.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to connect to a malicious POP
+    server sending specially crafted replies, possibly resulting in the
+    execution of arbitrary code with the privileges of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Sylpheed users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/sylpheed-2.4.5&quot;</code>
+    <p>
+    All Claws Mail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/claws-mail-3.0.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2958">CVE-2007-2958</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 08 Oct 2007 00:54:19 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 08 Oct 2007 02:57:28 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 09 Oct 2007 18:46:46 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-30.xml b/xml/htdocs/security/en/glsa/glsa-200710-30.xml
new file mode 100644
index 00000000..88b49f8b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-30.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-30">
+  <title>OpenSSL: Remote execution of arbitrary code</title>
+  <synopsis>
+    OpenSSL contains a vulnerability allowing execution of arbitrary code or a
+    Denial of Service.
+  </synopsis>
+  <product type="ebuild">openssl</product>
+  <announced>October 27, 2007</announced>
+  <revised>October 30, 2007: 03</revised>
+  <bug>195634</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/openssl" auto="yes" arch="*">
+      <unaffected range="ge">0.9.8f</unaffected>
+      <vulnerable range="lt">0.9.8f</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer
+    (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general
+    purpose cryptography library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Andy Polyakov reported a vulnerability in the OpenSSL toolkit, that is
+    caused due to an unspecified off-by-one error within the DTLS
+    implementation.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this issue to execute arbitrary code or
+    cause a Denial of Service. Only clients and servers explicitly using
+    DTLS are affected, systems using SSL and TLS are not.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenSSL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/openssl-0.9.8f&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4995">CVE-2007-4995</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 16 Oct 2007 17:07:11 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 16 Oct 2007 17:07:40 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 23 Oct 2007 17:06:07 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200710-31.xml b/xml/htdocs/security/en/glsa/glsa-200710-31.xml
new file mode 100644
index 00000000..44f2e528
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200710-31.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200710-31">
+  <title>Opera: Multiple vulnerabilities</title>
+  <synopsis>
+    Opera contains multiple vulnerabilities, which may allow the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">opera</product>
+  <announced>October 30, 2007</announced>
+  <revised>October 30, 2007: 01</revised>
+  <bug>196164</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/opera" auto="yes" arch="*">
+      <unaffected range="ge">9.24</unaffected>
+      <vulnerable range="lt">9.24</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Opera is a multi-platform web browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    Michael A. Puls II discovered an unspecified flaw when launching
+    external email or newsgroup clients (CVE-2007-5541). David Bloom
+    discovered that when displaying frames from different websites, the
+    same-origin policy is not correctly enforced (CVE-2007-5540).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could potentially exploit the first vulnerability to
+    execute arbitrary code with the privileges of the user running Opera by
+    enticing a user to visit a specially crafted URL. Note that this
+    vulnerability requires an external e-mail or newsgroup client
+    configured in Opera to be exploitable. The second vulnerability allows
+    an attacker to execute arbitrary script code in a user's browser
+    session in context of other sites or the theft of browser credentials.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time for all these
+    vulnerabilities.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Opera users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/opera-9.24&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5540">CVE-2007-5540</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5541">CVE-2007-5541</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 21 Oct 2007 22:07:58 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 22 Oct 2007 21:37:32 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-01.xml b/xml/htdocs/security/en/glsa/glsa-200711-01.xml
new file mode 100644
index 00000000..ddf38fac
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-01.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-01">
+  <title>gFTP: Multiple vulnerabilities</title>
+  <synopsis>
+    Two buffer overflow vulnerabilities have been discovered in fsplib code
+    used in gFTP.
+  </synopsis>
+  <product type="ebuild">gftp</product>
+  <announced>November 01, 2007</announced>
+  <revised>November 01, 2007: 01</revised>
+  <bug>188252</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-ftp/gftp" auto="yes" arch="*">
+      <unaffected range="ge">2.0.18-r6</unaffected>
+      <vulnerable range="lt">2.0.18-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    gFTP is an FTP client for the GNOME desktop environment.
+    </p>
+  </background>
+  <description>
+    <p>
+    Kalle Olavi Niemitalo discovered two boundary errors in fsplib code
+    included in gFTP when processing overly long directory or file names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could trigger these vulnerabilities by enticing a
+    user to download a file with a specially crafted directory or file
+    name, possibly resulting in the execution of arbitrary code
+    (CVE-2007-3962) or a Denial of Service (CVE-2007-3961).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All gFTP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-ftp/gftp-2.0.18-r6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3961">CVE-2007-3961</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3962">CVE-2007-3962</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 26 Sep 2007 07:30:16 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 26 Sep 2007 07:30:24 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 10 Oct 2007 19:23:34 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-02.xml b/xml/htdocs/security/en/glsa/glsa-200711-02.xml
new file mode 100644
index 00000000..42c49602
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-02.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-02">
+  <title>OpenSSH: Security bypass</title>
+  <synopsis>
+    A flaw has been discovered in OpenSSH which could allow a local attacker to
+    bypass security restrictions.
+  </synopsis>
+  <product type="ebuild">openssh</product>
+  <announced>November 01, 2007</announced>
+  <revised>November 01, 2007: 01</revised>
+  <bug>191321</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/openssh" auto="yes" arch="*">
+      <unaffected range="ge">4.7</unaffected>
+      <vulnerable range="lt">4.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSSH is a complete SSH protocol implementation that includes an SFTP
+    client and server support.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jan Pechanec discovered that OpenSSH uses a trusted X11 cookie when it
+    cannot create an untrusted one.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    An attacker could bypass the SSH client security policy and gain
+    privileges by causing an X client to be treated as trusted.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenSSH users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/openssh-4.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4752">CVE-2007-4752</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 25 Sep 2007 19:38:10 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 25 Sep 2007 19:38:18 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 28 Sep 2007 12:20:41 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-03.xml b/xml/htdocs/security/en/glsa/glsa-200711-03.xml
new file mode 100644
index 00000000..5df61cbc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-03.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-03">
+  <title>Gallery: Multiple vulnerabilities</title>
+  <synopsis>
+    The WebDAV and Reupload modules of Gallery contain multiple unspecified
+    vulnerabilities.
+  </synopsis>
+  <product type="ebuild">gallery</product>
+  <announced>November 01, 2007</announced>
+  <revised>November 11, 2007: 02</revised>
+  <bug>191587</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/gallery" auto="yes" arch="*">
+      <unaffected range="ge">2.2.3</unaffected>
+      <unaffected range="lt">2.0</unaffected>
+      <vulnerable range="lt">2.2.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gallery is a PHP based photo album manager.
+    </p>
+  </background>
+  <description>
+    <p>
+    Merrick Manalastas and Nicklous Roberts have discovered multiple
+    vulnerabilities in the WebDAV and Reupload modules.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker could exploit these vulnerabilities to bypass
+    security restrictions and rename, replace and change properties of
+    items, or edit item data using WebDAV.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gallery users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/gallery-2.2.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4650">CVE-2007-4650</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 25 Sep 2007 09:43:01 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 25 Sep 2007 09:46:35 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 15 Oct 2007 18:31:52 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-04.xml b/xml/htdocs/security/en/glsa/glsa-200711-04.xml
new file mode 100644
index 00000000..db1c5cc8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-04.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-04">
+  <title>Evolution: User-assisted remote execution of arbitrary code</title>
+  <synopsis>
+    The IMAP client of Evolution contains a vulnerability potentially leading
+    to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">evolution-data-server</product>
+  <announced>November 06, 2007</announced>
+  <revised>November 06, 2007: 01</revised>
+  <bug>190861</bug>
+  <access>remote</access>
+  <affected>
+    <package name="gnome-extra/evolution-data-server" auto="yes" arch="*">
+      <unaffected range="ge">1.10.3.1</unaffected>
+      <vulnerable range="lt">1.10.3.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Evolution is the mail client of the GNOME desktop environment. Camel is
+    the Evolution Data Server module that handles mail functions.
+    </p>
+  </background>
+  <description>
+    <p>
+    The imap_rescan() function of the file camel-imap-folder.c does not
+    properly sanitize the "SEQUENCE" response sent by an IMAP server before
+    being used to index arrays.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A malicious or compromised IMAP server could trigger the vulnerability
+    and execute arbitrary code with the permissions of the user running
+    Evolution.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Note that this GLSA addresses the same issue as GLSA 200707-03, but for
+    the 1.10 branch of Evolution Data Server.
+    </p>
+    <p>
+    All Evolution users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=gnome-extra/evolution-data-server-1.10.3.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200707-03.xml">GLSA 200707-03</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3257">CVE-2007-3257</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 17 Sep 2007 21:12:59 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 17 Sep 2007 21:13:37 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 07 Oct 2007 19:29:33 +0000">
+    aetius
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-05.xml b/xml/htdocs/security/en/glsa/glsa-200711-05.xml
new file mode 100644
index 00000000..997aebfa
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-05.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-05">
+  <title>SiteBar: Multiple issues</title>
+  <synopsis>
+    Multiple issues have been identified in SiteBar that might allow execution
+    of arbitrary code and arbitrary file disclosure.
+  </synopsis>
+  <product type="ebuild">sitebar</product>
+  <announced>November 06, 2007</announced>
+  <revised>November 06, 2007: 01</revised>
+  <bug>195810</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/sitebar" auto="yes" arch="*">
+      <unaffected range="ge">3.3.9</unaffected>
+      <vulnerable range="lt">3.3.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SiteBar is a PHP application that allows users to store their bookmarks
+    on a web server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tim Brown discovered these multiple issues: the translation module does
+    not properly sanitize the value to the "dir" parameter (CVE-2007-5491,
+    CVE-2007-5694); the translation module also does not sanitize the
+    values of the "edit" and "value" parameters which it passes to eval()
+    and include() (CVE-2007-5492, CVE-2007-5693); the log-in command does
+    not validate the URL to redirect users to after logging in
+    (CVE-2007-5695); SiteBar also contains several cross-site scripting
+    vulnerabilities (CVE-2007-5692).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An authenticated attacker in the "Translators" or "Admins" group could
+    execute arbitrary code, read arbitrary files and possibly change their
+    permissions with the privileges of the user running the web server by
+    passing a specially crafted parameter string to the "translator.php"
+    file. An unauthenticated attacker could entice a user to browse a
+    specially crafted URL, allowing for the execution of script code in the
+    context of the user's browser, for the theft of browser credentials or
+    for a redirection to an arbitrary web site after login.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SiteBar users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/sitebar-3.3.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5491">CVE-2007-5491</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5492">CVE-2007-5492</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5692">CVE-2007-5692</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5693">CVE-2007-5693</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5694">CVE-2007-5694</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5695">CVE-2007-5695</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 18 Oct 2007 20:00:51 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 18 Oct 2007 20:01:07 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-06.xml b/xml/htdocs/security/en/glsa/glsa-200711-06.xml
new file mode 100644
index 00000000..bd05737e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-06.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-06">
+  <title>Apache: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Apache, possibly resulting
+    in a Denial of Service or the disclosure of sensitive information.
+  </synopsis>
+  <product type="ebuild">apache</product>
+  <announced>November 07, 2007</announced>
+  <revised>November 07, 2007: 01</revised>
+  <bug>186219</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="rge">2.0.59-r5</unaffected>
+      <unaffected range="ge">2.2.6</unaffected>
+      <vulnerable range="lt">2.2.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP server is one of the most popular web servers on the
+    Internet.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple cross-site scripting vulnerabilities have been discovered in
+    mod_status and mod_autoindex (CVE-2006-5752, CVE-2007-4465). An error
+    has been discovered in the recall_headers() function in mod_mem_cache
+    (CVE-2007-1862). The mod_cache module does not properly sanitize
+    requests before processing them (CVE-2007-1863). The Prefork module
+    does not properly check PID values before sending signals
+    (CVE-2007-3304). The mod_proxy module does not correctly check headers
+    before processing them (CVE-2007-3847).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit one of these vulnerabilities to inject
+    arbitrary script or HTML content, obtain sensitive information or cause
+    a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Apache users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/apache-2.0.59-r5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5752">CVE-2006-5752</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1862">CVE-2007-1862</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1863">CVE-2007-1863</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3304">CVE-2007-3304</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3847">CVE-2007-3847</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4465">CVE-2007-4465</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 25 Sep 2007 14:34:09 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 25 Sep 2007 14:34:48 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 15 Oct 2007 20:07:35 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-07.xml b/xml/htdocs/security/en/glsa/glsa-200711-07.xml
new file mode 100644
index 00000000..830e35a6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-07.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-07">
+  <title>Python: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple integer overflow vulnerabilities have been discovered in Python,
+    possibly resulting in the execution of arbitrary code or a Denial of
+    Service.
+  </synopsis>
+  <product type="ebuild">python</product>
+  <announced>November 07, 2007</announced>
+  <revised>November 07, 2007: 01</revised>
+  <bug>192876</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/python" auto="yes" arch="*">
+      <unaffected range="rge">2.3.6-r3</unaffected>
+      <unaffected range="ge">2.4.4-r6</unaffected>
+      <vulnerable range="lt">2.4.4-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Python is an interpreted, interactive, object-oriented programming
+    language.
+    </p>
+  </background>
+  <description>
+    <p>
+    Slythers Bro discovered multiple integer overflows in the imageop
+    module, one of them in the tovideo() method, in various locations in
+    files imageop.c, rbgimgmodule.c, and also in other files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to process specially crafted
+    images with an application using the Python imageop module, resulting
+    in the execution of arbitrary code with the privileges of the user
+    running the application, or a Denial of Service. Note that this
+    vulnerability may or may not be exploitable, depending on the
+    application using the module.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Python 2.3.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/python-2.3.6-r3&quot;</code>
+    <p>
+    All Python 2.4.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/python-2.4.4-r6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4965">CVE-2007-4965</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 27 Oct 2007 13:38:30 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 01 Nov 2007 20:41:20 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 01 Nov 2007 20:41:27 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-08.xml b/xml/htdocs/security/en/glsa/glsa-200711-08.xml
new file mode 100644
index 00000000..5c5bd170
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-08.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-08">
+  <title>libpng: Multiple Denials of Service</title>
+  <synopsis>
+    Several vulnerabilities in libpng may allow a remote attacker to crash
+    applications that handle untrusted images.
+  </synopsis>
+  <product type="ebuild">libpng</product>
+  <announced>November 07, 2007</announced>
+  <revised>November 07, 2007: 01</revised>
+  <bug>195261</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libpng" auto="yes" arch="*">
+      <unaffected range="ge">1.2.21-r3</unaffected>
+      <vulnerable range="lt">1.2.21-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libpng is a free ANSI C library used to process and manipulate PNG
+    images.
+    </p>
+  </background>
+  <description>
+    <p>
+    An off-by-one error when handling ICC profile chunks in the
+    png_set_iCCP() function was discovered (CVE-2007-5266). George Cook and
+    Jeff Phillips reported several errors in pngrtran.c, the use of logical
+    instead of a bitwise functions and incorrect comparisons
+    (CVE-2007-5268). Tavis Ormandy reported out-of-bounds read errors in
+    several PNG chunk handling functions (CVE-2007-5269).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could craft an image that when processed or viewed by
+    an application using libpng would cause the application to terminate
+    abnormally.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libpng users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libpng-1.2.21-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5266">CVE-2007-5266</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5268">CVE-2007-5268</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5269">CVE-2007-5269</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 20 Oct 2007 09:57:33 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 20 Oct 2007 09:57:41 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 26 Oct 2007 00:26:03 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-09.xml b/xml/htdocs/security/en/glsa/glsa-200711-09.xml
new file mode 100644
index 00000000..c0d76c85
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-09.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-09">
+  <title>MadWifi: Denial of Service</title>
+  <synopsis>
+    MadWifi does not correctly process beacon frames which can lead to a
+    remotely triggered Denial of Service.
+  </synopsis>
+  <product type="ebuild">madwifi-ng</product>
+  <announced>November 07, 2007</announced>
+  <revised>November 07, 2007: 01</revised>
+  <bug>195705</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-wireless/madwifi-ng" auto="yes" arch="*">
+      <unaffected range="ge">0.9.3.3</unaffected>
+      <vulnerable range="lt">0.9.3.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The MadWifi driver provides support for Atheros based IEEE 802.11
+    Wireless Lan cards.
+    </p>
+  </background>
+  <description>
+    <p>
+    Clemens Kolbitsch and Sylvester Keil reported an error when processing
+    beacon frames with an overly large "length" value in the "xrates"
+    element.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could act as an access point and send a specially
+    crafted packet to an Atheros based wireless client, possibly resulting
+    in a Denial of Service (kernel panic).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MadWifi users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-wireless/madwifi-ng-0.9.3.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5448">CVE-2007-5448</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 02 Nov 2007 23:16:45 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 03 Nov 2007 23:18:04 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 03 Nov 2007 23:18:55 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-10.xml b/xml/htdocs/security/en/glsa/glsa-200711-10.xml
new file mode 100644
index 00000000..a244cc6f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-10.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-10">
+  <title>Mono: Buffer overflow</title>
+  <synopsis>
+    Mono's BigInteger implementation contains a buffer overflow vulnerability
+    that might lead to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mono</product>
+  <announced>November 07, 2007</announced>
+  <revised>November 07, 2007: 01</revised>
+  <bug>197067</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/mono" auto="yes" arch="*">
+      <unaffected range="ge">1.2.5.1-r1</unaffected>
+      <vulnerable range="lt">1.2.5.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mono provides the necessary software to develop and run .NET client and
+    server applications on various platforms.
+    </p>
+  </background>
+  <description>
+    <p>
+    IOActive discovered an error in the Mono.Math.BigInteger class, in the
+    reduction step of the Montgomery-based Pow methods, that could lead to
+    a buffer overflow.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this vulnerability by sending specially
+    crafted data to Mono applications using the BigInteger class, which
+    might lead to the execution of arbitrary code with the privileges of
+    the user running the application (possibly root) or a Denial of
+    Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mono users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/mono-1.2.5.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5197">CVE-2007-5197</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 03 Nov 2007 23:52:57 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 07 Nov 2007 22:49:37 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-11.xml b/xml/htdocs/security/en/glsa/glsa-200711-11.xml
new file mode 100644
index 00000000..0aaf4e0d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-11.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-11">
+  <title>Nagios Plugins: Two buffer overflows</title>
+  <synopsis>
+    Two buffer overflow vulnerabilities in the Nagios Plugins might allow for
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">nagios-plugins</product>
+  <announced>November 08, 2007</announced>
+  <revised>November 08, 2007: 01</revised>
+  <bug>196308</bug>
+  <bug>194178</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/nagios-plugins" auto="yes" arch="*">
+      <unaffected range="ge">1.4.10-r1</unaffected>
+      <vulnerable range="lt">1.4.10-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Nagios Plugins are an official set of plugins for Nagios, an open
+    source host, service and network monitoring program.
+    </p>
+  </background>
+  <description>
+    <p>
+    fabiodds reported a boundary checking error in the "check_snmp" plugin
+    when processing SNMP "GET" replies that could lead to a stack-based
+    buffer overflow (CVE-2007-5623). Nobuhiro Ban reported a boundary
+    checking error in the redir() function of the "check_http" plugin when
+    processing HTTP "Location:" header information which might lead to a
+    buffer overflow (CVE-2007-5198).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit these vulnerabilities to execute
+    arbitrary code with the privileges of the user running Nagios or cause
+    a Denial of Service by (1) sending a specially crafted SNMP "GET" reply
+    to the Nagios daemon or (2) sending an overly long string in the
+    "Location:" header of an HTTP reply. Note that to exploit (2), the
+    malicious or compromised web server has to be configured in Nagios and
+    the "-f" (follow) option has to be enabled.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users of the Nagios Plugins should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/nagios-plugins-1.4.10-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5198">CVE-2007-5198</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5623">CVE-2007-5623</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 03 Nov 2007 12:12:46 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 05 Nov 2007 00:16:27 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 07 Nov 2007 19:12:11 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-12.xml b/xml/htdocs/security/en/glsa/glsa-200711-12.xml
new file mode 100644
index 00000000..97e12d2b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-12.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-12">
+  <title>Tomboy: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Tomboy doesn't properly handle environment variables, potentially allowing
+    a local attacker to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">tomboy</product>
+  <announced>November 08, 2007</announced>
+  <revised>November 08, 2007: 01</revised>
+  <bug>189249</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-misc/tomboy" auto="yes" arch="*">
+      <unaffected range="ge">0.8.1-r1</unaffected>
+      <vulnerable range="lt">0.8.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Tomboy is a GTK-based desktop note-taking application written in C# and
+    the Mono C#.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jan Oravec reported that the "/usr/bin/tomboy" script sets the
+    "LD_LIBRARY_PATH" environment variable incorrectly, which might result
+    in the current working directory (.) to be included when searching for
+    dynamically linked libraries of the Mono Runtime application.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could entice a user into running Tomboy in a directory
+    containing a specially crafted library file to execute arbitrary code
+    with the privileges of the user running Tomboy.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not run Tomboy from an untrusted working directory.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Tomboy users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-misc/tomboy-0.8.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4790">CVE-2005-4790</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 06 Nov 2007 01:11:29 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 06 Nov 2007 04:11:22 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 06 Nov 2007 04:11:35 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-13.xml b/xml/htdocs/security/en/glsa/glsa-200711-13.xml
new file mode 100644
index 00000000..eeba4eac
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-13.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-13">
+  <title>3proxy: Denial of Service</title>
+  <synopsis>
+    A vulnerability has been discovered in 3proxy, possibly resulting in a
+    Denial of Service.
+  </synopsis>
+  <product type="ebuild">3proxy</product>
+  <announced>November 08, 2007</announced>
+  <revised>November 08, 2007: 01</revised>
+  <bug>196772</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-proxy/3proxy" auto="yes" arch="*">
+      <unaffected range="ge">0.5.3j</unaffected>
+      <vulnerable range="lt">0.5.3j</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    3proxy is a really tiny cross-platform proxy servers set, including
+    HTTP, HTTPS, FTP, SOCKS and POP3 support.
+    </p>
+  </background>
+  <description>
+    <p>
+    3proxy contains a double free vulnerability in the ftpprchild()
+    function, which frees param->hostname and calls the parsehostname()
+    function, which in turn attempts to free param->hostname again.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send a specially crafted request to the proxy,
+    possibly resulting in a Denial of Service. Under typical configuration,
+    the scope of this vulnerability is limited to the local network.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All 3proxy users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-proxy/3proxy-0.5.3j&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5622">CVE-2007-5622</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 02 Nov 2007 23:15:07 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 03 Nov 2007 12:02:00 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 04 Nov 2007 14:26:02 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-14.xml b/xml/htdocs/security/en/glsa/glsa-200711-14.xml
new file mode 100644
index 00000000..87364c36
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-14.xml
@@ -0,0 +1,127 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-14">
+  <title>Mozilla Firefox, SeaMonkey, XULRunner: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Mozilla Firefox, SeaMonkey
+    and XULRunner, potentially allowing to compromise a user's system.
+  </synopsis>
+  <product type="ebuild">firefox seamonkey xulrunner</product>
+  <announced>November 12, 2007</announced>
+  <revised>November 12, 2007: 01</revised>
+  <bug>196480</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.9</unaffected>
+      <vulnerable range="lt">2.0.0.9</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.9</unaffected>
+      <vulnerable range="lt">2.0.0.9</vulnerable>
+    </package>
+    <package name="www-client/seamonkey" auto="yes" arch="*">
+      <unaffected range="ge">1.1.6</unaffected>
+      <vulnerable range="lt">1.1.6</vulnerable>
+    </package>
+    <package name="www-client/seamonkey-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.1.6</unaffected>
+      <vulnerable range="lt">1.1.6</vulnerable>
+    </package>
+    <package name="net-libs/xulrunner" auto="yes" arch="*">
+      <unaffected range="ge">1.8.1.9</unaffected>
+      <vulnerable range="lt">1.8.1.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Firefox is a cross-platform web browser from Mozilla. SeaMonkey
+    is a free, cross-platform Internet suite.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in Mozilla Firefox and
+    SeaMonkey. Various errors in the browser engine and the Javascript
+    engine can be exploited to cause a memory corruption (CVE-2007-5339 and
+    CVE-2007-5340). Before being used in a request, input passed to the
+    user ID when making an HTTP request with digest authentication is not
+    properly sanitised (CVE-2007-2292). The titlebar can be hidden by a XUL
+    markup language document (CVE-2007-5334). Additionally, an error exists
+    in the handling of "smb:" and "sftp:" URI schemes on systems with
+    gnome-vfs support (CVE-2007-5337). An unspecified error in the handling
+    of "XPCNativeWrappers" and not properly implementing JavaScript
+    onUnload() handlers may allow the execution of arbitrary Javascript
+    code (CVE-2007-5338 and CVE-2007-1095). Another error is triggered by
+    using the addMicrosummaryGenerator sidebar method to access file: URIs
+    (CVE-2007-5335).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these issues to execute arbitrary code,
+    gain the privileges of the user running the application, disclose
+    sensitive information, conduct phishing attacks, and read and
+    manipulate certain data.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-2.0.0.9&quot;</code>
+    <p>
+    All Mozilla Firefox binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-2.0.0.9&quot;</code>
+    <p>
+    All SeaMonkey users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/seamonkey-1.1.6&quot;</code>
+    <p>
+    All SeaMonkey binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/seamonkey-bin-1.1.6&quot;</code>
+    <p>
+    All XULRunner users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/xulrunner-1.8.1.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1095">CVE-2007-1095</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2292">CVE-2007-2292</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5334">CVE-2007-5334</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5335">CVE-2007-5335</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5337">CVE-2007-5337</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5338">CVE-2007-5338</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5339">CVE-2007-5339</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5340">CVE-2007-5340</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 24 Oct 2007 22:27:12 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 25 Oct 2007 23:05:04 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 12 Nov 2007 21:08:46 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-15.xml b/xml/htdocs/security/en/glsa/glsa-200711-15.xml
new file mode 100644
index 00000000..68c8ee6d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-15.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-15">
+  <title>FLAC: Buffer overflow</title>
+  <synopsis>
+    Multiple integer overflow vulnerabilities were found in FLAC possibly
+    allowing for the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">flac</product>
+  <announced>November 12, 2007</announced>
+  <revised>November 12, 2007: 01</revised>
+  <bug>195700</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/flac" auto="yes" arch="*">
+      <unaffected range="ge">1.2.1-r1</unaffected>
+      <vulnerable range="lt">1.2.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Xiph.org Free Lossless Audio Codec (FLAC) library is the reference
+    implementation of the FLAC audio file format. It contains encoders and
+    decoders in library and executable form.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sean de Regge reported multiple integer overflows when processing FLAC
+    media files that could lead to improper memory allocations resulting in
+    heap-based buffer overflows.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted FLAC
+    file or network stream with an application using FLAC. This might lead
+    to the execution of arbitrary code with privileges of the user playing
+    the file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All FLAC users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/flac-1.2.1-r1&quot;</code>
+    <p>
+    You should also run revdep-rebuild to rebuild any packages that depend
+    on older versions of FLAC:
+    </p>
+    <code>
+    # revdep-rebuild --library=libFLAC.*</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4619">CVE-2007-4619</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 01 Nov 2007 19:12:08 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 02 Nov 2007 03:25:37 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 03 Nov 2007 23:19:45 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-16.xml b/xml/htdocs/security/en/glsa/glsa-200711-16.xml
new file mode 100644
index 00000000..ad33c61e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-16.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-16">
+  <title>CUPS: Memory corruption</title>
+  <synopsis>
+    CUPS contains a boundary checking error that might lead to the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">cups</product>
+  <announced>November 12, 2007</announced>
+  <revised>November 12, 2007: 01</revised>
+  <bug>196736</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-print/cups" auto="yes" arch="*">
+      <unaffected range="ge">1.2.12-r2</unaffected>
+      <vulnerable range="lt">1.2.12-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CUPS provides a portable printing layer for UNIX-based operating
+    systems.
+    </p>
+  </background>
+  <description>
+    <p>
+    Alin Rad Pop (Secunia Research) discovered an off-by-one error in the
+    ippReadIO() function when handling Internet Printing Protocol (IPP)
+    tags that might allow to overwrite one byte on the stack.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could send a specially crafted IPP request containing
+    "textWithLanguage" or "nameWithLanguage" tags, leading to a Denial of
+    Service or the execution of arbitrary code with the privileges of the
+    "lp" user. If CUPS is configured to allow network printing, this
+    vulnerability might be remotely exploitable.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    To avoid remote exploitation, network access to CUPS servers on port
+    631/udp should be restricted. In order to do this, update the "Listen"
+    setting in cupsd.conf to "<i>Listen localhost:631</i>" or add a rule to
+    the system's firewall. However, this will not avoid local users from
+    exploiting this vulnerability.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CUPS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-print/cups-1.2.12-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4351">CVE-2007-4351</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 04 Nov 2007 00:16:24 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 11 Nov 2007 08:38:00 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-17.xml b/xml/htdocs/security/en/glsa/glsa-200711-17.xml
new file mode 100644
index 00000000..c9ad00df
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-17.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-17">
+  <title>Ruby on Rails: Multiple vulnerabilities</title>
+  <synopsis>
+    Several vulnerabilities were found in Ruby on Rails allowing for file
+    disclosure and theft of user credentials.
+  </synopsis>
+  <product type="ebuild">rails</product>
+  <announced>November 14, 2007</announced>
+  <revised>November 14, 2007: 01</revised>
+  <bug>195315</bug>
+  <bug>182223</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-ruby/rails" auto="yes" arch="*">
+      <unaffected range="ge">1.2.5</unaffected>
+      <vulnerable range="lt">1.2.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ruby on Rails is a free web framework used to develop database-driven
+    web applications.
+    </p>
+  </background>
+  <description>
+    <p>
+    candlerb found that ActiveResource, when processing responses using the
+    Hash.from_xml() function, does not properly sanitize filenames
+    (CVE-2007-5380). The session management functionality allowed the
+    "session_id" to be set in the URL (CVE-2007-5380). BCC discovered that
+    the to_json() function does not properly sanitize input before
+    returning it to the user (CVE-2007-3227).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Unauthenticated remote attackers could exploit these vulnerabilities to
+    determine the existence of files or to read the contents of arbitrary
+    XML files; conduct session fixation attacks and gain unauthorized
+    access; and to execute arbitrary HTML and script code in a user's
+    browser session in context of an affected site by enticing a user to
+    browse a specially crafted URL.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ruby on Rails users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-ruby/rails-1.2.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3227">CVE-2007-3227</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5379">CVE-2007-5379</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5380">CVE-2007-5380</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 07 Nov 2007 08:24:34 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 07 Nov 2007 20:49:09 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 09 Nov 2007 19:31:01 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-18.xml b/xml/htdocs/security/en/glsa/glsa-200711-18.xml
new file mode 100644
index 00000000..97d8d95d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-18.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-18">
+  <title>Cpio: Buffer overflow</title>
+  <synopsis>
+    GNU cpio contains a buffer overflow vulnerability, possibly resulting in a
+    Denial of Service.
+  </synopsis>
+  <product type="ebuild">cpio</product>
+  <announced>November 14, 2007</announced>
+  <revised>November 14, 2007: 01</revised>
+  <bug>196978</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/cpio" auto="yes" arch="*">
+      <unaffected range="ge">2.9-r1</unaffected>
+      <vulnerable range="lt">2.9-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GNU cpio copies files into or out of a cpio or tar archive.
+    </p>
+  </background>
+  <description>
+    <p>
+    A buffer overflow vulnerability in the safer_name_suffix() function in
+    GNU cpio has been discovered.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    archive file resulting in a stack-based buffer overflow, possibly
+    crashing the application. It is disputed whether the execution of
+    arbitrary code is possible.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GNU cpio users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/cpio-2.9-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4476">CVE-2007-4476</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 07 Nov 2007 19:52:13 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 07 Nov 2007 20:48:37 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 08 Nov 2007 18:58:10 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-19.xml b/xml/htdocs/security/en/glsa/glsa-200711-19.xml
new file mode 100644
index 00000000..fc935eb5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-19.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-19">
+  <title>TikiWiki: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in TikiWiki, possibly
+    resulting in the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">tikiwiki</product>
+  <announced>November 14, 2007</announced>
+  <revised>November 14, 2007: 01</revised>
+  <bug>195503</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/tikiwiki" auto="yes" arch="*">
+      <unaffected range="ge">1.9.8.3</unaffected>
+      <vulnerable range="lt">1.9.8.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    TikiWiki is an open source content management system written in PHP.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Esser reported that a previous vulnerability (CVE-2007-5423,
+    GLSA 200710-21) was not properly fixed in TikiWiki 1.9.8.1
+    (CVE-2007-5682). The TikiWiki development team also added several
+    checks to avoid file inclusion.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit these vulnerabilities to inject
+    arbitrary code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All TikiWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/tikiwiki-1.9.8.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200710-21.xml">GLSA 200710-21</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5423">CVE-2007-5423</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5682">CVE-2007-5682</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 27 Oct 2007 13:39:33 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 03 Nov 2007 23:20:18 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 13 Nov 2007 23:14:54 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-20.xml b/xml/htdocs/security/en/glsa/glsa-200711-20.xml
new file mode 100644
index 00000000..ee7710d1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-20.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-20">
+  <title>Pioneers: Multiple Denials of Service</title>
+  <synopsis>
+    Two Denial of Service vulnerabilities were discovered in Pioneers.
+  </synopsis>
+  <product type="ebuild">pioneers</product>
+  <announced>November 14, 2007</announced>
+  <revised>November 29, 2007: 04</revised>
+  <bug>198807</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-board/pioneers" auto="yes" arch="*">
+      <unaffected range="ge">0.11.3-r1</unaffected>
+      <vulnerable range="lt">0.11.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Pioneers (formerly gnocatan) is a clone of the popular board game "The
+    Settlers of Catan".
+    </p>
+  </background>
+  <description>
+    <p>
+    Roland Clobus discovered that the Pioneers server may free sessions
+    objects while they are still in use, resulting in access to invalid
+    memory zones (CVE-2007-5933). Bas Wijnen discovered an error when
+    closing connections which can lead to a failed assertion
+    (CVE-2007-6010).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted data to the vulnerable
+    server, resulting in a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Pioneers users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-board/pioneers-0.11.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5933">CVE-2007-5933</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6010">CVE-2007-6010</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 11 Nov 2007 15:28:52 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 13 Nov 2007 22:49:53 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 13 Nov 2007 23:00:46 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-21.xml b/xml/htdocs/security/en/glsa/glsa-200711-21.xml
new file mode 100644
index 00000000..4d11264c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-21.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-21">
+  <title>Bochs: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Bochs, possibly allowing
+    for the execution of arbitrary code or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">bochs</product>
+  <announced>November 17, 2007</announced>
+  <revised>November 17, 2007: 01</revised>
+  <bug>188148</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-emulation/bochs" auto="yes" arch="*">
+      <unaffected range="ge">2.3</unaffected>
+      <vulnerable range="lt">2.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Bochs is a IA-32 (x86) PC emulator written in C++.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Google Security Team discovered a heap-based
+    overflow vulnerability in the NE2000 driver (CVE-2007-2893). He also
+    discovered a divide-by-zero error in the emulated floppy disk
+    controller (CVE-2007-2894).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker in the guest operating system could exploit these
+    issues to execute code outside of the virtual machine, or cause Bochs
+    to crash.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Bochs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/bochs-2.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2893">CVE-2007-2893</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2894">CVE-2007-2894</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 29 Sep 2007 14:10:20 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 29 Sep 2007 14:11:15 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 01 Nov 2007 20:22:24 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-22.xml b/xml/htdocs/security/en/glsa/glsa-200711-22.xml
new file mode 100644
index 00000000..db2d60ba
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-22.xml
@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-22">
+  <title>Poppler, KDE: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Poppler and various KDE components are vulnerable to multiple memory
+    management issues possibly resulting in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">poppler koffice kword kdegraphics kpdf</product>
+  <announced>November 18, 2007</announced>
+  <revised>November 18, 2007: 01</revised>
+  <bug>196735</bug>
+  <bug>198409</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/poppler" auto="yes" arch="*">
+      <unaffected range="ge">0.6.1-r1</unaffected>
+      <vulnerable range="lt">0.6.1-r1</vulnerable>
+    </package>
+    <package name="kde-base/kpdf" auto="yes" arch="*">
+      <unaffected range="rge">3.5.7-r3</unaffected>
+      <unaffected range="ge">3.5.8-r1</unaffected>
+      <vulnerable range="lt">3.5.8-r1</vulnerable>
+    </package>
+    <package name="kde-base/kdegraphics" auto="yes" arch="*">
+      <unaffected range="rge">3.5.7-r3</unaffected>
+      <unaffected range="ge">3.5.8-r1</unaffected>
+      <vulnerable range="lt">3.5.8-r1</vulnerable>
+    </package>
+    <package name="app-office/kword" auto="yes" arch="*">
+      <unaffected range="ge">1.6.3-r2</unaffected>
+      <vulnerable range="lt">1.6.3-r2</vulnerable>
+    </package>
+    <package name="app-office/koffice" auto="yes" arch="*">
+      <unaffected range="ge">1.6.3-r2</unaffected>
+      <vulnerable range="lt">1.6.3-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Poppler is a cross-platform PDF rendering library originally based on
+    Xpdf. KOffice is an integrated office suite for KDE. KWord is the
+    KOffice word processor. KPDF is a KDE-based PDF viewer included in the
+    kdegraphics package.
+    </p>
+  </background>
+  <description>
+    <p>
+    Alin Rad Pop (Secunia Research) discovered several vulnerabilities in
+    the "Stream.cc" file of Xpdf: An integer overflow in the
+    DCTStream::reset() method and a boundary error in the
+    CCITTFaxStream::lookChar() method, both leading to heap-based buffer
+    overflows (CVE-2007-5392, CVE-2007-5393). He also discovered a boundary
+    checking error in the DCTStream::readProgressiveDataUnit() method
+    causing memory corruption (CVE-2007-4352). Note: Gentoo's version of
+    Xpdf is patched to use the Poppler library, so the update to Poppler
+    will also fix Xpdf.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to view or process a specially crafted PDF file with
+    KWord or KPDF or a Poppler-based program such as Gentoo's viewers Xpdf,
+    ePDFView, and Evince or the CUPS printing system, a remote attacker
+    could cause an overflow, potentially resulting in the execution of
+    arbitrary code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Poppler users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/poppler-0.6.1-r1&quot;</code>
+    <p>
+    All KPDF users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kpdf-3.5.7-r3&quot;</code>
+    <p>
+    All KDE Graphics Libraries users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kdegraphics-3.5.7-r3&quot;</code>
+    <p>
+    All KWord users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/kword-1.6.3-r2&quot;</code>
+    <p>
+    All KOffice users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/koffice-1.6.3-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4352">CVE-2007-4352</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5392">CVE-2007-5392</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5393">CVE-2007-5393</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 13 Nov 2007 00:47:07 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 18 Nov 2007 00:30:13 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-23.xml b/xml/htdocs/security/en/glsa/glsa-200711-23.xml
new file mode 100644
index 00000000..2cf06dff
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-23.xml
@@ -0,0 +1,112 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-23">
+  <title>VMware Workstation and Player: Multiple vulnerabilities</title>
+  <synopsis>
+    VMware guest operating systems might be able to execute arbitrary code with
+    elevated privileges on the host operating system through multiple flaws.
+  </synopsis>
+  <product type="ebuild">vmware-workstation vmware-player</product>
+  <announced>November 18, 2007</announced>
+  <revised>April 16, 2008: 03</revised>
+  <bug>193196</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-emulation/vmware-workstation" auto="yes" arch="*">
+      <unaffected range="ge">5.5.5.56455</unaffected>
+      <vulnerable range="lt">5.5.5.56455</vulnerable>
+      <vulnerable range="eq">6.0.0.45731</vulnerable>
+    </package>
+    <package name="app-emulation/vmware-player" auto="yes" arch="*">
+      <unaffected range="ge">1.0.5.56455</unaffected>
+      <vulnerable range="lt">1.0.5.56455</vulnerable>
+      <vulnerable range="eq">2.0.0.45731</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    VMware Workstation is a virtual machine for developers and system
+    administrators. VMware Player is a freeware virtualization software
+    that can run guests produced by other VMware products.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in several VMware
+    products. Neel Mehta and Ryan Smith (IBM ISS X-Force) discovered that
+    the DHCP server contains an integer overflow vulnerability
+    (CVE-2007-0062), an integer underflow vulnerability (CVE-2007-0063) and
+    another error when handling malformed packets (CVE-2007-0061), leading
+    to stack-based buffer overflows or stack corruption. Rafal Wojtczvk
+    (McAfee) discovered two unspecified errors that allow authenticated
+    users with administrative or login privileges on a guest operating
+    system to corrupt memory or cause a Denial of Service (CVE-2007-4496,
+    CVE-2007-4497). Another unspecified vulnerability related to untrusted
+    virtual machine images was discovered (CVE-2007-5617).
+    </p>
+    <p>
+    VMware products also shipped code copies of software with several
+    vulnerabilities: Samba (GLSA-200705-15), BIND (GLSA-200702-06), MIT
+    Kerberos 5 (GLSA-200707-11), Vixie Cron (GLSA-200704-11), shadow
+    (GLSA-200606-02), OpenLDAP (CVE-2006-4600), PAM (CVE-2004-0813,
+    CVE-2007-1716), GCC (CVE-2006-3619) and GDB (CVE-2006-4146).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote attackers within a guest system could possibly exploit these
+    vulnerabilities to execute code on the host system with elevated
+    privileges or to cause a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All VMware Workstation users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/vmware-workstation-5.5.5.56455&quot;</code>
+    <p>
+    All VMware Player users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/vmware-player-1.0.5.56455&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0813">CVE-2004-0813</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3619">CVE-2006-3619</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4146">CVE-2006-4146</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4600">CVE-2006-4600</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0061">CVE-2007-0061</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0062">CVE-2007-0062</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0063">CVE-2007-0063</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1716">CVE-2007-1716</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4496">CVE-2007-4496</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4497">CVE-2007-4497</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5617">CVE-2007-5617</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200606-02.xml">GLSA-200606-02</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200702-06.xml">GLSA-200702-06</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200704-11.xml">GLSA-200704-11</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200705-15.xml">GLSA-200705-15</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200707-11.xml">GLSA-200707-11</uri>
+    <uri link="http://lists.vmware.com/pipermail/security-announce/2007/000001.html">VMSA-2007-0006</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 07 Nov 2007 01:24:32 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 13 Nov 2007 02:06:33 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 15 Nov 2007 23:43:42 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-24.xml b/xml/htdocs/security/en/glsa/glsa-200711-24.xml
new file mode 100644
index 00000000..2dc240e5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-24.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-24">
+  <title>Mozilla Thunderbird: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been reported in Mozilla Thunderbird, which
+    may allow user-assisted arbitrary remote code execution.
+  </synopsis>
+  <product type="ebuild">mozilla-thunderbird mozilla-thunderbird-bin</product>
+  <announced>November 18, 2007</announced>
+  <revised>November 18, 2007: 01</revised>
+  <bug>196481</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/mozilla-thunderbird" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.9</unaffected>
+      <vulnerable range="lt">2.0.0.9</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.9</unaffected>
+      <vulnerable range="lt">2.0.0.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Thunderbird is a popular open-source email client from the
+    Mozilla project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in Mozilla Thunderbird's
+    HTML browser engine (CVE-2007-5339) and JavaScript engine
+    (CVE-2007-5340) that can be exploited to cause a memory corruption.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to read a specially crafted email
+    that could trigger one of the vulnerabilities, possibly leading to the
+    execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time for all of these issues, but
+    some of them can be avoided by disabling JavaScript.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Thunderbird users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-2.0.0.9&quot;</code>
+    <p>
+    All Mozilla Thunderbird binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-bin-2.0.0.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5339">CVE-2007-5339</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5340">CVE-2007-5340</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200711-14.xml">GLSA 200711-14</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 18 Nov 2007 13:53:08 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 18 Nov 2007 19:54:39 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 18 Nov 2007 19:58:25 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-25.xml b/xml/htdocs/security/en/glsa/glsa-200711-25.xml
new file mode 100644
index 00000000..f26a8558
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-25.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-25">
+  <title>MySQL: Denial of Service</title>
+  <synopsis>
+    A Denial of Service vulnerability was found in MySQL.
+  </synopsis>
+  <product type="ebuild">mysql</product>
+  <announced>November 18, 2007</announced>
+  <revised>November 18, 2007: 01</revised>
+  <bug>198988</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/mysql" auto="yes" arch="*">
+      <unaffected range="ge">5.0.44-r2</unaffected>
+      <vulnerable range="lt">5.0.44-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MySQL is a popular multi-threaded, multi-user SQL server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Joe Gallo and Artem Russakovskii reported an error in the
+    convert_search_mode_to_innobase() function in ha_innodb.cc in the
+    InnoDB engine that is leading to a failed assertion when handling
+    CONTAINS operations.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote authenticated attacker with ALTER privileges could send a
+    specially crafted request to a vulnerable database server possibly
+    leading to a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MySQL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/mysql-5.0.44-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5925">CVE-2007-5925</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 18 Nov 2007 14:18:51 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 18 Nov 2007 20:09:52 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 18 Nov 2007 20:10:13 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-26.xml b/xml/htdocs/security/en/glsa/glsa-200711-26.xml
new file mode 100644
index 00000000..e8dd045f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-26.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-26">
+  <title>teTeX: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in teTeX, possibly allowing
+    to execute arbitrary code or overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">tetex</product>
+  <announced>November 18, 2007</announced>
+  <revised>November 18, 2007: 01</revised>
+  <bug>198238</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/tetex" auto="yes" arch="*">
+      <unaffected range="ge">3.0_p1-r6</unaffected>
+      <vulnerable range="lt">3.0_p1-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    teTeX is a complete TeX distribution for editing documents.
+    </p>
+  </background>
+  <description>
+    <p>
+    Joachim Schrod discovered several buffer overflow vulnerabilities and
+    an insecure temporary file creation in the "dvilj" application that is
+    used by dvips to convert DVI files to printer formats (CVE-2007-5937,
+    CVE-2007-5936). Bastien Roucaries reported that the "dvips" application
+    is vulnerable to two stack-based buffer overflows when processing DVI
+    documents with long \href{} URIs (CVE-2007-5935). teTeX also includes
+    code from Xpdf that is vulnerable to a memory corruption and two
+    heap-based buffer overflows (GLSA 200711-22); and it contains code from
+    T1Lib that is vulnerable to a buffer overflow when processing an overly
+    long font filename (GLSA 200710-12).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to process a specially crafted
+    DVI or PDF file which could lead to the execution of arbitrary code
+    with the privileges of the user running the application. A local
+    attacker could exploit the "dvilj" vulnerability to conduct a symlink
+    attack to overwrite arbitrary files.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All teTeX users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/tetex-3.0_p1-r6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5935">CVE-2007-5935</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5936">CVE-2007-5936</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5937">CVE-2007-5937</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200710-12.xml">GLSA 200710-12</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200711-22.xml">GLSA 200711-22</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 13 Nov 2007 01:13:42 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 18 Nov 2007 21:46:32 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-27.xml b/xml/htdocs/security/en/glsa/glsa-200711-27.xml
new file mode 100644
index 00000000..d359d625
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-27.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-27">
+  <title>Link Grammar: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow vulnerability has been discovered in Link Grammar.
+  </synopsis>
+  <product type="ebuild">link-grammar</product>
+  <announced>November 18, 2007</announced>
+  <revised>November 18, 2007: 01</revised>
+  <bug>196803</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/link-grammar" auto="yes" arch="*">
+      <unaffected range="ge">4.2.4-r1</unaffected>
+      <vulnerable range="lt">4.2.4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Link Grammar parser is a syntactic parser of English, based on link
+    grammar, an original theory of English syntax.
+    </p>
+  </background>
+  <description>
+    <p>
+    Alin Rad Pop from Secunia Research discovered a boundary error in the
+    function separate_sentence() in file tokenize.c when processing an
+    overly long word which might lead to a stack-based buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to parse a specially crafted
+    sentence, resulting in the remote execution of arbitrary code with the
+    privileges of the user running the application. Note that this
+    vulnerability may be triggered by an application using Link Grammar to
+    parse sentences (e.g. AbiWord).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Link Grammar users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/link-grammar-4.2.4-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5395">CVE-2007-5395</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 14 Nov 2007 17:43:19 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 17 Nov 2007 19:29:25 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 17 Nov 2007 19:29:34 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-28.xml b/xml/htdocs/security/en/glsa/glsa-200711-28.xml
new file mode 100644
index 00000000..0e511c72
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-28.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-28">
+  <title>Perl: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow in the Regular Expression engine in Perl possibly allows
+    for the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">perl</product>
+  <announced>November 19, 2007</announced>
+  <revised>November 19, 2007: 01</revised>
+  <bug>198196</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/perl" auto="yes" arch="*">
+      <unaffected range="ge">5.8.8-r4</unaffected>
+      <vulnerable range="lt">5.8.8-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Perl is a stable, cross-platform programming language created by Larry
+    Wall.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy and Will Drewry (Google Security Team) discovered a
+    heap-based buffer overflow in the Regular Expression engine (regcomp.c)
+    that occurs when switching from byte to Unicode (UTF-8) characters in a
+    regular expression.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could either entice a user to compile a specially
+    crafted regular expression or actively compile it in case the script
+    accepts remote input of regular expressions, possibly leading to the
+    execution of arbitrary code with the privileges of the user running
+    Perl.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Perl users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/perl-5.8.8-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5116">CVE-2007-5116</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 14 Nov 2007 01:27:30 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 15 Nov 2007 00:34:08 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 19 Nov 2007 14:24:28 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-29.xml b/xml/htdocs/security/en/glsa/glsa-200711-29.xml
new file mode 100644
index 00000000..aef528d6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-29.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-29">
+  <title>Samba: Execution of arbitrary code</title>
+  <synopsis>
+    Samba contains two buffer overflow vulnerabilities potentially resulting in
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">samba</product>
+  <announced>November 20, 2007</announced>
+  <revised>December 05, 2007: 03</revised>
+  <bug>197519</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-fs/samba" auto="yes" arch="*">
+      <unaffected range="ge">3.0.27a</unaffected>
+      <vulnerable range="lt">3.0.27a</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Samba is a suite of SMB and CIFS client/server programs for UNIX.
+    </p>
+  </background>
+  <description>
+    <p>
+    Two vulnerabilities have been reported in nmbd. Alin Rad Pop (Secunia
+    Research) discovered a boundary checking error in the
+    reply_netbios_packet() function which could lead to a stack-based
+    buffer overflow (CVE-2007-5398). The Samba developers discovered a
+    boundary error when processing GETDC logon requests also leading to a
+    buffer overflow (CVE-2007-4572).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    To exploit the first vulnerability, a remote unauthenticated attacker
+    could send specially crafted WINS "Name Registration" requests followed
+    by a WINS "Name Query" request. This might lead to execution of
+    arbitrary code with elevated privileges. Note that this vulnerability
+    is exploitable only when WINS server support is enabled in Samba. The
+    second vulnerability could be exploited by sending specially crafted
+    "GETDC" mailslot requests, but requires Samba to be configured as a
+    Primary or Backup Domain Controller. It is not believed the be
+    exploitable to execute arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    To work around the first vulnerability, disable WINS support in Samba
+    by setting "<i>wins support = no</i>" in the "global" section of your
+    smb.conf and restart Samba.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Samba users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-fs/samba-3.0.27a&quot;</code>
+    <p>
+    The first vulnerability (CVE-2007-5398) was already fixed in Samba
+    3.0.26a-r2.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4572">CVE-2007-4572</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5398">CVE-2007-5398</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 03 Nov 2007 23:37:14 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 20 Nov 2007 21:13:02 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-30.xml b/xml/htdocs/security/en/glsa/glsa-200711-30.xml
new file mode 100644
index 00000000..85dfbdbc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-30.xml
@@ -0,0 +1,102 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-30">
+  <title>PCRE: Multiple vulnerabilities</title>
+  <synopsis>
+    PCRE is vulnerable to multiple buffer overflow and memory corruption
+    vulnerabilities, possibly leading to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">libpcre</product>
+  <announced>November 20, 2007</announced>
+  <revised>November 20, 2007: 01</revised>
+  <bug>198198</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/libpcre" auto="yes" arch="*">
+      <unaffected range="ge">7.3-r1</unaffected>
+      <vulnerable range="lt">7.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PCRE is a library providing functions for Perl-compatible regular
+    expressions.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy (Google Security) discovered multiple vulnerabilities in
+    PCRE. He reported an error when processing "\Q\E" sequences with
+    unmatched "\E" codes that can lead to the compiled bytecode being
+    corrupted (CVE-2007-1659). PCRE does not properly calculate sizes for
+    unspecified "multiple forms of character class", which triggers a
+    buffer overflow (CVE-2007-1660). Further improper calculations of
+    memory boundaries were reported when matching certain input bytes
+    against regex patterns in non UTF-8 mode (CVE-2007-1661) and when
+    searching for unmatched brackets or parentheses (CVE-2007-1662).
+    Multiple integer overflows when processing escape sequences may lead to
+    invalid memory read operations or potentially cause heap-based buffer
+    overflows (CVE-2007-4766). PCRE does not properly handle "\P" and
+    "\P{x}" sequences which can lead to heap-based buffer overflows or
+    trigger the execution of infinite loops (CVE-2007-4767), PCRE is also
+    prone to an error when optimizing character classes containing a
+    singleton UTF-8 sequence which might lead to a heap-based buffer
+    overflow (CVE-2007-4768).
+    </p>
+    <p>
+    Chris Evans also reported multiple integer overflow vulnerabilities in
+    PCRE when processing a large number of named subpatterns ("name_count")
+    or long subpattern names ("max_name_size") (CVE-2006-7227), and via
+    large "min", "max", or "duplength" values (CVE-2006-7228) both possibly
+    leading to buffer overflows. Another vulnerability was reported when
+    compiling patterns where the "-x" or "-i" UTF-8 options change within
+    the pattern, which might lead to improper memory calculations
+    (CVE-2006-7230).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit these vulnerabilities by sending specially
+    crafted regular expressions to applications making use of the PCRE
+    library, which could possibly lead to the execution of arbitrary code,
+    a Denial of Service or the disclosure of sensitive information.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PCRE users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/libpcre-7.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7227">CVE-2006-7227</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7228">CVE-2006-7228</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7230">CVE-2006-7230</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1659">CVE-2007-1659</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1660">CVE-2007-1660</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1661">CVE-2007-1661</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1662">CVE-2007-1662</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4766">CVE-2007-4766</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4767">CVE-2007-4767</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4768">CVE-2007-4768</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 09 Nov 2007 10:23:13 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 20 Nov 2007 00:43:59 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 20 Nov 2007 00:44:04 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-31.xml b/xml/htdocs/security/en/glsa/glsa-200711-31.xml
new file mode 100644
index 00000000..17c69e95
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-31.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-31">
+  <title>Net-SNMP: Denial of Service</title>
+  <synopsis>
+    A Denial of Service vulnerability has been discovered in Net-SNMP when
+    processing GETBULK requests.
+  </synopsis>
+  <product type="ebuild">net-snmp</product>
+  <announced>November 20, 2007</announced>
+  <revised>November 20, 2007: 01</revised>
+  <bug>198346</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/net-snmp" auto="yes" arch="*">
+      <unaffected range="ge">5.4.1-r1</unaffected>
+      <vulnerable range="lt">5.4.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Net-SNMP is a collection of tools for generating and retrieving SNMP
+    data.
+    </p>
+  </background>
+  <description>
+    <p>
+    The SNMP agent (snmpd) does not properly handle GETBULK requests with
+    an overly large "max-repetitions" field.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote unauthenticated attacker could send a specially crafted SNMP
+    request to the vulnerable application, possibly resulting in a high CPU
+    and memory consumption.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Net-SNMP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/net-snmp-5.4.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5846">CVE-2007-5846</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 18 Nov 2007 22:35:11 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 18 Nov 2007 22:35:17 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 19 Nov 2007 21:51:55 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-32.xml b/xml/htdocs/security/en/glsa/glsa-200711-32.xml
new file mode 100644
index 00000000..979bd22b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-32.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-32">
+  <title>Feynmf: Insecure temporary file creation</title>
+  <synopsis>
+    A vulnerability has been discovered in Feynmf allowing local users to
+    overwrite arbitrary files via a symlink attack.
+  </synopsis>
+  <product type="ebuild">feynmf</product>
+  <announced>November 20, 2007</announced>
+  <revised>November 20, 2007: 01</revised>
+  <bug>198231</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-tex/feynmf" auto="yes" arch="*">
+      <unaffected range="ge">1.08-r2</unaffected>
+      <vulnerable range="lt">1.08-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Feynmf is a combined LaTeX and Metafont package for easy drawing of
+    professional quality Feynman (and maybe other) diagrams.
+    </p>
+  </background>
+  <description>
+    <p>
+    Kevin B. McCarty discovered that the feynmf.pl script creates a
+    temporary "properly list" file at the location "$TMPDIR/feynmf$PID.pl",
+    where $PID is the process ID.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could create symbolic links in the directory where the
+    temporary files are written, pointing to a valid file somewhere on the
+    filesystem that is writable by the user running Feynmf. When Feynmf
+    writes the temporary file, the target valid file would then be
+    overwritten with the contents of the Feynmf temporary file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Feynmf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-tex/feynmf-1.08-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5940">CVE-2007-5940</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 19 Nov 2007 21:43:28 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 19 Nov 2007 21:44:51 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 20 Nov 2007 00:07:40 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-33.xml b/xml/htdocs/security/en/glsa/glsa-200711-33.xml
new file mode 100644
index 00000000..77b08915
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-33.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-33">
+  <title>nss_ldap: Information disclosure</title>
+  <synopsis>
+    A race condition might lead to theft of user credentials or information
+    disclosure in services using nss_ldap.
+  </synopsis>
+  <product type="ebuild">nss_ldap</product>
+  <announced>November 25, 2007</announced>
+  <revised>November 25, 2007: 01</revised>
+  <bug>198390</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-auth/nss_ldap" auto="yes" arch="*">
+      <unaffected range="ge">258</unaffected>
+      <vulnerable range="lt">258</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    nss_ldap is a Name Service Switch module which allows 'passwd', 'group'
+    and 'host' database information to be pulled from LDAP.
+    </p>
+  </background>
+  <description>
+    <p>
+    Josh Burley reported that nss_ldap does not properly handle the LDAP
+    connections due to a race condition that can be triggered by
+    multi-threaded applications using nss_ldap, which might lead to
+    requested data being returned to a wrong process.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    Remote attackers could exploit this race condition by sending queries
+    to a vulnerable server using nss_ldap, possibly leading to theft of
+    user credentials or information disclosure (e.g. Dovecot returning
+    wrong mailbox contents).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All nss_ldap users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-auth/nss_ldap-258&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5794">CVE-2007-5794</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 18 Nov 2007 15:50:09 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 18 Nov 2007 15:50:16 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 21 Nov 2007 00:25:43 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200711-34.xml b/xml/htdocs/security/en/glsa/glsa-200711-34.xml
new file mode 100644
index 00000000..12e07f77
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200711-34.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200711-34">
+  <title>CSTeX: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities were discovered in CSTeX, possibly allowing to
+    execute arbitrary code or overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">cstetex</product>
+  <announced>November 25, 2007</announced>
+  <revised>November 25, 2007: 01</revised>
+  <bug>196673</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/cstetex" auto="no" arch="*">
+      <vulnerable range="lt">2.0.2-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CSTeX is a TeX distribution with Czech and Slovak support. It is used
+    for creating and manipulating LaTeX documents.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple issues were found in the teTeX 2 codebase that CSTeX builds
+    upon (GLSA 200709-17, GLSA 200711-26). CSTeX also includes vulnerable
+    code from the GD library (GLSA 200708-05), from Xpdf (GLSA 200709-12,
+    GLSA 200711-22) and from T1Lib (GLSA 200710-12).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote attackers could possibly execute arbitrary code and local
+    attackers could possibly overwrite arbitrary files with the privileges
+    of the user running CSTeX via multiple vectors.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    CSTeX is not maintained upstream, so the package was masked in Portage.
+    We recommend that users unmerge CSTeX:
+    </p>
+    <code>
+    # emerge --unmerge app-text/cstetex</code>
+    <p>
+    As an alternative, users should upgrade their systems to use teTeX or
+    TeX Live with its Babel packages.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200708-05.xml">GLSA 200708-05</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200709-12.xml">GLSA 200709-12</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200709-17.xml">GLSA 200709-17</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200710-12.xml">GLSA 200710-12</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200711-22.xml">GLSA 200711-22</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200711-26.xml">GLSA 200711-26</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 13 Nov 2007 00:12:34 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 19 Nov 2007 21:14:43 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-01.xml b/xml/htdocs/security/en/glsa/glsa-200712-01.xml
new file mode 100644
index 00000000..fa61c6c4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-01.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-01">
+  <title>Hugin: Insecure temporary file creation</title>
+  <synopsis>
+    A vulnerability has been discovered in Hugin, potentially allowing for a
+    Denial of Service.
+  </synopsis>
+  <product type="ebuild">hugin</product>
+  <announced>December 05, 2007</announced>
+  <revised>December 05, 2007: 01</revised>
+  <bug>195996</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-gfx/hugin" auto="yes" arch="*">
+      <unaffected range="rge">0.6.1-r1</unaffected>
+      <unaffected range="ge">0.7_beta4-r1</unaffected>
+      <vulnerable range="lt">0.7_beta4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Hugin is a GUI for creating and processing panoramic images.
+    </p>
+  </background>
+  <description>
+    <p>
+    Suse Linux reported that Hugin creates the
+    "hugin_debug_optim_results.txt" temporary file in an insecure manner.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit this vulnerability with a symlink
+    attack, potentially overwriting an arbitrary file with the privileges
+    of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Hugin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/hugin-0.6.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5200">CVE-2007-5200</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 17 Nov 2007 23:47:03 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 17 Nov 2007 23:47:10 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-02.xml b/xml/htdocs/security/en/glsa/glsa-200712-02.xml
new file mode 100644
index 00000000..72043280
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-02.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-02">
+  <title>Cacti: SQL injection</title>
+  <synopsis>
+    An SQL injection vulnerability has been discovered in Cacti.
+  </synopsis>
+  <product type="ebuild">cacti</product>
+  <announced>December 05, 2007</announced>
+  <revised>December 05, 2007: 02</revised>
+  <bug>199509</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/cacti" auto="yes" arch="*">
+      <unaffected range="rge">0.8.6j-r7</unaffected>
+      <unaffected range="ge">0.8.7a</unaffected>
+      <vulnerable range="lt">0.8.7a</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cacti is a complete web-based frontend to rrdtool.
+    </p>
+  </background>
+  <description>
+    <p>
+    It has been reported that the "local_graph_id" variable used in the
+    file graph.php is not properly sanitized before being processed in an
+    SQL statement.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send a specially crafted request to the
+    vulnerable host, possibly resulting in the execution of arbitrary SQL
+    code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cacti users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/cacti-0.8.6j-r7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6035">CVE-2007-6035</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 02 Dec 2007 22:34:20 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 02 Dec 2007 22:34:29 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 04 Dec 2007 22:01:32 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-03.xml b/xml/htdocs/security/en/glsa/glsa-200712-03.xml
new file mode 100644
index 00000000..5d53a3a3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-03.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-03">
+  <title>GNU Emacs: Multiple vulnerabilities</title>
+  <synopsis>
+    Two vulnerabilities were found in GNU Emacs possibly leading to the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">emacs</product>
+  <announced>December 09, 2007</announced>
+  <revised>December 09, 2007: 01</revised>
+  <bug>197958</bug>
+  <bug>200297</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-editors/emacs" auto="yes" arch="*">
+      <unaffected range="ge">22.1-r3</unaffected>
+      <unaffected range="rge">21.4-r14</unaffected>
+      <unaffected range="lt">19</unaffected>
+      <vulnerable range="lt">22.1-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GNU Emacs is a highly extensible and customizable text editor.
+    </p>
+  </background>
+  <description>
+    <p>
+    Drake Wilson reported that the hack-local-variables() function in GNU
+    Emacs 22 does not properly match assignments of local variables in a
+    file against a list of unsafe or risky variables, allowing to override
+    them (CVE-2007-5795). Andreas Schwab (SUSE) discovered a stack-based
+    buffer overflow in the format function when handling values with high
+    precision (CVE-2007-6109).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote attackers could entice a user to open a specially crafted file
+    in GNU Emacs, possibly leading to the execution of arbitrary Emacs Lisp
+    code (via CVE-2007-5795) or arbitrary code (via CVE-2007-6109) with the
+    privileges of the user running GNU Emacs.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    The first vulnerability can be worked around by setting the
+    "enable-local-variables" option to "nil", disabling the processing of
+    local variable lists. GNU Emacs prior to version 22 is not affected by
+    this vulnerability. There is no known workaround for the second
+    vulnerability at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GNU Emacs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-editors/emacs-22.1-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5795">CVE-2007-5795</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6109">CVE-2007-6109</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 20 Nov 2007 22:12:50 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 05 Dec 2007 01:01:27 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 07 Dec 2007 13:59:32 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-04.xml b/xml/htdocs/security/en/glsa/glsa-200712-04.xml
new file mode 100644
index 00000000..33246e00
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-04.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-04">
+  <title>Cairo: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple integer overflows were discovered in Cairo, possibly leading to
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">cairo</product>
+  <announced>December 09, 2007</announced>
+  <revised>December 09, 2007: 01</revised>
+  <bug>200350</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-libs/cairo" auto="yes" arch="*">
+      <unaffected range="ge">1.4.12</unaffected>
+      <vulnerable range="lt">1.4.12</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cairo is a 2D vector graphics library with cross-device output support.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple integer overflows were reported, one of which Peter Valchev
+    (Google Security) found to be leading to a heap-based buffer overflow
+    in the cairo_image_surface_create_from_png() function that processes
+    PNG images.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to view or process a specially
+    crafted PNG image file in an application linked against Cairo, possibly
+    leading to the execution of arbitrary code with the privileges of the
+    user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cairo users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/cairo-1.4.12&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5503">CVE-2007-5503</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 04 Dec 2007 23:43:52 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 05 Dec 2007 01:36:20 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 05 Dec 2007 01:36:55 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-05.xml b/xml/htdocs/security/en/glsa/glsa-200712-05.xml
new file mode 100644
index 00000000..7db39df6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-05.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-05">
+  <title>PEAR::MDB2: Information disclosure</title>
+  <synopsis>
+    A vulnerability when handling database input in PEAR::MDB2 allows remote
+    attackers to obtain sensitive information.
+  </synopsis>
+  <product type="ebuild">PEAR-MDB2</product>
+  <announced>December 09, 2007</announced>
+  <revised>December 09, 2007: 01</revised>
+  <bug>198446</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-php/PEAR-MDB2" auto="yes" arch="*">
+      <unaffected range="ge">2.5.0_alpha1</unaffected>
+      <vulnerable range="lt">2.5.0_alpha1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PEAR::MDB2 is a database abstraction layer for PHP aimed to provide a
+    common API for all supported relational database management systems. A
+    LOB ("large object") is a database field holding binary data.
+    </p>
+  </background>
+  <description>
+    <p>
+    priyadi discovered that the request to store a URL string as a LOB is
+    treated as a request to retrieve and store the contents of the URL.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    If an application using PEAR::MDB2 allows input of LOB values via a web
+    form, remote attackers could use the application as an indirect proxy
+    or obtain sensitive information, including "file://" URLs local to the
+    web server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    As a workaround, manually filter input before storing it as a LOB in
+    PEAR::MDB2.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PEAR::MDB2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-php/PEAR-MDB2-2.5.0_alpha1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5934">CVE-2007-5934</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 02 Dec 2007 12:32:27 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 05 Dec 2007 01:58:28 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 05 Dec 2007 01:59:26 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-06.xml b/xml/htdocs/security/en/glsa/glsa-200712-06.xml
new file mode 100644
index 00000000..14b9ec49
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-06.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-06">
+  <title>Firebird: Multiple buffer overflows</title>
+  <synopsis>
+    Multiple stack-based buffer overflows were discovered in Firebird.
+  </synopsis>
+  <product type="ebuild">firebird</product>
+  <announced>December 09, 2007</announced>
+  <revised>December 09, 2007: 01</revised>
+  <bug>195569</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/firebird" auto="yes" arch="*">
+      <unaffected range="ge">2.0.3.12981.0-r2</unaffected>
+      <vulnerable range="lt">2.0.3.12981.0-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Firebird is a multi-platfrom, open source relational database.
+    </p>
+  </background>
+  <description>
+    <p>
+    Adriano Lima and Ramon de Carvalho Valle reported that functions
+    isc_attach_database() and isc_create_database() do not perform proper
+    boundary checking when processing their input.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted requests to the Firebird
+    server on TCP port 3050, possibly resulting in the execution of
+    arbitrary code with the privileges of the user running Firebird
+    (usually firebird).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Firebird users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/firebird-2.0.3.12981.0-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4992">CVE-2007-4992</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5246">CVE-2007-5246</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 28 Nov 2007 11:24:49 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 29 Nov 2007 00:06:33 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 08 Dec 2007 23:26:04 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-07.xml b/xml/htdocs/security/en/glsa/glsa-200712-07.xml
new file mode 100644
index 00000000..e54ef4b8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-07.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-07">
+  <title>Lookup: Insecure temporary file creation</title>
+  <synopsis>
+    Lookup uses temporary files in an insecure manner, allowing for a symlink
+    attack.
+  </synopsis>
+  <product type="ebuild">lookup</product>
+  <announced>December 09, 2007</announced>
+  <revised>December 09, 2007: 01</revised>
+  <bug>197306</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-emacs/lookup" auto="yes" arch="*">
+      <unaffected range="ge">1.4.1</unaffected>
+      <vulnerable range="lt">1.4.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Lookup is a search interface to books and dictionnaries for Emacs.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tatsuya Kinoshita reported that the ndeb-binary function does not
+    handle temporay files correctly.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could use a symlink attack to overwrite files with the
+    privileges of the user running Lookup.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Lookup users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emacs/lookup-1.4.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0237">CVE-2007-0237</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 19 Nov 2007 22:00:43 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 21 Nov 2007 00:09:14 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 08 Dec 2007 23:10:28 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-08.xml b/xml/htdocs/security/en/glsa/glsa-200712-08.xml
new file mode 100644
index 00000000..439da382
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-08.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-08">
+  <title>AMD64 x86 emulation Qt library: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in the AMD64 x86 emulation Qt library may lead to
+    the remote execution of arbitrary code in Qt applications.
+  </synopsis>
+  <product type="ebuild">emul-linux-x86-qtlibs</product>
+  <announced>December 09, 2007</announced>
+  <revised>December 09, 2007: 01</revised>
+  <bug>189536</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-emulation/emul-linux-x86-qtlibs" auto="yes" arch="amd64">
+      <unaffected range="ge">20071114-r2</unaffected>
+      <vulnerable range="lt">20071114-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Qt is a cross-platform GUI framework, which is used e.g. by KDE. The
+    AMD64 x86 emulation Qt library packages Qt libraries for 32bit x86
+    emulation on AMD64.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Qt versions used by the AMD64 x86 emulation Qt libraries were
+    vulnerable to several flaws (GLSA 200708-16, GLSA 200710-28)
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could trigger one of the vulnerabilities by causing a Qt
+    application to parse specially crafted text or Unicode strings, which
+    may lead to the execution of arbitrary code with the privileges of the
+    user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All AMD64 x86 emulation Qt library users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/emul-linux-x86-qtlibs-20071114-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200708-16.xml">GLSA 200708-16</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200710-28.xml">GLSA 200710-28</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 02 Dec 2007 12:28:12 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 09 Dec 2007 19:55:14 +0000">
+    welp
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 09 Dec 2007 20:04:39 +0000">
+    welp
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-09.xml b/xml/htdocs/security/en/glsa/glsa-200712-09.xml
new file mode 100644
index 00000000..50c67694
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-09.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-09">
+  <title>Ruby-GNOME2: Format string error</title>
+  <synopsis>
+    A format string error has been discovered in Ruby-GNOME2, possibly leading
+    to the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">ruby-gtk2</product>
+  <announced>December 09, 2007</announced>
+  <revised>December 09, 2007: 01</revised>
+  <bug>200623</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-ruby/ruby-gtk2" auto="yes" arch="*">
+      <unaffected range="ge">0.16.0-r2</unaffected>
+      <vulnerable range="lt">0.16.0-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ruby-GNOME2 is a set of bindings for using GTK+ within the Ruby
+    programming language.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Rohlf discovered that the "Gtk::MessageDialog.new()" method in
+    the file gtk/src/rbgtkmessagedialog.c does not properly sanitize the
+    "message" parameter before passing it to the gtk_message_dialog_new()
+    function.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send a specially crafted string to an
+    application using Ruby-GNOME2, possibly leading to the execution of
+    arbitrary code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ruby-GNOME2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-ruby/ruby-gtk2-0.16.0-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6183">CVE-2007-6183</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 04 Dec 2007 18:00:54 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 04 Dec 2007 22:24:59 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 04 Dec 2007 22:25:12 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-10.xml b/xml/htdocs/security/en/glsa/glsa-200712-10.xml
new file mode 100644
index 00000000..afb02377
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-10.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-10">
+  <title>Samba: Execution of arbitrary code</title>
+  <synopsis>
+    Samba contains a buffer overflow vulnerability potentially resulting in the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">samba</product>
+  <announced>December 10, 2007</announced>
+  <revised>December 10, 2007: 01</revised>
+  <bug>200773</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-fs/samba" auto="yes" arch="*">
+      <unaffected range="ge">3.0.28</unaffected>
+      <vulnerable range="lt">3.0.28</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Samba is a suite of SMB and CIFS client/server programs for UNIX.
+    </p>
+  </background>
+  <description>
+    <p>
+    Alin Rad Pop (Secunia Research) discovered a boundary checking error in
+    the send_mailslot() function which could lead to a stack-based buffer
+    overflow.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send a specially crafted "SAMLOGON" domain
+    logon packet, possibly leading to the execution of arbitrary code with
+    elevated privileges. Note that this vulnerability is exploitable only
+    when domain logon support is enabled in Samba, which is not the case in
+    Gentoo's default configuration.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable domain logon in Samba by setting "<i>domain logons = no</i>" in
+    the "global" section of your smb.conf and restart Samba.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Samba users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-fs/samba-3.0.28&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6015">CVE-2007-6015</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 10 Dec 2007 02:00:00 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 10 Dec 2007 19:33:11 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-11.xml b/xml/htdocs/security/en/glsa/glsa-200712-11.xml
new file mode 100644
index 00000000..80f40753
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-11.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-11">
+  <title>Portage: Information disclosure</title>
+  <synopsis>
+    Portage may disclose sensitive information when updating configuration
+    files.
+  </synopsis>
+  <product type="ebuild">portage</product>
+  <announced>December 13, 2007</announced>
+  <revised>December 13, 2007: 01</revised>
+  <bug>193589</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-apps/portage" auto="yes" arch="*">
+      <unaffected range="ge">2.1.3.11</unaffected>
+      <vulnerable range="lt">2.1.3.11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Portage is the default Gentoo package management system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mike Frysinger reported that the "etc-update" utility uses temporary
+    files with the standard umask, which results in the files being
+    world-readable when merging configuration files in a default setup.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could access sensitive information when configuration
+    files are being merged.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Portage users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/portage-2.1.3.11&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6249">CVE-2007-6249</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 10 Dec 2007 21:27:57 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 10 Dec 2007 21:28:40 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 11 Dec 2007 22:39:19 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-12.xml b/xml/htdocs/security/en/glsa/glsa-200712-12.xml
new file mode 100644
index 00000000..7d0a761d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-12.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-12">
+  <title>IRC Services: Denial of Service</title>
+  <synopsis>
+    A Denial of Service vulnerability has been reported in IRC Services.
+  </synopsis>
+  <product type="ebuild">ircservices</product>
+  <announced>December 13, 2007</announced>
+  <revised>December 13, 2007: 01</revised>
+  <bug>199897</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-irc/ircservices" auto="yes" arch="*">
+      <unaffected range="ge">5.0.63</unaffected>
+      <vulnerable range="lt">5.0.63</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    IRC Services is a system of services to be used with Internet Relay
+    Chat networks.
+    </p>
+  </background>
+  <description>
+    <p>
+    loverboy reported that the "default_encrypt()" function in file
+    encrypt.c does not properly handle overly long passwords.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could provide an overly long password to the
+    vulnerable server, resulting in a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All IRC Services users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-irc/ircservices-5.0.63&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6122">CVE-2007-6122</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 10 Dec 2007 21:48:10 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 10 Dec 2007 21:51:02 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 11 Dec 2007 22:44:42 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-13.xml b/xml/htdocs/security/en/glsa/glsa-200712-13.xml
new file mode 100644
index 00000000..702aead1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-13.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-13">
+  <title>E2fsprogs: Multiple buffer overflows</title>
+  <synopsis>
+    Multiple heap-based buffer overflows in E2fsprogs could result in the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">e2fsprogs</product>
+  <announced>December 18, 2007</announced>
+  <revised>December 18, 2007: 01</revised>
+  <bug>201546</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-fs/e2fsprogs" auto="yes" arch="*">
+      <unaffected range="ge">1.40.3</unaffected>
+      <vulnerable range="lt">1.40.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    E2fsprogs provides utilities for use with the ext2 and ext3 file
+    systems including the libext2fs library that allows user-level programs
+    to manipulate an ext2 or ext3 file system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Rafal Wojtczuk (McAfee AVERT Research) discovered multiple integer
+    overflows in libext2fs, that are triggered when processing information
+    from within the file system, resulting in heap-based buffer overflows.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to process a specially-crafted ext2 or
+    ext3 file system image (with tools linking against libext2fs, e.g.
+    fsck, forensic tools or Xen's pygrub), possibly resulting in the
+    execution of arbitrary code with the privileges of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All E2fsprogs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-fs/e2fsprogs-1.40.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5497">CVE-2007-5497</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 12 Dec 2007 09:56:09 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 13 Dec 2007 21:11:04 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 13 Dec 2007 23:03:39 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-14.xml b/xml/htdocs/security/en/glsa/glsa-200712-14.xml
new file mode 100644
index 00000000..798daebe
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-14.xml
@@ -0,0 +1,92 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-14">
+  <title>CUPS: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in CUPS, allowing for the
+    remote execution of arbitrary code and a Denial of Service.
+  </synopsis>
+  <product type="ebuild">cups</product>
+  <announced>December 18, 2007</announced>
+  <revised>December 18, 2007: 01</revised>
+  <bug>199195</bug>
+  <bug>201042</bug>
+  <bug>201570</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-print/cups" auto="yes" arch="*">
+      <unaffected range="rge">1.2.12-r4</unaffected>
+      <unaffected range="ge">1.3.5</unaffected>
+      <vulnerable range="lt">1.3.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CUPS provides a portable printing layer for UNIX-based operating
+    systems. The alternate pdftops filter is a CUPS filter used to convert
+    PDF files to the Postscript format via Poppler; the filter is installed
+    by default in Gentoo Linux.
+    </p>
+  </background>
+  <description>
+    <p>
+    Wei Wang (McAfee AVERT Research) discovered an integer underflow in the
+    asn1_get_string() function of the SNMP backend, leading to a
+    stack-based buffer overflow when handling SNMP responses
+    (CVE-2007-5849). Elias Pipping (Gentoo) discovered that the alternate
+    pdftops filter creates temporary files with predictable file names when
+    reading from standard input (CVE-2007-6358). Furthermore, the
+    resolution of a Denial of Service vulnerability covered in GLSA
+    200703-28 introduced another Denial of Service vulnerability within SSL
+    handling (CVE-2007-4045).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker on the local network could exploit the first
+    vulnerability to execute arbitrary code with elevated privileges by
+    sending specially crafted SNMP messages as a response to an SNMP
+    broadcast request. A local attacker could exploit the second
+    vulnerability to overwrite arbitrary files with the privileges of the
+    user running the CUPS spooler (usually lp) by using symlink attacks. A
+    remote attacker could cause a Denial of Service condition via the third
+    vulnerability when SSL is enabled in CUPS.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    To disable SNMP support in CUPS, you have have to manually delete the
+    file "/usr/libexec/cups/backend/snmp". Please note that the file is
+    reinstalled if you merge CUPS again later. To disable the pdftops
+    filter, delete all lines referencing "pdftops" in CUPS' "mime.convs"
+    configuration file. To work around the third vulnerability, disable SSL
+    support via the corresponding USE flag.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CUPS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-print/cups-1.2.12-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4045">CVE-2007-4045</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5849">CVE-2007-5849</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6358">CVE-2007-6358</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200703-28.xml">GLSA 200703-28</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 14 Dec 2007 15:44:48 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 14 Dec 2007 15:45:00 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 15 Dec 2007 13:31:00 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-15.xml b/xml/htdocs/security/en/glsa/glsa-200712-15.xml
new file mode 100644
index 00000000..8552b155
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-15.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-15">
+  <title>libexif: Multiple vulnerabilities</title>
+  <synopsis>
+    Two vulnerabilities in libexif possibly allow for the execution of
+    arbitrary code or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">libexif</product>
+  <announced>December 29, 2007</announced>
+  <revised>December 29, 2007: 01</revised>
+  <bug>202350</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libexif" auto="yes" arch="*">
+      <unaffected range="ge">0.6.16-r1</unaffected>
+      <vulnerable range="lt">0.6.16-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libexif is a library for parsing, editing and saving Exif metadata from
+    images. Exif, the Exchangeable image file format, specifies the
+    addition of metadata tags to JPEG, TIFF and RIFF files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Meder Kydyraliev (Google Security) discovered an integer overflow
+    vulnerability in the exif_data_load_data_thumbnail() function leading
+    to a memory corruption (CVE-2007-6352) and an infinite recursion in the
+    exif_loader_write() function (CVE-2007-6351).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice the user of an application making use of
+    libexif to load an image file with specially crafted Exif tags,
+    possibly resulting in the execution of arbitrary code with the
+    privileges of the user running the application or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libexif users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libexif-0.6.16-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6351">CVE-2007-6351</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6352">CVE-2007-6352</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 21 Dec 2007 23:07:24 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 23 Dec 2007 19:26:36 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 23 Dec 2007 19:28:21 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-16.xml b/xml/htdocs/security/en/glsa/glsa-200712-16.xml
new file mode 100644
index 00000000..b5191f61
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-16.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-16">
+  <title>Exiv2: Integer overflow</title>
+  <synopsis>
+    An integer overflow vulnerability in Exiv2 possibly allows for the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">exiv2</product>
+  <announced>December 29, 2007</announced>
+  <revised>December 29, 2007: 01</revised>
+  <bug>202351</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/exiv2" auto="yes" arch="*">
+      <unaffected range="ge">0.13-r1</unaffected>
+      <vulnerable range="lt">0.13-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Exiv2 is a C++ library and set of tools for parsing, editing and saving
+    Exif and IPTC metadata from images. Exif, the Exchangeable image file
+    format, specifies the addition of metadata tags to JPEG, TIFF and RIFF
+    files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Meder Kydyraliev (Google Security) discovered an integer overflow
+    vulnerability in the JpegThumbnail::setDataArea() method leading to a
+    heap-based buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice the user of an application making use of Exiv2
+    or an application included in Exiv2 to load an image file with
+    specially crafted Exif tags, possibly resulting in the execution of
+    arbitrary code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Exiv2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/exiv2-0.13-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6353">CVE-2007-6353</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 21 Dec 2007 23:04:55 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 23 Dec 2007 19:26:11 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 23 Dec 2007 19:28:25 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-17.xml b/xml/htdocs/security/en/glsa/glsa-200712-17.xml
new file mode 100644
index 00000000..43e5157f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-17.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-17">
+  <title>exiftags: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in exiftags possibly allow for the execution of
+    arbitrary code or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">exiftags</product>
+  <announced>December 29, 2007</announced>
+  <revised>December 29, 2007: 01</revised>
+  <bug>202354</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/exiftags" auto="yes" arch="*">
+      <unaffected range="ge">1.01</unaffected>
+      <vulnerable range="lt">1.01</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    exiftags is a library and set of tools for parsing, editing and saving
+    Exif metadata from images. Exif, the Exchangeable image file format,
+    specifies the addition of metadata tags to JPEG, TIFF and RIFF files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Meder Kydyraliev (Google Security) discovered that Exif metadata is not
+    properly sanitized before being processed, resulting in illegal memory
+    access in the postprop() and other functions (CVE-2007-6354). He also
+    discovered integer overflow vulnerabilities in the parsetag() and other
+    functions (CVE-2007-6355) and an infinite recursion in the readifds()
+    function caused by recursive IFD references (CVE-2007-6356).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice the user of an application making use of
+    exiftags or an application included in exiftags to load an image file
+    with specially crafted Exif tags, possibly resulting in the execution
+    of arbitrary code with the privileges of the user running the
+    application or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All exiftags users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/exiftags-1.01&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6354">CVE-2007-6354</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6355">CVE-2007-6355</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6356">CVE-2007-6356</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 18 Dec 2007 01:37:57 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 23 Dec 2007 19:27:52 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 23 Dec 2007 19:28:18 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-18.xml b/xml/htdocs/security/en/glsa/glsa-200712-18.xml
new file mode 100644
index 00000000..13f6756d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-18.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-18">
+  <title>Multi-Threaded DAAP Daemon: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in the web server in the Multi-Threaded DAAP
+    Daemon may lead to the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mt-daapd</product>
+  <announced>December 29, 2007</announced>
+  <revised>December 29, 2007: 01</revised>
+  <bug>200110</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/mt-daapd" auto="yes" arch="*">
+      <unaffected range="ge">0.2.4.1</unaffected>
+      <vulnerable range="lt">0.2.4.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Multi-Threaded DAAP Daemon (mt-daapd), also known as the Firefly Media
+    Server, is a software to serve digital music to the Roku Soundbridge
+    and Apple's iTunes.
+    </p>
+  </background>
+  <description>
+    <p>
+    nnp discovered multiple vulnerabilities in the XML-RPC handler in the
+    file webserver.c. The ws_addarg() function contains a format string
+    vulnerability, as it does not properly sanitize username and password
+    data from the "Authorization: Basic" HTTP header line (CVE-2007-5825).
+    The ws_decodepassword() and ws_getheaders() functions do not correctly
+    handle empty Authorization header lines, or header lines without a ':'
+    character, leading to NULL pointer dereferences (CVE-2007-5824).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send specially crafted HTTP requests to the web
+    server in the Multi-Threaded DAAP Daemon, possibly leading to the
+    execution of arbitrary code with the privileges of the user running the
+    web server or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Multi-Threaded DAAP Daemon users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/mt-daapd-0.2.4.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5824">CVE-2007-5824</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5825">CVE-2007-5825</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 18 Dec 2007 21:05:33 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 23 Dec 2007 20:01:54 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 23 Dec 2007 20:02:16 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-19.xml b/xml/htdocs/security/en/glsa/glsa-200712-19.xml
new file mode 100644
index 00000000..cc78f7c8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-19.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-19">
+  <title>Syslog-ng: Denial of Service</title>
+  <synopsis>
+    A Denial of Service vulnerability has been discovered in Syslog-ng.
+  </synopsis>
+  <product type="ebuild">syslog-ng</product>
+  <announced>December 29, 2007</announced>
+  <revised>December 29, 2007: 01</revised>
+  <bug>202718</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-admin/syslog-ng" auto="yes" arch="*">
+      <unaffected range="ge">2.0.6</unaffected>
+      <vulnerable range="lt">2.0.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Syslog-ng is a flexible and scalable system logger.
+    </p>
+  </background>
+  <description>
+    <p>
+    Oriol Carreras reported a NULL pointer dereference in the
+    log_msg_parse() function when processing timestamps without a
+    terminating whitespace character.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send a specially crafted event to a vulnerable
+    Syslog-ng server, resulting in a crash.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Syslog-ng users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/syslog-ng-2.0.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6437">CVE-2007-6437</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 22 Dec 2007 13:17:29 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 28 Dec 2007 23:09:28 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 28 Dec 2007 23:09:43 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-20.xml b/xml/htdocs/security/en/glsa/glsa-200712-20.xml
new file mode 100644
index 00000000..901937d7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-20.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-20">
+  <title>ClamAV: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in ClamAV allowing remote
+    execution of arbitrary code and Denial of Service attacks.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>December 29, 2007</announced>
+  <revised>December 29, 2007: 01</revised>
+  <bug>202762</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.91.2-r1</unaffected>
+      <vulnerable range="lt">0.91.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Clam AntiVirus is a free anti-virus toolkit for UNIX, designed
+    especially for e-mail scanning on mail gateways.
+    </p>
+  </background>
+  <description>
+    <p>
+    iDefense reported an integer overflow vulnerability in the cli_scanpe()
+    function when parsing Portable Executable (PE) files packed in the MEW
+    format, that could be exploited to cause a heap-based buffer overflow
+    (CVE-2007-6335). Toeroek Edwin reported an off-by-one error when
+    decompressing MS-ZIP compressed CAB files (CVE-2007-6336). An
+    unspecified vulnerability related to the bzip2 decompression algorithm
+    has also been discovered (CVE-2007-6337).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could entice a user or automated system to scan a
+    specially crafted file, possibly leading to the execution of arbitrary
+    code with the privileges of the user running ClamAV (either a system
+    user or the "clamav" user if clamd is compromised).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.91.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6335">CVE-2007-6335</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6336">CVE-2007-6336</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6337">CVE-2007-6337</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 27 Dec 2007 00:36:49 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 28 Dec 2007 22:56:45 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-21.xml b/xml/htdocs/security/en/glsa/glsa-200712-21.xml
new file mode 100644
index 00000000..49fc327c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-21.xml
@@ -0,0 +1,104 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-21">
+  <title>Mozilla Firefox, SeaMonkey: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Mozilla Firefox and
+    Mozilla Seamonkey.
+  </synopsis>
+  <product type="ebuild">firefox seamonkey</product>
+  <announced>December 29, 2007</announced>
+  <revised>December 29, 2007: 01</revised>
+  <bug>198965</bug>
+  <bug>200909</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.11</unaffected>
+      <vulnerable range="lt">2.0.0.11</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.11</unaffected>
+      <vulnerable range="lt">2.0.0.11</vulnerable>
+    </package>
+    <package name="www-client/seamonkey" auto="yes" arch="*">
+      <unaffected range="ge">1.1.7</unaffected>
+      <vulnerable range="lt">1.1.7</vulnerable>
+    </package>
+    <package name="www-client/seamonkey-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.1.7</unaffected>
+      <vulnerable range="lt">1.1.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Firefox is a cross-platform web browser from Mozilla. SeaMonkey
+    is a free, cross-platform Internet suite.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jesse Ruderman and Petko D. Petkov reported that the jar protocol
+    handler in Mozilla Firefox and Seamonkey does not properly check MIME
+    types (CVE-2007-5947). Gregory Fleischer reported that the
+    window.location property can be used to generate a fake HTTP Referer
+    (CVE-2007-5960). Multiple memory errors have also been reported
+    (CVE-2007-5959).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could possibly exploit these vulnerabilities to
+    execute arbitrary code in the context of the browser and conduct
+    Cross-Site-Scripting or Cross-Site Request Forgery attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-2.0.0.11&quot;</code>
+    <p>
+    All Mozilla Firefox binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-2.0.0.11&quot;</code>
+    <p>
+    All SeaMonkey users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/seamonkey-1.1.7&quot;</code>
+    <p>
+    All SeaMonkey binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/seamonkey-bin-1.1.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5947">CVE-2007-5947</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5959">CVE-2007-5959</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5960">CVE-2007-5960</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 08 Dec 2007 23:32:55 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 12 Dec 2007 16:56:13 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 24 Dec 2007 11:43:38 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-22.xml b/xml/htdocs/security/en/glsa/glsa-200712-22.xml
new file mode 100644
index 00000000..24880087
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-22.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-22">
+  <title>Opera: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities were discovered in Opera, allowing for the
+    execution of arbitrary code and cross domain scripting.
+  </synopsis>
+  <product type="ebuild">opera</product>
+  <announced>December 30, 2007</announced>
+  <revised>December 30, 2007: 01</revised>
+  <bug>202770</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/opera" auto="yes" arch="*">
+      <unaffected range="ge">9.25</unaffected>
+      <vulnerable range="lt">9.25</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Opera is a fast Web browser that is available free of charge.
+    </p>
+  </background>
+  <description>
+    <p>
+    David Bloom reported two vulnerabilities where plug-ins (CVE-2007-6520)
+    and Rich text editing (CVE-2007-6522) could be used to allow cross
+    domain scripting. Alexander Klink (Cynops GmbH) discovered an issue
+    with TLS certificates (CVE-2007-6521). Gynvael Coldwind reported that
+    bitmaps might reveal random data from memory (CVE-2007-6524).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilites, possibly leading
+    to the execution of arbitrary code and cross domain scripting.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Opera users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/opera-9.25&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6520">CVE-2007-6520</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6521">CVE-2007-6521</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6522">CVE-2007-6522</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6524">CVE-2007-6524</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 22 Dec 2007 14:34:50 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 22 Dec 2007 15:15:57 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 23 Dec 2007 19:32:13 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-23.xml b/xml/htdocs/security/en/glsa/glsa-200712-23.xml
new file mode 100644
index 00000000..522e96bd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-23.xml
@@ -0,0 +1,92 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-23">
+  <title>Wireshark: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Wireshark, allowing for
+    the remote execution of arbitrary code and a Denial of Service.
+  </synopsis>
+  <product type="ebuild">wireshark</product>
+  <announced>December 30, 2007</announced>
+  <revised>December 30, 2007: 01</revised>
+  <bug>199958</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/wireshark" auto="yes" arch="*">
+      <unaffected range="ge">0.99.7</unaffected>
+      <vulnerable range="lt">0.99.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Wireshark is a network protocol analyzer with a graphical front-end.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple buffer overflows and infinite loops were discovered in
+    multiple dissector and parser components, including those for MP3 and
+    NCP (CVE-2007-6111), PPP (CVE-2007-6112), DNP (CVE-2007-6113), SSL and
+    iSeries (OS/400) Communication traces (CVE-2007-6114), ANSI MAP
+    (CVE-2007-6115), Firebird/Interbase (CVE-2007-6116), HTTP
+    (CVE-2007-6117), MEGACO (CVE-2007-6118), DCP ETSI (CVE-2007-6119),
+    Bluetooth SDP (CVE-2007-6120), RPC Portmap (CVE-2007-6121), SMB
+    (CVE-2007-6438), IPv6 amd USB (CVE-2007-6439), WiMAX (CVE-2007-6441),
+    RPL (CVE-2007-6450), CIP (CVE-2007-6451). The vulnerabilities were
+    discovered by Stefan Esser, Beyond Security, Fabiodds, Peter Leeming,
+    Steve and ainsley.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send specially crafted packets on a network
+    being monitored with Wireshark or entice a user to open a specially
+    crafted file, possibly resulting in the execution of arbitrary code
+    with the privileges of the user running Wireshark (which might be the
+    root user), or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Wireshark users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/wireshark-0.99.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6111">CVE-2007-6111</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6112">CVE-2007-6112</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6113">CVE-2007-6113</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6114">CVE-2007-6114</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6115">CVE-2007-6115</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6116">CVE-2007-6116</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6117">CVE-2007-6117</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6118">CVE-2007-6118</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6119">CVE-2007-6119</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6120">CVE-2007-6120</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6121">CVE-2007-6121</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6438">CVE-2007-6438</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6439">CVE-2007-6439</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6441">CVE-2007-6441</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6450">CVE-2007-6450</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6451">CVE-2007-6451</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 26 Dec 2007 11:44:15 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 29 Dec 2007 21:41:40 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 29 Dec 2007 22:00:22 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-24.xml b/xml/htdocs/security/en/glsa/glsa-200712-24.xml
new file mode 100644
index 00000000..511749eb
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-24.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-24">
+  <title>AMD64 x86 emulation GTK+ library: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple integer overflow vulnerabilities in the AMD64 x86 emulation GTK+
+    libraries may result in the execution of arbitrary code in applications
+    using Cairo.
+  </synopsis>
+  <product type="ebuild">emul-linux-x86-gtklibs</product>
+  <announced>December 30, 2007</announced>
+  <revised>December 30, 2007: 01</revised>
+  <bug>201860</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-emulation/emul-linux-x86-gtklibs" auto="yes" arch="amd64">
+      <unaffected range="ge">20071214</unaffected>
+      <vulnerable range="lt">20071214</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cairo is a 2D vector graphics library with cross-device output support.
+    The AMD64 x86 emulation GTK+ library packages Cairo libraries for 32bit
+    x86 emulation on AMD64.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Cairo versions used by the AMD64 x86 emulation GTK+ libraries were
+    vulnerable to integer overflow vulnerabilities (GLSA 200712-04).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to view or process a specially
+    crafted PNG image file in an application linked against Cairo, possibly
+    leading to the execution of arbitrary code with the privileges of the
+    user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All AMD64 x86 emulation GTK+ library users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/emul-linux-x86-gtklibs-20071214&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200712-04.xml">GLSA 200712-04</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 22 Dec 2007 13:50:24 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 29 Dec 2007 22:02:45 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 29 Dec 2007 22:14:56 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200712-25.xml b/xml/htdocs/security/en/glsa/glsa-200712-25.xml
new file mode 100644
index 00000000..7425aa45
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200712-25.xml
@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200712-25">
+  <title>OpenOffice.org: User-assisted arbitrary code execution</title>
+  <synopsis>
+    An unspecified vulnerability has been reported in OpenOffice.org, possibly
+    allowing for the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">openoffice openoffice-bin hsqldb</product>
+  <announced>December 30, 2007</announced>
+  <revised>December 30, 2007: 01</revised>
+  <bug>200771</bug>
+  <bug>201799</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/openoffice" auto="yes" arch="*">
+      <unaffected range="ge">2.3.1</unaffected>
+      <vulnerable range="lt">2.3.1</vulnerable>
+    </package>
+    <package name="app-office/openoffice-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.3.1</unaffected>
+      <vulnerable range="lt">2.3.1</vulnerable>
+    </package>
+    <package name="dev-db/hsqldb" auto="yes" arch="*">
+      <unaffected range="ge">1.8.0.9</unaffected>
+      <vulnerable range="lt">1.8.0.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenOffice.org is an open source office productivity suite, including
+    word processing, spreadsheet, presentation, drawing, data charting,
+    formula editing, and file conversion facilities.
+    </p>
+  </background>
+  <description>
+    <p>
+    The HSQLDB engine, as used in Openoffice.org, does not properly enforce
+    restrictions to SQL statements.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    document, possibly resulting in the remote execution of arbitrary Java
+    code with the privileges of the user running OpenOffice.org.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenOffice.org users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-2.3.1&quot;</code>
+    <p>
+    All OpenOffice.org binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-bin-2.3.1&quot;</code>
+    <p>
+    All HSQLDB users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/hsqldb-1.8.0.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4575">CVE-2007-4575</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 08 Dec 2007 23:31:31 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 08 Dec 2007 23:31:39 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 09 Dec 2007 00:15:00 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-01.xml b/xml/htdocs/security/en/glsa/glsa-200801-01.xml
new file mode 100644
index 00000000..3993a32c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-01.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-01">
+  <title>unp: Arbitrary command execution</title>
+  <synopsis>
+    unp allows execution of arbitrary code via malicious file names.
+  </synopsis>
+  <product type="ebuild">remote</product>
+  <announced>January 09, 2008</announced>
+  <revised>January 09, 2008: 01</revised>
+  <bug>203106</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/unp" auto="yes" arch="*">
+      <unaffected range="ge">1.0.14</unaffected>
+      <vulnerable range="lt">1.0.14</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    unp is a script for unpacking various file formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Erich Schubert from Debian discovered that unp does not escape file
+    names properly before passing them to calls of the shell.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or automated system to unpack a
+    compressed archive with a specially crafted file name, leading to the
+    execution of shell commands from within the filename. That code will be
+    executed with the privileges of the user running unp.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All unp users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/unp-1.0.14&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6610">CVE-2007-6610</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 28 Dec 2007 00:23:45 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 28 Dec 2007 11:27:28 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 28 Dec 2007 22:57:04 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-02.xml b/xml/htdocs/security/en/glsa/glsa-200801-02.xml
new file mode 100644
index 00000000..fe528803
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-02.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-02">
+  <title>R: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in R could result in the execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">R</product>
+  <announced>January 09, 2008</announced>
+  <revised>January 09, 2008: 02</revised>
+  <bug>198976</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/R" auto="yes" arch="*">
+      <unaffected range="ge">2.2.1-r1</unaffected>
+      <vulnerable range="lt">2.2.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    R is a GPL licensed implementation of S, a language and environment for
+    statistical computing and graphics. PCRE is a library providing
+    functions for Perl-compatible regular expressions.
+    </p>
+  </background>
+  <description>
+    <p>
+    R includes a copy of PCRE which is vulnerable to multiple buffer
+    overflows and memory corruptions vulnerabilities (GLSA 200711-30).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to process specially crafted regular
+    expressions with R, which could possibly lead to the execution of
+    arbitrary code, a Denial of Service or the disclosure of sensitive
+    information.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All R users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/R-2.2.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200711-30.xml">GLSA 200711-30</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 20 Nov 2007 22:35:44 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 21 Nov 2007 00:08:56 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 03 Jan 2008 22:08:35 +0000">
+    py2
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-03.xml b/xml/htdocs/security/en/glsa/glsa-200801-03.xml
new file mode 100644
index 00000000..f6cb19ef
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-03.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-03">
+  <title>Claws Mail: Insecure temporary file creation</title>
+  <synopsis>
+    Claws Mail uses temporary files in an insecure manner, allowing for a
+    symlink attack.
+  </synopsis>
+  <product type="ebuild">claws-mail</product>
+  <announced>January 09, 2008</announced>
+  <revised>January 09, 2008: 01</revised>
+  <bug>201244</bug>
+  <access>local</access>
+  <affected>
+    <package name="mail-client/claws-mail" auto="yes" arch="*">
+      <unaffected range="ge">3.0.2-r1</unaffected>
+      <vulnerable range="lt">3.0.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Claws Mail is a GTK based e-mail client.
+    </p>
+  </background>
+  <description>
+    <p>
+    Nico Golde from Debian reported that the sylprint.pl script that is
+    part of the Claws Mail tools creates temporary files in an insecure
+    manner.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit this vulnerability to conduct symlink
+    attacks to overwrite files with the privileges of the user running
+    Claws Mail.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Claws Mail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/claws-mail-3.0.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6208">CVE-2007-6208</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 06 Jan 2008 23:01:06 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 08 Jan 2008 23:07:07 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 08 Jan 2008 23:07:18 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-04.xml b/xml/htdocs/security/en/glsa/glsa-200801-04.xml
new file mode 100644
index 00000000..b09b8e20
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-04.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-04">
+  <title>OpenAFS: Denial of Service</title>
+  <synopsis>
+    A Denial of Service vulnerability has been discovered in OpenAFS.
+  </synopsis>
+  <product type="ebuild">openafs</product>
+  <announced>January 09, 2008</announced>
+  <revised>January 09, 2008: 01</revised>
+  <bug>203573</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-fs/openafs" auto="yes" arch="*">
+      <unaffected range="ge">1.4.6</unaffected>
+      <vulnerable range="lt">1.4.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenAFS is a distributed network filesystem.
+    </p>
+  </background>
+  <description>
+    <p>
+    Russ Allbery, Jeffrey Altman, Dan Hyde and Thomas Mueller discovered a
+    race condition due to an improper handling of the clients callbacks
+    lists.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could construct cases which trigger the race
+    condition, resulting in a server crash.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenAFS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-fs/openafs-1.4.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6599">CVE-2007-6599</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 05 Jan 2008 00:13:45 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 08 Jan 2008 21:35:12 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 08 Jan 2008 21:35:21 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-05.xml b/xml/htdocs/security/en/glsa/glsa-200801-05.xml
new file mode 100644
index 00000000..9025ee1c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-05.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-05">
+  <title>Squid: Denial of Service</title>
+  <synopsis>
+    A Denial of Service vulnerability has been reported in Squid.
+  </synopsis>
+  <product type="ebuild">squid</product>
+  <announced>January 09, 2008</announced>
+  <revised>January 09, 2008: 01</revised>
+  <bug>201209</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-proxy/squid" auto="yes" arch="*">
+      <unaffected range="ge">2.6.17</unaffected>
+      <vulnerable range="lt">2.6.17</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Squid is a multi-protocol proxy server.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Wikimedia Foundation reported a memory leak vulnerability when
+    performing cache updates.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could perform numerous specially crafted requests to
+    the vulnerable server, resulting in a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Squid users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-proxy/squid-2.6.17&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6239">CVE-2007-6239</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 05 Jan 2008 21:43:38 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 05 Jan 2008 21:44:28 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 07 Jan 2008 21:35:14 +0000">
+    py2
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-06.xml b/xml/htdocs/security/en/glsa/glsa-200801-06.xml
new file mode 100644
index 00000000..68e8c5cf
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-06.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-06">
+  <title>Xfce: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Xfce might allow user-assisted attackers to
+    execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">xfce4-panel libxfcegui4</product>
+  <announced>January 09, 2008</announced>
+  <revised>January 10, 2008: 03</revised>
+  <bug>201292</bug>
+  <bug>201293</bug>
+  <access>remote</access>
+  <affected>
+    <package name="xfce-base/xfce4-panel" auto="yes" arch="*">
+      <unaffected range="ge">4.4.2</unaffected>
+      <vulnerable range="lt">4.4.2</vulnerable>
+    </package>
+    <package name="xfce-base/libxfcegui4" auto="yes" arch="*">
+      <unaffected range="ge">4.4.2</unaffected>
+      <vulnerable range="lt">4.4.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Xfce is a GTK+ 2 based desktop environment that allows to run a modern
+    desktop environment on modest hardware.
+    </p>
+  </background>
+  <description>
+    <p>
+    Gregory Andersen reported that the Xfce4 panel does not correctly
+    calculate memory boundaries, leading to a stack-based buffer overflow
+    in the launcher_update_panel_entry() function (CVE-2007-6531). Daichi
+    Kawahata reported libxfcegui4 did not copy provided values when
+    creating "SessionClient" structs, possibly leading to access of freed
+    memory areas (CVE-2007-6532).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to install a specially crafted
+    "rc" file to execute arbitrary code via long strings in the "Name" and
+    "Comment" fields or via unspecified vectors involving the second
+    vulnerability.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Xfce4 panel users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=xfce-base/xfce4-panel-4.4.2&quot;</code>
+    <p>
+    All libxfcegui4 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=xfce-base/libxfcegui4-4.4.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6531">CVE-2007-6531</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6532">CVE-2007-6532</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 08 Dec 2007 23:45:36 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 22 Dec 2007 13:22:06 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 22 Dec 2007 16:37:18 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-07.xml b/xml/htdocs/security/en/glsa/glsa-200801-07.xml
new file mode 100644
index 00000000..cc4622a2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-07.xml
@@ -0,0 +1,102 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-07">
+  <title>Adobe Flash Player: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been identified, the worst of which allow
+    arbitrary code execution on a user's system via a malicious Flash file.
+  </synopsis>
+  <product type="ebuild">adobe-flash</product>
+  <announced>January 20, 2008</announced>
+  <revised>May 28, 2009: 03</revised>
+  <bug>193519</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-plugins/adobe-flash" auto="yes" arch="*">
+      <unaffected range="ge">9.0.115.0</unaffected>
+      <vulnerable range="lt">9.0.115.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Adobe Flash Player is a renderer for the popular SWF file format,
+    which is commonly used to provide interactive websites, digital
+    experiences and mobile content.
+    </p>
+  </background>
+  <description>
+    <ul>
+    <li>Flash contains a copy of PCRE which is vulnerable to a heap-based
+    buffer overflow (GLSA 200711-30, CVE-2007-4768).</li>
+    <li>Aaron Portnoy reported an unspecified vulnerability related to
+    input validation (CVE-2007-6242).</li>
+    <li>Jesse Michael and Thomas Biege reported that Flash does not
+    correctly set memory permissions (CVE-2007-6246).</li>
+    <li>Dan Boneh, Adam Barth, Andrew Bortz, Collin Jackson, and Weidong
+    Shao reported that Flash does not pin DNS hostnames to a single IP
+    addresses, allowing for DNS rebinding attacks (CVE-2007-5275).</li>
+    <li>David Neu reported an error withing the implementation of the
+    Socket and XMLSocket ActionScript 3 classes (CVE-2007-4324).</li>
+    <li>Toshiharu Sugiyama reported that Flash does not sufficiently
+    restrict the interpretation and usage of cross-domain policy files,
+    allowing for easier cross-site scripting attacks (CVE-2007-6243).</li>
+    <li>Rich Cannings reported a cross-site scripting vulnerability in the
+    way the "asfunction:" protocol was handled (CVE-2007-6244).</li>
+    <li>Toshiharu Sugiyama discovered that Flash allows remote attackers to
+    modify HTTP headers for client requests and conduct HTTP Request
+    Splitting attacks (CVE-2007-6245).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted file
+    (usually in a web browser), possibly leading to the execution of
+    arbitrary code with the privileges of the user running the Adobe Flash
+    Player. The attacker could also cause a user's machine to establish TCP
+    sessions with arbitrary hosts, bypass the Security Sandbox Model,
+    obtain sensitive information, port scan arbitrary hosts, or conduct
+    cross-site-scripting attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Adobe Flash Player users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-plugins/adobe-flash-9.0.115.0&quot;</code>
+    <p>
+    Please be advised that unaffected packages of the Adobe Flash Player
+    have known problems when used from within the Konqueror and Opera
+    browsers.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4324">CVE-2007-4324</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4768">CVE-2007-4768</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5275">CVE-2007-5275</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6242">CVE-2007-6242</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6243">CVE-2007-6243</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6244">CVE-2007-6244</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6245">CVE-2007-6245</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6246">CVE-2007-6246</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200711-30.xml">GLSA 200711-30</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 01 Jan 2008 22:05:12 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 15 Jan 2008 17:34:55 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 15 Jan 2008 17:41:04 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-08.xml b/xml/htdocs/security/en/glsa/glsa-200801-08.xml
new file mode 100644
index 00000000..7128b211
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-08.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-08">
+  <title>libcdio: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow vulnerability has been discovered in libcdio.
+  </synopsis>
+  <product type="ebuild">libcdio</product>
+  <announced>January 20, 2008</announced>
+  <revised>January 20, 2008: 01</revised>
+  <bug>203777</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/libcdio" auto="yes" arch="*">
+      <unaffected range="ge">0.78.2-r4</unaffected>
+      <vulnerable range="lt">0.78.2-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libcdio is a library for accessing CD-ROM and CD images.
+    </p>
+  </background>
+  <description>
+    <p>
+    Devon Miller reported a boundary error in the "print_iso9660_recurse()"
+    function in files cd-info.c and iso-info.c when processing long
+    filenames within Joliet images.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted ISO
+    image in the cd-info and iso-info applications, resulting in the
+    execution of arbitrary code with the privileges of the user running the
+    application. Applications linking against shared libraries of libcdio
+    are not affected.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libcdio users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/libcdio-0.78.2-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6613">CVE-2007-6613</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 01 Jan 2008 22:05:45 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 08 Jan 2008 21:42:57 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 15 Jan 2008 17:44:04 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-09.xml b/xml/htdocs/security/en/glsa/glsa-200801-09.xml
new file mode 100644
index 00000000..0a8d1a71
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-09.xml
@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-09">
+  <title>X.Org X server and Xfont library: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in the X.Org X server and
+    Xfont library, allowing for a local privilege escalation and arbitrary code
+    execution.
+  </synopsis>
+  <product type="ebuild">xorg-server libXfont</product>
+  <announced>January 20, 2008</announced>
+  <revised>March 05, 2008: 03</revised>
+  <bug>204362</bug>
+  <bug>208343</bug>
+  <access>remote, local</access>
+  <affected>
+    <package name="x11-base/xorg-server" auto="yes" arch="*">
+      <unaffected range="ge">1.3.0.0-r5</unaffected>
+      <vulnerable range="lt">1.3.0.0-r5</vulnerable>
+    </package>
+    <package name="x11-libs/libXfont" auto="yes" arch="*">
+      <unaffected range="ge">1.3.1-r1</unaffected>
+      <vulnerable range="lt">1.3.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The X Window System is a graphical windowing system based on a
+    client/server model.
+    </p>
+  </background>
+  <description>
+    <p>
+    regenrecht reported multiple vulnerabilities in various X server
+    extension via iDefense:
+    </p>
+    <ul>
+    <li>The XFree86-Misc extension does not properly sanitize a parameter
+    within a PassMessage request, allowing the modification of a function
+    pointer (CVE-2007-5760).</li>
+    <li>Multiple functions in the XInput extension do not properly sanitize
+    client requests for swapping bytes, leading to corruption of heap
+    memory (CVE-2007-6427).</li>
+    <li>Integer overflow vulnerabilities in the EVI extension and in the
+    MIT-SHM extension can lead to buffer overflows (CVE-2007-6429).</li>
+    <li>The TOG-CUP extension does not sanitize an index value in the
+    ProcGetReservedColormapEntries() function, leading to arbitrary memory
+    access (CVE-2007-6428).</li>
+    <li>A buffer overflow was discovered in the Xfont library when
+    processing PCF font files (CVE-2008-0006).</li>
+    <li>The X server does not enforce restrictions when a user specifies a
+    security policy file and attempts to open it (CVE-2007-5958).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    Remote attackers could exploit the vulnerability in the Xfont library
+    by enticing a user to load a specially crafted PCF font file resulting
+    in the execution of arbitrary code with the privileges of the user
+    running the X server, typically root. Local attackers could exploit
+    this and the vulnerabilities in the X.org extensions to gain elevated
+    privileges. If the X server allows connections from the network, these
+    vulnerabilities could be exploited remotely. A local attacker could
+    determine the existence of arbitrary files by exploiting the last
+    vulnerability or possibly cause a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Workarounds for some of the vulnerabilities can be found in the X.Org
+    security advisory as listed under References.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All X.Org X server users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-base/xorg-server-1.3.0.0-r5&quot;</code>
+    <p>
+    All X.Org Xfont library users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/libXfont-1.3.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5760">CVE-2007-5760</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5958">CVE-2007-5958</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6427">CVE-2007-6427</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6428">CVE-2007-6428</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6429">CVE-2007-6429</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0006">CVE-2008-0006</uri>
+    <uri link="http://lists.freedesktop.org/archives/xorg/2008-January/031918.html">X.Org security advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 05 Jan 2008 02:03:56 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 17 Jan 2008 15:57:38 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-10.xml b/xml/htdocs/security/en/glsa/glsa-200801-10.xml
new file mode 100644
index 00000000..5bc8066b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-10.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-10">
+  <title>TikiWiki: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in TikiWiki, some of them
+    having unknown impact.
+  </synopsis>
+  <product type="ebuild">tikiwiki</product>
+  <announced>January 23, 2008</announced>
+  <revised>January 23, 2008: 01</revised>
+  <bug>203265</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/tikiwiki" auto="yes" arch="*">
+      <unaffected range="ge">1.9.9</unaffected>
+      <vulnerable range="lt">1.9.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    TikiWiki is an open source content management system written in PHP.
+    </p>
+  </background>
+  <description>
+    <ul><li>Jesus Olmos Gonzalez from isecauditors reported insufficient
+    sanitization of the "movies" parameter in file tiki-listmovies.php
+    (CVE-2007-6528).</li>
+    <li>Mesut Timur from H-Labs discovered that the
+    input passed to the "area_name" parameter in file
+    tiki-special_chars.php is not properly sanitised before being returned
+    to the user (CVE-2007-6526).</li>
+    <li>redflo reported multiple
+    unspecified vulnerabilities in files tiki-edit_css.php,
+    tiki-list_games.php, and tiki-g-admin_shared_source.php
+    (CVE-2007-6529).</li>
+    </ul>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker can craft the "movies" parameter to run a directory
+    traversal attack through a ".." sequence and read the first 1000 bytes
+    of any arbitrary file, or conduct a cross-site scripting (XSS) attack
+    through the "area_name" parameter. This attack can be exploited to
+    execute arbitrary HTML and script code in a user's browser session,
+    allowing for the theft of browser session data or cookies in the
+    context of the affected web site. The impacts of the unspecified
+    vulnerabilities are still unknown.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All TikiWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/tikiwiki-1.9.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6526">CVE-2007-6526</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6528">CVE-2007-6528</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6529">CVE-2007-6529</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 20 Jan 2008 18:58:53 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 20 Jan 2008 21:50:20 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 20 Jan 2008 22:40:20 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-11.xml b/xml/htdocs/security/en/glsa/glsa-200801-11.xml
new file mode 100644
index 00000000..abfd4361
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-11.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-11">
+  <title>CherryPy: Directory traversal vulnerability</title>
+  <synopsis>
+    CherryPy is vulnerable to a directory traversal that could allow attackers
+    to read and write arbitrary files.
+  </synopsis>
+  <product type="ebuild">cherrypy</product>
+  <announced>January 27, 2008</announced>
+  <revised>January 27, 2008: 01</revised>
+  <bug>204829</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-python/cherrypy" auto="yes" arch="*">
+      <unaffected range="rge">2.2.1-r2</unaffected>
+      <unaffected range="ge">3.0.2-r1</unaffected>
+      <vulnerable range="lt">3.0.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CherryPy is a Python-based, object-oriented web development framework.
+    </p>
+  </background>
+  <description>
+    <p>
+    CherryPy does not sanitize the session id, provided as a cookie value,
+    in the FileSession._get_file_path() function before using it as part of
+    the file name.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit this vulnerability to read and possibly
+    write arbitrary files on the web server, or to hijack valid sessions,
+    by providing a specially crafted session id. This only affects
+    applications using file-based sessions.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable the "FileSession" functionality by using "PostgresqlSession" or
+    "RamSession" session management in your CherryPy application.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CherryPy 2.2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-python/cherrypy-2.2.1-r2&quot;</code>
+    <p>
+    All CherryPy 3.0 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-python/cherrypy-3.0.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0252">CVE-2008-0252</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 10 Jan 2008 20:11:50 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 20 Jan 2008 02:16:18 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 26 Jan 2008 19:16:48 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-12.xml b/xml/htdocs/security/en/glsa/glsa-200801-12.xml
new file mode 100644
index 00000000..d98124e9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-12.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-12">
+  <title>xine-lib: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    xine-lib is vulnerable to multiple heap-based buffer overflows when
+    processing RTSP streams.
+  </synopsis>
+  <product type="ebuild">xine-lib</product>
+  <announced>January 27, 2008</announced>
+  <revised>January 27, 2008: 01</revised>
+  <bug>205197</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/xine-lib" auto="yes" arch="*">
+      <unaffected range="ge">1.1.9.1</unaffected>
+      <vulnerable range="lt">1.1.9.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xine-lib is the core library package for the xine media player.
+    </p>
+  </background>
+  <description>
+    <p>
+    Luigi Auriemma reported that xine-lib does not properly check
+    boundaries when processing SDP attributes of RTSP streams, leading to
+    heap-based buffer overflows.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to play specially crafted RTSP video
+    streams with a player using xine-lib, potentially resulting in the
+    execution of arbitrary code with the privileges of the user running the
+    player.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xine-lib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/xine-lib-1.1.9.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0225">CVE-2008-0225</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0238">CVE-2008-0238</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 16 Jan 2008 19:08:20 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 20 Jan 2008 01:56:19 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 26 Jan 2008 21:39:28 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-13.xml b/xml/htdocs/security/en/glsa/glsa-200801-13.xml
new file mode 100644
index 00000000..7e28d3a9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-13.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-13">
+  <title>ngIRCd: Denial of Service</title>
+  <synopsis>
+    ngIRCd does not properly sanitize commands sent by users, allowing for a
+    Denial of Service.
+  </synopsis>
+  <product type="ebuild">ngircd</product>
+  <announced>January 27, 2008</announced>
+  <revised>January 27, 2008: 02</revised>
+  <bug>204834</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-irc/ngircd" auto="yes" arch="*">
+      <unaffected range="ge">0.10.4</unaffected>
+      <vulnerable range="lt">0.10.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ngIRCd is a free open source daemon for Internet Relay Chat (IRC).
+    </p>
+  </background>
+  <description>
+    <p>
+    The IRC_PART() function in the file irc-channel.c does not properly
+    check the number of parameters, referencing an invalid pointer if no
+    channel is supplied.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker can exploit this vulnerability to crash the ngIRCd
+    daemon.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ngIRCd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-irc/ngircd-0.10.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0285">CVE-2008-0285</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 15 Jan 2008 20:42:37 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 20 Jan 2008 01:06:19 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 20 Jan 2008 01:44:35 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-14.xml b/xml/htdocs/security/en/glsa/glsa-200801-14.xml
new file mode 100644
index 00000000..9fd470f2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-14.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-14">
+  <title>Blam: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Blam doesn't properly handle environment variables, potentially allowing a
+    local attacker to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">blam</product>
+  <announced>January 27, 2008</announced>
+  <revised>January 27, 2008: 01</revised>
+  <bug>199841</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-news/blam" auto="yes" arch="*">
+      <unaffected range="ge">1.8.4</unaffected>
+      <vulnerable range="lt">1.8.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Blam is an RSS and Atom feed reader for GNOME written in C#.
+    </p>
+  </background>
+  <description>
+    <p>
+    The "/usr/bin/blam" script sets the "LD_LIBRARY_PATH" environment
+    variable incorrectly, which might result in the current working
+    directory (.) being included when searching for dynamically linked
+    libraries of the Mono Runtime application.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could entice a user to run Blam in a directory
+    containing a specially crafted library file which could result in the
+    execution of arbitrary code with the privileges of the user running
+    Blam.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not run Blam from an untrusted working directory.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Blam users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-news/blam-1.8.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4790">CVE-2005-4790</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 20 Jan 2008 00:54:46 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 20 Jan 2008 00:55:57 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-15.xml b/xml/htdocs/security/en/glsa/glsa-200801-15.xml
new file mode 100644
index 00000000..bc74daa7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-15.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-15">
+  <title>PostgreSQL: Multiple vulnerabilities</title>
+  <synopsis>
+    PostgreSQL contains multiple vulnerabilities that could result in privilege
+    escalation or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">postgresql</product>
+  <announced>January 29, 2008</announced>
+  <revised>January 29, 2008: 01</revised>
+  <bug>204760</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/postgresql" auto="yes" arch="*">
+      <unaffected range="ge">8.0.15</unaffected>
+      <unaffected range="rge">7.4.19</unaffected>
+      <unaffected range="rge">7.3.21</unaffected>
+      <vulnerable range="lt">8.0.15</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PostgreSQL is an open source object-relational database management
+    system.
+    </p>
+  </background>
+  <description>
+    <p>
+    If using the "expression indexes" feature, PostgreSQL executes index
+    functions as the superuser during VACUUM and ANALYZE instead of the
+    table owner, and allows SET ROLE and SET SESSION AUTHORIZATION in the
+    index functions (CVE-2007-6600). Additionally, several errors involving
+    regular expressions were found (CVE-2007-4769, CVE-2007-4772,
+    CVE-2007-6067). Eventually, a privilege escalation vulnerability via
+    unspecified vectors in the DBLink module was reported (CVE-2007-6601).
+    This vulnerability is exploitable when local trust or ident
+    authentication is used, and is due to an incomplete fix of
+    CVE-2007-3278.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote authenticated attacker could send specially crafted queries
+    containing complex regular expressions to the server that could result
+    in a Denial of Service by a server crash (CVE-2007-4769), an infinite
+    loop (CVE-2007-4772) or a memory exhaustion (CVE-2007-6067). The two
+    other vulnerabilities can be exploited to gain additional privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround for all these issues at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PostgreSQL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;dev-db/postgresql&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3278">CVE-2007-3278</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4769">CVE-2007-4769</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4772">CVE-2007-4772</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6067">CVE-2007-6067</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6600">CVE-2007-6600</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6601">CVE-2007-6601</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 20 Jan 2008 00:00:08 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 20 Jan 2008 00:56:13 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 20 Jan 2008 22:38:13 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-16.xml b/xml/htdocs/security/en/glsa/glsa-200801-16.xml
new file mode 100644
index 00000000..a985dc9a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-16.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-16">
+  <title>MaraDNS: CNAME Denial of Service</title>
+  <synopsis>
+    MaraDNS is prone to a Denial of Service vulnerability impacting CNAME
+    resolution.
+  </synopsis>
+  <product type="ebuild">maradns</product>
+  <announced>January 29, 2008</announced>
+  <revised>January 29, 2008: 01</revised>
+  <bug>204351</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/maradns" auto="yes" arch="*">
+      <unaffected range="ge">1.2.12.08</unaffected>
+      <vulnerable range="lt">1.2.12.08</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MaraDNS is a package that implements the Domain Name Service (DNS) with
+    resolver and caching ability.
+    </p>
+  </background>
+  <description>
+    <p>
+    Michael Krieger reported that a specially crafted DNS could prevent an
+    authoritative canonical name (CNAME) record from being resolved because
+    of an "improper rotation of resource records".
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted DNS packets to a
+    vulnerable server, making it unable to resolve CNAME records.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Add "max_ar_chain = 2" to the "marac" configuration file.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MaraDNS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/maradns-1.2.12.09&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0061">CVE-2008-0061</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 27 Jan 2008 19:19:02 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 28 Jan 2008 17:41:20 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 28 Jan 2008 18:03:45 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-17.xml b/xml/htdocs/security/en/glsa/glsa-200801-17.xml
new file mode 100644
index 00000000..aac19bd2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-17.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-17">
+  <title>Netkit FTP Server: Denial of Service</title>
+  <synopsis>
+    Netkit FTP Server contains a Denial of Service vulnerability.
+  </synopsis>
+  <product type="ebuild">netkit-ftpd</product>
+  <announced>January 29, 2008</announced>
+  <revised>January 29, 2008: 01</revised>
+  <bug>199206</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-ftp/netkit-ftpd" auto="yes" arch="*">
+      <unaffected range="ge">0.17-r7</unaffected>
+      <vulnerable range="lt">0.17-r7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    net-ftp/netkit-ftpd is the Linux Netkit FTP server with optional SSL
+    support.
+    </p>
+  </background>
+  <description>
+    <p>
+    Venustech AD-LAB discovered that an FTP client connected to a
+    vulnerable server with passive mode and SSL support can trigger an
+    fclose() function call on an uninitialized stream in ftpd.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker can send specially crafted FTP data to a server with
+    passive mode and SSL support, causing the ftpd daemon to crash.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable passive mode or SSL.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Netkit FTP Server users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-ftp/netkit-ftpd-0.17-r7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6263">CVE-2007-6263</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 27 Jan 2008 19:17:40 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 28 Jan 2008 18:03:07 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 28 Jan 2008 18:03:42 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-18.xml b/xml/htdocs/security/en/glsa/glsa-200801-18.xml
new file mode 100644
index 00000000..024cbc22
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-18.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-18">
+  <title>Kazehakase: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Kazehakase could result in the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">kazehakase</product>
+  <announced>January 30, 2008</announced>
+  <revised>January 30, 2008: 01</revised>
+  <bug>198983</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/kazehakase" auto="yes" arch="*">
+      <unaffected range="ge">0.5.0</unaffected>
+      <vulnerable range="lt">0.5.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Kazehakase is a web browser based on the Gecko engine.
+    </p>
+  </background>
+  <description>
+    <p>
+    Kazehakase includes a copy of PCRE which is vulnerable to multiple
+    buffer overflows and memory corruptions vulnerabilities (GLSA
+    200711-30).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open specially crafted input
+    (e.g bookmarks) with Kazehakase, which could possibly lead to the
+    execution of arbitrary code, a Denial of Service or the disclosure of
+    sensitive information.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Kazehakase users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/kazehakase-0.5.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200711-30.xml">GLSA-200711-30</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 06 Jan 2008 23:02:26 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 29 Jan 2008 19:33:56 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 29 Jan 2008 19:34:04 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-19.xml b/xml/htdocs/security/en/glsa/glsa-200801-19.xml
new file mode 100644
index 00000000..75ff7075
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-19.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-19">
+  <title>GOffice: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in GOffice could result in the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">goffice</product>
+  <announced>January 30, 2008</announced>
+  <revised>January 30, 2008: 01</revised>
+  <bug>198385</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-libs/goffice" auto="yes" arch="*">
+      <unaffected range="ge">0.6.1</unaffected>
+      <unaffected range="rge">0.4.3</unaffected>
+      <vulnerable range="lt">0.6.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GOffice is a library of document-centric objects and utilities based on
+    GTK.
+    </p>
+  </background>
+  <description>
+    <p>
+    GOffice includes a copy of PCRE which is vulnerable to multiple buffer
+    overflows and memory corruptions vulnerabilities (GLSA 200711-30).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to open specially crafted documents
+    with GOffice, which could possibly lead to the execution of arbitrary
+    code, a Denial of Service or the disclosure of sensitive information.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GOffice 0.4.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/goffice-0.4.3&quot;</code>
+    <p>
+    All GOffice 0.6.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/goffice-0.6.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200711-30.xml">GLSA-200711-30</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 10 Jan 2008 19:49:11 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 29 Jan 2008 19:42:53 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 29 Jan 2008 19:43:29 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-20.xml b/xml/htdocs/security/en/glsa/glsa-200801-20.xml
new file mode 100644
index 00000000..7923a4aa
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-20.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-20">
+  <title>libxml2: Denial of Service</title>
+  <synopsis>
+    A Denial of Service vulnerability has been reported in libxml2.
+  </synopsis>
+  <product type="ebuild">libxml2</product>
+  <announced>January 30, 2008</announced>
+  <revised>January 30, 2008: 01</revised>
+  <bug>202628</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/libxml2" auto="yes" arch="*">
+      <unaffected range="ge">2.6.30-r1</unaffected>
+      <vulnerable range="lt">2.6.30-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libxml2 is the XML (eXtended Markup Language) C parser and toolkit
+    initially developed for the Gnome project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Brad Fitzpatrick reported that the xmlCurrentChar() function does not
+    properly handle some UTF-8 multibyte encodings.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted XML
+    document with an application using libxml2, possibly resulting in a
+    high CPU consumption. Note that this vulnerability could also be
+    triggered without user interaction by an automated system processing
+    XML content.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libxml2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/libxml2-2.6.30-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6284">CVE-2007-6284</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 12 Jan 2008 01:14:43 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 28 Jan 2008 19:48:32 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 28 Jan 2008 19:48:45 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-21.xml b/xml/htdocs/security/en/glsa/glsa-200801-21.xml
new file mode 100644
index 00000000..83be6af1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-21.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-21">
+  <title>Xdg-Utils: Arbitrary command execution</title>
+  <synopsis>
+    A vulnerability has been discovered in Xdg-Utils, allowing for the remote
+    execution of arbitrary commands.
+  </synopsis>
+  <product type="ebuild">xdg-utils</product>
+  <announced>January 30, 2008</announced>
+  <revised>January 30, 2008: 01</revised>
+  <bug>207331</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-misc/xdg-utils" auto="yes" arch="*">
+      <unaffected range="ge">1.0.2-r1</unaffected>
+      <vulnerable range="lt">1.0.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Xdg-Utils is a set of tools allowing all applications to easily
+    integrate with the Free Desktop configuration.
+    </p>
+  </background>
+  <description>
+    <p>
+    Miroslav Lichvar discovered that the "xdg-open" and "xdg-email" shell
+    scripts do not properly sanitize their input before processing it.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted link
+    with a vulnerable application using Xdg-Utils (e.g. an email client),
+    resulting in the execution of arbitrary code with the privileges of the
+    user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Xdg-Utils users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-misc/xdg-utils-1.0.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0386">CVE-2008-0386</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 26 Jan 2008 12:15:55 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 28 Jan 2008 20:04:22 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 28 Jan 2008 20:04:30 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200801-22.xml b/xml/htdocs/security/en/glsa/glsa-200801-22.xml
new file mode 100644
index 00000000..99db828e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200801-22.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200801-22">
+  <title>PeerCast: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow vulnerability has been discovered in PeerCast.
+  </synopsis>
+  <product type="ebuild">peercast</product>
+  <announced>January 30, 2008</announced>
+  <revised>January 30, 2008: 02</revised>
+  <bug>202747</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/peercast" auto="yes" arch="*">
+      <unaffected range="ge">0.1218</unaffected>
+      <vulnerable range="lt">0.1218</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PeerCast is a client and server for P2P-radio network
+    </p>
+  </background>
+  <description>
+    <p>
+    Luigi Auriemma reported a heap-based buffer overflow within the
+    "handshakeHTTP()" function when processing HTTP requests.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send a specially crafted request to the
+    vulnerable server, possibly resulting in the remote execution of
+    arbitrary code with the privileges of the user running the PeerCast
+    server, usually "nobody".
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PeerCast users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/peercast-0.1218&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6454">CVE-2007-6454</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 11 Jan 2008 08:22:19 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 29 Jan 2008 19:51:49 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 29 Jan 2008 23:04:06 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200802-01.xml b/xml/htdocs/security/en/glsa/glsa-200802-01.xml
new file mode 100644
index 00000000..83811479
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200802-01.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200802-01">
+  <title>SDL_image: Two buffer overflow vulnerabilities</title>
+  <synopsis>
+    Two boundary errors have been identified in SDL_image allowing for the
+    remote execution of arbitrary code or the crash of the application using
+    the library.
+  </synopsis>
+  <product type="ebuild">sdl-image</product>
+  <announced>February 06, 2008</announced>
+  <revised>February 06, 2008: 01</revised>
+  <bug>207933</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/sdl-image" auto="yes" arch="*">
+      <unaffected range="ge">1.2.6-r1</unaffected>
+      <vulnerable range="lt">1.2.6-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SDL_image is an image file library that loads images as SDL surfaces,
+    and supports various formats like BMP, GIF, JPEG, LBM, PCX, PNG, PNM,
+    TGA, TIFF, XCF, XPM, and XV.
+    </p>
+  </background>
+  <description>
+    <p>
+    The LWZReadByte() function in file IMG_gif.c and the IMG_LoadLBM_RW()
+    function in file IMG_lbm.c each contain a boundary error that can be
+    triggered to cause a static buffer overflow and a heap-based buffer
+    overflow. The first boundary error comes from some old vulnerable GD
+    PHP code (CVE-2006-4484).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker can make an application using the SDL_image library
+    to process a specially crafted GIF file or IFF ILBM file that will
+    trigger a buffer overflow, resulting in the execution of arbitrary code
+    with the permissions of the application or the application crash.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SDL_image users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/sdl-image-1.2.6-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://secunia.com/advisories/28640/">SA28640</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6697">CVE-2007-6697</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0544">CVE-2008-0544</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 29 Jan 2008 09:35:04 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 29 Jan 2008 09:36:22 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200802-02.xml b/xml/htdocs/security/en/glsa/glsa-200802-02.xml
new file mode 100644
index 00000000..42e3df4d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200802-02.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200802-02">
+  <title>Doomsday: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Doomsday might allow remote execution of
+    arbitrary code or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">doomsday</product>
+  <announced>February 06, 2008</announced>
+  <revised>February 10, 2008: 02</revised>
+  <bug>190835</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-fps/doomsday" auto="no" arch="*">
+      <vulnerable range="le">1.9.0_beta52</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Doomsday Engine (deng) is a modern gaming engine for popular ID
+    games like Doom, Heretic and Hexen.
+    </p>
+  </background>
+  <description>
+    <p>
+    Luigi Auriemma discovered multiple buffer overflows in the
+    D_NetPlayerEvent() function, the Msg_Write() function and the
+    NetSv_ReadCommands() function. He also discovered errors when handling
+    chat messages that are not NULL-terminated (CVE-2007-4642) or contain a
+    short data length, triggering an integer underflow (CVE-2007-4643).
+    Furthermore a format string vulnerability was discovered in the
+    Cl_GetPackets() function when processing PSV_CONSOLE_TEXT messages
+    (CVE-2007-4644).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit these vulnerabilities to execute
+    arbitrary code with the rights of the user running the Doomsday server
+    or cause a Denial of Service by sending specially crafted messages to
+    the server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    While some of these issues could be resolved in
+    "games-fps/doomsday-1.9.0-beta5.2", the format string vulnerability
+    (CVE-2007-4644) remains unfixed. We recommend that users unmerge
+    Doomsday:
+    </p>
+    <code>
+    # emerge --unmerge games-fps/doomsday</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4642">CVE-2007-4642</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4643">CVE-2007-4643</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4644">CVE-2007-4644</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 06 Dec 2007 00:50:29 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 12 Dec 2007 01:08:23 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 20 Jan 2008 00:41:43 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200802-03.xml b/xml/htdocs/security/en/glsa/glsa-200802-03.xml
new file mode 100644
index 00000000..455041ff
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200802-03.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200802-03">
+  <title>Horde IMP: Security bypass</title>
+  <synopsis>
+    Insufficient checks in Horde may allow a remote attacker to bypass security
+    restrictions.
+  </synopsis>
+  <product type="ebuild">horde-imp</product>
+  <announced>February 11, 2008</announced>
+  <revised>February 11, 2008: 01</revised>
+  <bug>205377</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/horde-imp" auto="yes" arch="*">
+      <unaffected range="ge">4.1.6</unaffected>
+      <vulnerable range="lt">4.1.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Horde IMP provides a web-based access to IMAP and POP3 mailboxes.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ulf Harnhammar, Secunia Research discovered that the "frame" and
+    "frameset" HTML tags are not properly filtered out. He also reported
+    that certain HTTP requests are executed without being checked.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted HTML
+    e-mail, possibly resulting in the deletion of arbitrary e-mail
+    messages.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Horde IMP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-imp-4.1.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6018">CVE-2007-6018</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 05 Feb 2008 12:56:07 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 05 Feb 2008 12:56:20 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200802-04.xml b/xml/htdocs/security/en/glsa/glsa-200802-04.xml
new file mode 100644
index 00000000..7d943ffc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200802-04.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200802-04">
+  <title>Gallery: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities were discovered in Gallery.
+  </synopsis>
+  <product type="ebuild">gallery</product>
+  <announced>February 11, 2008</announced>
+  <revised>February 11, 2008: 01</revised>
+  <bug>203217</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/gallery" auto="yes" arch="*">
+      <unaffected range="ge">2.2.4</unaffected>
+      <unaffected range="lt">2.0</unaffected>
+      <vulnerable range="lt">2.2.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gallery is a web-based application for creating and viewing photo
+    albums.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Gallery developement team reported and fixed critical
+    vulnerabilities during an internal audit (CVE-2007-6685, CVE-2007-6686,
+    CVE-2007-6687, CVE-2007-6688, CVE-2007-6689, CVE-2007-6690,
+    CVE-2007-6691, CVE-2007-6692, CVE-2007-6693).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit these vulnerabilities to execute
+    arbitrary code, conduct Cross-Site Scripting and Cross-Site Request
+    Forgery attacks, or disclose sensitive informations.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gallery users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/gallery-2.2.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6685">CVE-2007-6685</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6686">CVE-2007-6686</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6687">CVE-2007-6687</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6688">CVE-2007-6688</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6689">CVE-2007-6689</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6690">CVE-2007-6690</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6691">CVE-2007-6691</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6692">CVE-2007-6692</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6693">CVE-2007-6693</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 23 Jan 2008 19:59:20 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 23 Jan 2008 19:59:33 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 06 Feb 2008 11:03:19 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200802-05.xml b/xml/htdocs/security/en/glsa/glsa-200802-05.xml
new file mode 100644
index 00000000..67f9c4aa
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200802-05.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200802-05">
+  <title>Gnumeric: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Several integer overflow vulnerabilities have been reported in Gnumeric,
+    possibly resulting in user-assisted execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">gnumeric</product>
+  <announced>February 12, 2008</announced>
+  <revised>February 12, 2008: 01</revised>
+  <bug>208356</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/gnumeric" auto="yes" arch="*">
+      <unaffected range="ge">1.8.1</unaffected>
+      <vulnerable range="lt">1.8.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Gnumeric spreadsheet is a versatile application developed as part
+    of the GNOME Office project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple integer overflow and signedness errors have been reported in
+    the excel_read_HLINK() function in file plugins/excel/ms-excel-read.c
+    when processing XLS HLINK opcodes.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted XLS
+    file, possibly resulting in the remote execution of arbitrary code with
+    the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gnumeric users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/gnumeric-1.8.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0668">CVE-2008-0668</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 10 Feb 2008 23:12:13 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 10 Feb 2008 23:12:22 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 12 Feb 2008 08:14:23 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200802-06.xml b/xml/htdocs/security/en/glsa/glsa-200802-06.xml
new file mode 100644
index 00000000..8c36bdb8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200802-06.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200802-06">
+  <title>scponly: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in scponly allow authenticated users to bypass
+    security restrictions.
+  </synopsis>
+  <product type="ebuild">scponly</product>
+  <announced>February 12, 2008</announced>
+  <revised>February 13, 2008: 02</revised>
+  <bug>201726</bug>
+  <bug>203099</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-misc/scponly" auto="yes" arch="*">
+      <unaffected range="ge">4.8</unaffected>
+      <vulnerable range="lt">4.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    scponly is a shell for restricting user access to file transfer only
+    using sftp and scp.
+    </p>
+  </background>
+  <description>
+    <p>
+    Joachim Breitner reported that Subversion and rsync support invokes
+    subcommands in an insecure manner (CVE-2007-6350). It has also been
+    discovered that scponly does not filter the -o and -F options to the
+    scp executable (CVE-2007-6415).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit these vulnerabilities to elevate
+    privileges and execute arbitrary commands on the vulnerable host.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All scponly users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/scponly-4.8&quot;</code>
+    <p>
+    Due to the design of scponly's Subversion support, security
+    restrictions can still be circumvented. Please read carefully the
+    SECURITY file included in the package.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6350">CVE-2007-6350</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6415">CVE-2007-6415</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 23 Jan 2008 02:02:07 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 06 Feb 2008 10:51:42 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 06 Feb 2008 10:51:57 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200802-07.xml b/xml/htdocs/security/en/glsa/glsa-200802-07.xml
new file mode 100644
index 00000000..b0c4e2f5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200802-07.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200802-07">
+  <title>Pulseaudio: Privilege escalation</title>
+  <synopsis>
+    A vulnerability in pulseaudio may allow a local user to execute actions
+    with escalated privileges.
+  </synopsis>
+  <product type="ebuild">pulseaudio</product>
+  <announced>February 13, 2008</announced>
+  <revised>February 13, 2008: 01</revised>
+  <bug>207214</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-sound/pulseaudio" auto="yes" arch="*">
+      <unaffected range="ge">0.9.9</unaffected>
+      <vulnerable range="lt">0.9.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Pulseaudio is a networked sound server with an advanced plugin system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Marcus Meissner from SUSE reported that the pa_drop_root() function
+    does not properly check the return value of the system calls setuid(),
+    seteuid(), setresuid() and setreuid() when dropping its privileges.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could cause a resource exhaustion to make the system
+    calls fail, which would cause Pulseaudio to run as root. The attacker
+    could then perform actions with root privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Pulseaudio users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/pulseaudio-0.9.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0008">CVE-2008-0008</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 11 Feb 2008 18:33:13 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 11 Feb 2008 18:33:32 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 13 Feb 2008 20:35:58 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200802-08.xml b/xml/htdocs/security/en/glsa/glsa-200802-08.xml
new file mode 100644
index 00000000..0f7a2882
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200802-08.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200802-08">
+  <title>Boost: Denial of Service</title>
+  <synopsis>
+    Two vulnerabilities have been reported in Boost, each one possibly
+    resulting in a Denial of Service.
+  </synopsis>
+  <product type="ebuild">boost</product>
+  <announced>February 14, 2008</announced>
+  <revised>February 14, 2008: 01</revised>
+  <bug>205955</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/boost" auto="yes" arch="*">
+      <unaffected range="ge">1.34.1-r2</unaffected>
+      <vulnerable range="lt">1.34.1-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Boost is a set of C++ libraries, including the Boost.Regex library to
+    process regular expressions.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy and Will Drewry from the Google Security Team reported a
+    failed assertion in file regex/v4/perl_matcher_non_recursive.hpp
+    (CVE-2008-0171) and a NULL pointer dereference in function
+    get_repeat_type() file basic_regex_creator.hpp (CVE-2008-0172) when
+    processing regular expressions.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could provide specially crafted regular expressions
+    to an application using Boost, resulting in a crash.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Boost users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/boost-1.34.1-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0171">CVE-2008-0171</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0172">CVE-2008-0172</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 10 Feb 2008 14:26:57 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 10 Feb 2008 14:27:09 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 13 Feb 2008 20:51:31 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200802-09.xml b/xml/htdocs/security/en/glsa/glsa-200802-09.xml
new file mode 100644
index 00000000..cc1556a7
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200802-09.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200802-09">
+  <title>ClamAV: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in ClamAV may result in the remote execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>February 21, 2008</announced>
+  <revised>February 21, 2008: 01</revised>
+  <bug>209915</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.92.1</unaffected>
+      <vulnerable range="lt">0.92.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Clam AntiVirus is a free anti-virus toolkit for UNIX, designed
+    especially for e-mail scanning on mail gateways.
+    </p>
+  </background>
+  <description>
+    <p>
+    An integer overflow has been reported in the "cli_scanpe()" function in
+    file libclamav/pe.c (CVE-2008-0318). Another unspecified vulnerability
+    has been reported in file libclamav/mew.c (CVE-2008-0728).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could entice a user or automated system to scan a
+    specially crafted file, possibly leading to the execution of arbitrary
+    code with the privileges of the user running ClamAV (either a system
+    user or the "clamav" user if clamd is compromised).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.92.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0318">CVE-2008-0318</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0728">CVE-2008-0728</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 19 Feb 2008 20:13:32 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 19 Feb 2008 20:14:59 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 19 Feb 2008 21:50:12 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200802-10.xml b/xml/htdocs/security/en/glsa/glsa-200802-10.xml
new file mode 100644
index 00000000..ac0c4123
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200802-10.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200802-10">
+  <title>Python: PCRE Integer overflow</title>
+  <synopsis>
+    A vulnerability within Python's copy of PCRE might lead to the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">python</product>
+  <announced>February 23, 2008</announced>
+  <revised>February 23, 2008: 01</revised>
+  <bug>198373</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/python" auto="yes" arch="*">
+      <unaffected range="ge">2.3.6-r4</unaffected>
+      <vulnerable range="lt">2.3.6-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Python is an interpreted, interactive, object-oriented programming
+    language.
+    </p>
+  </background>
+  <description>
+    <p>
+    Python 2.3 includes a copy of PCRE which is vulnerable to an integer
+    overflow vulnerability, leading to a buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit the vulnerability by tricking a vulnerable
+    Python application to compile a regular expressions, which could
+    possibly lead to the execution of arbitrary code, a Denial of Service
+    or the disclosure of sensitive information.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Python 2.3 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/python-2.3.6-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7228">CVE-2006-7228</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200711-30.xml">GLSA 200711-30</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 07 Jan 2008 19:00:53 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 28 Jan 2008 18:01:42 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 18 Feb 2008 22:37:11 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200802-11.xml b/xml/htdocs/security/en/glsa/glsa-200802-11.xml
new file mode 100644
index 00000000..a337aa14
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200802-11.xml
@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200802-11">
+  <title>Asterisk: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been found in Asterisk.
+  </synopsis>
+  <product type="ebuild">asterisk</product>
+  <announced>February 26, 2008</announced>
+  <revised>February 26, 2008: 01</revised>
+  <bug>185713</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/asterisk" auto="yes" arch="*">
+      <unaffected range="rge">1.2.17-r1</unaffected>
+      <unaffected range="ge">1.2.21.1-r1</unaffected>
+      <vulnerable range="lt">1.2.21.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Asterisk is an open source telephony engine and tool kit.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been found in Asterisk:
+    </p>
+    <ul>
+    <li>Russel Bryant reported a stack buffer overflow in the IAX2 channel
+    driver (chan_iax2) when bridging calls between chan_iax2 and any
+    channel driver that uses RTP for media (CVE-2007-3762).</li>
+    <li>Chris
+    Clark and Zane Lackey (iSEC Partners) reported a NULL pointer
+    dereference in the IAX2 channel driver (chan_iax2)
+    (CVE-2007-3763).</li>
+    <li>Will Drewry (Google Security) reported a
+    vulnerability in the Skinny channel driver (chan_skinny), resulting in
+    an overly large memcpy (CVE-2007-3764).</li>
+    <li>Will Drewry (Google
+    Security) reported a vulnerability in the IAX2 channel driver
+    (chan_iax2), that does not correctly handle unauthenticated
+    transactions using a 3-way handshake (CVE-2007-4103).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    By sending a long voice or video RTP frame, a remote attacker could
+    possibly execute arbitrary code on the target machine. Sending
+    specially crafted LAGRQ or LAGRP frames containing information elements
+    of IAX frames, or a certain data length value in a crafted packet, or
+    performing a flood of calls not completing a 3-way handshake, could
+    result in a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Asterisk users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/asterisk-1.2.17-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3762">CVE-2007-3762</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3763">CVE-2007-3763</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3764">CVE-2007-3764</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4103">CVE-2007-4103</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 07 Nov 2007 19:55:16 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 22 Nov 2007 23:26:53 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 26 Feb 2008 19:44:52 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200802-12.xml b/xml/htdocs/security/en/glsa/glsa-200802-12.xml
new file mode 100644
index 00000000..94174169
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200802-12.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200802-12">
+  <title>xine-lib: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    xine-lib is vulnerable to multiple buffer overflows when processing FLAC
+    and ASF streams.
+  </synopsis>
+  <product type="ebuild">xine-lib</product>
+  <announced>February 26, 2008</announced>
+  <revised>March 03, 2008: 02</revised>
+  <bug>209106</bug>
+  <bug>208100</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/xine-lib" auto="yes" arch="*">
+      <unaffected range="ge">1.1.10.1</unaffected>
+      <vulnerable range="lt">1.1.10.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xine-lib is the core library package for the xine media player.
+    </p>
+  </background>
+  <description>
+    <p>
+    Damian Frizza and Alfredo Ortega (Core Security Technologies)
+    discovered a stack-based buffer overflow within the open_flac_file()
+    function in the file demux_flac.c when parsing tags within a FLAC file
+    (CVE-2008-0486). A buffer overflow when parsing ASF headers, which is
+    similar to CVE-2006-1664, has also been discovered (CVE-2008-1110).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to play specially crafted FLAC or
+    ASF video streams with a player using xine-lib, potentially resulting
+    in the execution of arbitrary code with the privileges of the user
+    running the player.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xine-lib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/xine-lib-1.1.10.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1664">CVE-2006-1664</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0486">CVE-2008-0486</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1110">CVE-2008-1110</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 20 Feb 2008 08:36:00 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 20 Feb 2008 08:36:16 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 23 Feb 2008 19:46:42 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-01.xml b/xml/htdocs/security/en/glsa/glsa-200803-01.xml
new file mode 100644
index 00000000..75eb3d69
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-01.xml
@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-01">
+  <title>Adobe Acrobat Reader: Multiple vulnerabilities</title>
+  <synopsis>
+    Adobe Acrobat Reader is vulnerable to remote code execution, Denial of
+    Service, and cross-site request forgery attacks.
+  </synopsis>
+  <product type="ebuild">acroread</product>
+  <announced>March 02, 2008</announced>
+  <revised>March 05, 2008: 05</revised>
+  <bug>170177</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/acroread" auto="yes" arch="*">
+      <unaffected range="ge">8.1.2</unaffected>
+      <vulnerable range="lt">8.1.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Adobe Acrobat Reader is a PDF reader released by Adobe.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in Adobe Acrobat Reader,
+    including:
+    </p>
+    <ul><li>A file disclosure when using file:// in PDF documents
+    (CVE-2007-1199)</li>
+    <li>Multiple buffer overflows in unspecified Javascript methods
+    (CVE-2007-5659)</li>
+    <li>An unspecified vulnerability in the Escript.api plugin
+    (CVE-2007-5663)</li>
+    <li>An untrusted search path (CVE-2007-5666)</li>
+    <li>Incorrect handling of printers (CVE-2008-0667)</li>
+    <li>An integer overflow when passing incorrect arguments to
+    "printSepsWithParams" (CVE-2008-0726)</li>
+    </ul>
+    <p>
+    Other unspecified vulnerabilities have also been reported
+    (CVE-2008-0655).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    document, possibly resulting in the remote execution of arbitrary code
+    with the privileges of the user running the application. A remote
+    attacker could also perform cross-site request forgery attacks, or
+    cause a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Adobe Acrobat Reader users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/acroread-8.1.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1199">CVE-2007-1199</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5659">CVE-2007-5659</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5663">CVE-2007-5663</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5666">CVE-2007-5666</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0655">CVE-2008-0655</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0667">CVE-2008-0667</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0726">CVE-2008-0726</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 12 Feb 2008 00:03:23 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 27 Feb 2008 22:32:54 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 27 Feb 2008 22:33:01 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-02.xml b/xml/htdocs/security/en/glsa/glsa-200803-02.xml
new file mode 100644
index 00000000..0881ddab
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-02.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-02">
+  <title>Firebird: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Firebird may allow the remote execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">firebird</product>
+  <announced>March 02, 2008</announced>
+  <revised>March 02, 2008: 01</revised>
+  <bug>208034</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/firebird" auto="yes" arch="*">
+      <unaffected range="ge">2.0.3.12981.0-r5</unaffected>
+      <vulnerable range="lt">2.0.3.12981.0-r5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Firebird is a multi-platform, open source relational database.
+    </p>
+  </background>
+  <description>
+    <p>
+    Firebird does not properly handle certain types of XDR requests,
+    resulting in an integer overflow (CVE-2008-0387). Furthermore, it is
+    vulnerable to a buffer overflow when processing usernames
+    (CVE-2008-0467).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send specially crafted XDR requests or an
+    overly long username to the vulnerable server, possibly resulting in
+    the remote execution of arbitrary code with the privileges of the user
+    running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Firebird users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/firebird-2.0.3.12981.0-r5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0387">CVE-2008-0387</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0467">CVE-2008-0467</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 25 Feb 2008 20:05:19 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 25 Feb 2008 20:05:28 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 28 Feb 2008 12:57:14 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-03.xml b/xml/htdocs/security/en/glsa/glsa-200803-03.xml
new file mode 100644
index 00000000..0ec40067
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-03.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-03">
+  <title>Audacity: Insecure temporary file creation</title>
+  <synopsis>
+    Audacity uses temporary files in an insecure manner, allowing for a symlink
+    attack.
+  </synopsis>
+  <product type="ebuild">audacity</product>
+  <announced>March 02, 2008</announced>
+  <revised>March 02, 2008: 01</revised>
+  <bug>199751</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-sound/audacity" auto="yes" arch="*">
+      <unaffected range="ge">1.3.4-r1</unaffected>
+      <vulnerable range="lt">1.3.4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Audacity is a free cross-platform audio editor.
+    </p>
+  </background>
+  <description>
+    <p>
+    Viktor Griph reported that the "AudacityApp::OnInit()" method in file
+    src/AudacityApp.cpp does not handle temporary files properly.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit this vulnerability to conduct symlink
+    attacks to delete arbitrary files and directories with the privileges
+    of the user running Audacity.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Audacity users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/audacity-1.3.4-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6061">CVE-2007-6061</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 20 Feb 2008 00:55:24 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 26 Feb 2008 22:46:54 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 26 Feb 2008 22:47:07 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-04.xml b/xml/htdocs/security/en/glsa/glsa-200803-04.xml
new file mode 100644
index 00000000..ee019459
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-04.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-04">
+  <title>Mantis: Cross-Site Scripting</title>
+  <synopsis>
+    A persistent Cross-Site Scripting vulnerability has been discovered in
+    Mantis.
+  </synopsis>
+  <product type="ebuild">mantis</product>
+  <announced>March 03, 2008</announced>
+  <revised>March 03, 2008: 01</revised>
+  <bug>203791</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/mantisbt" auto="yes" arch="*">
+      <unaffected range="ge">1.0.8-r1</unaffected>
+      <vulnerable range="lt">1.0.8-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mantis is a web-based bug tracking system.
+    </p>
+  </background>
+  <description>
+    <p>
+    seiji reported that the filename for the uploaded file in
+    bug_report.php is not properly sanitised before being stored.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker could upload a file with a specially crafted to a bug
+    report, resulting in the execution of arbitrary HTML and script code
+    within the context of the users's browser. Note that this vulnerability
+    is only exploitable by authenticated users.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mantis users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/mantisbt-1.0.8-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6611">CVE-2007-6611</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 10 Feb 2008 18:16:34 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 10 Feb 2008 18:16:43 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 28 Feb 2008 12:32:54 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-05.xml b/xml/htdocs/security/en/glsa/glsa-200803-05.xml
new file mode 100644
index 00000000..0b77a3e5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-05.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-05">
+  <title>SplitVT: Privilege escalation</title>
+  <synopsis>
+    A vulnerability in SplitVT may allow local users to gain escalated
+    privileges.
+  </synopsis>
+  <product type="ebuild">splitvt</product>
+  <announced>March 03, 2008</announced>
+  <revised>March 03, 2008: 01</revised>
+  <bug>211240</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-misc/splitvt" auto="yes" arch="*">
+      <unaffected range="ge">1.6.6-r1</unaffected>
+      <vulnerable range="lt">1.6.6-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SplitVT is a program for splitting terminals into two shells.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mike Ashton reported that SplitVT does not drop group privileges before
+    executing the xprop utility.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could exploit this vulnerability to gain the "utmp"
+    group privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SplitVT users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-misc/splitvt-1.6.6-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0162">CVE-2008-0162</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 26 Feb 2008 20:35:01 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 26 Feb 2008 20:35:10 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 29 Feb 2008 11:02:58 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-06.xml b/xml/htdocs/security/en/glsa/glsa-200803-06.xml
new file mode 100644
index 00000000..e7e14a84
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-06.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-06">
+  <title>SWORD: Shell command injection</title>
+  <synopsis>
+    Insufficient input checking in SWORD may allow shell command injection.
+  </synopsis>
+  <product type="ebuild">sword</product>
+  <announced>March 03, 2008</announced>
+  <revised>March 03, 2008: 01</revised>
+  <bug>210754</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/sword" auto="yes" arch="*">
+      <unaffected range="ge">1.5.8-r2</unaffected>
+      <vulnerable range="lt">1.5.8-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SWORD is a library for Bible study software.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dan Dennison reported that the diatheke.pl script used in SWORD does
+    not properly sanitize shell meta-characters in the "range" parameter
+    before processing it.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could provide specially crafted input to a vulnerable
+    application, possibly resulting in the remote execution of arbitrary
+    shell commands with the privileges of the user running SWORD (generally
+    the web server account).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SWORD users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/sword-1.5.8-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0932">CVE-2008-0932</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 23 Feb 2008 19:11:13 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 29 Feb 2008 12:41:01 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 29 Feb 2008 12:41:15 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-07.xml b/xml/htdocs/security/en/glsa/glsa-200803-07.xml
new file mode 100644
index 00000000..a14ee8ac
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-07.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-07">
+  <title>Paramiko: Information disclosure</title>
+  <synopsis>
+    Unsafe randomness usage in Paramiko may allow access to sensitive
+    information.
+  </synopsis>
+  <product type="ebuild">paramiko</product>
+  <announced>March 03, 2008</announced>
+  <revised>March 03, 2008: 01</revised>
+  <bug>205777</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-python/paramiko" auto="yes" arch="*">
+      <unaffected range="ge">1.7.2</unaffected>
+      <vulnerable range="lt">1.7.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Paramiko is a Secure Shell Server implementation written in Python.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dwayne C. Litzenberger reported that the file "common.py" does not
+    properly use RandomPool when using threads or forked processes.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker could predict the values generated by applications
+    using Paramiko for encryption purposes, potentially gaining access to
+    sensitive information.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Paramiko users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-python/paramiko-1.7.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0299">CVE-2008-0299</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 11 Feb 2008 18:32:09 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 11 Feb 2008 18:33:24 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 28 Feb 2008 12:43:49 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-08.xml b/xml/htdocs/security/en/glsa/glsa-200803-08.xml
new file mode 100644
index 00000000..58fa06bd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-08.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-08">
+  <title>Win32 binary codecs: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in the Win32 codecs for Linux may result in the
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">win32codecs</product>
+  <announced>March 04, 2008</announced>
+  <revised>March 04, 2008: 01</revised>
+  <bug>150288</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/win32codecs" auto="yes" arch="*">
+      <unaffected range="ge">20071007-r2</unaffected>
+      <vulnerable range="lt">20071007-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Win32 binary codecs provide support for video and audio playback.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple buffer overflow, heap overflow, and integer overflow
+    vulnerabilities were discovered in the Quicktime plugin when processing
+    MOV, FLC, SGI, H.264 and FPX files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted video
+    file, possibly resulting in the remote execution of arbitrary code with
+    the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Win32 binary codecs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/win32codecs-20071007-r2&quot;</code>
+    <p>
+    Note: Since no updated binary versions have been released, the
+    Quicktime libraries have been removed from the package. Please use the
+    free alternative Quicktime implementations within VLC, MPlayer or Xine
+    for playback.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4382">CVE-2006-4382</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4384">CVE-2006-4384</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4385">CVE-2006-4385</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4386">CVE-2006-4386</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4388">CVE-2006-4388</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4389">CVE-2006-4389</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4674">CVE-2007-4674</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6166">CVE-2007-6166</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 13 Nov 2007 22:48:06 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 13 Nov 2007 22:48:15 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 29 Feb 2008 10:44:06 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-09.xml b/xml/htdocs/security/en/glsa/glsa-200803-09.xml
new file mode 100644
index 00000000..748fc653
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-09.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-09">
+  <title>Opera: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Opera, allowing for file
+    disclosure, privilege escalation and Cross-Site scripting.
+  </synopsis>
+  <product type="ebuild">opera</product>
+  <announced>March 04, 2008</announced>
+  <revised>March 04, 2008: 01</revised>
+  <bug>210260</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/opera" auto="yes" arch="*">
+      <unaffected range="ge">9.26</unaffected>
+      <vulnerable range="lt">9.26</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Opera is a fast web browser that is available free of charge.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mozilla discovered that Opera does not handle input to file form fields
+    properly, allowing scripts to manipulate the file path (CVE-2008-1080).
+    Max Leonov found out that image comments might be treated as scripts,
+    and run within the wrong security context (CVE-2008-1081). Arnaud
+    reported that a wrong representation of DOM attribute values of
+    imported XML documents allows them to bypass sanitization filters
+    (CVE-2008-1082).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to upload a file with a known
+    path by entering text into a specially crafted form, to execute scripts
+    outside intended security boundaries and conduct Cross-Site Scripting
+    attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Opera users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/opera-9.26&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1080">CVE-2008-1080</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1081">CVE-2008-1081</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1082">CVE-2008-1082</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 26 Feb 2008 10:02:38 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 26 Feb 2008 10:02:54 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 02 Mar 2008 22:56:26 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-10.xml b/xml/htdocs/security/en/glsa/glsa-200803-10.xml
new file mode 100644
index 00000000..5ef0c99e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-10.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-10">
+  <title>lighttpd: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in lighttpd.
+  </synopsis>
+  <product type="ebuild">lighttpd</product>
+  <announced>March 05, 2008</announced>
+  <revised>March 05, 2008: 01</revised>
+  <bug>211230</bug>
+  <bug>211956</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/lighttpd" auto="yes" arch="*">
+      <unaffected range="ge">1.4.18-r2</unaffected>
+      <vulnerable range="lt">1.4.18-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    lighttpd is a lightweight high-performance web server.
+    </p>
+  </background>
+  <description>
+    <p>
+    lighttpd contains a calculation error when allocating the global file
+    descriptor array (CVE-2008-0983). Furthermore, it sends the source of a
+    CGI script instead of returning a 500 error (Internal Server Error)
+    when the fork() system call fails (CVE-2008-1111).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities to cause a Denial
+    of Service or gain the source of a CGI script.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All lighttpd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/lighttpd-1.4.18-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0983">CVE-2008-0983</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1111">CVE-2008-1111</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 02 Mar 2008 13:11:03 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 02 Mar 2008 22:33:25 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 04 Mar 2008 21:56:43 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-11.xml b/xml/htdocs/security/en/glsa/glsa-200803-11.xml
new file mode 100644
index 00000000..fd2b65a5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-11.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-11">
+  <title>Vobcopy: Insecure temporary file creation</title>
+  <synopsis>
+    Vobcopy uses temporary files in an insecure manner, allowing for a symlink
+    attack.
+  </synopsis>
+  <product type="ebuild">vobcopy</product>
+  <announced>March 05, 2008</announced>
+  <revised>March 05, 2008: 01</revised>
+  <bug>197578</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-video/vobcopy" auto="yes" arch="*">
+      <unaffected range="ge">1.1.0</unaffected>
+      <vulnerable range="lt">1.1.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Vobcopy is a tool for decrypting and copying DVD .vob files to a hard
+    disk.
+    </p>
+  </background>
+  <description>
+    <p>
+    Joey Hess reported that vobcopy appends data to the file
+    "/tmp/vobcopy.bla" in an insecure manner.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit this vulnerability to conduct symlink
+    attacks and append data to arbitrary files with the privileges of the
+    user running Vobcopy.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Vobcopy users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/vobcopy-1.1.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5718">CVE-2007-5718</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 04 Mar 2008 14:25:49 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 04 Mar 2008 22:37:51 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 04 Mar 2008 22:38:00 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-12.xml b/xml/htdocs/security/en/glsa/glsa-200803-12.xml
new file mode 100644
index 00000000..5b5ad44a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-12.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-12">
+  <title>Evolution: Format string vulnerability</title>
+  <synopsis>
+    A format string error has been discovered in Evolution, possibly resulting
+    in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">evolution</product>
+  <announced>March 05, 2008</announced>
+  <revised>March 05, 2008: 01</revised>
+  <bug>212272</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/evolution" auto="yes" arch="*">
+      <unaffected range="ge">2.12.3-r1</unaffected>
+      <vulnerable range="lt">2.12.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Evolution is a GNOME groupware application.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ulf Harnhammar from Secunia Research discovered a format string error
+    in the emf_multipart_encrypted() function in the file mail/em-format.c
+    when reading certain data (e.g. the "Version:" field) from an encrypted
+    e-mail.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    encrypted e-mail, potentially resulting in the execution of arbitrary
+    code with the privileges of the user running Evolution.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Evolution users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/evolution-2.12.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0072">CVE-2008-0072</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 05 Mar 2008 20:09:16 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 05 Mar 2008 21:00:40 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 05 Mar 2008 21:00:49 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-13.xml b/xml/htdocs/security/en/glsa/glsa-200803-13.xml
new file mode 100644
index 00000000..fc2d50b9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-13.xml
@@ -0,0 +1,100 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-13">
+  <title>VLC: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities were found in VLC, allowing for the execution of
+    arbitrary code and Denial of Service.
+  </synopsis>
+  <product type="ebuild">vlc</product>
+  <announced>March 07, 2008</announced>
+  <revised>March 07, 2008: 01</revised>
+  <bug>203345</bug>
+  <bug>211575</bug>
+  <bug>205299</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/vlc" auto="yes" arch="*">
+      <unaffected range="ge">0.8.6e</unaffected>
+      <vulnerable range="lt">0.8.6e</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    VLC is a cross-platform media player and streaming server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities were found in VLC:
+    </p>
+    <ul>
+    <li>Michal Luczaj
+    and Luigi Auriemma reported that VLC contains boundary errors when
+    handling subtitles in the ParseMicroDvd(), ParseSSA(), and
+    ParseVplayer() functions in the modules/demux/subtitle.c file, allowing
+    for a stack-based buffer overflow (CVE-2007-6681).</li>
+    <li>The web
+    interface listening on port 8080/tcp contains a format string error in
+    the httpd_FileCallBack() function in the network/httpd.c file
+    (CVE-2007-6682).</li>
+    <li>The browser plugin possibly contains an
+    argument injection vulnerability (CVE-2007-6683).</li>
+    <li>The RSTP
+    module triggers a NULL pointer dereference when processing a request
+    without a "Transport" parameter (CVE-2007-6684).</li>
+    <li>Luigi
+    Auriemma and Remi Denis-Courmont found a boundary error in the
+    modules/access/rtsp/real_sdpplin.c file when processing SDP data for
+    RTSP sessions (CVE-2008-0295) and a vulnerability in the
+    libaccess_realrtsp plugin (CVE-2008-0296), possibly resulting in a
+    heap-based buffer overflow.</li>
+    <li>Felipe Manzano and Anibal Sacco
+    (Core Security Technologies) discovered an arbitrary memory overwrite
+    vulnerability in VLC's MPEG-4 file format parser (CVE-2008-0984).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send a long subtitle in a file that a user is
+    enticed to open, a specially crafted MP4 input file, long SDP data, or
+    a specially crafted HTTP request with a "Connection" header value
+    containing format specifiers, possibly resulting in the remote
+    execution of arbitrary code. Also, a Denial of Service could be caused
+    and arbitrary files could be overwritten via the "demuxdump-file"
+    option in a filename in a playlist or via an EXTVLCOPT statement in an
+    MP3 file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All VLC users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/vlc-0.8.6e&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6681">CVE-2007-6681</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6682">CVE-2007-6682</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6683">CVE-2007-6683</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6684">CVE-2007-6684</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0295">CVE-2008-0295</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0296">CVE-2008-0296</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0984">CVE-2008-0984</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 05 Mar 2008 21:55:08 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 07 Mar 2008 18:42:04 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-14.xml b/xml/htdocs/security/en/glsa/glsa-200803-14.xml
new file mode 100644
index 00000000..fc3ede17
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-14.xml
@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-14">
+  <title>Ghostscript: Buffer overflow</title>
+  <synopsis>
+    A stack-based buffer overflow has been discovered in Ghostscript, allowing
+    arbitrary code execution.
+  </synopsis>
+  <product type="ebuild">ghostscript</product>
+  <announced>March 08, 2008</announced>
+  <revised>March 08, 2008: 01</revised>
+  <bug>208999</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/ghostscript-esp" auto="yes" arch="*">
+      <unaffected range="ge">8.15.4-r1</unaffected>
+      <vulnerable range="lt">8.15.4-r1</vulnerable>
+    </package>
+    <package name="app-text/ghostscript-gpl" auto="yes" arch="*">
+      <unaffected range="ge">8.61-r3</unaffected>
+      <vulnerable range="lt">8.61-r3</vulnerable>
+    </package>
+    <package name="app-text/ghostscript-gnu" auto="yes" arch="*">
+      <unaffected range="ge">8.60.0-r2</unaffected>
+      <vulnerable range="lt">8.60.0-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ghostscript is a suite of software based on an interpreter for
+    PostScript and PDF.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Evans (Google Security) discovered a stack-based buffer overflow
+    within the zseticcspace() function in the file zicc.c when processing a
+    PostScript file containing a long "Range" array in a .seticcscpate
+    operator.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit this vulnerability by enticing a user
+    to open a specially crafted PostScript file, which could possibly lead
+    to the execution of arbitrary code or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ghostscript ESP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/ghostscript-esp-8.15.4-r1&quot;</code>
+    <p>
+    All Ghostscript GPL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/ghostscript-gpl-8.61-r3&quot;</code>
+    <p>
+    All Ghostscript GNU users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/ghostscript-gnu-8.60.0-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0411">CVE-2008-0411</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 02 Mar 2008 15:25:45 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 02 Mar 2008 15:25:54 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 05 Mar 2008 20:06:31 +0000">
+    psychoschlumpf
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-15.xml b/xml/htdocs/security/en/glsa/glsa-200803-15.xml
new file mode 100644
index 00000000..8a6e3c5f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-15.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-15">
+  <title>phpMyAdmin: SQL injection vulnerability</title>
+  <synopsis>
+    A SQL injection vulnerability has been discovered in phpMyAdmin.
+  </synopsis>
+  <product type="ebuild">phpmyadmin</product>
+  <announced>March 09, 2008</announced>
+  <revised>March 09, 2008: 01</revised>
+  <bug>212000</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-db/phpmyadmin" auto="yes" arch="*">
+      <unaffected range="ge">2.11.5</unaffected>
+      <vulnerable range="lt">2.11.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpMyAdmin is a free web-based database administration tool.
+    </p>
+  </background>
+  <description>
+    <p>
+    Richard Cunningham reported that phpMyAdmin uses the $_REQUEST variable
+    of $_GET and $_POST as a source for its parameters.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    An attacker could entice a user to visit a malicious web application
+    that sets an "sql_query" cookie and is hosted on the same domain as
+    phpMyAdmin, and thereby conduct SQL injection attacks with the
+    privileges of the user authenticating in phpMyAdmin afterwards.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpMyAdmin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/phpmyadmin-2.11.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1149">CVE-2008-1149</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 05 Mar 2008 09:53:35 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 07 Mar 2008 08:44:33 +0000">
+    psychoschlumpf
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 07 Mar 2008 10:05:31 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-16.xml b/xml/htdocs/security/en/glsa/glsa-200803-16.xml
new file mode 100644
index 00000000..b66893c1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-16.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-16">
+  <title>MPlayer: Multiple buffer overflows</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in MPlayer, possibly allowing
+    for the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mplayer</product>
+  <announced>March 10, 2008</announced>
+  <revised>March 10, 2008: 01</revised>
+  <bug>208566</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/mplayer" auto="yes" arch="*">
+      <unaffected range="ge">1.0_rc2_p25993</unaffected>
+      <vulnerable range="lt">1.0_rc2_p25993</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MPlayer is a media player incuding support for a wide range of audio
+    and video formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following errors have been discovered in MPlayer:
+    </p>
+    <ul>
+    <li>Felipe Manzano and Anibal Sacco (Core Security Technologies)
+    reported an array indexing error in the file libmpdemux/demux_mov.c
+    when parsing MOV file headers (CVE-2008-0485).</li>
+    <li>Damian Frizza
+    and Alfredo Ortega (Core Security Technologies) reported a boundary
+    error in the file libmpdemux/demux_audio.c when parsing FLAC comments
+    (CVE-2008-0486).</li>
+    <li>Adam Bozanich (Mu Security) reported boundary
+    errors in the cddb_parse_matches_list() and cddb_query_parse()
+    functions in the file stream_cddb.c when parsing CDDB album titles
+    (CVE-2008-0629) and in the url_scape_string() function in the file
+    stream/url.c when parsing URLS (CVE-2008-0630).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted file,
+    possibly resulting in the execution of arbitrary code with the
+    privileges of the user running MPlayer.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MPlayer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/mplayer-1.0_rc2_p25993&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0485">CVE-2008-0485</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0486">CVE-2008-0486</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0629">CVE-2008-0629</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0630">CVE-2008-0630</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 19 Feb 2008 20:10:11 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 19 Feb 2008 20:13:04 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 07 Mar 2008 23:38:09 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-17.xml b/xml/htdocs/security/en/glsa/glsa-200803-17.xml
new file mode 100644
index 00000000..5366f3ff
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-17.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-17">
+  <title>PDFlib: Multiple buffer overflows</title>
+  <synopsis>
+    Multiple stack-based buffer overflows have been reported in PDFlib.
+  </synopsis>
+  <product type="ebuild">pdflib</product>
+  <announced>March 10, 2008</announced>
+  <revised>March 10, 2008: 01</revised>
+  <bug>203287</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/pdflib" auto="yes" arch="*">
+      <unaffected range="ge">7.0.2_p8</unaffected>
+      <vulnerable range="lt">7.0.2_p8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PDFlib is a library for generating PDF on the fly.
+    </p>
+  </background>
+  <description>
+    <p>
+    poplix reported multiple boundary errors in the pdc_fsearch_fopen()
+    function when processing overly long filenames.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted content to a vulnerable
+    application using PDFlib, possibly resulting in the remote execution of
+    arbitrary code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PDFlib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/pdflib-7.0.2_p8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6561">CVE-2007-6561</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 08 Mar 2008 16:26:44 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 10 Mar 2008 12:46:32 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 10 Mar 2008 12:46:45 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-18.xml b/xml/htdocs/security/en/glsa/glsa-200803-18.xml
new file mode 100644
index 00000000..40e13b5a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-18.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-18">
+  <title>Cacti: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities were discovered in Cacti.
+  </synopsis>
+  <product type="ebuild">cacti</product>
+  <announced>March 10, 2008</announced>
+  <revised>May 28, 2009: 02</revised>
+  <bug>209918</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/cacti" auto="yes" arch="*">
+      <unaffected range="ge">0.8.7b</unaffected>
+      <unaffected range="rge">0.8.6j-r8</unaffected>
+      <vulnerable range="lt">0.8.7b</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cacti is a web-based network graphing and reporting tool.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following inputs are not properly sanitized before being processed:
+    </p>
+    <ul><li>"view_type" parameter in the file graph.php, "filter" parameter
+    in the file graph_view.php, "action" and "login_username" parameters in
+    the file index.php (CVE-2008-0783).</li>
+    <li>"local_graph_id" parameter in the file graph.php
+    (CVE-2008-0784).</li>
+    <li>"graph_list" parameter in the file graph_view.php, "leaf_id" and
+    "id" parameters in the file tree.php, "local_graph_id" in the file
+    graph_xport.php (CVE-2008-0785).</li>
+    </ul>
+    <p>
+    Furthermore, CRLF injection attack are possible via unspecified vectors
+    (CVE-2008-0786).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities, leading to path
+    disclosure, Cross-Site Scripting attacks, SQL injection, and HTTP
+    response splitting.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cacti users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/cacti-0.8.7b&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0783">CVE-2008-0783</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0784">CVE-2008-0784</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0785">CVE-2008-0785</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0786">CVE-2008-0786</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 25 Feb 2008 22:16:20 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 07 Mar 2008 23:16:40 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 07 Mar 2008 23:16:51 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-19.xml b/xml/htdocs/security/en/glsa/glsa-200803-19.xml
new file mode 100644
index 00000000..4433cc97
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-19.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-19">
+  <title>Apache: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Apache.
+  </synopsis>
+  <product type="ebuild">apache</product>
+  <announced>March 11, 2008</announced>
+  <revised>March 12, 2008: 02</revised>
+  <bug>201163</bug>
+  <bug>204410</bug>
+  <bug>205195</bug>
+  <bug>209899</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="ge">2.2.8</unaffected>
+      <vulnerable range="lt">2.2.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP server is one of the most popular web servers on the
+    Internet.
+    </p>
+  </background>
+  <description>
+    <p>
+    Adrian Pastor and Amir Azam (ProCheckUp) reported that the HTTP Method
+    specifier header is not properly sanitized when the HTTP return code is
+    "413 Request Entity too large" (CVE-2007-6203). The mod_proxy_balancer
+    module does not properly check the balancer name before using it
+    (CVE-2007-6422). The mod_proxy_ftp does not define a charset in its
+    answers (CVE-2008-0005). Stefano Di Paola (Minded Security) reported
+    that filenames are not properly sanitized within the mod_negotiation
+    module (CVE-2008-0455, CVE-2008-0456).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to visit a malicious URL or send
+    specially crafted HTTP requests (i.e using Adobe Flash) to perform
+    Cross-Site Scripting and HTTP response splitting attacks, or conduct a
+    Denial of Service attack on the vulnerable web server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Apache users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/apache-2.2.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6203">CVE-2007-6203</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6422">CVE-2007-6422</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0005">CVE-2008-0005</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0455">CVE-2008-0455</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0456">CVE-2008-0456</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 13 Jan 2008 14:04:58 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 10 Mar 2008 12:30:36 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 10 Mar 2008 12:31:50 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-20.xml b/xml/htdocs/security/en/glsa/glsa-200803-20.xml
new file mode 100644
index 00000000..2166c286
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-20.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-20">
+  <title>International Components for Unicode: Multiple vulnerabilities</title>
+  <synopsis>
+    Two vulnerabilities have been discovered in the International Components
+    for Unicode, possibly resulting in the remote execution of arbitrary code
+    or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">icu</product>
+  <announced>March 11, 2008</announced>
+  <revised>May 28, 2009: 03</revised>
+  <bug>208001</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/icu" auto="yes" arch="*">
+      <unaffected range="ge">3.8.1-r1</unaffected>
+      <unaffected range="rge">3.6-r2</unaffected>
+      <vulnerable range="lt">3.8.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    International Components for Unicode is a set of C/C++ and Java
+    libraries providing Unicode and Globalization support for software
+    applications.
+    </p>
+  </background>
+  <description>
+    <p>
+    Will Drewry (Google Security) reported a vulnerability in the regular
+    expression engine when using back references to capture \0 characters
+    (CVE-2007-4770). He also found that the backtracking stack size is not
+    limited, possibly allowing for a heap-based buffer overflow
+    (CVE-2007-4771).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could submit specially crafted regular expressions to
+    an application using the library, possibly resulting in the remote
+    execution of arbitrary code with the privileges of the user running the
+    application or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All International Components for Unicode users should upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/icu-3.8.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4770">CVE-2007-4770</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4771">CVE-2007-4771</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 20 Feb 2008 08:30:44 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 20 Feb 2008 08:30:59 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 11 Mar 2008 12:40:50 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-21.xml b/xml/htdocs/security/en/glsa/glsa-200803-21.xml
new file mode 100644
index 00000000..4234474b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-21.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-21">
+  <title>Sarg: Remote execution of arbitrary code</title>
+  <synopsis>
+    Sarg is vulnerable to the execution of arbitrary code when processed with
+    untrusted input files.
+  </synopsis>
+  <product type="ebuild">sarg</product>
+  <announced>March 12, 2008</announced>
+  <revised>March 12, 2008: 01</revised>
+  <bug>212208</bug>
+  <bug>212731</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/sarg" auto="yes" arch="*">
+      <unaffected range="ge">2.2.5</unaffected>
+      <vulnerable range="lt">2.2.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Sarg (Squid Analysis Report Generator) is a tool that provides many
+    informations about the Squid web proxy server users activities: time,
+    sites, traffic, etc.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sarg doesn't properly check its input for abnormal content when
+    processing Squid log files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker using a vulnerable Squid as a proxy server or a
+    reverse-proxy server can inject arbitrary content into the "User-Agent"
+    HTTP client header, that will be processed by sarg, which will lead to
+    the execution of arbitrary code, or JavaScript injection, allowing
+    Cross-Site Scripting attacks and the theft of credentials.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All sarg users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/sarg-2.2.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1167">CVE-2008-1167</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1168">CVE-2008-1168</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 08 Mar 2008 16:52:09 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 09 Mar 2008 18:03:52 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 09 Mar 2008 21:03:08 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-22.xml b/xml/htdocs/security/en/glsa/glsa-200803-22.xml
new file mode 100644
index 00000000..864dfb57
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-22.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-22">
+  <title>LIVE555 Media Server: Denial of Service</title>
+  <synopsis>
+    A Denial of Service vulnerability has been reported in LIVE555 Media
+    Server.
+  </synopsis>
+  <product type="ebuild">live</product>
+  <announced>March 13, 2008</announced>
+  <revised>March 13, 2008: 01</revised>
+  <bug>204065</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-plugins/live" auto="yes" arch="*">
+      <unaffected range="ge">2008.02.08</unaffected>
+      <vulnerable range="lt">2008.02.08</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    LIVE555 Media Server is a set of libraries for multimedia streaming.
+    </p>
+  </background>
+  <description>
+    <p>
+    Luigi Auriemma reported a signedness error in the
+    parseRTSPRequestString() function when processing short RTSP queries.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send a specially crafted RTSP query to the
+    vulnerable server, resulting in a crash.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All LIVE555 Media Server users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-plugins/live-2008.02.08&quot;</code>
+    <p>
+    Note: Due to ABI changes, applications built against LIVE555 Media
+    Server such as VLC or MPlayer should also be rebuilt.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6036">CVE-2007-6036</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 08 Mar 2008 16:52:57 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 11 Mar 2008 12:26:32 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 11 Mar 2008 12:27:04 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-23.xml b/xml/htdocs/security/en/glsa/glsa-200803-23.xml
new file mode 100644
index 00000000..d7bef873
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-23.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-23">
+  <title>Website META Language: Insecure temporary file usage</title>
+  <synopsis>
+    Multiple insecure temporary file vulnerabilities have been discovered in
+    the Website META Language.
+  </synopsis>
+  <product type="ebuild">wml</product>
+  <announced>March 15, 2008</announced>
+  <revised>March 15, 2008: 01</revised>
+  <bug>209927</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-lang/wml" auto="yes" arch="*">
+      <unaffected range="ge">2.0.11-r3</unaffected>
+      <vulnerable range="lt">2.0.11-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Website META Language is a free and extensible Webdesigner's off-line
+    HTML generation toolkit for Unix.
+    </p>
+  </background>
+  <description>
+    <p>
+    Temporary files are handled insecurely in the files
+    wml_backend/p1_ipp/ipp.src, wml_contrib/wmg.cgi, and
+    wml_backend/p3_eperl/eperl_sys.c, allowing users to overwrite or delete
+    arbitrary files with the privileges of the user running the program.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Local users can exploit the insecure temporary file vulnerabilities via
+    symlink attacks to perform certain actions with escalated privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Restrict access to the temporary directory to trusted users only.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Website META Language users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/wml-2.0.11-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0665">CVE-2008-0665</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0666">CVE-2008-0666</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 11 Mar 2008 22:05:35 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 11 Mar 2008 22:05:48 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 15 Mar 2008 20:18:51 +0000">
+    mfleming
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-24.xml b/xml/htdocs/security/en/glsa/glsa-200803-24.xml
new file mode 100644
index 00000000..293c4414
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-24.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-24">
+  <title>PCRE: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow vulnerability has been discovered in PCRE, allowing for
+    the execution of arbitrary code and Denial of Service.
+  </synopsis>
+  <product type="ebuild">libpcre glib</product>
+  <announced>March 17, 2008</announced>
+  <revised>March 17, 2008: 02</revised>
+  <bug>209067</bug>
+  <bug>209293</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/libpcre" auto="yes" arch="*">
+      <unaffected range="ge">7.6-r1</unaffected>
+      <vulnerable range="lt">7.6-r1</vulnerable>
+    </package>
+    <package name="dev-libs/glib" auto="yes" arch="*">
+      <unaffected range="ge">2.14.6</unaffected>
+      <unaffected range="lt">2.14.0</unaffected>
+      <vulnerable range="lt">2.14.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PCRE is a Perl-compatible regular expression library. GLib includes a
+    copy of PCRE.
+    </p>
+  </background>
+  <description>
+    <p>
+    PCRE contains a buffer overflow vulnerability when processing a
+    character class containing a very large number of characters with
+    codepoints greater than 255.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this vulnerability by sending a
+    specially crafted regular expression to an application making use of
+    the PCRE library, which could possibly lead to the execution of
+    arbitrary code or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PCRE users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/libpcre-7.6-r1&quot;</code>
+    <p>
+    All GLib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/glib-2.14.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0674">CVE-2008-0674</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 26 Feb 2008 20:45:26 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 01 Mar 2008 06:12:22 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 05 Mar 2008 14:06:55 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-25.xml b/xml/htdocs/security/en/glsa/glsa-200803-25.xml
new file mode 100644
index 00000000..70954c1c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-25.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-25">
+  <title>Dovecot: Multiple vulnerabilities</title>
+  <synopsis>
+    Two vulnerabilities in Dovecot allow for information disclosure and
+    argument injection.
+  </synopsis>
+  <product type="ebuild">dovecot</product>
+  <announced>March 18, 2008</announced>
+  <revised>March 18, 2008: 01</revised>
+  <bug>212336</bug>
+  <bug>213030</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/dovecot" auto="yes" arch="*">
+      <unaffected range="ge">1.0.13-r1</unaffected>
+      <vulnerable range="lt">1.0.13-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Dovecot is a lightweight, fast and easy to configure IMAP and POP3 mail
+    server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dovecot uses the group configured via the "mail_extra_groups" setting,
+    which should be used to create lockfiles in the /var/mail directory,
+    when accessing arbitrary files (CVE-2008-1199). Dovecot does not escape
+    TAB characters in passwords when saving them, which might allow for
+    argument injection in blocking passdbs such as MySQL, PAM or shadow
+    (CVE-2008-1218).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote attackers can exploit the first vulnerability to disclose
+    sensitive data, such as the mail of other users, or modify files or
+    directories that are writable by group via a symlink attack. Please
+    note that the "mail_extra_groups" setting is set to the "mail" group by
+    default when the "mbox" USE flag is enabled.
+    </p>
+    <p>
+    The second vulnerability can be abused to inject arguments for internal
+    fields. No exploitation vectors are known for this vulnerability that
+    affect previously stable versions of Dovecot in Gentoo.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Dovecot users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/dovecot-1.0.13-r1&quot;</code>
+    <p>
+    This version removes the "mail_extra_groups" option and introduces a
+    "mail_privileged_group" setting which is handled safely.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1199">CVE-2008-1199</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1218">CVE-2008-1218</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 11 Mar 2008 18:35:36 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 12 Mar 2008 01:34:31 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 18 Mar 2008 11:19:55 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-26.xml b/xml/htdocs/security/en/glsa/glsa-200803-26.xml
new file mode 100644
index 00000000..cb5b587d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-26.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-26">
+  <title>Adobe Acrobat Reader: Insecure temporary file creation</title>
+  <synopsis>
+    An insecure temporary file creation vulnerability has been discovered in
+    Adobe Acrobat Reader.
+  </synopsis>
+  <product type="ebuild">acroread</product>
+  <announced>March 18, 2008</announced>
+  <revised>March 18, 2008: 01</revised>
+  <bug>212367</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-text/acroread" auto="yes" arch="*">
+      <unaffected range="ge">8.1.2-r1</unaffected>
+      <vulnerable range="lt">8.1.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Acrobat Reader is a PDF reader released by Adobe.
+    </p>
+  </background>
+  <description>
+    <p>
+    SUSE reported that the "acroread" wrapper script does not create
+    temporary files in a secure manner when handling SSL certificates
+    (CVE-2008-0883).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit this vulnerability to overwrite
+    arbitrary files via a symlink attack on temporary files.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Adobe Acrobat Reader users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/acroread-8.1.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0883">CVE-2008-0883</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 16 Mar 2008 13:19:39 +0000">
+    mfleming
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 17 Mar 2008 11:44:20 +0000">
+    mfleming
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 18 Mar 2008 13:28:58 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-27.xml b/xml/htdocs/security/en/glsa/glsa-200803-27.xml
new file mode 100644
index 00000000..14ef5075
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-27.xml
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-27">
+  <title>MoinMoin: Multiple vulnerabilities</title>
+  <synopsis>
+    Several vulnerabilities have been reported in MoinMoin Wiki Engine.
+  </synopsis>
+  <product type="ebuild">moinmoin</product>
+  <announced>March 18, 2008</announced>
+  <revised>March 18, 2008: 01</revised>
+  <bug>209133</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/moinmoin" auto="yes" arch="*">
+      <unaffected range="ge">1.6.1</unaffected>
+      <vulnerable range="lt">1.6.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MoinMoin is an advanced, easy to use and extensible Wiki Engine.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered:
+    </p>
+    <ul>
+    <li>
+    A vulnerability exists in the file wikimacro.py because the
+    _macro_Getval function does not properly enforce ACLs
+    (CVE-2008-1099).</li>
+    <li>
+    A directory traversal vulnerability exists in the userform action
+    (CVE-2008-0782).</li>
+    <li>
+    A Cross-Site Scripting vulnerability exists in the login action
+    (CVE-2008-0780).</li>
+    <li>
+    Multiple Cross-Site Scripting vulnerabilities exist in the file
+    action/AttachFile.py when using the message, pagename, and target
+    filenames (CVE-2008-0781).</li>
+    <li>
+    Multiple Cross-Site Scripting vulnerabilities exist in
+    formatter/text_gedit.py (aka the gui editor formatter) which can be
+    exploited via a page name or destination page name, which trigger an
+    injection in the file PageEditor.py (CVE-2008-1098).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    These vulnerabilities can be exploited to allow remote attackers to
+    inject arbitrary web script or HTML, overwrite arbitrary files, or read
+    protected pages.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MoinMoin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/moinmoin-1.6.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0780">CVE-2008-0780</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0781">CVE-2008-0781</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0782">CVE-2008-0782</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1098">CVE-2008-1098</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1099">CVE-2008-1099</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 26 Feb 2008 09:02:13 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 26 Feb 2008 09:03:06 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 15 Mar 2008 19:53:09 +0000">
+    mfleming
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-28.xml b/xml/htdocs/security/en/glsa/glsa-200803-28.xml
new file mode 100644
index 00000000..3a99b192
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-28.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-28">
+  <title>OpenLDAP: Denial of Service vulnerabilities</title>
+  <synopsis>
+    Multiple Denial of Service vulnerabilities have been reported in OpenLDAP.
+  </synopsis>
+  <product type="ebuild">openldap</product>
+  <announced>March 19, 2008</announced>
+  <revised>March 19, 2008: 01</revised>
+  <bug>197446</bug>
+  <bug>209677</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-nds/openldap" auto="yes" arch="*">
+      <unaffected range="ge">2.3.41</unaffected>
+      <vulnerable range="lt">2.3.41</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenLDAP Software is an open source implementation of the Lightweight
+    Directory Access Protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following errors have been discovered in OpenLDAP:
+    </p>
+    <ul>
+    <li>
+    Tony Blake discovered an error which exists within the normalisation of
+    "objectClasses" (CVE-2007-5707).</li>
+    <li>
+    Thomas Sesselmann reported that, when running as a proxy-caching server
+    the "add_filter_attrs()" function in servers/slapd/overlay/pcache.c
+    does not correctly NULL terminate "new_attrs" (CVE-2007-5708).</li>
+    <li>
+    A double-free bug exists in attrs_free() in the file
+    servers/slapd/back-bdb/modrdn.c, which was discovered by Jonathan
+    Clarke (CVE-2008-0658).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker can cause a Denial of Serivce by sending a malformed
+    "objectClasses" attribute, and via unknown vectors that prevent the
+    "new_attrs" array from being NULL terminated, and via a modrdn
+    operation with a NOOP (LDAP_X_NO_OPERATION) control.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenLDAP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-nds/openldap-2.3.41&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5707">CVE-2007-5707</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5708">CVE-2007-5708</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0658">CVE-2008-0658</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 15 Mar 2008 17:57:19 +0000">
+    mfleming
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 19 Mar 2008 01:23:44 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-29.xml b/xml/htdocs/security/en/glsa/glsa-200803-29.xml
new file mode 100644
index 00000000..d63ca774
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-29.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-29">
+  <title>ViewVC: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple security issues have been reported in ViewVC, which can be
+    exploited by malicious people to bypass certain security restrictions.
+  </synopsis>
+  <product type="ebuild">viewvc</product>
+  <announced>March 19, 2008</announced>
+  <revised>April 01, 2009: 02</revised>
+  <bug>212288</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/viewvc" auto="yes" arch="*">
+      <unaffected range="ge">1.0.5</unaffected>
+      <vulnerable range="lt">1.0.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ViewVC is a browser interface for CVS and Subversion version control
+    repositories.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple unspecified errors were reportedly fixed by the ViewVC
+    development team.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send a specially crafted URL to the server to
+    list CVS or SVN commits on "all-forbidden" files, access hidden CVSROOT
+    folders, and view restricted content via the revision view, the log
+    history, or the diff view.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ViewVC users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/viewvc-1.0.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1290">CVE-2008-1290</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1291">CVE-2008-1291</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1292">CVE-2008-1292</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 11 Mar 2008 22:06:35 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 11 Mar 2008 22:06:42 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 15 Mar 2008 21:33:23 +0000">
+    mfleming
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-30.xml b/xml/htdocs/security/en/glsa/glsa-200803-30.xml
new file mode 100644
index 00000000..68d20184
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-30.xml
@@ -0,0 +1,170 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-30">
+  <title>ssl-cert eclass: Certificate disclosure</title>
+  <synopsis>
+    An error in the usage of the ssl-cert eclass within multiple ebuilds might
+    allow for disclosure of generated SSL private keys.
+  </synopsis>
+  <product type="ebuild">ssl-cert.eclass</product>
+  <announced>March 20, 2008</announced>
+  <revised>March 20, 2008: 01</revised>
+  <bug>174759</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-admin/conserver" auto="yes" arch="*">
+      <unaffected range="ge">8.1.16</unaffected>
+      <vulnerable range="lt">8.1.16</vulnerable>
+    </package>
+    <package name="mail-mta/postfix" auto="yes" arch="*">
+      <unaffected range="ge">2.4.6-r2</unaffected>
+      <unaffected range="rge">2.3.8-r1</unaffected>
+      <unaffected range="rge">2.2.11-r1</unaffected>
+      <vulnerable range="lt">2.4.6-r2</vulnerable>
+    </package>
+    <package name="net-ftp/netkit-ftpd" auto="yes" arch="*">
+      <unaffected range="ge">0.17-r7</unaffected>
+      <vulnerable range="lt">0.17-r7</vulnerable>
+    </package>
+    <package name="net-im/ejabberd" auto="yes" arch="*">
+      <unaffected range="ge">1.1.3</unaffected>
+      <vulnerable range="lt">1.1.3</vulnerable>
+    </package>
+    <package name="net-irc/unrealircd" auto="yes" arch="*">
+      <unaffected range="ge">3.2.7-r2</unaffected>
+      <vulnerable range="lt">3.2.7-r2</vulnerable>
+    </package>
+    <package name="net-mail/cyrus-imapd" auto="yes" arch="*">
+      <unaffected range="ge">2.3.9-r1</unaffected>
+      <vulnerable range="lt">2.3.9-r1</vulnerable>
+    </package>
+    <package name="net-mail/dovecot" auto="yes" arch="*">
+      <unaffected range="ge">1.0.10</unaffected>
+      <vulnerable range="lt">1.0.10</vulnerable>
+    </package>
+    <package name="net-misc/stunnel" auto="yes" arch="*">
+      <unaffected range="ge">4.21-r1</unaffected>
+      <unaffected range="lt">4.0</unaffected>
+      <vulnerable range="lt">4.21-r1</vulnerable>
+    </package>
+    <package name="net-nntp/inn" auto="yes" arch="*">
+      <unaffected range="ge">2.4.3-r1</unaffected>
+      <vulnerable range="lt">2.4.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The ssl-cert eclass is a code module used by Gentoo ebuilds to generate
+    SSL certificates.
+    </p>
+  </background>
+  <description>
+    <p>
+    Robin Johnson reported that the docert() function provided by
+    ssl-cert.eclass can be called by source building stages of an ebuild,
+    such as src_compile() or src_install(), which will result in the
+    generated SSL keys being included inside binary packages (binpkgs).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could recover the SSL keys from publicly readable
+    binary packages when "<i>emerge</i>" is called with the "<i>--buildpkg
+    (-b)</i>" or "<i>--buildpkgonly (-B)</i>" option. Remote attackers can
+    recover these keys if the packages are served to a network. Binary
+    packages built using "<i>quickpkg</i>" are not affected.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not use pre-generated SSL keys, but use keys that were generated
+    using a different Certificate Authority.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Upgrading to newer versions of the above packages will neither remove
+    possibly compromised SSL certificates, nor old binary packages. Please
+    remove the certificates installed by Portage, and then emerge an
+    upgrade to the package.
+    </p>
+    <p>
+    All Conserver users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/conserver-8.1.16&quot;</code>
+    <p>
+    All Postfix 2.4 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-mta/postfix-2.4.6-r2&quot;</code>
+    <p>
+    All Postfix 2.3 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-mta/postfix-2.3.8-r1&quot;</code>
+    <p>
+    All Postfix 2.2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-mta/postfix-2.2.11-r1&quot;</code>
+    <p>
+    All Netkit FTP Server users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-ftp/netkit-ftpd-0.17-r7&quot;</code>
+    <p>
+    All ejabberd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/ejabberd-1.1.3&quot;</code>
+    <p>
+    All UnrealIRCd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-irc/unrealircd-3.2.7-r2&quot;</code>
+    <p>
+    All Cyrus IMAP Server users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/cyrus-imapd-2.3.9-r1&quot;</code>
+    <p>
+    All Dovecot users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/dovecot-1.0.10&quot;</code>
+    <p>
+    All stunnel 4 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/stunnel-4.21&quot;</code>
+    <p>
+    All InterNetNews users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-nntp/inn-2.4.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1383">CVE-2008-1383</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 14 Mar 2008 23:17:10 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 15 Mar 2008 00:11:06 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-31.xml b/xml/htdocs/security/en/glsa/glsa-200803-31.xml
new file mode 100644
index 00000000..fa6b3ba5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-31.xml
@@ -0,0 +1,102 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-31">
+  <title>MIT Kerberos 5: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilites have been found in MIT Kerberos 5, which could
+    allow a remote unauthenticated user to execute arbitrary code with root
+    privileges.
+  </synopsis>
+  <product type="ebuild">mit-krb5</product>
+  <announced>March 24, 2008</announced>
+  <revised>March 24, 2008: 01</revised>
+  <bug>199205</bug>
+  <bug>212363</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/mit-krb5" auto="yes" arch="*">
+      <unaffected range="ge">1.6.3-r1</unaffected>
+      <vulnerable range="lt">1.6.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MIT Kerberos 5 is a suite of applications that implement the Kerberos
+    network protocol. kadmind is the MIT Kerberos 5 administration daemon,
+    KDC is the Key Distribution Center.
+    </p>
+  </background>
+  <description>
+    <ul><li>Two vulnerabilities were found in the Kerberos 4 support in
+    KDC: A global variable is not set for some incoming message types,
+    leading to a NULL pointer dereference or a double free()
+    (CVE-2008-0062) and unused portions of a buffer are not properly
+    cleared when generating an error message, which results in stack
+    content being contained in a reply (CVE-2008-0063).</li>
+    <li>Jeff
+    Altman (Secure Endpoints) discovered a buffer overflow in the RPC
+    library server code, used in the kadmin server, caused when too many
+    file descriptors are opened (CVE-2008-0947).</li>
+    <li>Venustech AD-LAB
+    discovered multiple vulnerabilities in the GSSAPI library: usage of a
+    freed variable in the gss_indicate_mechs() function (CVE-2007-5901) and
+    a double free() vulnerability in the gss_krb5int_make_seal_token_v3()
+    function (CVE-2007-5971).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    The first two vulnerabilities can be exploited by a remote
+    unauthenticated attacker to execute arbitrary code on the host running
+    krb5kdc, compromise the Kerberos key database or cause a Denial of
+    Service. These bugs can only be triggered when Kerberos 4 support is
+    enabled.
+    </p>
+    <p>
+    The RPC related vulnerability can be exploited by a remote
+    unauthenticated attacker to crash kadmind, and theoretically execute
+    arbitrary code with root privileges or cause database corruption. This
+    bug can only be triggered in configurations that allow large numbers of
+    open file descriptors in a process.
+    </p>
+    <p>
+    The GSSAPI vulnerabilities could be exploited by a remote attacker to
+    cause Denial of Service conditions or possibly execute arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Kerberos 4 support can be disabled via disabling the "krb4" USE flag
+    and recompiling the ebuild, or setting "v4_mode=none" in the
+    [kdcdefaults] section of /etc/krb5/kdc.conf. This will only work around
+    the KDC related vulnerabilities.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MIT Kerberos 5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-crypt/mit-krb5-1.6.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5894">CVE-2007-5901</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5971">CVE-2007-5971</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0062">CVE-2008-0062</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0063">CVE-2008-0063</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0947">CVE-2008-0947</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 18 Mar 2008 22:11:44 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 20 Mar 2008 23:06:42 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 20 Mar 2008 23:15:12 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200803-32.xml b/xml/htdocs/security/en/glsa/glsa-200803-32.xml
new file mode 100644
index 00000000..fadee2f3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200803-32.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200803-32">
+  <title>Wireshark: Denial of Service</title>
+  <synopsis>
+    Multiple Denial of Service vulnerabilities have been discovered in
+    Wireshark.
+  </synopsis>
+  <product type="ebuild">wireshark</product>
+  <announced>March 24, 2008</announced>
+  <revised>March 24, 2008: 01</revised>
+  <bug>212149</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/wireshark" auto="yes" arch="*">
+      <unaffected range="ge">0.99.8</unaffected>
+      <vulnerable range="lt">0.99.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Wireshark is a network protocol analyzer with a graphical front-end.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple unspecified errors exist in the SCTP, SNMP, and TFTP
+    dissectors.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could cause a Denial of Service by sending a
+    malformed packet.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable the SCTP, SNMP, and TFTP dissectors.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Wireshark users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/wireshark-0.99.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1070">CVE-2008-1070</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1071">CVE-2008-1071</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1072">CVE-2008-1072</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 21 Mar 2008 02:18:33 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 21 Mar 2008 21:01:15 +0000">
+    mfleming
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 24 Mar 2008 19:58:33 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-01.xml b/xml/htdocs/security/en/glsa/glsa-200804-01.xml
new file mode 100644
index 00000000..8e620e4c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-01.xml
@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-01">
+  <title>CUPS: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in CUPS, allowing for the
+    remote execution of arbitrary code and a Denial of Service.
+  </synopsis>
+  <product type="ebuild">cups</product>
+  <announced>April 01, 2008</announced>
+  <revised>April 01, 2008: 01</revised>
+  <bug>211449</bug>
+  <bug>212364</bug>
+  <bug>214068</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-print/cups" auto="yes" arch="*">
+      <unaffected range="ge">1.2.12-r7</unaffected>
+      <vulnerable range="lt">1.2.12-r7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CUPS provides a portable printing layer for UNIX-based operating
+    systems.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in CUPS:
+    </p>
+    <ul>
+    <li>regenrecht (VeriSign iDefense) discovered that the
+    cgiCompileSearch() function used in several CGI scripts in CUPS'
+    administration interface does not correctly calculate boundaries when
+    processing a user-provided regular expression, leading to a heap-based
+    buffer overflow (CVE-2008-0047).</li>
+    <li>Helge Blischke reported a
+    double free() vulnerability in the process_browse_data() function when
+    adding or removing remote shared printers (CVE-2008-0882).</li>
+    <li>Tomas Hoger (Red Hat) reported that the gif_read_lzw() function
+    uses the code_size value from GIF images without properly checking it,
+    leading to a buffer overflow (CVE-2008-1373).</li>
+    <li>An unspecified
+    input validation error was discovered in the HP-GL/2 filter
+    (CVE-2008-0053).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could send specially crafted network packets or print
+    jobs and possibly execute arbitrary code with the privileges of the
+    user running CUPS (usually lp), or cause a Denial of Service. The
+    vulnerabilities are exploitable via the network when CUPS is sharing
+    printers remotely.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CUPS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-print/cups-1.2.12-r7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0047">CVE-2008-0047</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0053">CVE-2008-0053</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0882">CVE-2008-0882</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1373">CVE-2008-1373</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 08 Mar 2008 16:37:44 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 18 Mar 2008 13:25:31 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 01 Apr 2008 19:15:08 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-02.xml b/xml/htdocs/security/en/glsa/glsa-200804-02.xml
new file mode 100644
index 00000000..49d2a4df
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-02.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-02">
+  <title>bzip2: Denial of Service</title>
+  <synopsis>
+    A buffer overread vulnerability has been discovered in Bzip2.
+  </synopsis>
+  <product type="ebuild">bzip2</product>
+  <announced>April 02, 2008</announced>
+  <revised>April 02, 2008: 01</revised>
+  <bug>213820</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/bzip2" auto="yes" arch="*">
+      <unaffected range="ge">1.0.5</unaffected>
+      <vulnerable range="lt">1.0.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    bzip2 is a free and open source lossless data compression program.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Oulu University discovered that bzip2 does not properly check
+    offsets provided by the bzip2 file, leading to a buffer overread.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote attackers can entice a user or automated system to open a
+    specially crafted file that triggers a buffer overread, causing a
+    Denial of Service. libbz2 and programs linking against it are also
+    affected.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All bzip2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/bzip2-1.0.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1372">CVE-2008-1372</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 21 Mar 2008 02:17:50 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 21 Mar 2008 23:42:29 +0000">
+    mfleming
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 02 Apr 2008 13:31:45 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-03.xml b/xml/htdocs/security/en/glsa/glsa-200804-03.xml
new file mode 100644
index 00000000..791430c0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-03.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-03">
+  <title>OpenSSH: Privilege escalation</title>
+  <synopsis>
+    Two flaws have been discovered in OpenSSH which could allow local attackers
+    to escalate their privileges.
+  </synopsis>
+  <product type="ebuild">openssh</product>
+  <announced>April 05, 2008</announced>
+  <revised>April 05, 2008: 01</revised>
+  <bug>214985</bug>
+  <bug>215702</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-misc/openssh" auto="yes" arch="*">
+      <unaffected range="ge">4.7_p1-r6</unaffected>
+      <vulnerable range="lt">4.7_p1-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSSH is a complete SSH protocol implementation that includes an SFTP
+    client and server support.
+    </p>
+  </background>
+  <description>
+    <p>
+    Two issues have been discovered in OpenSSH:
+    </p>
+    <ul>
+    <li>Timo Juhani
+    Lindfors discovered that OpenSSH sets the DISPLAY variable in SSH
+    sessions using X11 forwarding even when it cannot bind the X11 server
+    to a local port in all address families (CVE-2008-1483).</li>
+    <li>OpenSSH will execute the contents of the ".ssh/rc" file even when
+    the "ForceCommand" directive is enabled in the global sshd_config
+    (CVE-2008-1657).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit the first vulnerability to hijack
+    forwarded X11 sessions of other users and possibly execute code with
+    their privileges, disclose sensitive data or cause a Denial of Service,
+    by binding a local X11 server to a port using only one address family.
+    The second vulnerability might allow local attackers to bypass intended
+    security restrictions and execute commands other than those specified
+    by "ForceCommand" if they are able to write to their home directory.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenSSH users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/openssh-4.7_p1-r6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1483">CVE-2008-1483</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1657">CVE-2008-1657</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 31 Mar 2008 15:53:04 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 03 Apr 2008 21:55:34 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 03 Apr 2008 22:39:55 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-04.xml b/xml/htdocs/security/en/glsa/glsa-200804-04.xml
new file mode 100644
index 00000000..2648d6b3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-04.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-04">
+  <title>MySQL: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in MySQL might lead to privilege escalation and
+    Denial of Service.
+  </synopsis>
+  <product type="ebuild">mysql</product>
+  <announced>April 06, 2008</announced>
+  <revised>April 06, 2008: 01</revised>
+  <bug>201669</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/mysql" auto="yes" arch="*">
+      <unaffected range="ge">5.0.54</unaffected>
+      <vulnerable range="lt">5.0.54</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MySQL is a popular multi-threaded, multi-user SQL server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in MySQL:
+    </p>
+    <ul>
+    <li>Mattias Jonsson reported that a "RENAME TABLE" command against a
+    table with explicit "DATA DIRECTORY" and "INDEX DIRECTORY" options
+    would overwrite the file to which the symlink points
+    (CVE-2007-5969).</li>
+    <li>Martin Friebe discovered that MySQL does not
+    update the DEFINER value of a view when the view is altered
+    (CVE-2007-6303).</li>
+    <li>Philip Stoev discovered that the federated
+    engine expects the response of a remote MySQL server to contain a
+    minimum number of columns in query replies (CVE-2007-6304).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    An authenticated remote attacker could exploit the first vulnerability
+    to overwrite MySQL system tables and escalate privileges, or use the
+    second vulnerability to gain privileges via an "ALTER VIEW" statement.
+    Remote federated MySQL servers could cause a Denial of Service in the
+    local MySQL server by exploiting the third vulnerability.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MySQL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/mysql-5.0.54&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5969">CVE-2007-5969</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6303">CVE-2007-6303</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6304">CVE-2007-6304</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 28 Jan 2008 18:21:58 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 09 Feb 2008 20:29:29 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 03 Apr 2008 23:20:56 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-05.xml b/xml/htdocs/security/en/glsa/glsa-200804-05.xml
new file mode 100644
index 00000000..224cc460
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-05.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-05">
+  <title>NX: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    NX uses code from the X.org X11 server which is prone to multiple
+    vulnerabilities.
+  </synopsis>
+  <product type="ebuild">nx, nxnode</product>
+  <announced>April 06, 2008</announced>
+  <revised>April 06, 2008: 02</revised>
+  <bug>210317</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/nxnode" auto="yes" arch="*">
+      <unaffected range="ge">3.1.0-r2</unaffected>
+      <vulnerable range="lt">3.1.0-r2</vulnerable>
+    </package>
+    <package name="net-misc/nx" auto="yes" arch="*">
+      <unaffected range="ge">3.1.0-r1</unaffected>
+      <vulnerable range="lt">3.1.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    NoMachine's NX establishes remote connections to X11 desktops over
+    small bandwidth links. NX and NX Node are the compression core
+    libraries, whereas NX is used by FreeNX and NX Node by the binary-only
+    NX servers.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple integer overflow and buffer overflow vulnerabilities have been
+    discovered in the X.Org X server as shipped by NX and NX Node
+    (vulnerabilities 1-4 in GLSA 200801-09).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities via unspecified
+    vectors, leading to the execution of arbitrary code with the privileges
+    of the user on the machine running the NX server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All NX Node users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/nxnode-3.1.0-r2&quot;</code>
+    <p>
+    All NX users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/nx-3.1.0-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200801-09.xml">GLSA 200801-09</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 21 Mar 2008 02:19:05 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 03 Apr 2008 22:57:19 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 03 Apr 2008 22:57:27 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-06.xml b/xml/htdocs/security/en/glsa/glsa-200804-06.xml
new file mode 100644
index 00000000..f34ab2a3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-06.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-06">
+  <title>UnZip: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A double free vulnerability discovered in UnZip might lead to the execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">unzip</product>
+  <announced>April 06, 2008</announced>
+  <revised>April 06, 2008: 01</revised>
+  <bug>213761</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-arch/unzip" auto="yes" arch="*">
+      <unaffected range="ge">5.52-r2</unaffected>
+      <vulnerable range="lt">5.52-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Info-ZIP's UnZip is a tool to list and extract files inside PKZIP
+    compressed files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Google Security Team discovered that the NEEDBITS
+    macro in the inflate_dynamic() function in the file inflate.c can be
+    invoked using invalid buffers, which can lead to a double free.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote attackers could entice a user or automated system to open a
+    specially crafted ZIP file that might lead to the execution of
+    arbitrary code or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All UnZip users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-arch/unzip-5.52-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0888">CVE-2008-0888</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 29 Mar 2008 19:46:56 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 03 Apr 2008 22:38:54 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 03 Apr 2008 22:39:11 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-07.xml b/xml/htdocs/security/en/glsa/glsa-200804-07.xml
new file mode 100644
index 00000000..5c3616d0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-07.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-07">
+  <title>PECL APC: Buffer Overflow</title>
+  <synopsis>
+    A buffer overflow vulnerability in PECL APC might allow for the remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">pecl-apc</product>
+  <announced>April 09, 2008</announced>
+  <revised>April 09, 2008: 01</revised>
+  <bug>214576</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-php5/pecl-apc" auto="yes" arch="*">
+      <unaffected range="ge">3.0.16-r1</unaffected>
+      <vulnerable range="lt">3.0.16-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PECL Alternative PHP Cache (PECL APC) is a free, open, and robust
+    framework for caching and optimizing PHP intermediate code.
+    </p>
+  </background>
+  <description>
+    <p>
+    Daniel Papasian discovered a stack-based buffer overflow in the
+    apc_search_paths() function in the file apc.c when processing long
+    filenames.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this vulnerability to execute arbitrary
+    code in PHP applications that pass user-controlled input to the
+    include() function.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PECL APC users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-php5/pecl-apc-3.0.16-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1488">CVE-2008-1488</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 03 Apr 2008 14:46:37 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 03 Apr 2008 14:49:16 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 03 Apr 2008 23:31:29 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-08.xml b/xml/htdocs/security/en/glsa/glsa-200804-08.xml
new file mode 100644
index 00000000..32b3157b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-08.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-08">
+  <title>lighttpd: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in lighttpd may lead to information disclosure or
+    a Denial of Service.
+  </synopsis>
+  <product type="ebuild">lighttpd</product>
+  <announced>April 10, 2008</announced>
+  <revised>April 10, 2008: 01</revised>
+  <bug>212930</bug>
+  <bug>214892</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/lighttpd" auto="yes" arch="*">
+      <unaffected range="ge">1.4.19-r2</unaffected>
+      <vulnerable range="lt">1.4.19-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    lighttpd is a lightweight high-performance web server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Julien Cayzax discovered that an insecure default setting exists in
+    mod_userdir in lighttpd. When userdir.path is not set the default value
+    used is $HOME. It should be noted that the "nobody" user's $HOME is "/"
+    (CVE-2008-1270). An error also exists in the SSL connection code which
+    can be triggered when a user prematurely terminates his connection
+    (CVE-2008-1531).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit the first vulnerability to read
+    arbitrary files. The second vulnerability can be exploited by a remote
+    attacker to cause a Denial of Service by terminating a victim's SSL
+    connection.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    As a workaround for CVE-2008-1270 you can set userdir.path to a
+    sensible value, e.g. <i>"public_html"</i>.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All lighttpd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/lighttpd-1.4.19-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1270">CVE-2008-1270</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1531">CVE-2008-1531</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 29 Mar 2008 20:15:35 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 03 Apr 2008 22:44:24 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 06 Apr 2008 21:43:05 +0000">
+    mfleming
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-09.xml b/xml/htdocs/security/en/glsa/glsa-200804-09.xml
new file mode 100644
index 00000000..bb7534fc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-09.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-09">
+  <title>am-utils: Insecure temporary file creation</title>
+  <synopsis>
+    am-utils creates temporary files insecurely allowing local users to
+    overwrite arbitrary files via a symlink attack.
+  </synopsis>
+  <product type="ebuild">am-utils</product>
+  <announced>April 10, 2008</announced>
+  <revised>April 10, 2008: 01</revised>
+  <bug>210158</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-fs/am-utils" auto="yes" arch="*">
+      <unaffected range="ge">6.1.5</unaffected>
+      <vulnerable range="lt">6.1.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    am-utils is a collection of utilities for use with the Berkeley
+    Automounter.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy discovered that, when creating temporary files, the
+    'expn' utility does not check whether the file already exists.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit the vulnerability via a symlink attack
+    to overwrite arbitrary files.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All am-utils users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-fs/am-utils-6.1.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1078">CVE-2008-1078</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 08 Apr 2008 21:38:37 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 10 Apr 2008 09:22:28 +0000">
+    mfleming
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 10 Apr 2008 13:21:27 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-10.xml b/xml/htdocs/security/en/glsa/glsa-200804-10.xml
new file mode 100644
index 00000000..d2d2bb19
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-10.xml
@@ -0,0 +1,110 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-10">
+  <title>Tomcat: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Tomcat may lead to local file overwriting,
+    session hijacking or information disclosure.
+  </synopsis>
+  <product type="ebuild">tomcat</product>
+  <announced>April 10, 2008</announced>
+  <revised>May 28, 2009: 02</revised>
+  <bug>196066</bug>
+  <bug>203169</bug>
+  <access>local, remote</access>
+  <affected>
+    <package name="www-servers/tomcat" auto="yes" arch="*">
+      <unaffected range="rge">5.5.26</unaffected>
+      <unaffected range="ge">6.0.16</unaffected>
+      <unaffected range="rge">5.5.27</unaffected>
+      <vulnerable range="lt">6.0.16</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Tomcat is the Apache Jakarta Project's official implementation of Java
+    Servlets and Java Server Pages.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were reported:
+    </p>
+    <ul>
+    <li>Delian Krustev discovered that the JULI logging component does not
+    properly enforce access restrictions, allowing web application to add
+    or overwrite files (CVE-2007-5342).</li>
+    <li>
+    When the native APR connector is used, Tomcat does not properly handle
+    an empty request to the SSL port, which allows remote attackers to
+    trigger handling of a duplicate copy of one of the recent requests
+    (CVE-2007-6286).</li>
+    <li>
+    If the processing or parameters is interrupted, i.e. by an exception,
+    then it is possible for the parameters to be processed as part of later
+    request (CVE-2008-0002).</li>
+    <li>
+    An absolute path traversal vulnerability exists due to the way that
+    WebDAV write requests are handled (CVE-2007-5461).</li>
+    <li>
+    Tomcat does not properly handle double quote (") characters or %5C
+    (encoded backslash) sequences in a cookie value, which might cause
+    sensitive information such as session IDs to be leaked to remote
+    attackers and enable session hijacking attacks
+    (CVE-2007-5333).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    These vulnerabilities can be exploited by:
+    </p>
+    <ul>
+    <li>
+    a malicious web application to add or overwrite files with the
+    permissions of the user running Tomcat.
+    </li>
+    <li>
+    a remote attacker to conduct session hijacking or disclose sensitive
+    data.
+    </li>
+    </ul>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Tomcat 5.5.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/tomcat-5.5.26&quot;</code>
+    <p>
+    All Tomcat 6.0.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/tomcat-6.0.16&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5333">CVE-2007-5333</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5342">CVE-2007-5342</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5461">CVE-2007-5461</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6286">CVE-2007-6286</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0002">CVE-2008-0002</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 21 Mar 2008 02:25:49 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 21 Mar 2008 18:05:04 +0000">
+    mfleming
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 04 Apr 2008 15:09:23 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-11.xml b/xml/htdocs/security/en/glsa/glsa-200804-11.xml
new file mode 100644
index 00000000..9d15689d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-11.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-11">
+  <title>policyd-weight: Insecure temporary file creation</title>
+  <synopsis>
+    policyd-weight uses temporary files in an insecure manner, allowing for a
+    symlink attack.
+  </synopsis>
+  <product type="ebuild">policyd-weight</product>
+  <announced>April 11, 2008</announced>
+  <revised>April 11, 2008: 01</revised>
+  <bug>214403</bug>
+  <access>local</access>
+  <affected>
+    <package name="mail-filter/policyd-weight" auto="yes" arch="*">
+      <unaffected range="ge">0.1.14.17</unaffected>
+      <vulnerable range="lt">0.1.14.17</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    policyd-weight is a Perl policy daemon for the Postfix MTA intended to
+    eliminate forged envelope senders and HELOs.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Howells reported that policyd-weight creates and uses the
+    "/tmp/.policyd-weight/" directory in an insecure manner.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit this vulnerability to delete arbitrary
+    files or change the ownership to the "polw" user via symlink attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Set "<i>$LOCKPATH = '/var/run/policyd-weight/'</i>" manually in
+    "/etc/policyd-weight.conf".
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All policyd-weight users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-filter/policyd-weight-0.1.14.17&quot;</code>
+    <p>
+    This version changes the default path for sockets to
+    "/var/run/policyd-weight", which is only writable by a privileged user.
+    Users need to restart policyd-weight immediately after the upgrade due
+    to this change.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1569">CVE-2008-1569</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 29 Mar 2008 20:06:42 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 07 Apr 2008 07:47:13 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 07 Apr 2008 07:47:40 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-12.xml b/xml/htdocs/security/en/glsa/glsa-200804-12.xml
new file mode 100644
index 00000000..e886411e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-12.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-12">
+  <title>gnome-screensaver: Privilege escalation</title>
+  <synopsis>
+    gnome-screensaver allows local users to bypass authentication under certain
+    configurations.
+  </synopsis>
+  <product type="ebuild">gnome-screensaver</product>
+  <announced>April 11, 2008</announced>
+  <revised>April 11, 2008: 01</revised>
+  <bug>213940</bug>
+  <access>local</access>
+  <affected>
+    <package name="gnome-extra/gnome-screensaver" auto="yes" arch="*">
+      <unaffected range="ge">2.20.0-r3</unaffected>
+      <vulnerable range="lt">2.20.0-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    gnome-screensaver is a screensaver, designed to integrate with the
+    Gnome desktop, that can replace xscreensaver.
+    </p>
+  </background>
+  <description>
+    <p>
+    gnome-screensaver incorrectly handles the results of the getpwuid()
+    function in the file src/setuid.c when using directory servers (like
+    NIS) during a network outage, a similar issue to GLSA 200705-14.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local user can crash gnome-xscreensaver by preventing network
+    connectivity if the system uses a remote directory service for
+    credentials such as NIS or LDAP, which will unlock the screen.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All gnome-screensaver users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=gnome-extra/gnome-screensaver-2.20.0-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0887">CVE-2008-0887</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200705-14.xml">GLSA 200705-14</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 09 Apr 2008 17:28:36 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 10 Apr 2008 13:16:15 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-13.xml b/xml/htdocs/security/en/glsa/glsa-200804-13.xml
new file mode 100644
index 00000000..13f86f04
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-13.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-13">
+  <title>Asterisk: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been found in Asterisk allowing for SQL
+    injection, session hijacking and unauthorized usage.
+  </synopsis>
+  <product type="ebuild">asterisk</product>
+  <announced>April 14, 2008</announced>
+  <revised>April 14, 2008: 01</revised>
+  <bug>200792</bug>
+  <bug>202733</bug>
+  <bug>213883</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/asterisk" auto="yes" arch="*">
+      <unaffected range="ge">1.2.27</unaffected>
+      <vulnerable range="lt">1.2.27</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Asterisk is an open source telephony engine and tool kit.
+    </p>
+  </background>
+  <description>
+    <p>
+    Asterisk upstream developers reported multiple vulnerabilities:
+    </p>
+    <ul>
+    <li>The Call Detail Record Postgres logging engine (cdr_pgsql)
+    does not correctly escape the ANI and DNIS arguments before using them
+    in SQL statements (CVE-2007-6170).</li>
+    <li>When using database-based
+    registrations ("realtime") and host-based authentication, Asterisk does
+    not check the IP address when the username is correct and there is no
+    password provided (CVE-2007-6430).</li>
+    <li>The SIP channel driver does
+    not correctly determine if authentication is required
+    (CVE-2008-1332).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote authenticated attackers could send specially crafted data to
+    Asterisk to execute arbitrary SQL commands and compromise the
+    administrative database. Remote unauthenticated attackers could bypass
+    authentication using a valid username to hijack other user's sessions,
+    and establish sessions on the SIP channel without authentication.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Asterisk users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/asterisk-1.2.27&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6170">CVE-2007-6170</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6430">CVE-2007-6430</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1332">CVE-2008-1332</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 29 Mar 2008 20:11:29 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 03 Apr 2008 14:50:06 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 07 Apr 2008 07:59:17 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-14.xml b/xml/htdocs/security/en/glsa/glsa-200804-14.xml
new file mode 100644
index 00000000..6714025f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-14.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-14">
+  <title>Opera: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Opera, allowing for
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">opera</product>
+  <announced>April 14, 2008</announced>
+  <revised>April 14, 2008: 01</revised>
+  <bug>216022</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/opera" auto="yes" arch="*">
+      <unaffected range="ge">9.27</unaffected>
+      <vulnerable range="lt">9.27</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Opera is a fast web browser that is available free of charge.
+    </p>
+  </background>
+  <description>
+    <p>
+    Michal Zalewski reported two vulnerabilities, memory corruption when
+    adding news feed sources from a website (CVE-2008-1761) as well as when
+    processing HTML CANVAS elements to use scaled images (CVE-2008-1762).
+    Additionally, an unspecified weakness related to keyboard handling of
+    password inputs has been reported (CVE-2008-1764).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to visit a specially crafted web
+    site or news feed and possibly execute arbitrary code with the
+    privileges of the user running Opera.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Opera users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/opera-9.27&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1761">CVE-2008-1761</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1762">CVE-2008-1762</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1764">CVE-2008-1764</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 13 Apr 2008 00:02:37 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 13 Apr 2008 00:02:49 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-15.xml b/xml/htdocs/security/en/glsa/glsa-200804-15.xml
new file mode 100644
index 00000000..0fdf9808
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-15.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-15">
+  <title>libpng: Execution of arbitrary code</title>
+  <synopsis>
+    A vulnerability in libpng may allow for execution of arbitrary code in
+    certain applications that handle untrusted images.
+  </synopsis>
+  <product type="ebuild">libpng</product>
+  <announced>April 15, 2008</announced>
+  <revised>April 15, 2008: 01</revised>
+  <bug>217047</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libpng" auto="yes" arch="*">
+      <unaffected range="ge">1.2.26-r1</unaffected>
+      <vulnerable range="lt">1.2.26-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libpng is a free ANSI C library used to process and manipulate PNG
+    images.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Google Security Team discovered that libpng does
+    not handle zero-length unknown chunks in PNG files correctly, which
+    might lead to memory corruption in applications that call
+    png_set_read_user_chunk_fn() or png_set_keep_unknown_chunks().
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could entice a user or automated system to process a
+    specially crafted PNG image in an application using libpng and possibly
+    execute arbitrary code with the privileges of the user running the
+    application. Note that processing of unknown chunks is disabled by
+    default in most PNG applications, but some such as ImageMagick are
+    affected.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libpng users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libpng-1.2.26-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1382">CVE-2008-1382</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 14 Apr 2008 01:44:56 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 14 Apr 2008 01:49:03 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 14 Apr 2008 08:39:38 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-16.xml b/xml/htdocs/security/en/glsa/glsa-200804-16.xml
new file mode 100644
index 00000000..a2910746
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-16.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-16">
+  <title>rsync: Execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow in rsync might lead to the remote execution of arbitrary
+    code when extended attributes are being used.
+  </synopsis>
+  <product type="ebuild">rsync</product>
+  <announced>April 17, 2008</announced>
+  <revised>April 17, 2008: 01</revised>
+  <bug>216887</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/rsync" auto="yes" arch="*">
+      <unaffected range="ge">2.6.9-r6</unaffected>
+      <vulnerable range="lt">2.6.9-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    rsync is a file transfer program to keep remote directories
+    synchronized.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sebastian Krahmer of SUSE reported an integer overflow in the
+    expand_item_list() function in the file util.c which might lead to a
+    heap-based buffer overflow when extended attribute (xattr) support is
+    enabled.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send a file containing specially crafted
+    extended attributes to an rsync deamon, or entice a user to sync from
+    an rsync server containing specially crafted files, possibly leading to
+    the execution of arbitrary code.
+    </p>
+    <p>
+    Please note that extended attributes are only enabled when USE="acl" is
+    enabled, which is the default setting.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable extended attributes in the rsync daemon by setting "<i>refuse
+    options = xattrs</i>" in the file "/etc/rsyncd.conf" (or append
+    "xattrs" to an existing "refuse" statement). When synchronizing to a
+    server, do not provide the "-X" parameter to rsync. You can also
+    disable the "acl" USE flag for rsync and recompile the package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All rsync users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/rsync-2.6.9-r6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1720">CVE-2008-1720</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 14 Apr 2008 22:37:35 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 14 Apr 2008 23:01:29 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 14 Apr 2008 23:01:42 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-17.xml b/xml/htdocs/security/en/glsa/glsa-200804-17.xml
new file mode 100644
index 00000000..cb9fd3c9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-17.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-17">
+  <title>Speex: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Improper input validation in Speex might lead to array indexing
+    vulnerabilities in multiple player applications.
+  </synopsis>
+  <product type="ebuild">speex</product>
+  <announced>April 17, 2008</announced>
+  <revised>April 17, 2008: 01</revised>
+  <bug>217715</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/speex" auto="yes" arch="*">
+      <unaffected range="ge">1.2_beta3_p2</unaffected>
+      <vulnerable range="lt">1.2_beta3_p2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Speex is an audio compression format designed for speech that is free
+    of patent restrictions.
+    </p>
+  </background>
+  <description>
+    <p>
+    oCERT reported that the Speex library does not properly validate the
+    "mode" value it derives from Speex streams, allowing for array indexing
+    vulnerabilities inside multiple player applications. Within Gentoo,
+    xine-lib, VLC, gst-plugins-speex from the GStreamer Good Plug-ins,
+    vorbis-tools, libfishsound, Sweep, SDL_sound, and speexdec were found
+    to be vulnerable.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted Speex
+    file or network stream with an application listed above. This might
+    lead to the execution of arbitrary code with privileges of the user
+    playing the file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Speex users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/speex-1.2_beta3_p2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1686">CVE-2008-1686</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 17 Apr 2008 09:58:14 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 17 Apr 2008 09:58:25 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 17 Apr 2008 10:58:23 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-18.xml b/xml/htdocs/security/en/glsa/glsa-200804-18.xml
new file mode 100644
index 00000000..c8f21a6e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-18.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-18">
+  <title>Poppler: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Poppler does not handle fonts inside PDF files safely, allowing for
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">poppler</product>
+  <announced>April 17, 2008</announced>
+  <revised>April 17, 2008: 02</revised>
+  <bug>216850</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/poppler" auto="yes" arch="*">
+      <unaffected range="ge">0.6.3</unaffected>
+      <vulnerable range="lt">0.6.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Poppler is a cross-platform PDF rendering library originally based on
+    Xpdf.
+    </p>
+  </background>
+  <description>
+    <p>
+    Kees Cook from the Ubuntu Security Team reported that the
+    CairoFont::create() function in the file CairoFontEngine.cc does not
+    verify the type of an embedded font object inside a PDF file before
+    dereferencing a function pointer from it.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted PDF
+    file with a Poppler-based PDF viewer such as Gentoo's Xpdf, Epdfview,
+    or Evince, potentially resulting in the execution of arbitrary code
+    with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Poppler users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/poppler-0.6.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1693">CVE-2008-1693</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 14 Apr 2008 01:16:23 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 17 Apr 2008 11:28:12 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-19.xml b/xml/htdocs/security/en/glsa/glsa-200804-19.xml
new file mode 100644
index 00000000..216af3f9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-19.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-19">
+  <title>PHP Toolkit: Data disclosure and Denial of Service</title>
+  <synopsis>
+    PHP Toolkit does not quote parameters, allowing for PHP source code
+    disclosure on Apache, and a Denial of Service.
+  </synopsis>
+  <product type="ebuild">php-toolkit</product>
+  <announced>April 17, 2008</announced>
+  <revised>April 17, 2008: 01</revised>
+  <bug>209535</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-admin/php-toolkit" auto="yes" arch="*">
+      <unaffected range="ge">1.0.1</unaffected>
+      <vulnerable range="lt">1.0.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHP Toolkit is a utility to manage parallel installations of PHP within
+    Gentoo. It is executed by the PHP ebuilds at setup.
+    </p>
+  </background>
+  <description>
+    <p>
+    Toni Arnold, David Sveningsson, Michal Bartoszkiewicz, and Joseph
+    reported that php-select does not quote parameters passed to the "tr"
+    command, which could convert the "-D PHP5" argument in the
+    "APACHE2_OPTS" setting in the file /etc/conf.d/apache2 to lower case.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a system administrator to run "<i>emerge
+    php</i>" or call "<i>php-select -t apache2 php5</i>" directly in a
+    directory containing a lower case single-character named file, which
+    would prevent Apache from loading mod_php and thereby disclose PHP
+    source code and cause a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not run "emerge" or "php-select" from a working directory which
+    contains a lower case single-character named file.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHP Toolkit users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/php-toolkit-1.0.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1734">CVE-2008-1734</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 07 Apr 2008 23:54:47 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 10 Apr 2008 13:22:11 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 11 Apr 2008 19:26:49 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-20.xml b/xml/htdocs/security/en/glsa/glsa-200804-20.xml
new file mode 100644
index 00000000..e0b23be1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-20.xml
@@ -0,0 +1,234 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-20">
+  <title>Sun JDK/JRE: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been identified in Sun Java Development Kit
+    (JDK) and Java Runtime Environment (JRE).
+  </synopsis>
+  <product type="ebuild">sun-jdk, sun-jre-bin, emul-linux-x86-java</product>
+  <announced>April 17, 2008</announced>
+  <revised>March 05, 2010: 06</revised>
+  <bug>178851</bug>
+  <bug>178962</bug>
+  <bug>183580</bug>
+  <bug>185256</bug>
+  <bug>194711</bug>
+  <bug>212425</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/sun-jre-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.6.0.05</unaffected>
+      <unaffected range="rge">1.5.0.21</unaffected>
+      <unaffected range="rge">1.5.0.20</unaffected>
+      <unaffected range="rge">1.5.0.19</unaffected>
+      <unaffected range="rge">1.5.0.18</unaffected>
+      <unaffected range="rge">1.5.0.17</unaffected>
+      <unaffected range="rge">1.5.0.16</unaffected>
+      <unaffected range="rge">1.5.0.15</unaffected>
+      <unaffected range="rge">1.4.2.17</unaffected>
+      <unaffected range="rge">1.5.0.22</unaffected>
+      <vulnerable range="lt">1.6.0.05</vulnerable>
+    </package>
+    <package name="dev-java/sun-jdk" auto="yes" arch="*">
+      <unaffected range="ge">1.6.0.05</unaffected>
+      <unaffected range="rge">1.5.0.21</unaffected>
+      <unaffected range="rge">1.5.0.20</unaffected>
+      <unaffected range="rge">1.5.0.19</unaffected>
+      <unaffected range="rge">1.5.0.18</unaffected>
+      <unaffected range="rge">1.5.0.17</unaffected>
+      <unaffected range="rge">1.5.0.16</unaffected>
+      <unaffected range="rge">1.5.0.15</unaffected>
+      <unaffected range="rge">1.4.2.17</unaffected>
+      <unaffected range="rge">1.5.0.22</unaffected>
+      <vulnerable range="lt">1.6.0.05</vulnerable>
+    </package>
+    <package name="app-emulation/emul-linux-x86-java" auto="yes" arch="*">
+      <unaffected range="ge">1.6.0.05</unaffected>
+      <unaffected range="rge">1.5.0.21</unaffected>
+      <unaffected range="rge">1.5.0.20</unaffected>
+      <unaffected range="rge">1.5.0.19</unaffected>
+      <unaffected range="rge">1.5.0.18</unaffected>
+      <unaffected range="rge">1.5.0.17</unaffected>
+      <unaffected range="rge">1.5.0.16</unaffected>
+      <unaffected range="rge">1.5.0.15</unaffected>
+      <unaffected range="rge">1.4.2.17</unaffected>
+      <unaffected range="rge">1.5.0.22</unaffected>
+      <vulnerable range="lt">1.6.0.05</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Sun Java Development Kit (JDK) and the Sun Java Runtime Environment
+    (JRE) provide the Sun Java platform.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in Sun Java:
+    </p>
+    <ul>
+    <li>Daniel Soeder discovered that a long codebase attribute string in a
+    JNLP file will overflow a stack variable when launched by Java WebStart
+    (CVE-2007-3655).</li>
+    <li>Multiple vulnerabilities (CVE-2007-2435, CVE-2007-2788,
+    CVE-2007-2789) that were previously reported as GLSA 200705-23 and GLSA
+    200706-08 also affect 1.4 and 1.6 SLOTs, which was not mentioned in the
+    initial revision of said GLSAs.</li>
+    <li>The Zero Day Initiative, TippingPoint and John Heasman reported
+    multiple buffer overflows and unspecified vulnerabilities in Java Web
+    Start (CVE-2008-1188, CVE-2008-1189, CVE-2008-1190,
+    CVE-2008-1191).</li>
+    <li>Hisashi Kojima of Fujitsu and JPCERT/CC reported a security issue
+    when performing XSLT transformations (CVE-2008-1187).</li>
+    <li>CERT/CC reported a Stack-based buffer overflow in Java Web Start
+    when using JNLP files (CVE-2008-1196).</li>
+    <li>Azul Systems reported an unspecified vulnerability that allows
+    applets to escalate their privileges (CVE-2007-5689).</li>
+    <li>Billy Rios, Dan Boneh, Collin Jackson, Adam Barth, Andrew Bortz,
+    Weidong Shao, and David Byrne discovered multiple instances where Java
+    applets or JavaScript programs run within browsers do not pin DNS
+    hostnames to a single IP address, allowing for DNS rebinding attacks
+    (CVE-2007-5232, CVE-2007-5273, CVE-2007-5274).</li>
+    <li>Peter Csepely reported that Java Web Start does not properly
+    enforce access restrictions for untrusted applications (CVE-2007-5237,
+    CVE-2007-5238).</li>
+    <li>Java Web Start does not properly enforce access restrictions for
+    untrusted Java applications and applets, when handling drag-and-drop
+    operations (CVE-2007-5239).</li>
+    <li>Giorgio Maone discovered that warnings for untrusted code can be
+    hidden under applications' windows (CVE-2007-5240).</li>
+    <li>Fujitsu reported two security issues where security restrictions of
+    web applets and applications were not properly enforced (CVE-2008-1185,
+    CVE-2008-1186).</li>
+    <li>John Heasman of NGSSoftware discovered that the Java Plug-in does
+    not properly enforce the same origin policy (CVE-2008-1192).</li>
+    <li>Chris Evans of the Google Security Team discovered multiple
+    unspecified vulnerabilities within the Java Runtime Environment Image
+    Parsing Library (CVE-2008-1193, CVE-2008-1194).</li>
+    <li>Gregory Fleischer reported that web content fetched via the "jar:"
+    protocol was not subject to network access restrictions
+    (CVE-2008-1195).</li>
+    <li>Chris Evans and Johannes Henkel of the Google Security Team
+    reported that the XML parsing code retrieves external entities even
+    when that feature is disabled (CVE-2008-0628).</li>
+    <li>Multiple unspecified vulnerabilities might allow for escalation of
+    privileges (CVE-2008-0657).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to run a specially crafted applet
+    on a website or start an application in Java Web Start to execute
+    arbitrary code outside of the Java sandbox and of the Java security
+    restrictions with the privileges of the user running Java. The attacker
+    could also obtain sensitive information, create, modify, rename and
+    read local files, execute local applications, establish connections in
+    the local network, bypass the same origin policy, and cause a Denial of
+    Service via multiple vectors.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Sun JRE 1.6 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jre-bin-1.6.0.05&quot;</code>
+    <p>
+    All Sun JRE 1.5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jre-bin-1.5.0.15&quot;</code>
+    <p>
+    All Sun JRE 1.4 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jre-bin-1.4.2.17&quot;</code>
+    <p>
+    All Sun JDK 1.6 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jdk-1.6.0.05&quot;</code>
+    <p>
+    All Sun JDK 1.5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jdk-1.5.0.15&quot;</code>
+    <p>
+    All Sun JDK 1.4 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jdk-1.4.2.17&quot;</code>
+    <p>
+    All emul-linux-x86-java 1.6 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/emul-linux-x86-java-1.6.0.05&quot;</code>
+    <p>
+    All emul-linux-x86-java 1.5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/emul-linux-x86-java-1.5.0.15&quot;</code>
+    <p>
+    All emul-linux-x86-java 1.4 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/emul-linux-x86-java-1.4.2.17&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2435">CVE-2007-2435</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2788">CVE-2007-2788</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2789">CVE-2007-2789</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3655">CVE-2007-3655</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5232">CVE-2007-5232</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5237">CVE-2007-5237</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5238">CVE-2007-5238</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5239">CVE-2007-5239</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5240">CVE-2007-5240</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5273">CVE-2007-5273</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5274">CVE-2007-5274</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5689">CVE-2007-5689</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0628">CVE-2008-0628</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0657">CVE-2008-0657</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1185">CVE-2008-1185</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1186">CVE-2008-1186</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1187">CVE-2008-1187</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1188">CVE-2008-1188</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1189">CVE-2008-1189</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1190">CVE-2008-1190</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1191">CVE-2008-1191</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1192">CVE-2008-1192</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1193">CVE-2008-1193</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1194">CVE-2008-1194</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1195">CVE-2008-1195</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1196">CVE-2008-1196</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200705-23.xml">GLSA 200705-23</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200706-08.xml">GLSA 200706-08</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 15 Jul 2007 07:23:49 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 25 Jul 2007 05:33:06 +0000">
+    jaervosz
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 09 Sep 2007 23:51:30 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-21.xml b/xml/htdocs/security/en/glsa/glsa-200804-21.xml
new file mode 100644
index 00000000..271e3435
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-21.xml
@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-21">
+  <title>Adobe Flash Player: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been identified, the worst of which allow
+    arbitrary code execution on a user's system via a malicious Flash file.
+  </synopsis>
+  <product type="ebuild">adobe-flash</product>
+  <announced>April 18, 2008</announced>
+  <revised>May 28, 2009: 02</revised>
+  <bug>204344</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-plugins/adobe-flash" auto="yes" arch="*">
+      <unaffected range="ge">9.0.124.0</unaffected>
+      <vulnerable range="lt">9.0.124.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Adobe Flash Player is a renderer for the popular SWF file format,
+    which is commonly used to provide interactive websites, digital
+    experiences and mobile content.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in Adobe Flash:
+    </p>
+    <ul>
+    <li>
+    Secunia Research and Zero Day Initiative reported a boundary error
+    related to DeclareFunction2 Actionscript tags in SWF files
+    (CVE-2007-6019).
+    </li>
+    <li>
+    The ISS X-Force and the Zero Day Initiative reported an unspecified
+    input validation error that might lead to a buffer overflow
+    (CVE-2007-0071).
+    </li>
+    <li>
+    Microsoft, UBsecure and JPCERT/CC reported that cross-domain policy
+    files are not checked before sending HTTP headers to another domain
+    (CVE-2008-1654) and that it does not sufficiently restrict the
+    interpretation and usage of cross-domain policy files (CVE-2007-6243).
+    </li>
+    <li>
+    The Stanford University and Ernst and Young's Advanced Security Center
+    reported that Flash does not pin DNS hostnames to a single IP
+    addresses, allowing for DNS rebinding attacks (CVE-2007-5275,
+    CVE-2008-1655).
+    </li>
+    <li>
+    The Google Security Team and Minded Security Multiple reported multiple
+    cross-site scripting vulnerabilities when passing input to Flash
+    functions (CVE-2007-6637).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted file
+    (usually in a web browser), possibly leading to the execution of
+    arbitrary code with the privileges of the user running the Adobe Flash
+    Player. The attacker could also cause a user's machine to send HTTP
+    requests to other hosts, establish TCP sessions with arbitrary hosts,
+    bypass the security sandbox model, or conduct Cross-Site Scripting and
+    Cross-Site Request Forgery attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Adobe Flash Player users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-plugins/adobe-flash-9.0.124.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0071">CVE-2007-0071</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5275">CVE-2007-5275</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6019">CVE-2007-6019</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6243">CVE-2007-6243</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6637">CVE-2007-6637</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1654">CVE-2008-1654</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1655">CVE-2008-1655</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 17 Apr 2008 10:39:32 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 18 Apr 2008 01:16:42 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 18 Apr 2008 01:18:41 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-22.xml b/xml/htdocs/security/en/glsa/glsa-200804-22.xml
new file mode 100644
index 00000000..36457fd2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-22.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-22">
+  <title>PowerDNS Recursor: DNS Cache Poisoning</title>
+  <synopsis>
+    Use of insufficient randomness in PowerDNS Recursor might lead to DNS cache
+    poisoning.
+  </synopsis>
+  <product type="ebuild">pdns-recursor</product>
+  <announced>April 18, 2008</announced>
+  <revised>August 21, 2008: 03</revised>
+  <bug>215567</bug>
+  <bug>231335</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/pdns-recursor" auto="yes" arch="*">
+      <unaffected range="ge">3.1.6</unaffected>
+      <vulnerable range="lt">3.1.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The PowerDNS Recursor is an advanced recursing nameserver.
+    </p>
+  </background>
+  <description>
+    <p>
+    Amit Klein of Trusteer reported that insufficient randomness is used to
+    calculate the TRXID values and the UDP source port numbers
+    (CVE-2008-1637). Thomas Biege of SUSE pointed out that a prior fix to
+    resolve this issue was incomplete, as it did not always enable the
+    stronger random number generator for source port selection
+    (CVE-2008-3217).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send malicious answers to insert arbitrary DNS
+    data into the cache. These attacks would in turn help an attacker to
+    perform man-in-the-middle and site impersonation attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PowerDNS Recursor users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/pdns-recursor-3.1.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1637">CVE-2008-1637</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3217">CVE-2008-3217</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 17 Apr 2008 20:12:08 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 18 Apr 2008 01:27:35 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 18 Apr 2008 01:27:43 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-23.xml b/xml/htdocs/security/en/glsa/glsa-200804-23.xml
new file mode 100644
index 00000000..948fae73
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-23.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-23">
+  <title>CUPS: Integer overflow vulnerability</title>
+  <synopsis>
+    A vulnerability in CUPS might allow for the execution of arbitrary code or
+    a Denial of Service.
+  </synopsis>
+  <product type="ebuild">cups</product>
+  <announced>April 18, 2008</announced>
+  <revised>April 18, 2008: 01</revised>
+  <bug>217232</bug>
+  <access>remote, local</access>
+  <affected>
+    <package name="net-print/cups" auto="yes" arch="*">
+      <unaffected range="ge">1.2.12-r8</unaffected>
+      <vulnerable range="lt">1.2.12-r8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CUPS provides a portable printing layer for UNIX-based operating
+    systems.
+    </p>
+  </background>
+  <description>
+    <p>
+    Thomas Pollet reported a possible integer overflow vulnerability in the
+    PNG image handling in the file filter/image-png.c.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A malicious user might be able to execute arbitrary code with the
+    privileges of the user running CUPS (usually lp), or cause a Denial of
+    Service by sending a specially crafted PNG image to the print server.
+    The vulnerability is exploitable via the network if CUPS is sharing
+    printers remotely.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CUPS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-print/cups-1.2.12-r8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1722">CVE-2008-1722</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 17 Apr 2008 10:26:38 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 17 Apr 2008 10:26:47 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 17 Apr 2008 11:05:44 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-24.xml b/xml/htdocs/security/en/glsa/glsa-200804-24.xml
new file mode 100644
index 00000000..4f779e5f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-24.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-24">
+  <title>DBmail: Data disclosure</title>
+  <synopsis>
+    A vulnerability in DBMail could allow for passwordless login to any account
+    under certain configurations.
+  </synopsis>
+  <product type="ebuild">dbmail</product>
+  <announced>April 18, 2008</announced>
+  <revised>April 18, 2008: 01</revised>
+  <bug>218154</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/dbmail" auto="yes" arch="*">
+      <unaffected range="ge">2.2.9</unaffected>
+      <vulnerable range="lt">2.2.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    DBMail is a mail storage and retrieval daemon that uses SQL databases
+    as its data store. IMAP and POP3 can be used to retrieve mails from the
+    database.
+    </p>
+  </background>
+  <description>
+    <p>
+    A vulnerability in DBMail's authldap module when used in conjunction
+    with an Active Directory server has been reported by vugluskr. When
+    passing a zero length password to the module, it tries to bind
+    anonymously to the LDAP server. If the LDAP server allows anonymous
+    binds, this bind succeeds and results in a successful authentication to
+    DBMail.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    By passing an empty password string to the server, an attacker could be
+    able to log in to any account.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All DBMail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/dbmail-2.2.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6714">CVE-2007-6714</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 18 Apr 2008 08:54:02 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 18 Apr 2008 09:20:04 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 18 Apr 2008 14:01:09 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-25.xml b/xml/htdocs/security/en/glsa/glsa-200804-25.xml
new file mode 100644
index 00000000..092e29c3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-25.xml
@@ -0,0 +1,95 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-25">
+  <title>VLC: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple vulnerabilities were found in VLC, allowing for the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">vlc</product>
+  <announced>April 23, 2008</announced>
+  <revised>April 23, 2008: 01</revised>
+  <bug>214277</bug>
+  <bug>214627</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/vlc" auto="yes" arch="*">
+      <unaffected range="ge">0.8.6f</unaffected>
+      <vulnerable range="lt">0.8.6f</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    VLC is a cross-platform media player and streaming server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities were found in VLC:
+    </p>
+    <ul>
+    <li>
+    Luigi Auriemma discovered that the stack-based buffer overflow when
+    reading subtitles, which has been reported as CVE-2007-6681 in GLSA
+    200803-13, was not properly fixed (CVE-2008-1881).
+    </li>
+    <li>
+    Alin Rad Pop of Secunia reported an array indexing vulnerability in the
+    sdpplin_parse() function when processing streams from RTSP servers in
+    Xine code, which is also used in VLC (CVE-2008-0073).
+    </li>
+    <li>
+    Drew Yao and Nico Golde reported an integer overflow in the
+    MP4_ReadBox_rdrf() function in the file libmp4.c leading to a
+    heap-based buffer overflow when reading MP4 files (CVE-2008-1489).
+    </li>
+    <li>Drew Yao also reported integer overflows in the MP4 demuxer,
+    the Real demuxer and in the Cinepak codec, which might lead to buffer
+    overflows (CVE-2008-1768).</li>
+    <li>Drew Yao finally discovered and a
+    boundary error in Cinepak, which might lead to memory corruption
+    (CVE-2008-1769).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted media
+    file or stream, possibly resulting in the remote execution of arbitrary
+    code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All VLC users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/vlc-0.8.6f&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6681">CVE-2007-6681</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0073">CVE-2008-0073</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1489">CVE-2008-1489</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1768">CVE-2008-1768</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1769">CVE-2008-1769</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1881">CVE-2008-1881</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200803-13.xml">GLSA 200803-13</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 24 Mar 2008 19:42:45 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 14 Apr 2008 00:49:24 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 14 Apr 2008 00:56:14 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-26.xml b/xml/htdocs/security/en/glsa/glsa-200804-26.xml
new file mode 100644
index 00000000..74251072
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-26.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-26">
+  <title>Openfire: Denial of Service</title>
+  <synopsis>
+    A design error in Openfire might lead to a Denial of Service.
+  </synopsis>
+  <product type="ebuild">openfire</product>
+  <announced>April 23, 2008</announced>
+  <revised>April 23, 2008: 01</revised>
+  <bug>217234</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/openfire" auto="yes" arch="*">
+      <unaffected range="ge">3.5.0</unaffected>
+      <vulnerable range="lt">3.5.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Openfire (formerly Wildfire) is a Java implementation of a complete
+    Jabber server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Openfire's connection manager in the file ConnectionManagerImpl.java
+    cannot handle clients that fail to read messages, and has no limit on
+    their session's send buffer.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote authenticated attackers could trigger large outgoing queues
+    without reading messages, causing a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Openfire users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/openfire-3.5.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1728">CVE-2008-1728</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 17 Apr 2008 20:09:13 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 18 Apr 2008 01:33:23 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 18 Apr 2008 01:33:32 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-27.xml b/xml/htdocs/security/en/glsa/glsa-200804-27.xml
new file mode 100644
index 00000000..18e4736f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-27.xml
@@ -0,0 +1,104 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-27">
+  <title>SILC: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities were found in SILC Client, Server, and Toolkit,
+    allowing for Denial of Service and execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">silc-toolkit silc-client silc-server</product>
+  <announced>April 24, 2008</announced>
+  <revised>April 24, 2008: 01</revised>
+  <bug>212362</bug>
+  <bug>214116</bug>
+  <bug>214812</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/silc-toolkit" auto="yes" arch="*">
+      <unaffected range="ge">1.1.7</unaffected>
+      <vulnerable range="lt">1.1.7</vulnerable>
+    </package>
+    <package name="net-im/silc-client" auto="yes" arch="*">
+      <unaffected range="ge">1.1.4</unaffected>
+      <vulnerable range="lt">1.1.4</vulnerable>
+    </package>
+    <package name="net-im/silc-server" auto="yes" arch="*">
+      <unaffected range="ge">1.1.2</unaffected>
+      <vulnerable range="lt">1.1.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SILC (Secure Internet Live Conferencing protocol) Toolkit is a software
+    development kit for use in clients, SILC Server is a communication
+    server, and SILC Client is an IRSSI-based text client.
+    </p>
+  </background>
+  <description>
+    <ul>
+    <li>Nathan G. Grennan reported a boundary error in SILC Toolkit
+    within the silc_fingerprint() function in the file
+    lib/silcutil/silcutil.c when passing overly long data, resulting in a
+    stack-based buffer overflow (CVE-2008-1227).</li>
+    <li>A vulnerability
+    has been reported in SILC Server which is caused due to an error in the
+    handling of "NEW_CLIENT" packets that do not contain a nickname
+    (CVE-2008-1429).</li>
+    <li>Ariel Waissbein, Pedro Varangot, Martin
+    Mizrahi, Oren Isacson, Carlos Garcia, and Ivan Arce of Core Security
+    Technologies reported that SILC Client, Server, and Toolkit contain a
+    vulnerability in the silc_pkcs1_decode() function in the silccrypt
+    library (silcpkcs1.c), resulting in an integer underflow, signedness
+    error, and a buffer overflow (CVE-2008-1552).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities to cause a Denial
+    of Service or execute arbitrary code with the privileges of the user
+    running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SILC Toolkit users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/silc-toolkit-1.1.7&quot;</code>
+    <p>
+    All SILC Client users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/silc-client-1.1.4&quot;</code>
+    <p>
+    All SILC Server users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/silc-server-1.1.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1227">CVE-2008-1227</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1429">CVE-2008-1429</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1552">CVE-2008-1552</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 21 Mar 2008 02:19:53 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 03 Apr 2008 14:49:27 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 23 Apr 2008 16:41:55 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-28.xml b/xml/htdocs/security/en/glsa/glsa-200804-28.xml
new file mode 100644
index 00000000..3a206dd3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-28.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-28">
+  <title>JRockit: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been identified in BEA JRockit.
+  </synopsis>
+  <product type="ebuild">jrockit-jdk-bin</product>
+  <announced>April 24, 2008</announced>
+  <revised>April 24, 2008: 01</revised>
+  <bug>218226</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/jrockit-jdk-bin" auto="yes" arch="*">
+      <unaffected range="rge">1.4.2.16</unaffected>
+      <unaffected range="ge">1.5.0.14</unaffected>
+      <vulnerable range="lt">1.5.0.14</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    JRockit is BEA WebLogic's J2SE Development Kit.
+    </p>
+  </background>
+  <description>
+    <p>
+    Because of sharing the same codebase, JRockit is affected by the
+    vulnerabilities mentioned in GLSA 200804-20.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to run a specially crafted applet
+    on a website or start an application in Java Web Start to execute
+    arbitrary code outside of the Java sandbox and of the Java security
+    restrictions with the privileges of the user running Java. The attacker
+    could also obtain sensitive information, create, modify, rename and
+    read local files, execute local applications, establish connections in
+    the local network, bypass the same origin policy, and cause a Denial of
+    Service via multiple vectors.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All JRockit 1.4 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/jrockit-jdk-bin-1.4.2.16&quot;</code>
+    <p>
+    All JRockit 1.5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/jrockit-jdk-bin-1.5.0.14&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200804-20.xml">GLSA 200804-20</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 23 Apr 2008 16:40:01 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 23 Apr 2008 17:27:24 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 23 Apr 2008 17:27:42 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-29.xml b/xml/htdocs/security/en/glsa/glsa-200804-29.xml
new file mode 100644
index 00000000..626ef294
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-29.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-29">
+  <title>Comix: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Comix may lead to execution of arbitrary
+    commands and a Denial of Service.
+  </synopsis>
+  <product type="ebuild">comix</product>
+  <announced>April 25, 2008</announced>
+  <revised>April 25, 2008: 01</revised>
+  <bug>215694</bug>
+  <access>local, remote</access>
+  <affected>
+    <package name="media-gfx/comix" auto="yes" arch="*">
+      <unaffected range="ge">3.6.4-r1</unaffected>
+      <vulnerable range="lt">3.6.4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Comix is a GTK comic book viewer.
+    </p>
+  </background>
+  <description>
+    <p>
+    Comix does not properly sanitize filenames containing shell
+    metacharacters when they are passed to the rar, unrar, or jpegtran
+    programs (CVE-2008-1568). Comix also creates directories with
+    predictable names (CVE-2008-1796).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit the first vulnerability by enticing a
+    user to use Comix to open a file with a specially crafted filename,
+    resulting in the execution of arbitrary commands. The second
+    vulnerability could be exploited by a local attacker to cause a Denial
+    of Service by creating a file or directory with the same filename as
+    the predictable filename used by Comix.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Comix users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/comix-3.6.4-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1568">CVE-2008-1568</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1796">CVE-2008-1796</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 10 Apr 2008 14:29:23 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 10 Apr 2008 22:35:39 +0000">
+    mfleming
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 13 Apr 2008 23:01:03 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200804-30.xml b/xml/htdocs/security/en/glsa/glsa-200804-30.xml
new file mode 100644
index 00000000..9c616729
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200804-30.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200804-30">
+  <title>KDE start_kdeinit: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in start_kdeinit could possibly allow a local
+    attacker to execute arbitrary code with root privileges.
+  </synopsis>
+  <product type="ebuild">kdelibs</product>
+  <announced>April 29, 2008</announced>
+  <revised>April 08, 2009: 02</revised>
+  <bug>218933</bug>
+  <access>local</access>
+  <affected>
+    <package name="kde-base/kdelibs" auto="yes" arch="*">
+      <unaffected range="rge">3.5.8-r4</unaffected>
+      <unaffected range="rge">3.5.9-r3</unaffected>
+      <unaffected range="gt">4.0</unaffected>
+      <unaffected range="lt">3.5.5</unaffected>
+      <unaffected range="rge">3.5.10-r2</unaffected>
+      <vulnerable range="lt">4.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KDE is a feature-rich graphical desktop environment for Linux and
+    Unix-like operating systems. start_kdeinit is a wrapper for kdeinit.
+    </p>
+  </background>
+  <description>
+    <p>
+    Vulnerabilities have been reported in the processing of user-controlled
+    data by start_kdeinit, which is setuid root by default.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could possibly execute arbitrary code with root
+    privileges, cause a Denial of Service or send Unix signals to other
+    processes, when start_kdeinit is setuid root.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All kdelibs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kdelibs-3.5.8-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1671">CVE-2008-1671</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 24 Apr 2008 09:52:59 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 28 Apr 2008 13:20:59 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-01.xml b/xml/htdocs/security/en/glsa/glsa-200805-01.xml
new file mode 100644
index 00000000..48a6ddc6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-01.xml
@@ -0,0 +1,131 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-01">
+  <title>Horde Application Framework: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in the Horde Application Framework may lead to the
+    execution of arbitrary files, information disclosure, and allow a remote
+    attacker to bypass security restrictions.
+  </synopsis>
+  <product type="ebuild">horde</product>
+  <announced>May 05, 2008</announced>
+  <revised>May 05, 2008: 01</revised>
+  <bug>212635</bug>
+  <bug>213493</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/horde" auto="yes" arch="*">
+      <unaffected range="ge">3.1.7</unaffected>
+      <vulnerable range="lt">3.1.7</vulnerable>
+    </package>
+    <package name="www-apps/horde-groupware" auto="yes" arch="*">
+      <unaffected range="ge">1.0.5</unaffected>
+      <vulnerable range="lt">1.0.5</vulnerable>
+    </package>
+    <package name="www-apps/horde-kronolith" auto="yes" arch="*">
+      <unaffected range="ge">2.1.7</unaffected>
+      <vulnerable range="lt">2.1.7</vulnerable>
+    </package>
+    <package name="www-apps/horde-mnemo" auto="yes" arch="*">
+      <unaffected range="ge">2.1.2</unaffected>
+      <vulnerable range="lt">2.1.2</vulnerable>
+    </package>
+    <package name="www-apps/horde-nag" auto="yes" arch="*">
+      <unaffected range="ge">2.1.4</unaffected>
+      <vulnerable range="lt">2.1.4</vulnerable>
+    </package>
+    <package name="www-apps/horde-webmail" auto="yes" arch="*">
+      <unaffected range="ge">1.0.6</unaffected>
+      <vulnerable range="lt">1.0.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Horde Application Framework is a general-purpose web application
+    framework written in PHP, providing classes for handling preferences,
+    compression, browser detection, connection tracking, MIME and more.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in the Horde Application
+    Framework:
+    </p>
+    <ul>
+    <li>David Collins, Patrick Pelanne and the
+    HostGator.com LLC support team discovered that the theme preference
+    page does not sanitize POST variables for several options, allowing the
+    insertion of NULL bytes and ".." sequences (CVE-2008-1284).</li>
+    <li>An
+    error exists in the Horde API allowing users to bypass security
+    restrictions.</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    The first vulnerability can be exploited by a remote attacker to read
+    arbitrary files and by remote authenticated attackers to execute
+    arbitrary files. The second vulnerability can be exploited by
+    authenticated remote attackers to perform restricted operations.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Horde Application Framework users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-3.1.7&quot;</code>
+    <p>
+    All horde-groupware users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-groupware-1.0.5&quot;</code>
+    <p>
+    All horde-kronolith users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-kronolith-2.1.7&quot;</code>
+    <p>
+    All horde-mnemo users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-mnemo-2.1.2&quot;</code>
+    <p>
+    All horde-nag users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-nag-2.1.4&quot;</code>
+    <p>
+    All horde-webmail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-webmail-1.0.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1284">CVE-2008-1284</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 29 Mar 2008 20:23:06 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 03 Apr 2008 14:49:55 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 26 Apr 2008 11:40:54 +0000">
+    mfleming
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-02.xml b/xml/htdocs/security/en/glsa/glsa-200805-02.xml
new file mode 100644
index 00000000..9f21a487
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-02.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-02">
+  <title>phpMyAdmin: Information disclosure</title>
+  <synopsis>
+    A vulnerability in phpMyAdmin may lead to information disclosure.
+  </synopsis>
+  <product type="ebuild">phpmyadmin</product>
+  <announced>May 05, 2008</announced>
+  <revised>May 05, 2008: 01</revised>
+  <bug>219005</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/phpmyadmin" auto="yes" arch="*">
+      <unaffected range="ge">2.11.5.2</unaffected>
+      <vulnerable range="lt">2.11.5.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpMyAdmin is a tool written in PHP intended to handle the
+    administration of MySQL databases from a web-browser.
+    </p>
+  </background>
+  <description>
+    <p>
+    Cezary Tomczak reported that an undefined UploadDir variable exposes an
+    information disclosure vulnerability when running on shared hosts.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker with CREATE TABLE permissions can exploit this
+    vulnerability via a specially crafted HTTP POST request in order to
+    read arbitrary files.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpMyAdmin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/phpmyadmin-2.11.5.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1924">CVE-2008-1924</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 29 Apr 2008 13:00:15 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 29 Apr 2008 13:00:26 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 29 Apr 2008 18:38:43 +0000">
+    mfleming
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-03.xml b/xml/htdocs/security/en/glsa/glsa-200805-03.xml
new file mode 100644
index 00000000..f165288b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-03.xml
@@ -0,0 +1,136 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-03">
+  <title>Multiple X11 terminals: Local privilege escalation</title>
+  <synopsis>
+    A vulnerability was found in aterm, Eterm, Mrxvt, multi-aterm, RXVT,
+    rxvt-unicode, and wterm, allowing for local privilege escalation.
+  </synopsis>
+  <product type="ebuild">aterm eterm rxvt mrxvt multi-aterm wterm rxvt-unicode</product>
+  <announced>May 07, 2008</announced>
+  <revised>May 10, 2008: 02</revised>
+  <bug>216833</bug>
+  <bug>217819</bug>
+  <bug>219746</bug>
+  <bug>219750</bug>
+  <bug>219754</bug>
+  <bug>219760</bug>
+  <bug>219762</bug>
+  <access>local</access>
+  <affected>
+    <package name="x11-terms/aterm" auto="yes" arch="*">
+      <unaffected range="ge">1.0.1-r1</unaffected>
+      <vulnerable range="lt">1.0.1-r1</vulnerable>
+    </package>
+    <package name="x11-terms/eterm" auto="yes" arch="*">
+      <unaffected range="ge">0.9.4-r1</unaffected>
+      <vulnerable range="lt">0.9.4-r1</vulnerable>
+    </package>
+    <package name="x11-terms/mrxvt" auto="yes" arch="*">
+      <unaffected range="ge">0.5.3-r2</unaffected>
+      <vulnerable range="lt">0.5.3-r2</vulnerable>
+    </package>
+    <package name="x11-terms/multi-aterm" auto="yes" arch="*">
+      <unaffected range="ge">0.2.1-r1</unaffected>
+      <vulnerable range="lt">0.2.1-r1</vulnerable>
+    </package>
+    <package name="x11-terms/rxvt" auto="yes" arch="*">
+      <unaffected range="ge">2.7.10-r4</unaffected>
+      <vulnerable range="lt">2.7.10-r4</vulnerable>
+    </package>
+    <package name="x11-terms/rxvt-unicode" auto="yes" arch="*">
+      <unaffected range="ge">9.02-r1</unaffected>
+      <vulnerable range="lt">9.02-r1</vulnerable>
+    </package>
+    <package name="x11-terms/wterm" auto="yes" arch="*">
+      <unaffected range="ge">6.2.9-r3</unaffected>
+      <vulnerable range="lt">6.2.9-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Aterm, Eterm, Mrxvt, multi-aterm, RXVT, rxvt-unicode, and wterm are X11
+    terminal emulators.
+    </p>
+  </background>
+  <description>
+    <p>
+    Bernhard R. Link discovered that RXVT opens a terminal on :0 if the
+    "-display" option is not specified and the DISPLAY environment variable
+    is not set. Further research by the Gentoo Security Team has shown that
+    aterm, Eterm, Mrxvt, multi-aterm, rxvt-unicode, and wterm are also
+    affected.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit this vulnerability to hijack X11
+    terminals of other users.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All aterm users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-terms/aterm-1.0.1-r1&quot;</code>
+    <p>
+    All Eterm users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-terms/eterm-0.9.4-r1&quot;</code>
+    <p>
+    All Mrxvt users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-terms/mrxvt-0.5.3-r2&quot;</code>
+    <p>
+    All multi-aterm users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-terms/multi-aterm-0.2.1-r1&quot;</code>
+    <p>
+    All RXVT users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-terms/rxvt-2.7.10-r4&quot;</code>
+    <p>
+    All rxvt-unicode users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-terms/rxvt-unicode-9.02-r1&quot;</code>
+    <p>
+    All wterm users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-terms/wterm-6.2.9-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1142">CVE-2008-1142</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1692">CVE-2008-1692</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 29 Apr 2008 13:00:54 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 29 Apr 2008 13:12:03 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 07 May 2008 18:53:21 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-04.xml b/xml/htdocs/security/en/glsa/glsa-200805-04.xml
new file mode 100644
index 00000000..820a3e7e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-04.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-04">
+  <title>eGroupWare: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in eGroupWare may lead to execution of arbitrary
+    PHP code, the ability to upload malicious files and cross-site scripting
+    attacks.
+  </synopsis>
+  <product type="ebuild">egroupware</product>
+  <announced>May 07, 2008</announced>
+  <revised>May 07, 2008: 01</revised>
+  <bug>214212</bug>
+  <bug>218625</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/egroupware" auto="yes" arch="*">
+      <unaffected range="ge">1.4.004</unaffected>
+      <vulnerable range="lt">1.4.004</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    eGroupWare is a suite of web-based group applications including
+    calendar, address book, messenger and email.
+    </p>
+  </background>
+  <description>
+    <p>
+    A vulnerability has been reported in FCKEditor due to the way that file
+    uploads are handled in the file
+    editor/filemanager/upload/php/upload.php when a filename has multiple
+    file extensions (CVE-2008-2041). Another vulnerability exists in the
+    _bad_protocol_once() function in the file
+    phpgwapi/inc/class.kses.inc.php, which allows remote attackers to
+    bypass HTML filtering (CVE-2008-1502).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    The first vulnerability can be exploited to upload malicious files and
+    execute arbitrary PHP code provided that a directory is writable by the
+    webserver. The second vulnerability can be exploited by remote
+    attackers via a specially crafted URL in order to conduct cross-site
+    scripting attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All eGroupWare users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/egroupware-1.4.004&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1502">CVE-2008-1502</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2041">CVE-2008-2041</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 29 Apr 2008 12:58:46 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 29 Apr 2008 13:57:44 +0000">
+    mfleming
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 29 Apr 2008 14:01:45 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-05.xml b/xml/htdocs/security/en/glsa/glsa-200805-05.xml
new file mode 100644
index 00000000..3bce4343
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-05.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-05">
+  <title>Wireshark: Denial of Service</title>
+  <synopsis>
+    Multiple Denial of Service vulnerabilities have been discovered in
+    Wireshark.
+  </synopsis>
+  <product type="ebuild">wireshark</product>
+  <announced>May 07, 2008</announced>
+  <revised>May 07, 2008: 01</revised>
+  <bug>215276</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/wireshark" auto="yes" arch="*">
+      <unaffected range="ge">1.0.0</unaffected>
+      <vulnerable range="lt">1.0.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Wireshark is a network protocol analyzer with a graphical front-end.
+    </p>
+  </background>
+  <description>
+    <p>
+    Errors exist in:
+    </p>
+    <ul>
+    <li>
+    the X.509sat dissector because of an uninitialized variable and the
+    Roofnet dissector because a NULL pointer may be passed to the
+    g_vsnprintf() function (CVE-2008-1561).</li>
+    <li>
+    the LDAP dissector because a NULL pointer may be passed to the
+    ep_strdup_printf() function (CVE-2008-1562).</li>
+    <li>
+    the SCCP dissector because it does not reset a pointer once the packet
+    has been processed (CVE-2008-1563).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities by sending a
+    malformed packet or enticing a user to read a malformed packet trace
+    file, causing a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable the X.509sat, Roofnet, LDAP, and SCCP dissectors.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Wireshark users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/wireshark-1.0.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1561">CVE-2008-1561</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1562">CVE-2008-1562</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1563">CVE-2008-1563</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 29 Apr 2008 13:11:47 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 29 Apr 2008 13:12:26 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 29 Apr 2008 15:31:30 +0000">
+    mfleming
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-06.xml b/xml/htdocs/security/en/glsa/glsa-200805-06.xml
new file mode 100644
index 00000000..8f982a93
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-06.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-06">
+  <title>Firebird: Data disclosure</title>
+  <synopsis>
+    Firebird allows remote connections to the administrative account without
+    verifying credentials.
+  </synopsis>
+  <product type="ebuild">firebird</product>
+  <announced>May 09, 2008</announced>
+  <revised>May 09, 2008: 01</revised>
+  <bug>216158</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/firebird" auto="yes" arch="*">
+      <unaffected range="ge">2.0.3.12981.0-r6</unaffected>
+      <vulnerable range="lt">2.0.3.12981.0-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Firebird is a multi-platform, open source relational database.
+    </p>
+  </background>
+  <description>
+    <p>
+    Viesturs reported that the default configuration for Gentoo's init
+    script ("/etc/conf.d/firebird") sets the "ISC_PASSWORD" environment
+    variable when starting Firebird. It will be used when no password is
+    supplied by a client connecting as the "SYSDBA" user.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker can authenticate as the "SYSDBA" user without
+    providing the credentials, resulting in complete disclosure of all
+    databases except for the user and password database (security2.fdb).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Firebird users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/firebird-2.0.3.12981.0-r6&quot;</code>
+    <p>
+    Note: /etc/conf.d is protected by Portage as a configuration directory.
+    Do not forget to use "<i>etc-update</i>" or "<i>dispatch-conf</i>" to
+    overwrite the "firebird" configuration file, and then restart Firebird.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1880">CVE-2008-1880</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 14 Apr 2008 02:05:02 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 15 Apr 2008 09:22:33 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-07.xml b/xml/htdocs/security/en/glsa/glsa-200805-07.xml
new file mode 100644
index 00000000..9ec5abda
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-07.xml
@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-07">
+  <title>Linux Terminal Server Project: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in components shipped with
+    LTSP which allow remote attackers to compromise terminal clients.
+  </synopsis>
+  <product type="ebuild">ltsp</product>
+  <announced>May 09, 2008</announced>
+  <revised>May 09, 2008: 01</revised>
+  <bug>215699</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/ltsp" auto="yes" arch="*">
+      <vulnerable range="lt">5.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Linux Terminal Server Project adds thin-client support to Linux
+    servers.
+    </p>
+  </background>
+  <description>
+    <p>
+    LTSP version 4.2, ships prebuilt copies of programs such as the Linux
+    Kernel, the X.org X11 server (GLSA 200705-06, GLSA 200710-16, GLSA
+    200801-09), libpng (GLSA 200705-24, GLSA 200711-08), Freetype (GLSA
+    200705-02, GLSA 200705-22) and OpenSSL (GLSA 200710-06, GLSA 200710-30)
+    which were subject to multiple security vulnerabilities since 2006.
+    Please note that the given list of vulnerabilities might not be
+    exhaustive.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could possibly exploit vulnerabilities in the
+    aforementioned programs and execute arbitrary code, disclose sensitive
+    data or cause a Denial of Service within LTSP 4.2 clients.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    LTSP 4.2 is not maintained upstream in favor of version 5. Since
+    version 5 is not yet available in Gentoo, the package has been masked.
+    We recommend that users unmerge LTSP:
+    </p>
+    <code>
+    # emerge --unmerge net-misc/ltsp</code>
+    <p>
+    If you have a requirement for Linux Terminal Servers, please either set
+    up a terminal server by hand or use one of the distributions that
+    already migrated to LTSP 5. If you want to contribute to the
+    integration of LTSP 5 in Gentoo, or want to follow its development,
+    find details in bug 177580.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200705-02.xml">GLSA 200705-02</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200705-06.xml">GLSA 200705-06</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200705-22.xml">GLSA 200705-22</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200705-24.xml">GLSA 200705-24</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200710-06.xml">GLSA 200710-06</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200710-16.xml">GLSA 200710-16</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200710-30.xml">GLSA 200710-30</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200711-08.xml">GLSA 200711-08</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200801-09.xml">GLSA 200801-09</uri>
+    <uri link="https://bugs.gentoo.org/177580">Gentoo bug 177580: Port LTSP 5 to Gentoo</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 01 Apr 2008 19:23:11 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 03 Apr 2008 14:49:37 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 03 Apr 2008 22:27:26 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-08.xml b/xml/htdocs/security/en/glsa/glsa-200805-08.xml
new file mode 100644
index 00000000..74921afe
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-08.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-08">
+  <title>InspIRCd: Denial of Service</title>
+  <synopsis>
+    A buffer overflow in InspIRCd allows remote attackers to cause a Denial of
+    Service.
+  </synopsis>
+  <product type="ebuild">inspircd</product>
+  <announced>May 09, 2008</announced>
+  <revised>May 09, 2008: 01</revised>
+  <bug>215704</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-irc/inspircd" auto="yes" arch="*">
+      <unaffected range="ge">1.1.19</unaffected>
+      <vulnerable range="lt">1.1.19</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    InspIRCd (Inspire IRCd) is a modular C++ IRC daemon.
+    </p>
+  </background>
+  <description>
+    <p>
+    The "namesx" and "uhnames" modules do not properly validate network
+    input, leading to a buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker can send specially crafted IRC commands to the
+    server, causing a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Unload the "uhnames" module in the InspIRCd configuration.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All InspIRCd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-irc/inspircd-1.1.19&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1925">CVE-2008-1925</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 06 May 2008 14:50:35 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 06 May 2008 19:30:15 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 06 May 2008 19:30:22 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-09.xml b/xml/htdocs/security/en/glsa/glsa-200805-09.xml
new file mode 100644
index 00000000..47a22db1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-09.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-09">
+  <title>MoinMoin: Privilege escalation</title>
+  <synopsis>
+    A vulnerability in MoinMoin may allow a remote attacker to elevate his
+    privileges.
+  </synopsis>
+  <product type="ebuild">moinmoin</product>
+  <announced>May 11, 2008</announced>
+  <revised>May 11, 2008: 01</revised>
+  <bug>218752</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/moinmoin" auto="yes" arch="*">
+      <unaffected range="ge">1.6.3</unaffected>
+      <vulnerable range="lt">1.6.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MoinMoin is an advanced and extensible Wiki Engine.
+    </p>
+  </background>
+  <description>
+    <p>
+    It has been reported that the user form processing in the file
+    userform.py does not properly manage users when using Access Control
+    Lists or a non-empty superusers list.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit this vulnerability to gain superuser
+    privileges on the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MoinMoin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/moinmoin-1.6.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1937">CVE-2008-1937</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 07 May 2008 22:43:27 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 07 May 2008 22:49:11 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 09 May 2008 14:03:55 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-10.xml b/xml/htdocs/security/en/glsa/glsa-200805-10.xml
new file mode 100644
index 00000000..688b1009
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-10.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-10">
+  <title>Pngcrush: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A vulnerability in Pngcrush might result in user-assisted execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">pngcrush</product>
+  <announced>May 11, 2008</announced>
+  <revised>May 11, 2008: 01</revised>
+  <bug>219033</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/pngcrush" auto="yes" arch="*">
+      <unaffected range="ge">1.6.4-r1</unaffected>
+      <vulnerable range="lt">1.6.4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Pngcrush is a multi platform optimizer for PNG (Portable Network
+    Graphics) files.
+    </p>
+  </background>
+  <description>
+    <p>
+    It has been reported that Pngcrush includes a copy of libpng that is
+    vulnerable to a memory corruption (GLSA 200804-15).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to process a specially crafted
+    PNG image, possibly resulting in the execution of arbitrary code with
+    the privileges of the user running the application, or a Denial of
+    Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Pngcrush users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/pngcrush-1.6.4-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1382">CVE-2008-1382</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200804-15.xml">GLSA 200804-15</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 05 May 2008 21:28:49 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 05 May 2008 21:29:02 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 09 May 2008 14:19:10 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-11.xml b/xml/htdocs/security/en/glsa/glsa-200805-11.xml
new file mode 100644
index 00000000..00d338ca
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-11.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-11">
+  <title>Chicken: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Chicken could result in the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">chicken</product>
+  <announced>May 12, 2008</announced>
+  <revised>May 12, 2008: 01</revised>
+  <bug>198979</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-scheme/chicken" auto="yes" arch="*">
+      <unaffected range="ge">3.1.0</unaffected>
+      <vulnerable range="lt">3.1.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Chicken is a Scheme interpreter and native Scheme to C compiler.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chicken includes a copy of PCRE which is vulnerable to multiple buffer
+    overflows and memory corruption vulnerabilities (GLSA 200711-30).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to process specially crafted regular
+    expressions with Chicken, which could possibly lead to the execution of
+    arbitrary code, a Denial of Service or the disclosure of sensitive
+    information.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Chicken users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-scheme/chicken-3.1.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200711-30.xml">GLSA 200711-30</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 12 May 2008 11:47:42 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 12 May 2008 11:47:52 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 12 May 2008 12:10:35 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-12.xml b/xml/htdocs/security/en/glsa/glsa-200805-12.xml
new file mode 100644
index 00000000..7f058376
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-12.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-12">
+  <title>Blender: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Blender might result in the remote execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">blender</product>
+  <announced>May 12, 2008</announced>
+  <revised>May 12, 2008: 01</revised>
+  <bug>219008</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/blender" auto="yes" arch="*">
+      <unaffected range="ge">2.43-r2</unaffected>
+      <vulnerable range="lt">2.43-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Blender is a 3D creation, animation and publishing program.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Cornelius (Secunia Research) reported a boundary error within
+    the imb_loadhdr() function in in the file
+    source/blender/imbuf/intern/radiance_hdr.c when processing RGBE images
+    (CVE-2008-1102). Multiple vulnerabilities involving insecure usage of
+    temporary files have also been reported (CVE-2008-1103).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted file
+    (.hdr or .blend), possibly resulting in the remote execution of
+    arbitrary code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Blender users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/blender-2.43-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1102">CVE-2008-1102</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1103">CVE-2008-1103</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 11 May 2008 13:10:27 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 12 May 2008 11:15:05 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 12 May 2008 11:15:14 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-13.xml b/xml/htdocs/security/en/glsa/glsa-200805-13.xml
new file mode 100644
index 00000000..a05e78df
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-13.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-13">
+  <title>PTeX: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities were discovered in PTeX, possibly allowing the
+    execution of arbitrary code or overwriting arbitrary files.
+  </synopsis>
+  <product type="ebuild">ptex</product>
+  <announced>May 12, 2008</announced>
+  <revised>May 12, 2008: 01</revised>
+  <bug>196673</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/ptex" auto="yes" arch="*">
+      <unaffected range="ge">3.1.10_p20071203</unaffected>
+      <vulnerable range="lt">3.1.10_p20071203</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PTeX is a TeX distribution with Japanese support. It is used for
+    creating and manipulating LaTeX documents.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple issues were found in the teTeX 2 codebase that PTeX builds
+    upon (GLSA 200709-17, GLSA 200711-26). PTeX also includes vulnerable
+    code from the GD library (GLSA 200708-05), from Xpdf (GLSA 200709-12,
+    GLSA 200711-22) and from T1Lib (GLSA 200710-12).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote attackers could possibly execute arbitrary code and local
+    attackers could possibly overwrite arbitrary files with the privileges
+    of the user running PTeX via multiple vectors, e.g. enticing users to
+    open specially crafted files.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PTeX users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/ptex-3.1.10_p20071203&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200708-05.xml">GLSA 200708-05</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200709-12.xml">GLSA 200709-12</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200709-17.xml">GLSA 200709-17</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200710-12.xml">GLSA 200710-12</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200711-22.xml">GLSA 200711-22</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200711-26.xml">GLSA 200711-26</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 07 May 2008 22:31:38 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 07 May 2008 22:32:17 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 12 May 2008 11:34:22 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-14.xml b/xml/htdocs/security/en/glsa/glsa-200805-14.xml
new file mode 100644
index 00000000..82d58748
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-14.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-14">
+  <title>Common Data Format library: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow vulnerability has been discovered in the Common Data
+    Format library.
+  </synopsis>
+  <product type="ebuild">cdf</product>
+  <announced>May 13, 2008</announced>
+  <revised>May 13, 2008: 01</revised>
+  <bug>220391</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sci-libs/cdf" auto="yes" arch="*">
+      <unaffected range="ge">3.2.1</unaffected>
+      <vulnerable range="lt">3.2.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Common Data Format library is a scientific data management package
+    which allows programmers and application developers to manage and
+    manipulate scalar, vector, and multi-dimensional data arrays in a
+    platform independent fashion.
+    </p>
+  </background>
+  <description>
+    <p>
+    Alfredo Ortega (Core Security Technologies) reported a boundary error
+    within the Read32s_64() function when processing CDF files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted CDF
+    file, possibly resulting in the remote execution of arbitrary code with
+    the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Common Data Format library users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sci-libs/cdf-3.2.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2080">CVE-2008-2080</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 11 May 2008 18:49:47 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 12 May 2008 10:41:41 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 12 May 2008 10:41:52 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-15.xml b/xml/htdocs/security/en/glsa/glsa-200805-15.xml
new file mode 100644
index 00000000..2b27bfc4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-15.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-15">
+  <title>libid3tag: Denial of Service</title>
+  <synopsis>
+    A Denial of Service vulnerability was found in libid3tag.
+  </synopsis>
+  <product type="ebuild">libid3tag</product>
+  <announced>May 14, 2008</announced>
+  <revised>May 14, 2008: 01</revised>
+  <bug>210564</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libid3tag" auto="yes" arch="*">
+      <unaffected range="ge">0.15.1b-r2</unaffected>
+      <vulnerable range="lt">0.15.1b-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libid3tag is an ID3 tag manipulation library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Kentaro Oda reported an infinite loop in the file field.c when parsing
+    an MP3 file with an ID3_FIELD_TYPE_STRINGLIST field that ends in '\0'.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted MP3
+    file, possibly resulting in a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libid3tag users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libid3tag-0.15.1b-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2109">CVE-2008-2109</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 13 May 2008 20:49:10 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 13 May 2008 20:57:48 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 13 May 2008 21:27:22 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-16.xml b/xml/htdocs/security/en/glsa/glsa-200805-16.xml
new file mode 100644
index 00000000..65823df0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-16.xml
@@ -0,0 +1,110 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-16">
+  <title>OpenOffice.org: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been reported in OpenOffice.org, possibly
+    allowing for user-assisted execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">openoffice openoffice-bin</product>
+  <announced>May 14, 2008</announced>
+  <revised>May 14, 2008: 02</revised>
+  <bug>218080</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/openoffice" auto="yes" arch="*">
+      <unaffected range="ge">2.4.0</unaffected>
+      <vulnerable range="lt">2.4.0</vulnerable>
+    </package>
+    <package name="app-office/openoffice-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.4.0</unaffected>
+      <vulnerable range="lt">2.4.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenOffice.org is an open source office productivity suite, including
+    word processing, spreadsheet, presentation, drawing, data charting,
+    formula editing, and file conversion facilities.
+    </p>
+  </background>
+  <description>
+    <p>
+    iDefense Labs reported multiple vulnerabilities in OpenOffice.org:
+    </p>
+    <ul>
+    <li>
+    multiple heap-based buffer overflows when parsing the "Attribute" and
+    "Font" Description records of Quattro Pro (QPRO) files
+    (CVE-2007-5745),
+    </li>
+    <li>
+    an integer overflow when parsing the EMR_STRETCHBLT record of an EMF
+    file, resulting in a heap-based buffer overflow (CVE-2007-5746),
+    </li>
+    <li>
+    an integer underflow when parsing Quattro Pro (QPRO) files, resulting
+    in an excessive loop and a stack-based buffer overflow
+    (CVE-2007-5747),
+    </li>
+    <li>
+    and a heap-based buffer overflow when parsing the
+    "DocumentSummaryInformation" stream in an OLE file (CVE-2008-0320).
+    </li>
+    </ul>
+    <p>
+    Furthermore, Will Drewry (Google Security) reported vulnerabilities in
+    the memory management of the International Components for Unicode
+    (CVE-2007-4770, CVE-2007-4771), which was resolved with GLSA 200803-20.
+    However, the binary version of OpenOffice.org uses an internal copy of
+    said library.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    document, possibly resulting in the remote execution of arbitrary code
+    with the privileges of the user running OpenOffice.org.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenOffice.org users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-2.4.0&quot;</code>
+    <p>
+    All OpenOffice.org binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-bin-2.4.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4770">CVE-2007-4770</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4771">CVE-2007-4771</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5745">CVE-2007-5745</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5746">CVE-2007-5746</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5747">CVE-2007-5747</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0320">CVE-2008-0320</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200803-20.xml">GLSA 200803-20</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 29 Apr 2008 12:59:56 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 08 May 2008 17:40:20 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 08 May 2008 17:40:49 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-17.xml b/xml/htdocs/security/en/glsa/glsa-200805-17.xml
new file mode 100644
index 00000000..d99ba9a4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-17.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-17">
+  <title>Perl: Execution of arbitrary code</title>
+  <synopsis>
+    A double free vulnerability was discovered in Perl, possibly resulting in
+    the execution of arbitrary code and a Denial of Service.
+  </synopsis>
+  <product type="ebuild">perl libperl</product>
+  <announced>May 20, 2008</announced>
+  <revised>May 20, 2008: 01</revised>
+  <bug>219203</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/perl" auto="yes" arch="*">
+      <unaffected range="ge">5.8.8-r5</unaffected>
+      <vulnerable range="lt">5.8.8-r5</vulnerable>
+    </package>
+    <package name="sys-devel/libperl" auto="yes" arch="*">
+      <unaffected range="ge">5.8.8-r2</unaffected>
+      <vulnerable range="lt">5.8.8-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Perl is a stable, cross platform programming language.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy and Will Drewry of the Google Security Team have reported
+    a double free vulnerability when processing a crafted regular
+    expression containing UTF-8 characters.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could possibly exploit this vulnerability to execute
+    arbitrary code or cause a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Perl users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/perl-5.8.8-r5&quot;</code>
+    <p>
+    All libperl users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-devel/libperl-5.8.8-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1927">CVE-2008-1927</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 17 May 2008 10:42:17 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 17 May 2008 10:42:31 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 17 May 2008 13:52:28 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-18.xml b/xml/htdocs/security/en/glsa/glsa-200805-18.xml
new file mode 100644
index 00000000..e5794355
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-18.xml
@@ -0,0 +1,282 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-18">
+  <title>Mozilla products: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been reported in Mozilla Firefox,
+    Thunderbird, SeaMonkey and XULRunner, some of which may allow user-assisted
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mozilla-firefox mozilla-firefox-bin seamonkey seamonkey-bin mozilla-thunderbird mozilla-thunderbird-bin xulrunner</product>
+  <announced>May 20, 2008</announced>
+  <revised>May 20, 2008: 01</revised>
+  <bug>208128</bug>
+  <bug>214816</bug>
+  <bug>218065</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.14</unaffected>
+      <vulnerable range="lt">2.0.0.14</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.14</unaffected>
+      <vulnerable range="lt">2.0.0.14</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.14</unaffected>
+      <vulnerable range="lt">2.0.0.14</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.14</unaffected>
+      <vulnerable range="lt">2.0.0.14</vulnerable>
+    </package>
+    <package name="www-client/seamonkey" auto="yes" arch="*">
+      <unaffected range="ge">1.1.9-r1</unaffected>
+      <vulnerable range="lt">1.1.9-r1</vulnerable>
+    </package>
+    <package name="www-client/seamonkey-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.1.9</unaffected>
+      <vulnerable range="lt">1.1.9</vulnerable>
+    </package>
+    <package name="net-libs/xulrunner" auto="yes" arch="*">
+      <unaffected range="ge">1.8.1.14</unaffected>
+      <vulnerable range="lt">1.8.1.14</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Firefox is an open-source web browser and Mozilla Thunderbird
+    an open-source email client, both from the Mozilla Project. The
+    SeaMonkey project is a community effort to deliver production-quality
+    releases of code derived from the application formerly known as the
+    'Mozilla Application Suite'. XULRunner is a Mozilla runtime package
+    that can be used to bootstrap XUL+XPCOM applications like Firefox and
+    Thunderbird.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were reported in all mentioned Mozilla
+    products:
+    </p>
+    <ul>
+    <li>
+    Jesse Ruderman, Kai Engert, Martijn Wargers, Mats Palmgren, and Paul
+    Nickerson reported browser crashes related to JavaScript methods,
+    possibly triggering memory corruption (CVE-2008-0412).
+    </li>
+    <li>
+    Carsten Book, Wesley Garland, Igor Bukanov, moz_bug_r_a4, shutdown,
+    Philip Taylor, and tgirmann reported crashes in the JavaScript engine,
+    possibly triggering memory corruption (CVE-2008-0413).
+    </li>
+    <li>
+    David Bloom discovered a vulnerability in the way images are treated by
+    the browser when a user leaves a page, possibly triggering memory
+    corruption (CVE-2008-0419).
+    </li>
+    <li>
+    moz_bug_r_a4, Boris Zbarsky, and Johnny Stenback reported a series of
+    privilege escalation vulnerabilities related to JavaScript
+    (CVE-2008-1233, CVE-2008-1234, CVE-2008-1235).
+    </li>
+    <li>
+    Mozilla developers identified browser crashes caused by the layout and
+    JavaScript engines, possibly triggering memory corruption
+    (CVE-2008-1236, CVE-2008-1237).
+    </li>
+    <li>
+    moz_bug_r_a4 and Boris Zbarsky discovered that pages could escape from
+    its sandboxed context and run with chrome privileges, and inject script
+    content into another site, violating the browser's same origin policy
+    (CVE-2008-0415).
+    </li>
+    <li>
+    Gerry Eisenhaur discovered a directory traversal vulnerability when
+    using "flat" addons (CVE-2008-0418).
+    </li>
+    <li>
+    Alexey Proskuryakov, Yosuke Hasegawa and Simon Montagu reported
+    multiple character handling flaws related to the backspace character,
+    the "0x80" character, involving zero-length non-ASCII sequences in
+    multiple character sets, that could facilitate Cross-Site Scripting
+    attacks (CVE-2008-0416).
+    </li>
+    </ul> <p>
+    The following vulnerability was reported in Thunderbird and SeaMonkey:
+    </p>
+    <ul>
+    <li>
+    regenrecht (via iDefense) reported a heap-based buffer overflow when
+    rendering an email message with an external MIME body (CVE-2008-0304).
+    </li>
+    </ul> <p>
+    The following vulnerabilities were reported in Firefox, SeaMonkey and
+    XULRunner:
+    </p>
+    <ul>
+    <li>The fix for CVE-2008-1237 in Firefox 2.0.0.13
+    and SeaMonkey 1.1.9 introduced a new crash vulnerability
+    (CVE-2008-1380).</li>
+    <li>hong and Gregory Fleischer each reported a
+    variant on earlier reported bugs regarding focus shifting in file input
+    controls (CVE-2008-0414).
+    </li>
+    <li>
+    Gynvael Coldwind (Vexillium) discovered that BMP images could be used
+    to reveal uninitialized memory, and that this data could be extracted
+    using a "canvas" feature (CVE-2008-0420).
+    </li>
+    <li>
+    Chris Thomas reported that background tabs could create a borderless
+    XUL pop-up in front of pages in other tabs (CVE-2008-1241).
+    </li>
+    <li>
+    oo.rio.oo discovered that a plain text file with a
+    "Content-Disposition: attachment" prevents Firefox from rendering
+    future plain text files within the browser (CVE-2008-0592).
+    </li>
+    <li>
+    Martin Straka reported that the ".href" property of stylesheet DOM
+    nodes is modified to the final URI of a 302 redirect, bypassing the
+    same origin policy (CVE-2008-0593).
+    </li>
+    <li>
+    Gregory Fleischer discovered that under certain circumstances, leading
+    characters from the hostname part of the "Referer:" HTTP header are
+    removed (CVE-2008-1238).
+    </li>
+    <li>
+    Peter Brodersen and Alexander Klink reported that the browser
+    automatically selected and sent a client certificate when SSL Client
+    Authentication is requested by a server (CVE-2007-4879).
+    </li>
+    <li>
+    Gregory Fleischer reported that web content fetched via the "jar:"
+    protocol was not subject to network access restrictions
+    (CVE-2008-1240).
+    </li>
+    </ul> <p>
+    The following vulnerabilities were reported in Firefox:
+    </p>
+    <ul>
+    <li>
+    Justin Dolske discovered a CRLF injection vulnerability when storing
+    passwords (CVE-2008-0417).
+    </li>
+    <li>
+    Michal Zalewski discovered that Firefox does not properly manage a
+    delay timer used in confirmation dialogs (CVE-2008-0591).
+    </li>
+    <li>
+    Emil Ljungdahl and Lars-Olof Moilanen discovered that a web forgery
+    warning dialog is not displayed if the entire contents of a web page
+    are in a DIV tag that uses absolute positioning (CVE-2008-0594).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to view a specially crafted web
+    page or email that will trigger one of the vulnerabilities, possibly
+    leading to the execution of arbitrary code or a Denial of Service. It
+    is also possible for an attacker to trick a user to upload arbitrary
+    files when submitting a form, to corrupt saved passwords for other
+    sites, to steal login credentials, or to conduct Cross-Site Scripting
+    and Cross-Site Request Forgery attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-2.0.0.14&quot;</code>
+    <p>
+    All Mozilla Firefox binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-2.0.0.14&quot;</code>
+    <p>
+    All Mozilla Thunderbird users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-2.0.0.14&quot;</code>
+    <p>
+    All Mozilla Thunderbird binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-bin-2.0.0.14&quot;</code>
+    <p>
+    All SeaMonkey users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/seamonkey-1.1.9-r1&quot;</code>
+    <p>
+    All SeaMonkey binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/seamonkey-bin-1.1.9&quot;</code>
+    <p>
+    All XULRunner users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/xulrunner-1.8.1.14&quot;</code>
+    <p>
+    NOTE: The crash vulnerability (CVE-2008-1380) is currently unfixed in
+    the SeaMonkey binary ebuild, as no precompiled packages have been
+    released. Until an update is available, we recommend all SeaMonkey
+    users to disable JavaScript, use Firefox for JavaScript-enabled
+    browsing, or switch to the SeaMonkey source ebuild.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4879">CVE-2007-4879</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0304">CVE-2008-0304</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0412">CVE-2008-0412</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0413">CVE-2008-0413</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0414">CVE-2008-0414</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0415">CVE-2008-0415</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0416">CVE-2008-0416</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0417">CVE-2008-0417</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0418">CVE-2008-0418</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0419">CVE-2008-0419</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0420">CVE-2008-0420</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0591">CVE-2008-0591</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0592">CVE-2008-0592</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0593">CVE-2008-0593</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0594">CVE-2008-0594</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1233">CVE-2008-1233</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1234">CVE-2008-1234</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1235">CVE-2008-1235</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1236">CVE-2008-1236</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1237">CVE-2008-1237</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1238">CVE-2008-1238</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1240">CVE-2008-1240</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1241">CVE-2008-1241</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1380">CVE-2008-1380</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 27 Mar 2008 03:40:04 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 20 May 2008 21:13:08 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-19.xml b/xml/htdocs/security/en/glsa/glsa-200805-19.xml
new file mode 100644
index 00000000..cedfc0d0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-19.xml
@@ -0,0 +1,102 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-19">
+  <title>ClamAV: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in ClamAV may result in the remote execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>May 20, 2008</announced>
+  <revised>May 20, 2008: 01</revised>
+  <bug>213762</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.93</unaffected>
+      <vulnerable range="lt">0.93</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Clam AntiVirus is a free anti-virus toolkit for UNIX, designed
+    especially for e-mail scanning on mail gateways.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported:
+    </p>
+    <ul>
+    <li>
+    Damian Put reported a heap-based buffer overflow when processing PeSpin
+    packed PE binaries (CVE-2008-0314).
+    </li>
+    <li>
+    Alin Rad Pop of Secunia Research reported a buffer overflow in the
+    cli_scanpe() function when processing Upack PE binaries
+    (CVE-2008-1100).
+    </li>
+    <li>
+    Hanno Boeck reported an infinite loop when processing ARJ archives
+    (CVE-2008-1387).
+    </li>
+    <li>
+    Damian Put and Thomas Pollet reported a heap-based buffer overflow when
+    processing WWPack compressed PE binaries (CVE-2008-1833).
+    </li>
+    <li>
+    A buffer over-read was discovered in the rfc2231() function when
+    producing a string that is not NULL terminated (CVE-2008-1836).
+    </li>
+    <li>
+    An unspecified vulnerability leading to "memory problems" when scanning
+    RAR files was reported (CVE-2008-1837).
+    </li>
+    <li>
+    Thierry Zoller reported that scanning of RAR files could be
+    circumvented (CVE-2008-1835).
+    </li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could entice a user or automated system to scan a
+    specially crafted file, possibly leading to the execution of arbitrary
+    code with the privileges of the user running ClamAV (either a system
+    user or the "clamav" user if clamd is compromised), or a Denial of
+    Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.93&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0314">CVE-2008-0314</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1100">CVE-2008-1100</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1387">CVE-2008-1387</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1833">CVE-2008-1833</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1835">CVE-2008-1835</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1836">CVE-2008-1836</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1837">CVE-2008-1837</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 14 May 2008 18:45:19 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 14 May 2008 18:56:12 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-20.xml b/xml/htdocs/security/en/glsa/glsa-200805-20.xml
new file mode 100644
index 00000000..c19c4d00
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-20.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-20">
+  <title>GnuTLS: Execution of arbitrary code</title>
+  <synopsis>
+    Multiple vulnerabilities might allow for the execution of arbitrary code in
+    daemons using GnuTLS.
+  </synopsis>
+  <product type="ebuild">gnutls</product>
+  <announced>May 21, 2008</announced>
+  <revised>May 21, 2008: 01</revised>
+  <bug>222823</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-libs/gnutls" auto="yes" arch="*">
+      <unaffected range="ge">2.2.5</unaffected>
+      <vulnerable range="lt">2.2.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GnuTLS is an implementation of Secure Sockets Layer (SSL) 3.0 and
+    Transport Layer Security (TLS) 1.0, 1.1 and 1.2.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ossi Herrala and Jukka Taimisto of Codenomicon reported three
+    vulnerabilities in libgnutls of GnuTLS:
+    </p>
+    <ul>
+    <li>
+    "Client Hello" messages containing an invalid server name can lead to a
+    buffer overflow when evaluating "Security Parameters" (CVE-2008-1948).
+    </li>
+    <li>
+    Multiple "Client Hello" messages can lead to a NULL pointer dereference
+    (CVE-2008-1949).
+    </li>
+    <li>
+    A TLS handshake including an encrypted "Client Hello" message and an
+    invalid record length could lead to a buffer overread (CVE-2008-1950).
+    </li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    Unauthenticated remote attackers could exploit these vulnerabilities to
+    cause Denial of Service conditions in daemons using GnuTLS. The first
+    vulnerability (CVE-2008-1948) might allow for the execution of
+    arbitrary code with the privileges of the daemon handling incoming TLS
+    connections.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GnuTLS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/gnutls-2.2.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1948">CVE-2008-1948</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1949">CVE-2008-1949</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1950">CVE-2008-1950</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 20 May 2008 16:44:10 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 21 May 2008 16:32:55 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-21.xml b/xml/htdocs/security/en/glsa/glsa-200805-21.xml
new file mode 100644
index 00000000..b87517c0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-21.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-21">
+  <title>Roundup: Permission bypass</title>
+  <synopsis>
+    A vulnerability in Roundup allows for bypassing permission restrictions.
+  </synopsis>
+  <product type="ebuild">roundup</product>
+  <announced>May 27, 2008</announced>
+  <revised>May 27, 2008: 01</revised>
+  <bug>212488</bug>
+  <bug>214666</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/roundup" auto="yes" arch="*">
+      <unaffected range="ge">1.4.4-r1</unaffected>
+      <vulnerable range="lt">1.4.4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Roundup is an issue-tracking system with command-line, web and e-mail
+    interfaces.
+    </p>
+  </background>
+  <description>
+    <p>
+    Philipp Gortan reported that the xml-rpc server in Roundup does not
+    check property permissions (CVE-2008-1475). Furthermore, Roland Meister
+    discovered multiple vulnerabilities caused by unspecified errors, some
+    of which may be related to cross-site scripting (CVE-2008-1474).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could possibly exploit the first vulnerability to
+    edit or view restricted properties via the list(), display(), and set()
+    methods. The impact and attack vectors of the second vulnerability are
+    unknown.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Roundup users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/roundup-1.4.4-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1474">CVE-2008-1474</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1475">CVE-2008-1475</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 19 May 2008 15:24:06 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 21 May 2008 19:07:57 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 22 May 2008 09:03:17 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-22.xml b/xml/htdocs/security/en/glsa/glsa-200805-22.xml
new file mode 100644
index 00000000..ae0a085a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-22.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-22">
+  <title>MPlayer: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    An integer overflow vulnerability in MPlayer may allow for the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">mplayer</product>
+  <announced>May 29, 2008</announced>
+  <revised>May 29, 2008: 01</revised>
+  <bug>215006</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/mplayer" auto="yes" arch="*">
+      <unaffected range="ge">1.0_rc2_p26753</unaffected>
+      <vulnerable range="lt">1.0_rc2_p26753</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MPlayer is a media player including support for a wide range of audio
+    and video formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    k`sOSe reported an integer overflow vulnerability in the
+    sdpplin_parse() function in the file stream/realrtsp/sdpplin.c, which
+    can be exploited to overwrite arbitrary memory regions via an overly
+    large "StreamCount" SDP parameter.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted media
+    file, possibly resulting in the execution of arbitrary code with the
+    privileges of the user running MPlayer.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MPlayer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/mplayer-1.0_rc2_p26753&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1558">CVE-2008-1558</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 22 May 2008 17:37:55 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 27 May 2008 21:32:21 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 28 May 2008 13:57:42 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200805-23.xml b/xml/htdocs/security/en/glsa/glsa-200805-23.xml
new file mode 100644
index 00000000..3ad6123b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200805-23.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200805-23">
+  <title>Samba: Heap-based buffer overflow</title>
+  <synopsis>
+    A heap-based buffer overflow vulnerability was found in Samba, allowing for
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">samba</product>
+  <announced>May 29, 2008</announced>
+  <revised>May 29, 2008: 01</revised>
+  <bug>222299</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-fs/samba" auto="yes" arch="*">
+      <unaffected range="ge">3.0.28a-r1</unaffected>
+      <vulnerable range="lt">3.0.28a-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Samba is a suite of SMB and CIFS client/server programs.
+    </p>
+  </background>
+  <description>
+    <p>
+    Alin Rad Pop (Secunia Research) reported a vulnerability in Samba
+    within the receive_smb_raw() function in the file lib/util_sock.c when
+    parsing SMB packets, possibly leading to a heap-based buffer overflow
+    via an overly large SMB packet.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could possibly exploit this vulnerability by enticing
+    a user to connect to a malicious server or by sending specially crafted
+    packets to an nmbd server configured as a local or domain master
+    browser, resulting in the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Samba users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-fs/samba-3.0.28a-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1105">CVE-2008-1105</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 27 May 2008 15:20:30 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 27 May 2008 21:23:53 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 29 May 2008 13:07:54 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200806-01.xml b/xml/htdocs/security/en/glsa/glsa-200806-01.xml
new file mode 100644
index 00000000..5cd1da3a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200806-01.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200806-01">
+  <title>mtr: Stack-based buffer overflow</title>
+  <synopsis>
+    A stack-based buffer overflow was found in mtr, possibly resulting in the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mtr</product>
+  <announced>June 03, 2008</announced>
+  <revised>June 03, 2008: 01</revised>
+  <bug>223017</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/mtr" auto="yes" arch="*">
+      <unaffected range="ge">0.73-r1</unaffected>
+      <vulnerable range="lt">0.73-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    mtr combines the functionality of the 'traceroute' and 'ping' programs
+    in a single network diagnostic tool.
+    </p>
+  </background>
+  <description>
+    <p>
+    Adam Zabrocki reported a boundary error within the split_redraw()
+    function in the file split.c, possibly leading to a stack-based buffer
+    overflow.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could use a specially crafted resolved hostname to
+    execute arbitrary code with root privileges. However, it is required
+    that the attacker controls the DNS server used by the victim, and that
+    the "-p" (or "--split") command line option is used.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mtr users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/mtr-0.73-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2357">CVE-2008-2357</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 26 May 2008 19:29:01 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 27 May 2008 21:17:06 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 02 Jun 2008 21:28:08 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200806-02.xml b/xml/htdocs/security/en/glsa/glsa-200806-02.xml
new file mode 100644
index 00000000..0e949b89
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200806-02.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200806-02">
+  <title>libxslt: Execution of arbitrary code</title>
+  <synopsis>
+    A vulnerability was found in libxslt, possibly resulting in the execution
+    of arbitrary code and Denial of Service.
+  </synopsis>
+  <product type="ebuild">libxslt</product>
+  <announced>June 03, 2008</announced>
+  <revised>June 03, 2008: 01</revised>
+  <bug>222499</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/libxslt" auto="yes" arch="*">
+      <unaffected range="ge">1.1.24</unaffected>
+      <vulnerable range="lt">1.1.24</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Libxslt is the XSLT C library developed for the GNOME project. XSLT
+    itself is an XML language to define transformations for XML.
+    </p>
+  </background>
+  <description>
+    <p>
+    Anthony de Almeida Lopes reported a vulnerability in libxslt when
+    handling XSL style-sheet files, which could be exploited to trigger the
+    use of uninitialized memory, e.g. in a call to "free()".
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or automated system to process an
+    XML file using a specially crafted XSL transformation file, possibly
+    resulting in the execution of arbitrary code or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libxslt users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/libxslt-1.1.24&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1767">CVE-2008-1767</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 27 May 2008 20:52:43 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 27 May 2008 21:07:25 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 02 Jun 2008 21:27:22 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200806-03.xml b/xml/htdocs/security/en/glsa/glsa-200806-03.xml
new file mode 100644
index 00000000..965b7f5c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200806-03.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200806-03">
+  <title>Imlib 2: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Two vulnerabilities in Imlib 2 may allow for the execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">imlib2</product>
+  <announced>June 08, 2008</announced>
+  <revised>June 08, 2008: 01</revised>
+  <bug>223965</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/imlib2" auto="yes" arch="*">
+      <unaffected range="ge">1.4.0-r1</unaffected>
+      <vulnerable range="lt">1.4.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Imlib 2 is an advanced replacement library for libraries like libXpm.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Cornelius (Secunia Research) reported two boundary errors in
+    Imlib2:
+    </p>
+    <ul>
+    <li>One of them within the load() function in the
+    file src/modules/loaders/loader_pnm.c when processing the header of a
+    PNM image file, possibly leading to a stack-based buffer overflow.</li>
+    <li>The second one within the load() function in the file
+    src/modules/loader_xpm.c when processing an XPM image file, possibly
+    leading to a stack-based buffer overflow.</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted PNM
+    or XPM image, possibly resulting in the execution of arbitrary code
+    with the rights of the user running the application using Imlib 2.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Imlib 2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/imlib2-1.4.0-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2426">CVE-2008-2426</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 31 May 2008 09:11:57 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 03 Jun 2008 07:11:46 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 06 Jun 2008 17:06:14 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200806-04.xml b/xml/htdocs/security/en/glsa/glsa-200806-04.xml
new file mode 100644
index 00000000..2541f1aa
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200806-04.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200806-04">
+  <title>rdesktop: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in rdesktop may lead to the execution of arbitrary
+    code or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">rdesktop</product>
+  <announced>June 14, 2008</announced>
+  <revised>June 14, 2008: 01</revised>
+  <bug>220911</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/rdesktop" auto="yes" arch="*">
+      <unaffected range="ge">1.6.0</unaffected>
+      <vulnerable range="lt">1.6.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    rdesktop is an open source Remote Desktop Protocol (RDP) client.
+    </p>
+  </background>
+  <description>
+    <p>
+    An anonymous researcher reported multiple vulnerabilities in rdesktop
+    via iDefense Labs:
+    </p>
+    <ul>
+    <li>An integer underflow error exists in
+    the function iso_recv_msg() in the file iso.c which can be triggered
+    via a specially crafted RDP request, causing a heap-based buffer
+    overflow (CVE-2008-1801).</li>
+    <li>An input validation error exists in
+    the function process_redirect_pdu() in the file rdp.c which can be
+    triggered via a specially crafted RDP redirect request, causing a
+    BSS-based buffer overflow (CVE-2008-1802).</li>
+    <li>
+    An integer signedness error exists in the function xrealloc() in the
+    file rdesktop.c which can be be exploited to cause a heap-based buffer
+    overflow (CVE-2008-1803).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit these vulnerabilities by enticing a user to
+    connect to a malicious RDP server thereby allowing the attacker to
+    execute arbitrary code or cause a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All rdesktop users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/rdesktop-1.6.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1801">CVE-2008-1801</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1802">CVE-2008-1802</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1803">CVE-2008-1803</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 19 May 2008 15:23:05 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 03 Jun 2008 15:21:36 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 07 Jun 2008 15:00:31 +0000">
+    mfleming
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200806-05.xml b/xml/htdocs/security/en/glsa/glsa-200806-05.xml
new file mode 100644
index 00000000..9073d92a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200806-05.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200806-05">
+  <title>cbrPager: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Insecure filename usage in cbrPager may allow for the remote execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">cbrpager</product>
+  <announced>June 16, 2008</announced>
+  <revised>June 16, 2008: 01</revised>
+  <bug>223657</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-misc/cbrpager" auto="yes" arch="*">
+      <unaffected range="ge">0.9.17</unaffected>
+      <vulnerable range="lt">0.9.17</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    cbrPager is a comic book pager.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mamoru Tasaka discovered that filenames of the image archives are not
+    properly sanitized before being passed to decompression utilities like
+    unrar and unzip, which use the system() libc library call.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open an archive with a
+    specially crafted filename, resulting in arbitrary code execution with
+    the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All cbrPager users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-misc/cbrpager-0.9.17&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2575">CVE-2008-2575</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 28 May 2008 17:48:23 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 03 Jun 2008 15:18:59 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 14 Jun 2008 21:12:52 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200806-06.xml b/xml/htdocs/security/en/glsa/glsa-200806-06.xml
new file mode 100644
index 00000000..ac26ccbd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200806-06.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200806-06">
+  <title>Evolution: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple vulnerabilities in Evolution may allow for user-assisted execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">evolution</product>
+  <announced>June 16, 2008</announced>
+  <revised>June 16, 2008: 01</revised>
+  <bug>223963</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/evolution" auto="yes" arch="*">
+      <unaffected range="ge">2.12.3-r2</unaffected>
+      <vulnerable range="lt">2.12.3-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Evolution is the mail client of the GNOME desktop environment.
+    </p>
+  </background>
+  <description>
+    <p>
+    Alin Rad Pop (Secunia Research) reported two vulnerabilities in
+    Evolution:
+    </p>
+    <ul><li>
+    A boundary error exists when parsing overly long timezone strings
+    contained within iCalendar attachments and when the ITip formatter is
+    disabled (CVE-2008-1108).</li>
+    <li>
+    A boundary error exists when replying to an iCalendar request with an
+    overly long "DESCRIPTION" property while in calendar view
+    (CVE-2008-1109).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    iCalendar attachment, resulting in the execution of arbitrary code with
+    the privileges of the user running Evolution.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Evolution users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/evolution-2.12.3-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1108">CVE-2008-1108</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1109">CVE-2008-1109</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 03 Jun 2008 15:11:52 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 05 Jun 2008 10:04:23 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 14 Jun 2008 21:39:04 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200806-07.xml b/xml/htdocs/security/en/glsa/glsa-200806-07.xml
new file mode 100644
index 00000000..90136c83
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200806-07.xml
@@ -0,0 +1,99 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200806-07">
+  <title>X.Org X server: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in the X.Org X server,
+    possibly allowing for the remote execution of arbitrary code with root
+    privileges.
+  </synopsis>
+  <product type="ebuild">xorg-server</product>
+  <announced>June 19, 2008</announced>
+  <revised>June 19, 2008: 01</revised>
+  <bug>225419</bug>
+  <access>remote, local</access>
+  <affected>
+    <package name="x11-base/xorg-server" auto="yes" arch="*">
+      <unaffected range="ge">1.3.0.0-r6</unaffected>
+      <vulnerable range="lt">1.3.0.0-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The X Window System is a graphical windowing system based on a
+    client/server model.
+    </p>
+  </background>
+  <description>
+    <p>
+    Regenrecht reported multiple vulnerabilities in various X server
+    extensions via iDefense:
+    </p>
+    <ul>
+    <li>The
+    SProcSecurityGenerateAuthorization() and SProcRecordCreateContext()
+    functions of the RECORD and Security extensions are lacking proper
+    parameter validation (CVE-2008-1377).</li>
+    <li>An integer overflow is
+    possible in the function ShmPutImage() of the MIT-SHM extension
+    (CVE-2008-1379).</li>
+    <li>The RENDER extension contains several
+    possible integer overflows in the AllocateGlyph() function
+    (CVE-2008-2360) which could possibly lead to a heap-based buffer
+    overflow. Further possible integer overflows have been found in the
+    ProcRenderCreateCursor() function (CVE-2008-2361) as well as in the
+    SProcRenderCreateLinearGradient(), SProcRenderCreateRadialGradient()
+    and SProcRenderCreateConicalGradient() functions (CVE-2008-2362).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    Exploitation of these vulnerabilities could possibly lead to the remote
+    execution of arbitrary code with root privileges, if the server is
+    running as root, which is the default. It is also possible to crash the
+    server by making use of these vulnerabilities.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    It is possible to avoid these vulnerabilities by disabling the affected
+    server extensions. Therefore edit the configuration file
+    (/etc/X11/xorg.conf) to contain the following in the appropriate
+    places:
+    </p>
+    <code>
+      Section &quot;Extensions&quot;   
+    	Option &quot;MIT-SHM&quot; &quot;disable&quot;
+    	Option &quot;RENDER&quot; &quot;disable&quot; 
+    	Option &quot;SECURITY&quot; &quot;disable&quot;
+      EndSection
+    
+      Section &quot;Module&quot;
+       Disable &quot;record&quot;
+      EndSection</code>
+  </workaround>
+  <resolution>
+    <p>
+    All X.org X Server users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-base/xorg-server-1.3.0.0-r6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1377">CVE-2008-1377</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1379">CVE-2008-1379</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2360">CVE-2008-2360</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2361">CVE-2008-2361</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2362">CVE-2008-2362</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 11 Jun 2008 10:16:02 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 16 Jun 2008 08:09:32 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200806-08.xml b/xml/htdocs/security/en/glsa/glsa-200806-08.xml
new file mode 100644
index 00000000..9b54bc79
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200806-08.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200806-08">
+  <title>OpenSSL: Denial of Service</title>
+  <synopsis>
+    Two vulnerabilities might allow for a Denial of Service of daemons using
+    OpenSSL.
+  </synopsis>
+  <product type="ebuild">openssl</product>
+  <announced>June 23, 2008</announced>
+  <revised>June 23, 2008: 01</revised>
+  <bug>223429</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/openssl" auto="yes" arch="*">
+      <unaffected range="ge">0.9.8g-r2</unaffected>
+      <unaffected range="lt">0.9.8f</unaffected>
+      <vulnerable range="lt">0.9.8g-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer
+    (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general
+    purpose cryptography library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Ossi Herrala and Jukka Taimisto of Codenomicon discovered two
+    vulnerabilities:
+    </p>
+    <ul>
+    <li>
+    A double free() call in the TLS server name extension (CVE-2008-0891).
+    </li>
+    <li>
+    The OpenSSL client code does not properly handle servers that omit the
+    Server Key Exchange message in the TLS handshake (CVE-2008-1672).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could connect to a vulnerable server, or entice a
+    daemon to connect to a malicious server, causing a Denial of Service of
+    the daemon in both cases.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenSSL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/openssl-0.9.8g-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0891">CVE-2008-0891</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1672">CVE-2008-1672</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 16 Jun 2008 22:48:49 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 16 Jun 2008 23:22:26 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 16 Jun 2008 23:22:36 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200806-09.xml b/xml/htdocs/security/en/glsa/glsa-200806-09.xml
new file mode 100644
index 00000000..c9b040a4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200806-09.xml
@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200806-09">
+  <title>libvorbis: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in libvorbis might lead to the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">libvorbis</product>
+  <announced>June 23, 2008</announced>
+  <revised>June 23, 2008: 02</revised>
+  <bug>222085</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libvorbis" auto="yes" arch="*">
+      <unaffected range="ge">1.2.1_rc1</unaffected>
+      <vulnerable range="lt">1.2.1_rc1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libvorbis is the reference implementation of the Xiph.org Ogg Vorbis
+    audio file format. It is used by many applications for playback of Ogg
+    Vorbis files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Will Drewry of the Google Security Team reported multiple
+    vulnerabilities in libvorbis:
+    </p>
+    <ul>
+    <li>
+    A zero value for "codebook.dim" is not properly handled, leading to a
+    crash, infinite loop or triggering an integer overflow
+    (CVE-2008-1419).
+    </li>
+    <li>
+    An integer overflow in "residue partition value" evaluation might lead
+    to a heap-based buffer overflow (CVE-2008-1420).
+    </li>
+    <li>
+    An integer overflow in a certain "quantvals" and "quantlist"
+    calculation might lead to a heap-based buffer overflow
+    (CVE-2008-1423).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities by enticing a
+    user to open a specially crafted Ogg Vorbis file or network stream with
+    an application using libvorbis. This might lead to the execution of
+    arbitrary code with the privileges of the user playing the file or a
+    Denial of Service by a crash or CPU consumption.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libvorbis users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libvorbis-1.2.1_rc1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1419">CVE-2008-1419</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1420">CVE-2008-1420</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1423">CVE-2008-1423</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 16 Jun 2008 22:45:51 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 16 Jun 2008 23:30:07 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 16 Jun 2008 23:30:17 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200806-10.xml b/xml/htdocs/security/en/glsa/glsa-200806-10.xml
new file mode 100644
index 00000000..e015fb59
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200806-10.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200806-10">
+  <title>FreeType: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Font parsing vulnerabilities in FreeType might lead to user-assisted
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">freetype</product>
+  <announced>June 23, 2008</announced>
+  <revised>May 28, 2009: 03</revised>
+  <bug>225851</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/freetype" auto="yes" arch="*">
+      <unaffected range="ge">2.3.6</unaffected>
+      <unaffected range="rge">1.4_pre20080316-r1</unaffected>
+      <vulnerable range="lt">2.3.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    FreeType is a font rendering library for TrueType Font (TTF) and
+    Printer Font Binary (PFB).
+    </p>
+  </background>
+  <description>
+    <p>
+    Regenrecht reported multiple vulnerabilities in FreeType via iDefense:
+    </p>
+    <ul>
+    <li>
+    An integer overflow when parsing values in the Private dictionary table
+    in a PFB file, leading to a heap-based buffer overflow
+    (CVE-2008-1806).
+    </li>
+    <li>
+    An invalid free() call related to parsing an invalid "number of axes"
+    field in a PFB file (CVE-2008-1807).
+    </li>
+    <li>
+    Multiple off-by-one errors when parsing PBF and TTF files, leading to
+    heap-based buffer overflows (CVE-2008-1808).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted TTF
+    or PBF file, possibly resulting in the execution of arbitrary code with
+    the privileges of the user running an application linked against
+    FreeType (such as the X.org X server, running as root).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All FreeType users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/freetype-2.3.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1806">CVE-2008-1806</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1807">CVE-2008-1807</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1808">CVE-2008-1808</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 12 Jun 2008 09:20:25 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 17 Jun 2008 00:04:48 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 17 Jun 2008 00:04:59 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200806-11.xml b/xml/htdocs/security/en/glsa/glsa-200806-11.xml
new file mode 100644
index 00000000..2cb49462
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200806-11.xml
@@ -0,0 +1,99 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200806-11">
+  <title>IBM JDK/JRE: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been found in IBM Java Development Kit (JDK)
+    and Java Runtime Environment (JRE), resulting in the execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">ibm-jdk-bin ibm-jre-bin</product>
+  <announced>June 25, 2008</announced>
+  <revised>June 25, 2008: 01</revised>
+  <bug>186277</bug>
+  <bug>198644</bug>
+  <bug>216112</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/ibm-jdk-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.7</unaffected>
+      <unaffected range="rge">1.4.2.11</unaffected>
+      <vulnerable range="lt">1.5.0.7</vulnerable>
+    </package>
+    <package name="dev-java/ibm-jre-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.5.0.7</unaffected>
+      <unaffected range="rge">1.4.2.11</unaffected>
+      <vulnerable range="lt">1.5.0.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The IBM Java Development Kit (JDK) and the IBM Java Runtime Environment
+    (JRE) provide the IBM Java platform.
+    </p>
+  </background>
+  <description>
+    <p>
+    Because of sharing the same codebase, IBM JDK and JRE are affected by
+    the vulnerabilities mentioned in GLSA 200804-20.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to run a specially crafted applet
+    on a website or start an application in Java Web Start to execute
+    arbitrary code outside of the Java sandbox and of the Java security
+    restrictions with the privileges of the user running Java. The attacker
+    could also obtain sensitive information, create, modify, rename and
+    read local files, execute local applications, establish connections in
+    the local network, bypass the same origin policy, and cause a Denial of
+    Service via multiple vectors.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All IBM JDK 1.5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/ibm-jdk-bin-1.5.0.7&quot;</code>
+    <p>
+    All IBM JDK 1.4 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/ibm-jdk-bin-1.4.2.11&quot;</code>
+    <p>
+    All IBM JRE 1.5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/ibm-jre-bin-1.5.0.7&quot;</code>
+    <p>
+    All IBM JRE 1.4 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/ibm-jre-bin-1.4.2.11&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200804-20.xml">GLSA 200804-20</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 05 Apr 2008 22:14:16 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 23 Apr 2008 17:16:09 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 24 Jun 2008 01:10:44 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200807-01.xml b/xml/htdocs/security/en/glsa/glsa-200807-01.xml
new file mode 100644
index 00000000..b25a6312
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200807-01.xml
@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200807-01">
+  <title>Python: Multiple integer overflows</title>
+  <synopsis>
+    Multiple integer overflows may allow for Denial of Service.
+  </synopsis>
+  <product type="ebuild">python</product>
+  <announced>July 01, 2008</announced>
+  <revised>July 01, 2008: 01</revised>
+  <bug>216673</bug>
+  <bug>217221</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/python" auto="yes" arch="*">
+      <unaffected range="rge">2.3.6-r6</unaffected>
+      <unaffected range="ge">2.4.4-r13</unaffected>
+      <vulnerable range="lt">2.4.4-r13</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Python is an interpreted, interactive, object-oriented programming
+    language.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities were discovered in Python:
+    </p>
+    <ul>
+    <li>David
+    Remahl reported multiple integer overflows in the file imageop.c,
+    leading to a heap-based buffer overflow (CVE-2008-1679). This issue is
+    due to an incomplete fix for CVE-2007-4965.</li>
+    <li>Justin Ferguson
+    discovered that an integer signedness error in the zlib extension
+    module might trigger insufficient memory allocation and a buffer
+    overflow via a negative signed integer (CVE-2008-1721).</li>
+    <li>Justin
+    Ferguson discovered that insufficient input validation in the
+    PyString_FromStringAndSize() function might lead to a buffer overflow
+    (CVE-2008-1887).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities to cause a Denial
+    of Service or possibly the remote execution of arbitrary code with the
+    privileges of the user running Python.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    The imageop module is no longer built in the unaffected versions.
+    </p>
+    <p>
+    All Python 2.3 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/python-2.3.6-r6&quot;</code>
+    <p>
+    All Python 2.4 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/python-2.4.4-r13&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1679">CVE-2008-1679</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1721">CVE-2008-1721</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1887">CVE-2008-1887</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 27 Jun 2008 08:54:25 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 01 Jul 2008 11:46:03 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200807-02.xml b/xml/htdocs/security/en/glsa/glsa-200807-02.xml
new file mode 100644
index 00000000..0c9a224e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200807-02.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200807-02">
+  <title>Motion: Execution of arbitrary code</title>
+  <synopsis>
+    Multiple vulnerabilities in Motion might result in the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">motion</product>
+  <announced>July 01, 2008</announced>
+  <revised>July 01, 2008: 01</revised>
+  <bug>227053</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/motion" auto="yes" arch="*">
+      <unaffected range="ge">3.2.10.1</unaffected>
+      <vulnerable range="lt">3.2.10.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Motion is a program that monitors the video signal from one or more
+    cameras and is able to detect motions.
+    </p>
+  </background>
+  <description>
+    <p>
+    Nico Golde reported an off-by-one error within the read_client()
+    function in the webhttpd.c file, leading to a stack-based buffer
+    overflow. Stefan Cornelius (Secunia Research) reported a boundary error
+    within the same function, also leading to a stack-based buffer
+    overflow. Both vulnerabilities require that the HTTP Control interface
+    is enabled.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities by sending an
+    overly long or specially crafted request to a vulnerable Motion HTTP
+    control interface, possibly resulting in the execution of arbitrary
+    code with the privileges of the motion user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Motion users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/motion-3.2.10.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2654">CVE-2008-2654</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 24 Jun 2008 00:58:06 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 25 Jun 2008 11:12:50 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 01 Jul 2008 11:55:40 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200807-03.xml b/xml/htdocs/security/en/glsa/glsa-200807-03.xml
new file mode 100644
index 00000000..32da5857
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200807-03.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200807-03">
+  <title>PCRE: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow vulnerability has been discovered in PCRE, allowing for
+    the execution of arbitrary code and a Denial of Service.
+  </synopsis>
+  <product type="ebuild">libpcre glib</product>
+  <announced>July 07, 2008</announced>
+  <revised>July 07, 2008: 01</revised>
+  <bug>228091</bug>
+  <bug>230039</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/libpcre" auto="yes" arch="*">
+      <unaffected range="ge">7.7-r1</unaffected>
+      <vulnerable range="lt">7.7-r1</vulnerable>
+    </package>
+    <package name="dev-libs/glib" auto="yes" arch="*">
+      <unaffected range="ge">2.16.3-r1</unaffected>
+      <unaffected range="lt">2.14.0</unaffected>
+      <vulnerable range="lt">2.16.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PCRE is a Perl-compatible regular expression library. GLib includes a
+    copy of PCRE.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy of the Google Security team reported a heap-based buffer
+    overflow when compiling regular expression patterns containing
+    "Internal Option Settings" such as "<i>(?i)</i>".
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this vulnerability by sending a
+    specially crafted regular expression to an application making use of
+    the PCRE library, which could possibly lead to the execution of
+    arbitrary code or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PCRE users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/libpcre-7.7-r1&quot;</code>
+    <p>
+    All GLib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/glib-2.16.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2371">CVE-2008-2371</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 07 Jul 2008 00:02:02 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 07 Jul 2008 00:02:22 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200807-04.xml b/xml/htdocs/security/en/glsa/glsa-200807-04.xml
new file mode 100644
index 00000000..92ef61a2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200807-04.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200807-04">
+  <title>Poppler: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Poppler is affected by a memory management issue, which could lead to the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">poppler</product>
+  <announced>July 08, 2008</announced>
+  <revised>July 08, 2008: 01</revised>
+  <bug>229931</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/poppler" auto="yes" arch="*">
+      <unaffected range="ge">0.6.3-r1</unaffected>
+      <vulnerable range="lt">0.6.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Poppler is a cross-platform PDF rendering library originally based on
+    Xpdf.
+    </p>
+  </background>
+  <description>
+    <p>
+    Felipe Andres Manzano reported a memory management issue in the Page
+    class constructor/destructor.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted PDF
+    file with a Poppler-based PDF viewer such as Gentoo's Xpdf, Epdfview,
+    or Evince, potentially resulting in the execution of arbitrary code
+    with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All poppler users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/poppler-0.6.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2950">CVE-2008-2950</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 07 Jul 2008 09:09:47 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 08 Jul 2008 18:44:36 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200807-05.xml b/xml/htdocs/security/en/glsa/glsa-200807-05.xml
new file mode 100644
index 00000000..3f93b327
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200807-05.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200807-05">
+  <title>OpenOffice.org: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    An integer overflow vulnerability has been reported in OpenOffice.org.
+  </synopsis>
+  <product type="ebuild">openoffice openoffice-bin</product>
+  <announced>July 09, 2008</announced>
+  <revised>July 09, 2008: 01</revised>
+  <bug>225723</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-office/openoffice" auto="yes" arch="*">
+      <unaffected range="ge">2.4.1</unaffected>
+      <vulnerable range="lt">2.4.1</vulnerable>
+    </package>
+    <package name="app-office/openoffice-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.4.1</unaffected>
+      <vulnerable range="lt">2.4.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenOffice.org is an open source office productivity suite, including
+    word processing, spreadsheet, presentation, drawing, data charting,
+    formula editing, and file conversion facilities.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sean Larsson (iDefense Labs) reported an integer overflow in the
+    function rtl_allocateMemory() in the file
+    sal/rtl/source/alloc_global.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    document, possibly resulting in the remote execution of arbitrary code
+    with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenOffice.org users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-2.4.1&quot;</code>
+    <p>
+    All OpenOffice.org binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-bin-2.4.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2152">CVE-2008-2152</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 07 Jul 2008 07:24:43 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 07 Jul 2008 07:24:50 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 07 Jul 2008 11:42:11 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200807-06.xml b/xml/htdocs/security/en/glsa/glsa-200807-06.xml
new file mode 100644
index 00000000..7b8a9ccd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200807-06.xml
@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200807-06">
+  <title>Apache: Denial of Service</title>
+  <synopsis>
+    Multiple vulnerabilities in Apache might lead to a Denial of Service.
+  </synopsis>
+  <product type="ebuild">apache</product>
+  <announced>July 09, 2008</announced>
+  <revised>July 09, 2008: 01</revised>
+  <bug>222643</bug>
+  <bug>227111</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="ge">2.2.9</unaffected>
+      <vulnerable range="lt">2.2.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP server is one of the most popular web servers on the
+    Internet.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in Apache:
+    </p>
+    <ul>
+    <li>
+    Dustin Kirkland reported that the mod_ssl module can leak memory when
+    the client reports support for a compression algorithm (CVE-2008-1678).
+    </li>
+    <li>
+    Ryujiro Shibuya reported that the ap_proxy_http_process_response()
+    function in the mod_proxy module does not limit the number of forwarded
+    interim responses (CVE-2008-2364).
+    </li>
+    <li>
+    sp3x of SecurityReason reported a Cross-Site Request Forgery
+    vulnerability in the balancer-manager in the mod_proxy_balancer module
+    (CVE-2007-6420).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities by connecting to
+    an Apache httpd, by causing an Apache proxy server to connect to a
+    malicious server, or by enticing a balancer administrator to connect to
+    a specially-crafted URL, resulting in a Denial of Service of the Apache
+    daemon.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Apache users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/apache-2.2.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6420">CVE-2007-6420</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1678">CVE-2008-1678</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2364">CVE-2008-2364</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 14 Jun 2008 10:47:39 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 16 Jun 2008 23:51:04 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 16 Jun 2008 23:51:13 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200807-07.xml b/xml/htdocs/security/en/glsa/glsa-200807-07.xml
new file mode 100644
index 00000000..bea41c45
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200807-07.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200807-07">
+  <title>NX: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    NX uses code from the X.org X11 server which is prone to multiple
+    vulnerabilities.
+  </synopsis>
+  <product type="ebuild">nx, nxnode</product>
+  <announced>July 09, 2008</announced>
+  <revised>July 09, 2008: 01</revised>
+  <bug>230147</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/nxnode" auto="yes" arch="*">
+      <unaffected range="ge">3.2.0-r3</unaffected>
+      <vulnerable range="lt">3.2.0-r3</vulnerable>
+    </package>
+    <package name="net-misc/nx" auto="yes" arch="*">
+      <unaffected range="ge">3.2.0-r2</unaffected>
+      <vulnerable range="lt">3.2.0-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    NoMachine's NX establishes remote connections to X11 desktops over
+    small bandwidth links. NX and NX Node are the compression core
+    libraries, whereas NX is used by FreeNX and NX Node by the binary-only
+    NX servers.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple integer overflow and buffer overflow vulnerabilities have been
+    discovered in the X.Org X server as shipped by NX and NX Node (GLSA
+    200806-07).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities via unspecified
+    vectors, leading to the execution of arbitrary code with the privileges
+    of the user on the machine running the NX server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All NX Node users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/nxnode-3.2.0-r3&quot;</code>
+    <p>
+    All NX users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/nx-3.2.0-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200806-07.xml">GLSA 200806-07</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 07 Jul 2008 00:06:37 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 07 Jul 2008 00:06:48 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200807-08.xml b/xml/htdocs/security/en/glsa/glsa-200807-08.xml
new file mode 100644
index 00000000..45e805f4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200807-08.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200807-08">
+  <title>BIND: Cache poisoning</title>
+  <synopsis>
+    A weakness in the DNS protocol has been reported, which could lead to cache
+    poisoning on recursive resolvers.
+  </synopsis>
+  <product type="ebuild">bind</product>
+  <announced>July 11, 2008</announced>
+  <revised>July 11, 2008: 01</revised>
+  <bug>231201</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/bind" auto="yes" arch="*">
+      <unaffected range="ge">9.4.2_p1</unaffected>
+      <vulnerable range="lt">9.4.2_p1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ISC BIND is the Internet Systems Consortium implementation of the
+    Domain Name System (DNS) protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dan Kaminsky of IOActive has reported a weakness in the DNS protocol
+    related to insufficient randomness of DNS transaction IDs and query
+    source ports.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An attacker could exploit this weakness to poison the cache of a
+    recursive resolver and thus spoof DNS traffic, which could e.g. lead to
+    the redirection of web or mail traffic to malicious sites.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All BIND users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/bind-9.4.2_p1&quot;</code>
+    <p>
+    Note: In order to utilize the query port randomization to mitigate the
+    weakness, you need to make sure that your network setup allows the DNS
+    server to use random source ports for query and that you have not set a
+    fixed query port via the "query-source port" directive in the BIND
+    configuration.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447">CVE-2008-1447</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 09 Jul 2008 08:55:27 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 09 Jul 2008 14:42:45 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 11 Jul 2008 17:35:39 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200807-09.xml b/xml/htdocs/security/en/glsa/glsa-200807-09.xml
new file mode 100644
index 00000000..b53a7d43
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200807-09.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200807-09">
+  <title>Mercurial: Directory traversal</title>
+  <synopsis>
+    A directory traversal vulnerability in Mercurial allows for the renaming of
+    arbitrary files.
+  </synopsis>
+  <product type="ebuild">mercurial</product>
+  <announced>July 15, 2008</announced>
+  <revised>July 15, 2008: 01</revised>
+  <bug>230193</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-util/mercurial" auto="yes" arch="*">
+      <unaffected range="ge">1.0.1-r2</unaffected>
+      <vulnerable range="lt">1.0.1-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mercurial is a distributed Source Control Management system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jakub Wilk discovered a directory traversal vulnerabilty in the
+    applydiff() function in the mercurial/patch.py file.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to import a specially crafted
+    patch, possibly resulting in the renaming of arbitrary files, even
+    outside the repository.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mercurial users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-util/mercurial-1.0.1-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2942">CVE-2008-2942</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 15 Jul 2008 10:37:24 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 15 Jul 2008 11:41:04 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 15 Jul 2008 11:48:10 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200807-10.xml b/xml/htdocs/security/en/glsa/glsa-200807-10.xml
new file mode 100644
index 00000000..37b07d2e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200807-10.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200807-10">
+  <title>Bacula: Information disclosure</title>
+  <synopsis>
+    A vulnerability in Bacula may allow local attackers to obtain sensitive
+    information.
+  </synopsis>
+  <product type="ebuild">bacula</product>
+  <announced>July 21, 2008</announced>
+  <revised>July 21, 2008: 01</revised>
+  <bug>196834</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-backup/bacula" auto="yes" arch="*">
+      <unaffected range="ge">2.4.1</unaffected>
+      <vulnerable range="lt">2.4.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Bacula is a network based backup suite.
+    </p>
+  </background>
+  <description>
+    <p>
+    Matthijs Kooijman reported that the "make_catalog_backup" script uses
+    the MySQL password as a command line argument when invoking other
+    programs.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could list the processes on the local machine when the
+    script is running to obtain the MySQL password. Note: The password
+    could also be disclosed via network sniffing attacks when the script
+    fails, in which case it would be sent via cleartext e-mail.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    A warning about this issue has been added in version 2.4.1, but the
+    issue is still unfixed. We advise not to use the make_catalog_backup
+    script, but to put all MySQL parameters into a dedicated file readable
+    only by the user running Bacula.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5626">CVE-2007-5626</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 15 Jul 2008 10:41:52 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 15 Jul 2008 11:29:18 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 15 Jul 2008 11:29:25 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200807-11.xml b/xml/htdocs/security/en/glsa/glsa-200807-11.xml
new file mode 100644
index 00000000..a63ac6c1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200807-11.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200807-11">
+  <title>PeerCast: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow vulnerability in PeerCast may allow for the remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">peercast</product>
+  <announced>July 21, 2008</announced>
+  <revised>July 21, 2008: 01</revised>
+  <bug>220281</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/peercast" auto="yes" arch="*">
+      <unaffected range="ge">0.1218-r1</unaffected>
+      <vulnerable range="lt">0.1218-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PeerCast is a client and server for P2P-radio networks.
+    </p>
+  </background>
+  <description>
+    <p>
+    Nico Golde reported a boundary error in the HTTP::getAuthUserPass()
+    function when processing overly long HTTP Basic authentication
+    requests.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send a specially crafted HTTP request to the
+    vulnerable server, possibly resulting in the remote execution of
+    arbitrary code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PeerCast users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/peercast-0.1218-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2040">CVE-2008-2040</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 08 Jul 2008 00:36:04 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 12 Jul 2008 19:41:58 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 20 Jul 2008 15:19:30 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200807-12.xml b/xml/htdocs/security/en/glsa/glsa-200807-12.xml
new file mode 100644
index 00000000..84ea28b9
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200807-12.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200807-12">
+  <title>BitchX: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in BitchX may allow for the remote execution of
+    arbitrary code or symlink attacks.
+  </synopsis>
+  <product type="ebuild">bitchx</product>
+  <announced>July 21, 2008</announced>
+  <revised>July 21, 2008: 01</revised>
+  <bug>190667</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-irc/bitchx" auto="yes" arch="*">
+      <vulnerable range="le">1.1-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    BitchX is an IRC client.
+    </p>
+  </background>
+  <description>
+    <p>
+    bannedit reported a boundary error when handling overly long IRC MODE
+    messages (CVE-2007-4584). Nico Golde reported an insecure creation of a
+    temporary file within the e_hostname() function (CVE-2007-5839).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to connect to a malicious IRC
+    server, resulting in the remote execution of arbitrary code with the
+    privileges of the user running the application. A local attacker could
+    perform symlink attacks to overwrite arbitrary files on the local
+    machine.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Since BitchX is no longer maintained, we recommend that users unmerge
+    the vulnerable package and switch to another IRC client:
+    </p>
+    <code>
+    # emerge --unmerge &quot;net-irc/bitchx&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4584">CVE-2007-4584</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5839">CVE-2007-5839</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 07 Jul 2008 22:27:23 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 07 Jul 2008 22:27:35 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 17 Jul 2008 11:41:45 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200807-13.xml b/xml/htdocs/security/en/glsa/glsa-200807-13.xml
new file mode 100644
index 00000000..a0bdc306
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200807-13.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200807-13">
+  <title>VLC: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in VLC may allow for the execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">vlc</product>
+  <announced>July 31, 2008</announced>
+  <revised>July 31, 2008: 01</revised>
+  <bug>221959</bug>
+  <bug>230692</bug>
+  <access>local, remote</access>
+  <affected>
+    <package name="media-video/vlc" auto="yes" arch="*">
+      <unaffected range="ge">0.8.6i</unaffected>
+      <vulnerable range="lt">0.8.6i</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    VLC is a cross-platform media player and streaming server.
+    </p>
+  </background>
+  <description>
+    <ul><li>Remi Denis-Courmont reported that VLC loads plugins from the
+    current working directory in an unsafe manner (CVE-2008-2147).</li>
+    <li>Alin Rad Pop (Secunia Research) reported an integer overflow error
+    in the Open() function in the file modules/demux/wav.c
+    (CVE-2008-2430).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted .wav
+    file, and a local attacker could entice a user to run VLC from a
+    directory containing specially crafted modules, possibly resulting in
+    the execution of arbitrary code with the privileges of the user running
+    the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All VLC users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/vlc-0.8.6i&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2147">CVE-2008-2147</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2430">CVE-2008-2430</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 22 May 2008 17:39:12 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 03 Jun 2008 15:20:33 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 22 Jul 2008 11:52:52 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200807-14.xml b/xml/htdocs/security/en/glsa/glsa-200807-14.xml
new file mode 100644
index 00000000..55375b1a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200807-14.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200807-14">
+  <title>Linux Audit: Buffer overflow</title>
+  <synopsis>
+    A buffer overflow vulnerability in Linux Audit may allow local attackers to
+    execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">audit</product>
+  <announced>July 31, 2008</announced>
+  <revised>July 31, 2008: 01</revised>
+  <bug>215705</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-process/audit" auto="yes" arch="*">
+      <unaffected range="ge">1.7.3</unaffected>
+      <vulnerable range="lt">1.7.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Linux Audit is a set of userspace utilities for storing and processing
+    auditing records.
+    </p>
+  </background>
+  <description>
+    <p>
+    A stack-based buffer overflow has been reported in the
+    audit_log_user_command() function in the file lib/audit_logging.c when
+    processing overly long arguments.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could execute a specially crafted command on the host
+    running Linux Audit, possibly resulting in the execution of arbitrary
+    code with the privileges of the user running Linux Audit.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Linux Audit users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-process/audit-1.7.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1628">CVE-2008-1628</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 21 Jul 2008 20:07:20 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 21 Jul 2008 20:07:28 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200807-15.xml b/xml/htdocs/security/en/glsa/glsa-200807-15.xml
new file mode 100644
index 00000000..074edab8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200807-15.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200807-15">
+  <title>Pan: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow vulnerability in Pan may allow remote attacker to execute
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">pan</product>
+  <announced>July 31, 2008</announced>
+  <revised>July 31, 2008: 01</revised>
+  <bug>224051</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-nntp/pan" auto="yes" arch="*">
+      <unaffected range="ge">0.132-r3</unaffected>
+      <unaffected range="rge">0.14.2.91-r2</unaffected>
+      <unaffected range="eq">0.14.2</unaffected>
+      <vulnerable range="lt">0.132-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Pan is a newsreader for the GNOME desktop.
+    </p>
+  </background>
+  <description>
+    <p>
+    Pavel Polischouk reported a boundary error in the PartsBatch class when
+    processing .nzb files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted .nzb
+    file, possibly resulting in the remote execution of arbitrary code with
+    the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Pan users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-nntp/pan-0.132-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2363">CVE-2008-2363</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 01 Jul 2008 08:32:55 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 04 Jul 2008 13:13:53 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 22 Jul 2008 11:35:24 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200807-16.xml b/xml/htdocs/security/en/glsa/glsa-200807-16.xml
new file mode 100644
index 00000000..c1b2dfa1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200807-16.xml
@@ -0,0 +1,109 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200807-16">
+  <title>Python: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Python may allow for the execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">python</product>
+  <announced>July 31, 2008</announced>
+  <revised>July 19, 2009: 02</revised>
+  <bug>230640</bug>
+  <bug>232137</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/python" auto="yes" arch="*">
+      <unaffected range="rge">2.4.4-r14</unaffected>
+      <unaffected range="ge">2.5.2-r6</unaffected>
+      <unaffected range="rge">2.4.6</unaffected>
+      <vulnerable range="lt">2.5.2-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Python is an interpreted, interactive, object-oriented programming
+    language.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities were discovered in Python:
+    </p>
+    <ul>
+    <li>
+    David Remahl of Apple Product Security reported several integer
+    overflows in core modules such as stringobject, unicodeobject,
+    bufferobject, longobject, tupleobject, stropmodule, gcmodule,
+    mmapmodule (CVE-2008-2315).
+    </li>
+    <li>
+    David Remahl of Apple Product Security also reported an integer
+    overflow in the hashlib module, leading to unreliable cryptographic
+    digest results (CVE-2008-2316).
+    </li>
+    <li>
+    Justin Ferguson reported multiple buffer overflows in unicode string
+    processing that only affect 32bit systems (CVE-2008-3142).
+    </li>
+    <li>
+    The Google Security Team reported multiple integer overflows
+    (CVE-2008-3143).
+    </li>
+    <li>
+    Justin Ferguson reported multiple integer underflows and overflows in
+    the PyOS_vsnprintf() function, and an off-by-one error when passing
+    zero-length strings, leading to memory corruption (CVE-2008-3144).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities in Python
+    applications or daemons that pass user-controlled input to vulnerable
+    functions. Exploitation might lead to the execution of arbitrary code
+    or a Denial of Service. Vulnerabilities within the hashlib might lead
+    to weakened cryptographic protection of data integrity or authenticity.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Python 2.4 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/python-2.4.4-r14&quot;</code>
+    <p>
+    All Python 2.5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/python-2.5.2-r6&quot;</code>
+    <p>
+    Please note that Python 2.3 is masked since June 24, and we will not be
+    releasing updates to it. It will be removed from the tree in the near
+    future.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2315">CVE-2008-2315</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2316">CVE-2008-2316</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3142">CVE-2008-3142</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3143">CVE-2008-3143</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3144">CVE-2008-3144</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 31 Jul 2008 15:42:37 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 31 Jul 2008 15:45:02 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200808-01.xml b/xml/htdocs/security/en/glsa/glsa-200808-01.xml
new file mode 100644
index 00000000..3fdb8c4e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200808-01.xml
@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200808-01">
+  <title>xine-lib: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    xine-lib is vulnerable to multiple buffer overflows when processing media
+    streams.
+  </synopsis>
+  <product type="ebuild">xine-lib</product>
+  <announced>August 06, 2008</announced>
+  <revised>August 06, 2008: 01</revised>
+  <bug>213039</bug>
+  <bug>214270</bug>
+  <bug>218059</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/xine-lib" auto="yes" arch="*">
+      <unaffected range="ge">1.1.13</unaffected>
+      <vulnerable range="lt">1.1.13</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xine-lib is the core library package for the xine media player, and
+    other players such as Amarok, Codeine/Dragon Player and Kaffeine.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in xine-lib:
+    </p>
+    <ul>
+    <li>
+    Alin Rad Pop of Secunia reported an array indexing vulnerability in the
+    sdpplin_parse() function in the file input/libreal/sdpplin.c when
+    processing streams from RTSP servers that contain a large "streamid"
+    SDP parameter (CVE-2008-0073).
+    </li>
+    <li>
+    Luigi Auriemma reported multiple integer overflows that result in
+    heap-based buffer overflows when processing ".FLV", ".MOV" ".RM",
+    ".MVE", ".MKV", and ".CAK" files (CVE-2008-1482).
+    </li>
+    <li>
+    Guido Landi reported a stack-based buffer overflow in the
+    demux_nsf_send_chunk() function when handling titles within NES Music
+    (.NSF) files (CVE-2008-1878).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to play a specially crafted video
+    file or stream with a player using xine-lib, potentially resulting in
+    the execution of arbitrary code with the privileges of the user running
+    the player.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xine-lib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/xine-lib-1.1.13&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0073">CVE-2008-0073</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1482">CVE-2008-1482</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1878">CVE-2008-1878</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 24 Mar 2008 19:44:35 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 10 Apr 2008 20:23:27 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 14 Apr 2008 00:56:00 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200808-02.xml b/xml/htdocs/security/en/glsa/glsa-200808-02.xml
new file mode 100644
index 00000000..7f44d3e8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200808-02.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200808-02">
+  <title>Net-SNMP: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Net-SNMP allow for authentication bypass in
+    snmpd and execution of arbitrary code in Perl applications using Net-SMNP.
+  </synopsis>
+  <product type="ebuild">net-snmp</product>
+  <announced>August 06, 2008</announced>
+  <revised>August 06, 2008: 01</revised>
+  <bug>222265</bug>
+  <bug>225105</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/net-snmp" auto="yes" arch="*">
+      <unaffected range="ge">5.4.1.1</unaffected>
+      <vulnerable range="lt">5.4.1.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Net-SNMP is a collection of tools for generating and retrieving SNMP
+    data. The SNMPv3 protocol uses a keyed-Hash Message Authentication Code
+    (HMAC) to verify data integrity and authenticity of SNMP messages.
+    </p>
+  </background>
+  <description>
+    <p>
+    Wes Hardaker reported that the SNMPv3 HMAC verification relies on the
+    client to specify the HMAC length (CVE-2008-0960). John Kortink
+    reported a buffer overflow in the Perl bindings of Net-SNMP when
+    processing the OCTETSTRING in an attribute value pair (AVP) received by
+    an SNMP agent (CVE-2008-2292).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could send SNMPv3 packets to an instance of snmpd providing
+    a valid user name and an HMAC length value of 1, and easily conduct
+    brute-force attacks to bypass SNMP authentication. An attacker could
+    further entice a user to connect to a malicious SNMP agent with an SNMP
+    client using the Perl bindings, possibly resulting in the execution of
+    arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Net-SNMP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/net-snmp-5.4.1.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0960">CVE-2008-0960</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2292">CVE-2008-2292</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 02 Jul 2008 11:15:36 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 04 Jul 2008 13:09:07 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 07 Jul 2008 08:46:03 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200808-03.xml b/xml/htdocs/security/en/glsa/glsa-200808-03.xml
new file mode 100644
index 00000000..94249543
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200808-03.xml
@@ -0,0 +1,249 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200808-03">
+  <title>Mozilla products: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been reported in Mozilla Firefox,
+    Thunderbird, SeaMonkey and XULRunner, some of which may allow user-assisted
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mozilla-firefox mozilla-firefox-bin mozilla-thunderbird mozilla-thunderbird-bin seamonkey seamonkey-bin xulrunner xulrunner-bin</product>
+  <announced>August 06, 2008</announced>
+  <revised>August 06, 2008: 01</revised>
+  <bug>204337</bug>
+  <bug>218065</bug>
+  <bug>230567</bug>
+  <bug>231975</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/mozilla-firefox" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.16</unaffected>
+      <vulnerable range="lt">2.0.0.16</vulnerable>
+    </package>
+    <package name="www-client/mozilla-firefox-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.16</unaffected>
+      <vulnerable range="lt">2.0.0.16</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.16</unaffected>
+      <vulnerable range="lt">2.0.0.16</vulnerable>
+    </package>
+    <package name="mail-client/mozilla-thunderbird-bin" auto="yes" arch="*">
+      <unaffected range="ge">2.0.0.16</unaffected>
+      <vulnerable range="lt">2.0.0.16</vulnerable>
+    </package>
+    <package name="www-client/seamonkey" auto="yes" arch="*">
+      <unaffected range="ge">1.1.11</unaffected>
+      <vulnerable range="lt">1.1.11</vulnerable>
+    </package>
+    <package name="www-client/seamonkey-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.1.11</unaffected>
+      <vulnerable range="lt">1.1.11</vulnerable>
+    </package>
+    <package name="net-libs/xulrunner" auto="yes" arch="*">
+      <unaffected range="ge">1.8.1.16</unaffected>
+      <vulnerable range="lt">1.8.1.16</vulnerable>
+    </package>
+    <package name="net-libs/xulrunner-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.8.1.16</unaffected>
+      <vulnerable range="lt">1.8.1.16</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mozilla Firefox is an open-source web browser and Mozilla Thunderbird
+    an open-source email client, both from the Mozilla Project. The
+    SeaMonkey project is a community effort to deliver production-quality
+    releases of code derived from the application formerly known as the
+    'Mozilla Application Suite'. XULRunner is a Mozilla runtime package
+    that can be used to bootstrap XUL+XPCOM applications like Firefox and
+    Thunderbird.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were reported in all mentioned Mozilla
+    products:
+    </p>
+    <ul>
+    <li>
+    TippingPoint's Zero Day Initiative reported that an incorrect integer
+    data type is used as a CSS object reference counter, leading to a
+    counter overflow and a free() of in-use memory (CVE-2008-2785).
+    </li>
+    <li>
+    Igor Bukanov, Jesse Ruderman and Gary Kwong reported crashes in the
+    JavaScript engine, possibly triggering memory corruption
+    (CVE-2008-2799).
+    </li>
+    <li>
+    Devon Hubbard, Jesse Ruderman, and Martijn Wargers reported crashes in
+    the layout engine, possibly triggering memory corruption
+    (CVE-2008-2798).
+    </li>
+    <li>
+    moz_bug_r_a4 reported that XUL documents that include a script from a
+    chrome: URI that points to a fastload file would be executed with the
+    privileges specified in the file (CVE-2008-2802).
+    </li>
+    <li>
+    moz_bug_r_a4 reported that the mozIJSSubScriptLoader.LoadScript()
+    function only apply XPCNativeWrappers to scripts loaded from standard
+    "chrome:" URIs, which could be the case in third-party add-ons
+    (CVE-2008-2803).
+    </li>
+    <li>
+    Astabis reported a crash in the block reflow implementation related to
+    large images (CVE-2008-2811).
+    </li>
+    <li>
+    John G. Myers, Frank Benkstein and Nils Toedtmann reported a weakness
+    in the trust model used by Mozilla, that when a user accepts an SSL
+    server certificate on the basis of the CN domain name in the DN field,
+    the certificate is also regarded as accepted for all domain names in
+    subjectAltName:dNSName fields (CVE-2008-2809).
+    </li>
+    </ul> <p>
+    The following vulnerabilities were reported in Firefox, SeaMonkey and
+    XULRunner:
+    </p>
+    <ul>
+    <li>
+    moz_bug_r_a4 reported that the Same Origin Policy is not properly
+    enforced on JavaScript (CVE-2008-2800).
+    </li>
+    <li>
+    Collin Jackson and Adam Barth reported that JAR signing is not properly
+    implemented, allowing injection of JavaScript into documents within a
+    JAR archive (CVE-2008-2801).
+    </li>
+    <li>
+    Opera Software reported an error allowing for arbitrary local file
+    upload (CVE-2008-2805).
+    </li>
+    <li>
+    Daniel Glazman reported that an invalid .properties file for an add-on
+    might lead to the usage of uninitialized memory (CVE-2008-2807).
+    </li>
+    <li>
+    Masahiro Yamada reported that HTML in "file://" URLs in directory
+    listings is not properly escaped (CVE-2008-2808).
+    </li>
+    <li>
+    Geoff reported that the context of Windows Internet shortcut files is
+    not correctly identified (CVE-2008-2810).
+    </li>
+    <li>
+    The crash vulnerability (CVE-2008-1380) that was previously announced
+    in GLSA 200805-18 is now also also resolved in Seamonkey binary
+    ebuilds.
+    </li>
+    </ul> <p>
+    The following vulnerability was reported in Firefox only:
+    </p>
+    <ul>
+    <li>
+    Billy Rios reported that the Pipe character in a command-line URI is
+    identified as a request to open multiple tabs, allowing to open
+    "chrome" and "file" URIs (CVE-2008-2933).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to view a specially crafted web
+    page or email that will trigger one of the vulnerabilities, possibly
+    leading to the execution of arbitrary code or a Denial of Service. It
+    is also possible for an attacker to trick a user to upload arbitrary
+    files or to accept an invalid certificate for a spoofed web site, to
+    read uninitialized memory, to violate Same Origin Policy, or to conduct
+    Cross-Site Scripting attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mozilla Firefox users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-2.0.0.16&quot;</code>
+    <p>
+    All Mozilla Firefox binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/mozilla-firefox-bin-2.0.0.16&quot;</code>
+    <p>
+    All Mozilla Thunderbird users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-2.0.0.16&quot;</code>
+    <p>
+    All Mozilla Thunderbird binary users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/mozilla-thunderbird-bin-2.0.0.16&quot;</code>
+    <p>
+    All Seamonkey users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/seamonkey-1.1.11&quot;</code>
+    <p>
+    All Seamonkey binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/seamonkey-bin-1.1.11&quot;</code>
+    <p>
+    All XULRunner users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/xulrunner-1.8.1.16&quot;</code>
+    <p>
+    All XULRunner binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/xulrunner-bin-1.8.1.16&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1380">CVE-2008-1380</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2785">CVE-2008-2785</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2798">CVE-2008-2798</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2799">CVE-2008-2799</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2800">CVE-2008-2800</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2801">CVE-2008-2801</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2802">CVE-2008-2802</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2803">CVE-2008-2803</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2805">CVE-2008-2805</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2807">CVE-2008-2807</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2808">CVE-2008-2808</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2809">CVE-2008-2809</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2810">CVE-2008-2810</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2811">CVE-2008-2811</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2933">CVE-2008-2933</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml">GLSA 200805-18</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 06 Jul 2008 18:09:54 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 30 Jul 2008 20:08:31 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 06 Aug 2008 00:34:26 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200808-04.xml b/xml/htdocs/security/en/glsa/glsa-200808-04.xml
new file mode 100644
index 00000000..6707e707
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200808-04.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200808-04">
+  <title>Wireshark: Denial of Service</title>
+  <synopsis>
+    Multiple Denial of Service vulnerabilities have been discovered in
+    Wireshark.
+  </synopsis>
+  <product type="ebuild">wireshark</product>
+  <announced>August 06, 2008</announced>
+  <revised>August 06, 2008: 01</revised>
+  <bug>230411</bug>
+  <bug>231587</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/wireshark" auto="yes" arch="*">
+      <unaffected range="ge">1.0.2</unaffected>
+      <vulnerable range="lt">1.0.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Wireshark is a network protocol analyzer with a graphical front-end.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities related to memory management were discovered
+    in the GSM SMS dissector (CVE-2008-3137), the PANA and KISMET
+    dissectors (CVE-2008-3138), the RTMPT dissector (CVE-2008-3139), the
+    syslog dissector (CVE-2008-3140) and the RMI dissector (CVE-2008-3141)
+    and when reassembling fragmented packets (CVE-2008-3145).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities by sending a
+    specially crafted packet on a network being monitored by Wireshark or
+    enticing a user to read a malformed packet trace file, causing a Denial
+    of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Wireshark users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/wireshark-1.0.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3137">CVE-2008-3137</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3138">CVE-2008-3138</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3139">CVE-2008-3139</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3140">CVE-2008-3140</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3141">CVE-2008-3141</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3145">CVE-2008-3145</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 15 Jul 2008 10:40:07 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 30 Jul 2008 18:25:58 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 30 Jul 2008 18:26:07 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200808-05.xml b/xml/htdocs/security/en/glsa/glsa-200808-05.xml
new file mode 100644
index 00000000..b9a82601
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200808-05.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200808-05">
+  <title>ISC DHCP: Denial of Service</title>
+  <synopsis>
+    A Denial of Service vulnerability was discovered in ISC DHCP.
+  </synopsis>
+  <product type="ebuild">dhcp</product>
+  <announced>August 06, 2008</announced>
+  <revised>August 06, 2008: 01</revised>
+  <bug>227135</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/dhcp" auto="yes" arch="*">
+      <unaffected range="ge">3.1.1</unaffected>
+      <vulnerable range="lt">3.1.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ISC DHCP is ISC's reference implementation of all aspects of the
+    Dynamic Host Configuration Protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    A buffer overflow error was found in ISC DHCP server, that can only be
+    exploited under unusual server configurations where the DHCP server is
+    configured to provide clients with a large set of DHCP options.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit this vulnerability to cause a Denial of
+    Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ISC DHCP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/dhcp-3.1.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0062">CVE-2007-0062</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 01 Jul 2008 08:33:40 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 04 Jul 2008 13:11:49 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 01 Aug 2008 23:00:13 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200808-06.xml b/xml/htdocs/security/en/glsa/glsa-200808-06.xml
new file mode 100644
index 00000000..6e21c89f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200808-06.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200808-06">
+  <title>libxslt: Execution of arbitrary code</title>
+  <synopsis>
+    libxslt is affected by a heap-based buffer overflow, possibly leading to
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">libxslt</product>
+  <announced>August 06, 2008</announced>
+  <revised>August 06, 2008: 01</revised>
+  <bug>232172</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/libxslt" auto="yes" arch="*">
+      <unaffected range="ge">1.1.24-r1</unaffected>
+      <unaffected range="lt">1.1.8</unaffected>
+      <vulnerable range="lt">1.1.24-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libxslt is the XSLT C library developed for the GNOME project. XSLT is
+    an XML language to define transformations for XML.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Evans (Google Security) reported that the libexslt library that
+    is part of libxslt is affected by a heap-based buffer overflow in the
+    RC4 encryption/decryption functions.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to process an XML file using a
+    specially crafted XSLT stylesheet in an application linked against
+    libxslt, possibly leading to the execution of arbitrary code with the
+    privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libxslt users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/libxslt-1.1.24-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2935">CVE-2008-2935</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 31 Jul 2008 23:42:58 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 01 Aug 2008 23:18:29 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 01 Aug 2008 23:18:48 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200808-07.xml b/xml/htdocs/security/en/glsa/glsa-200808-07.xml
new file mode 100644
index 00000000..fef05c97
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200808-07.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200808-07">
+  <title>ClamAV: Multiple Denials of Service</title>
+  <synopsis>
+    Multiple vulnerabilities in ClamAV may result in a Denial of Service.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>August 08, 2008</announced>
+  <revised>August 08, 2008: 01</revised>
+  <bug>204340</bug>
+  <bug>227351</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.93.3</unaffected>
+      <vulnerable range="lt">0.93.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Clam AntiVirus is a free anti-virus toolkit for UNIX, designed
+    especially for e-mail scanning on mail gateways.
+    </p>
+  </background>
+  <description>
+    <p>
+    Damian Put has discovered an out-of-bounds memory access while
+    processing Petite files (CVE-2008-2713, CVE-2008-3215). Also, please
+    note that the 0.93 ClamAV branch fixes the first of the two attack
+    vectors of CVE-2007-6595 concerning an insecure creation of temporary
+    files vulnerability. The sigtool attack vector seems still unfixed.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker could entice a user or automated system to scan a
+    specially crafted Petite file, possibly resulting in a Denial of
+    Service (daemon crash). Also, the insecure creation of temporary files
+    vulnerability can be triggered by a local user to perform a symlink
+    attack.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.93.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6595">CVE-2007-6595</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2713">CVE-2008-2713</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3215">CVE-2008-3215</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 03 Aug 2008 21:50:46 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 05 Aug 2008 21:44:31 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 05 Aug 2008 21:46:23 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200808-08.xml b/xml/htdocs/security/en/glsa/glsa-200808-08.xml
new file mode 100644
index 00000000..f7a589db
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200808-08.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200808-08">
+  <title>stunnel: Security bypass</title>
+  <synopsis>
+    stunnel does not properly prevent the authentication of a revoked
+    certificate which would be published by OCSP.
+  </synopsis>
+  <product type="ebuild">stunnel</product>
+  <announced>August 08, 2008</announced>
+  <revised>August 09, 2009: 02</revised>
+  <bug>222805</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/stunnel" auto="yes" arch="*">
+      <unaffected range="ge">4.24</unaffected>
+      <unaffected range="lt">4</unaffected>
+      <vulnerable range="lt">4.24</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The stunnel program is designed to work as an SSL encryption wrapper
+    between a remote client and a local or remote server. OCSP (Online
+    Certificate Status Protocol), as described in RFC 2560, is an internet
+    protocol used for obtaining the revocation status of an X.509 digital
+    certificate.
+    </p>
+  </background>
+  <description>
+    <p>
+    An unspecified bug in the OCSP search functionality of stunnel has been
+    discovered.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker can use a revoked certificate that would be
+    successfully authenticated by stunnel. This issue only concerns the
+    users who have enabled the OCSP validation in stunnel.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All stunnel users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/stunnel-4.24&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2420">CVE-2008-2420</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 03 Aug 2008 21:53:49 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 05 Aug 2008 21:07:35 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 05 Aug 2008 21:08:30 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200808-09.xml b/xml/htdocs/security/en/glsa/glsa-200808-09.xml
new file mode 100644
index 00000000..60d8c59e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200808-09.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200808-09">
+  <title>OpenLDAP: Denial of Service vulnerability</title>
+  <synopsis>
+    A flaw in OpenLDAP allows remote unauthenticated attackers to cause a
+    Denial of Service.
+  </synopsis>
+  <product type="ebuild">openldap</product>
+  <announced>August 08, 2008</announced>
+  <revised>August 08, 2008: 01</revised>
+  <bug>230269</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-nds/openldap" auto="yes" arch="*">
+      <unaffected range="ge">2.3.43</unaffected>
+      <vulnerable range="lt">2.3.43</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenLDAP Software is an open source implementation of the Lightweight
+    Directory Access Protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    Cameron Hotchkies discovered an error within the parsing of ASN.1 BER
+    encoded packets in the "ber_get_next()" function in
+    libraries/liblber/io.c.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote unauthenticated attacker can send a specially crafted ASN.1
+    BER encoded packet which will trigger the error and cause an
+    "assert()", terminating the "slapd" daemon.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenLDAP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-nds/openldap-2.3.43&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2952">CVE-2008-2952</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 05 Aug 2008 20:53:02 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 05 Aug 2008 20:54:49 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200808-10.xml b/xml/htdocs/security/en/glsa/glsa-200808-10.xml
new file mode 100644
index 00000000..38013f19
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200808-10.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200808-10">
+  <title>Adobe Reader: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Adobe Reader is vulnerable to execution of arbitrary code via a crafted
+    PDF.
+  </synopsis>
+  <product type="ebuild">acroread</product>
+  <announced>August 09, 2008</announced>
+  <revised>August 09, 2008: 01</revised>
+  <bug>233383</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/acroread" auto="yes" arch="*">
+      <unaffected range="ge">8.1.2-r3</unaffected>
+      <vulnerable range="lt">8.1.2-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Adobe Reader (formerly Adobe Acrobat Reader) is a closed-source PDF
+    reader.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Johns Hopkins University Applied Physics Laboratory reported that
+    input to an unspecified JavaScript method is not properly validated.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted PDF
+    document, possibly resulting in the remote execution of arbitrary code
+    with the privileges of the user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Adobe Reader users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/acroread-8.1.2-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2641">CVE-2008-2641</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 06 Aug 2008 23:14:17 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 06 Aug 2008 23:14:50 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200808-11.xml b/xml/htdocs/security/en/glsa/glsa-200808-11.xml
new file mode 100644
index 00000000..8c848a43
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200808-11.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200808-11">
+  <title>UUDeview: Insecure temporary file creation</title>
+  <synopsis>
+    A vulnerability in UUDeview may allow local attackers to conduct symlink
+    attacks.
+  </synopsis>
+  <product type="ebuild">nzbget uudeview</product>
+  <announced>August 11, 2008</announced>
+  <revised>August 11, 2008: 01</revised>
+  <bug>222275</bug>
+  <bug>224193</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-text/uudeview" auto="yes" arch="*">
+      <unaffected range="ge">0.5.20-r1</unaffected>
+      <vulnerable range="lt">0.5.20-r1</vulnerable>
+    </package>
+    <package name="news-nntp/nzbget" auto="yes" arch="*">
+      <unaffected range="ge">0.4.0</unaffected>
+      <vulnerable range="lt">0.4.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    UUdeview is encoder and decoder supporting various binary formats.
+    NZBGet is a command-line based binary newsgrabber supporting .nzb
+    files.
+    </p>
+  </background>
+  <description>
+    <p>
+    UUdeview makes insecure usage of the tempnam() function when creating
+    temporary files. NZBGet includes a copy of the vulnerable code.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit this vulnerability to overwrite
+    arbitrary files on the system.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All UUDview users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/uudeview-0.5.20-r1&quot;</code>
+    <p>
+    All NZBget users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=news-nntp/nzbget-0.4.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2266">CVE-2008-2266</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 06 Jul 2008 18:30:42 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 06 Jul 2008 18:32:00 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 22 Jul 2008 11:22:12 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200808-12.xml b/xml/htdocs/security/en/glsa/glsa-200808-12.xml
new file mode 100644
index 00000000..7f564f49
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200808-12.xml
@@ -0,0 +1,126 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200808-12">
+  <title>Postfix: Local privilege escalation vulnerability</title>
+  <synopsis>
+    Postfix incorrectly checks the ownership of a mailbox, allowing, in certain
+    circumstances, to append data to arbitrary files on a local system with
+    root privileges.
+  </synopsis>
+  <product type="ebuild">postfix</product>
+  <announced>August 14, 2008</announced>
+  <revised>October 23, 2008: 02</revised>
+  <bug>232642</bug>
+  <access>local</access>
+  <affected>
+    <package name="mail-mta/postfix" auto="yes" arch="*">
+      <unaffected range="rge">2.4.7-r1</unaffected>
+      <unaffected range="ge">2.5.3-r1</unaffected>
+      <unaffected range="rge">2.4.8</unaffected>
+      <unaffected range="ge">2.4.9</unaffected>
+      <vulnerable range="lt">2.5.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Postfix is Wietse Venema's mailer that attempts to be fast, easy to
+    administer, and secure, as an alternative to the widely-used Sendmail
+    program.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sebastian Krahmer of SuSE has found that Postfix allows to deliver mail
+    to root-owned symlinks in an insecure manner under certain conditions.
+    Normally, Postfix does not deliver mail to symlinks, except to
+    root-owned symlinks, for compatibility with the systems using symlinks
+    in /dev like Solaris. Furthermore, some systems like Linux allow to
+    hardlink a symlink, while the POSIX.1-2001 standard requires that the
+    symlink is followed. Depending on the write permissions and the
+    delivery agent being used, this can lead to an arbitrary local file
+    overwriting vulnerability (CVE-2008-2936). Furthermore, the Postfix
+    delivery agent does not properly verify the ownership of a mailbox
+    before delivering mail (CVE-2008-2937).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    The combination of these features allows a local attacker to hardlink a
+    root-owned symlink such that the newly created symlink would be
+    root-owned and would point to a regular file (or another symlink) that
+    would be written by the Postfix built-in local(8) or virtual(8)
+    delivery agents, regardless the ownership of the final destination
+    regular file. Depending on the write permissions of the spool mail
+    directory, the delivery style, and the existence of a root mailbox,
+    this could allow a local attacker to append a mail to an arbitrary file
+    like /etc/passwd in order to gain root privileges.
+    </p>
+    <p>
+    The default configuration of Gentoo Linux does not permit any kind of
+    user privilege escalation.
+    </p>
+    <p>
+    The second vulnerability (CVE-2008-2937) allows a local attacker,
+    already having write permissions to the mail spool directory which is
+    not the case on Gentoo by default, to create a previously nonexistent
+    mailbox before Postfix creates it, allowing to read the mail of another
+    user on the system.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    The following conditions should be met in order to be vulnerable to
+    local privilege escalation.
+    </p>
+    <ul>
+    <li>The mail delivery style is mailbox, with the Postfix built-in
+    local(8) or virtual(8) delivery agents.</li>
+    <li>The mail spool directory (/var/spool/mail) is user-writeable.</li>
+    <li>The user can create hardlinks pointing to root-owned symlinks
+    located in other directories.</li>
+    </ul>
+    <p>
+    Consequently, each one of the following workarounds is efficient.
+    </p>
+    <ul>
+    <li>Verify that your /var/spool/mail directory is not writeable by a
+    user. Normally on Gentoo, only the mail group has write access, and no
+    end-user should be granted the mail group ownership.</li>
+    <li>Prevent the local users from being able to create hardlinks
+    pointing outside of the /var/spool/mail directory, e.g. with a
+    dedicated partition.</li>
+    <li>Use a non-builtin Postfix delivery agent, like procmail or
+    maildrop.</li>
+    <li>Use the maildir delivery style of Postfix ("home_mailbox=Maildir/"
+    for example).</li>
+    </ul>
+    <p>
+    Concerning the second vulnerability, check the write permissions of
+    /var/spool/mail, or check that every Unix account already has a
+    mailbox, by using Wietse Venema's Perl script available in the official
+    advisory.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Postfix users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-mta/postfix-2.5.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2936">CVE-2008-2936</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2937">CVE-2008-2937</uri>
+    <uri link="http://article.gmane.org/gmane.mail.postfix.announce/110">Official Advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 14 Aug 2008 13:13:26 +0000">
+    falco
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 14 Aug 2008 22:37:03 +0000">
+    falco
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200809-01.xml b/xml/htdocs/security/en/glsa/glsa-200809-01.xml
new file mode 100644
index 00000000..816ecfd6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200809-01.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200809-01">
+  <title>yelp: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A vulnerability in yelp can lead to the execution of arbitrary code when
+    opening a URI, for example through Firefox.
+  </synopsis>
+  <product type="ebuild">yelp</product>
+  <announced>September 04, 2008</announced>
+  <revised>September 04, 2008: 01</revised>
+  <bug>234079</bug>
+  <access>remote</access>
+  <affected>
+    <package name="gnome-extra/yelp" auto="yes" arch="*">
+      <unaffected range="ge">2.22.1-r2</unaffected>
+      <unaffected range="rge">2.20.0-r1</unaffected>
+      <vulnerable range="lt">2.22.1-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    yelp is the default help browser for GNOME.
+    </p>
+  </background>
+  <description>
+    <p>
+    Aaron Grattafiori reported a format string vulnerability in the
+    window_error() function in yelp-window.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker can entice a user to open specially crafted "man:" or
+    "ghelp:" URIs in yelp, or an application using yelp such as Firefox or
+    Evolution, and execute arbitrary code with the privileges of that user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All yelp users running GNOME 2.22 should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=gnome-extra/yelp-2.22.1-r2&quot;</code>
+    <p>
+    All yelp users running GNOME 2.20 should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=gnome-extra/yelp-2.20.0-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3533">CVE-2008-3533</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 15 Aug 2008 14:25:26 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 19 Aug 2008 23:34:23 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 19 Aug 2008 23:34:31 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200809-02.xml b/xml/htdocs/security/en/glsa/glsa-200809-02.xml
new file mode 100644
index 00000000..e5f2418f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200809-02.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200809-02">
+  <title>dnsmasq: Denial of Service and DNS spoofing</title>
+  <synopsis>
+    Two vulnerabilities in dnsmasq might allow for a Denial of Service or
+    spoofing of DNS replies.
+  </synopsis>
+  <product type="ebuild">dnsmasq</product>
+  <announced>September 04, 2008</announced>
+  <revised>September 04, 2008: 01</revised>
+  <bug>231282</bug>
+  <bug>232523</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/dnsmasq" auto="yes" arch="*">
+      <unaffected range="ge">2.45</unaffected>
+      <vulnerable range="lt">2.45</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Dnsmasq is a lightweight and easily-configurable DNS forwarder and DHCP
+    server.
+    </p>
+  </background>
+  <description>
+    <ul>
+    <li>
+    Dan Kaminsky of IOActive reported that dnsmasq does not randomize UDP
+    source ports when forwarding DNS queries to a recursing DNS server
+    (CVE-2008-1447).
+    </li>
+    <li>
+    Carlos Carvalho reported that dnsmasq in the 2.43 version does not
+    properly handle clients sending inform or renewal queries for unknown
+    DHCP leases, leading to a crash (CVE-2008-3350).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send spoofed DNS response traffic to dnsmasq,
+    possibly involving generating queries via multiple vectors, and spoof
+    DNS replies, which could e.g. lead to the redirection of web or mail
+    traffic to malicious sites. Furthermore, an attacker could generate
+    invalid DHCP traffic and cause a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All dnsmasq users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/dnsmasq-2.45&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3350">CVE-2008-3350</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447">CVE-2008-1447</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 13 Jul 2008 19:25:11 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 19 Aug 2008 23:52:40 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 19 Aug 2008 23:52:59 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200809-03.xml b/xml/htdocs/security/en/glsa/glsa-200809-03.xml
new file mode 100644
index 00000000..757ea9cb
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200809-03.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200809-03">
+  <title>RealPlayer: Buffer overflow</title>
+  <synopsis>
+    RealPlayer is vulnerable to a buffer overflow allowing for the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">realplayer</product>
+  <announced>September 04, 2008</announced>
+  <revised>September 04, 2008: 01</revised>
+  <bug>232997</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/realplayer" auto="yes" arch="*">
+      <unaffected range="ge">11.0.0.4028-r1</unaffected>
+      <vulnerable range="lt">11.0.0.4028-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    RealPlayer is a multimedia player capable of handling multiple
+    multimedia file formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dyon Balding of Secunia Research reported an unspecified heap-based
+    buffer overflow in the Shockwave Flash (SWF) frame handling.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    By enticing a user to open a specially crafted SWF (Shockwave Flash)
+    file, a remote attacker could be able to execute arbitrary code with
+    the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All RealPlayer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/realplayer-11.0.0.4028-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5400">CVE-2007-5400</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 19 Aug 2008 23:23:04 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 19 Aug 2008 23:23:18 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200809-04.xml b/xml/htdocs/security/en/glsa/glsa-200809-04.xml
new file mode 100644
index 00000000..298a69e1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200809-04.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200809-04">
+  <title>MySQL: Privilege bypass</title>
+  <synopsis>
+    A vulnerability in MySQL might allow users to bypass privileges and gain
+    access to other databases.
+  </synopsis>
+  <product type="ebuild">mysql</product>
+  <announced>September 04, 2008</announced>
+  <revised>September 04, 2008: 01</revised>
+  <bug>220399</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/mysql" auto="yes" arch="*">
+      <unaffected range="ge">5.0.60-r1</unaffected>
+      <vulnerable range="lt">5.0.60-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MySQL is a popular multi-threaded, multi-user SQL server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sergei Golubchik reported that MySQL imposes no restrictions on the
+    specification of "DATA DIRECTORY" or "INDEX DIRECTORY" in SQL "CREATE
+    TABLE" statements.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An authenticated remote attacker could create MyISAM tables, specifying
+    DATA or INDEX directories that contain future table files by other
+    database users, or existing table files in the MySQL data directory,
+    gaining access to those tables.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MySQL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/mysql-5.0.60-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2079">CVE-2008-2079</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 20 Aug 2008 00:05:23 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 21 Aug 2008 15:32:52 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200809-05.xml b/xml/htdocs/security/en/glsa/glsa-200809-05.xml
new file mode 100644
index 00000000..a6ae8425
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200809-05.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200809-05">
+  <title>Courier Authentication Library: SQL injection vulnerability</title>
+  <synopsis>
+    An SQL injection vulnerability has been discovered in the Courier
+    Authentication Library.
+  </synopsis>
+  <product type="ebuild">courier-authlib</product>
+  <announced>September 05, 2008</announced>
+  <revised>September 05, 2008: 01</revised>
+  <bug>225407</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-libs/courier-authlib" auto="yes" arch="*">
+      <unaffected range="ge">0.60.6</unaffected>
+      <vulnerable range="lt">0.60.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Courier Authentication Library is a generic authentication API that
+    encapsulates the process of validating account passwords.
+    </p>
+  </background>
+  <description>
+    <p>
+    It has been discovered that some input (e.g. the username) passed to
+    the library are not properly sanitised before being used in SQL
+    queries.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could provide specially crafted input to the library,
+    possibly resulting in the remote execution of arbitrary SQL commands.
+    NOTE: Exploitation of this vulnerability requires that a MySQL database
+    is used for authentication and that a Non-Latin character set is
+    selected.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Courier Authentication Library users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/courier-authlib-0.60.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2667">CVE-2008-2667</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 11 Aug 2008 18:54:58 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 11 Aug 2008 18:56:59 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 28 Aug 2008 21:07:13 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200809-06.xml b/xml/htdocs/security/en/glsa/glsa-200809-06.xml
new file mode 100644
index 00000000..1a749eb0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200809-06.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200809-06">
+  <title>VLC: Multiple vulnerabilities</title>
+  <synopsis>
+    Two vulnerabilities in VLC may lead to the remote execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">vlc</product>
+  <announced>September 07, 2008</announced>
+  <revised>September 07, 2008: 01</revised>
+  <bug>235238</bug>
+  <bug>235589</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/vlc" auto="yes" arch="*">
+      <unaffected range="ge">0.8.6i-r2</unaffected>
+      <vulnerable range="lt">0.8.6i-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    VLC is a cross-platform media player and streaming server.
+    </p>
+  </background>
+  <description>
+    <p>
+    g_ reported the following vulnerabilities:
+    </p>
+    <ul><li>An integer
+    overflow leading to a heap-based buffer overflow in the Open() function
+    in modules/demux/tta.c (CVE-2008-3732).</li>
+    <li>A signedness error
+    leading to a stack-based buffer overflow in the mms_ReceiveCommand()
+    function in modules/access/mms/mmstu.c (CVE-2008-3794).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted file,
+    possibly resulting in the remote execution of arbitrary code with the
+    privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All VLC users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/vlc-0.8.6i-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3732">CVE-2008-3732</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3794">CVE-2008-3794</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 25 Aug 2008 18:33:15 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 25 Aug 2008 18:33:23 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 28 Aug 2008 20:55:29 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200809-07.xml b/xml/htdocs/security/en/glsa/glsa-200809-07.xml
new file mode 100644
index 00000000..8dc82871
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200809-07.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200809-07">
+  <title>libTIFF: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple buffer underflow vulnerabilities in libTIFF may allow for the
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">tiff</product>
+  <announced>September 08, 2008</announced>
+  <revised>September 08, 2008: 01</revised>
+  <bug>234080</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/tiff" auto="yes" arch="*">
+      <unaffected range="ge">3.8.2-r4</unaffected>
+      <vulnerable range="lt">3.8.2-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libTIFF provides support for reading and manipulating TIFF (Tagged
+    Image File Format) images.
+    </p>
+  </background>
+  <description>
+    <p>
+    Drew Yao (Apple Product Security) and Clay Wood reported multiple
+    buffer underflows in the LZWDecode() and LZWDecodeCompat() functions in
+    tif_lzw.c when processing TIFF files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted TIFF
+    file with an application making use of libTIFF, possibly resulting in
+    the remote execution of arbitrary code with the privileges of the user
+    running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libTIFF users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/tiff-3.8.2-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2327">CVE-2008-2327</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 02 Sep 2008 17:01:52 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 05 Sep 2008 22:08:51 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 05 Sep 2008 22:08:59 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200809-08.xml b/xml/htdocs/security/en/glsa/glsa-200809-08.xml
new file mode 100644
index 00000000..e211c067
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200809-08.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200809-08">
+  <title>Amarok: Insecure temporary file creation</title>
+  <synopsis>
+    Amarok uses temporary files in an insecure manner, allowing for a symlink
+    attack.
+  </synopsis>
+  <product type="ebuild">amarok</product>
+  <announced>September 08, 2008</announced>
+  <revised>September 08, 2008: 01</revised>
+  <bug>234689</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-sound/amarok" auto="yes" arch="*">
+      <unaffected range="ge">1.4.10</unaffected>
+      <vulnerable range="lt">1.4.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Amarok is an advanced music player.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dwayne Litzenberger reported that the
+    MagnatuneBrowser::listDownloadComplete() function in
+    magnatunebrowser/magnatunebrowser.cpp uses the album_info.xml temporary
+    file in an insecure manner.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could perform a symlink attack to overwrite arbitrary
+    files on the system with the privileges of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Amarok users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/amarok-1.4.10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3699">CVE-2008-3699</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 02 Sep 2008 17:05:46 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 05 Sep 2008 21:54:43 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 05 Sep 2008 21:54:55 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200809-09.xml b/xml/htdocs/security/en/glsa/glsa-200809-09.xml
new file mode 100644
index 00000000..e8a9d29d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200809-09.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200809-09">
+  <title>Postfix: Denial of Service</title>
+  <synopsis>
+    A memory leak in Postfix might allow local users to cause a Denial of
+    Service.
+  </synopsis>
+  <product type="ebuild">postfix</product>
+  <announced>September 19, 2008</announced>
+  <revised>September 19, 2008: 01</revised>
+  <bug>236453</bug>
+  <access>local</access>
+  <affected>
+    <package name="mail-mta/postfix" auto="yes" arch="*">
+      <unaffected range="ge">2.4.9</unaffected>
+      <unaffected range="ge">2.5.5</unaffected>
+      <vulnerable range="lt">2.4.9</vulnerable>
+      <vulnerable range="lt">2.5.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Postfix is Wietse Venema's mailer that attempts to be fast, easy to
+    administer, and secure, as an alternative to the widely-used Sendmail
+    program.
+    </p>
+  </background>
+  <description>
+    <p>
+    It has been discovered than Postfix leaks an epoll file descriptor when
+    executing external commands, e.g. user-controlled $HOME/.forward or
+    $HOME/.procmailrc files. NOTE: This vulnerability only concerns Postfix
+    instances running on Linux 2.6 kernels.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit this vulnerability to reduce the
+    performance of Postfix, and possibly trigger an assertion, resulting in
+    a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Allow only trusted users to control delivery to non-Postfix commands.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Postfix 2.4 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-mta/postfix-2.4.9&quot;</code>
+    <p>
+    All Postfix 2.5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-mta/postfix-2.5.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3889">CVE-2008-3889</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 03 Sep 2008 20:58:07 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 08 Sep 2008 18:33:40 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 08 Sep 2008 18:33:49 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200809-10.xml b/xml/htdocs/security/en/glsa/glsa-200809-10.xml
new file mode 100644
index 00000000..3d9152e1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200809-10.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200809-10">
+  <title>Mantis: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been reported in Mantis.
+  </synopsis>
+  <product type="ebuild">mantisbt</product>
+  <announced>September 21, 2008</announced>
+  <revised>November 26, 2008: 02</revised>
+  <bug>222649</bug>
+  <bug>233336</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/mantisbt" auto="yes" arch="*">
+      <unaffected range="ge">1.1.2</unaffected>
+      <vulnerable range="lt">1.1.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mantis is a PHP/MySQL/Web based bugtracking system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Antonio Parata and Francesco Ongaro reported a Cross-Site Request
+    Forgery vulnerability in manage_user_create.php (CVE-2008-2276), a
+    Cross-Site Scripting vulnerability in return_dynamic_filters.php
+    (CVE-2008-3331), and an insufficient input validation in
+    adm_config_set.php (CVE-2008-3332). A directory traversal vulnerability
+    in core/lang_api.php (CVE-2008-3333) has also been reported.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit these vulnerabilities to execute
+    arbitrary HTML and script code, create arbitrary users with
+    administrative privileges, execute arbitrary PHP commands, and include
+    arbitrary files.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mantis users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/mantisbt-1.1.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2276">CVE-2008-2276</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3331">CVE-2008-3331</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3332">CVE-2008-3332</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3333">CVE-2008-3333</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 19 Sep 2008 19:55:47 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 19 Sep 2008 19:59:03 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 20 Sep 2008 21:37:36 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200809-11.xml b/xml/htdocs/security/en/glsa/glsa-200809-11.xml
new file mode 100644
index 00000000..3c8db002
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200809-11.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200809-11">
+  <title>HAVP: Denial of Service</title>
+  <synopsis>
+    A Denial of Service vulnerability has been reported in HAVP.
+  </synopsis>
+  <product type="ebuild">havp</product>
+  <announced>September 21, 2008</announced>
+  <revised>September 21, 2008: 01</revised>
+  <bug>234715</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-proxy/havp" auto="yes" arch="*">
+      <unaffected range="ge">0.89</unaffected>
+      <vulnerable range="lt">0.89</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    HAVP is a HTTP AntiVirus Proxy.
+    </p>
+  </background>
+  <description>
+    <p>
+    Peter Warasin reported an infinite loop in sockethandler.cpp when
+    connecting to a non-responsive HTTP server.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send requests to unavailable servers, resulting
+    in a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All HAVP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-proxy/havp-0.89&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3688">CVE-2008-3688</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 18 Sep 2008 21:30:12 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 18 Sep 2008 21:30:30 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 19 Sep 2008 11:28:47 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200809-12.xml b/xml/htdocs/security/en/glsa/glsa-200809-12.xml
new file mode 100644
index 00000000..18292024
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200809-12.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200809-12">
+  <title>Newsbeuter: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Insufficient input validation in newsbeuter may allow remote attackers to
+    execute arbitrary shell commands.
+  </synopsis>
+  <product type="ebuild">newsbeuter</product>
+  <announced>September 22, 2008</announced>
+  <revised>September 22, 2008: 01</revised>
+  <bug>236506</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-news/newsbeuter" auto="yes" arch="*">
+      <unaffected range="ge">1.2</unaffected>
+      <vulnerable range="lt">1.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Newsbeuter is a RSS/Atom feed reader for the text console.
+    </p>
+  </background>
+  <description>
+    <p>
+    J.H.M. Dassen reported that the open-in-browser command does not
+    properly escape shell metacharacters in the URL before passing it to
+    system().
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a feed with specially
+    crafted URLs, possibly resulting in the remote execution of arbitrary
+    shell commands with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Newsbeuter users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-news/newsbeuter-1.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3907">CVE-2008-3907</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 11 Sep 2008 17:38:14 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 18 Sep 2008 21:45:41 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 18 Sep 2008 21:45:49 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200809-13.xml b/xml/htdocs/security/en/glsa/glsa-200809-13.xml
new file mode 100644
index 00000000..8dfb858d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200809-13.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200809-13">
+  <title>R: Insecure temporary file creation</title>
+  <synopsis>
+    R is vulnerable to symlink attacks due to an insecure usage of temporary
+    files.
+  </synopsis>
+  <product type="ebuild">R</product>
+  <announced>September 22, 2008</announced>
+  <revised>September 22, 2008: 01</revised>
+  <bug>235822</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-lang/R" auto="yes" arch="*">
+      <unaffected range="ge">2.7.1</unaffected>
+      <vulnerable range="lt">2.7.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    R is a GPL licensed implementation of S, a language and environment for
+    statistical computing and graphics.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dmitry E. Oboukhov reported that the "javareconf" script uses temporary
+    files in an insecure manner.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit this vulnerability to overwrite
+    arbitrary files with the privileges of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All R users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/R-2.7.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3931">CVE-2008-3931</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 18 Sep 2008 21:52:27 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 18 Sep 2008 22:01:59 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 19 Sep 2008 11:52:28 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200809-14.xml b/xml/htdocs/security/en/glsa/glsa-200809-14.xml
new file mode 100644
index 00000000..ebde6ddf
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200809-14.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200809-14">
+  <title>BitlBee: Security bypass</title>
+  <synopsis>
+    Multiple vulnerabilities in Bitlbee may allow to bypass security
+    restrictions and hijack accounts.
+  </synopsis>
+  <product type="ebuild">bitlbee</product>
+  <announced>September 23, 2008</announced>
+  <revised>September 23, 2008: 01</revised>
+  <bug>236160</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/bitlbee" auto="yes" arch="*">
+      <unaffected range="ge">1.2.3</unaffected>
+      <vulnerable range="lt">1.2.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    BitlBee is an IRC to IM gateway that support multiple IM protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple unspecified vulnerabilities were reported, including a NULL
+    pointer dereference.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities to overwrite
+    existing IM accounts.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All BitlBee users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/bitlbee-1.2.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3920">CVE-2008-3920</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3969">CVE-2008-3969</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 05 Sep 2008 20:44:15 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 19 Sep 2008 20:00:27 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 20 Sep 2008 21:14:39 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200809-15.xml b/xml/htdocs/security/en/glsa/glsa-200809-15.xml
new file mode 100644
index 00000000..71c1ff46
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200809-15.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200809-15">
+  <title>GNU ed: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow vulnerability in ed may allow for the remote execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">ed</product>
+  <announced>September 23, 2008</announced>
+  <revised>September 23, 2008: 01</revised>
+  <bug>236521</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-apps/ed" auto="yes" arch="*">
+      <unaffected range="ge">1.0</unaffected>
+      <vulnerable range="lt">1.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GNU ed is a basic line editor. red is a restricted version of ed that
+    does not allow shell command execution.
+    </p>
+  </background>
+  <description>
+    <p>
+    Alfredo Ortega from Core Security Technologies reported a heap-based
+    buffer overflow in the strip_escapes() function when processing overly
+    long filenames.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to process specially crafted
+    commands with ed or red, possibly resulting in the execution of
+    arbitrary code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GNU ed users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/ed-1.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3916">CVE-2008-3916</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 14 Sep 2008 11:31:13 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 18 Sep 2008 21:37:26 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 18 Sep 2008 21:37:35 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200809-16.xml b/xml/htdocs/security/en/glsa/glsa-200809-16.xml
new file mode 100644
index 00000000..5cf03066
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200809-16.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200809-16">
+  <title>Git: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple buffer overflow vulnerabilities have been discovered in Git.
+  </synopsis>
+  <product type="ebuild">git</product>
+  <announced>September 25, 2008</announced>
+  <revised>September 25, 2008: 01</revised>
+  <bug>234075</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-util/git" auto="yes" arch="*">
+      <unaffected range="ge">1.5.6.4</unaffected>
+      <vulnerable range="lt">1.5.6.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Git is a distributed version control system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple boundary errors in the functions diff_addremove() and
+    diff_change() when processing overly long repository path names were
+    reported.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to run commands like "git-diff"
+    or "git-grep" on a specially crafted repository, possibly resulting in
+    the remote execution of arbitrary code with the privileges of the user
+    running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Git users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-util/git-1.5.6.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3546">CVE-2008-3546</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 21 Sep 2008 11:13:42 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 21 Sep 2008 11:16:38 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 22 Sep 2008 11:39:05 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200809-17.xml b/xml/htdocs/security/en/glsa/glsa-200809-17.xml
new file mode 100644
index 00000000..d6b15c02
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200809-17.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200809-17">
+  <title>Wireshark: Multiple Denials of Service</title>
+  <synopsis>
+    Multiple Denial of Service vulnerabilities have been discovered in
+    Wireshark.
+  </synopsis>
+  <product type="ebuild">wireshark</product>
+  <announced>September 25, 2008</announced>
+  <revised>September 25, 2008: 01</revised>
+  <bug>236515</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/wireshark" auto="yes" arch="*">
+      <unaffected range="ge">1.0.3</unaffected>
+      <vulnerable range="lt">1.0.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Wireshark is a network protocol analyzer with a graphical front-end.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were reported:
+    </p>
+    <ul>
+    <li>
+    Multiple buffer overflows in the NCP dissector (CVE-2008-3146).
+    </li>
+    <li>
+    Infinite loop in the NCP dissector (CVE-2008-3932).
+    </li>
+    <li>
+    Invalid read in the tvb_uncompress() function when processing zlib
+    compressed data (CVE-2008-3933).
+    </li>
+    <li>
+    Unspecified error when processing Textronix .rf5 files
+    (CVE-2008-3934).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities by sending
+    specially crafted packets on a network being monitored by Wireshark or
+    by enticing a user to read a malformed packet trace file, causing a
+    Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Wireshark users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/wireshark-1.0.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3146">CVE-2008-3146</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3932">CVE-2008-3932</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3933">CVE-2008-3933</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3934">CVE-2008-3934</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 22 Sep 2008 12:39:05 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 24 Sep 2008 19:29:18 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 24 Sep 2008 19:30:10 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200809-18.xml b/xml/htdocs/security/en/glsa/glsa-200809-18.xml
new file mode 100644
index 00000000..c412926e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200809-18.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200809-18">
+  <title>ClamAV: Multiple Denials of Service</title>
+  <synopsis>
+    Multiple vulnerabilities in ClamAV may result in a Denial of Service.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>September 25, 2008</announced>
+  <revised>September 25, 2008: 01</revised>
+  <bug>236665</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.94</unaffected>
+      <vulnerable range="lt">0.94</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Clam AntiVirus is a free anti-virus toolkit for UNIX, designed
+    especially for e-mail scanning on mail gateways.
+    </p>
+  </background>
+  <description>
+    <p>
+    Hanno boeck reported an error in libclamav/chmunpack.c when processing
+    CHM files (CVE-2008-1389). Other unspecified vulnerabilites were also
+    reported, including a NULL pointer dereference in libclamav
+    (CVE-2008-3912), memory leaks in freshclam/manager.c (CVE-2008-3913),
+    and file descriptor leaks in libclamav/others.c and libclamav/sis.c
+    (CVE-2008-3914).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or automated system to scan a
+    specially crafted CHM, possibly resulting in a Denial of Service
+    (daemon crash). The other attack vectors mentioned above could also
+    result in a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.94&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1389">CVE-2008-1389</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3912">CVE-2008-3912</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3913">CVE-2008-3913</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3914">CVE-2008-3914</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 18 Sep 2008 21:57:14 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 24 Sep 2008 19:42:36 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 24 Sep 2008 19:42:53 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200810-01.xml b/xml/htdocs/security/en/glsa/glsa-200810-01.xml
new file mode 100644
index 00000000..587686c2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200810-01.xml
@@ -0,0 +1,94 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200810-01">
+  <title>WordNet: Execution of arbitrary code</title>
+  <synopsis>
+    Multiple vulnerabilities were found in WordNet, possibly allowing for the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">wordnet</product>
+  <announced>October 07, 2008</announced>
+  <revised>October 07, 2008: 01</revised>
+  <bug>211491</bug>
+  <access>local, remote</access>
+  <affected>
+    <package name="app-dicts/wordnet" auto="yes" arch="*">
+      <unaffected range="ge">3.0-r2</unaffected>
+      <vulnerable range="lt">3.0-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    WordNet is a large lexical database of English.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jukka Ruohonen initially reported a boundary error within the
+    searchwn() function in src/wn.c. A thorough investigation by the oCERT
+    team revealed several other vulnerabilities in WordNet:
+    </p>
+    <ul>
+    <li>Jukka Ruohonen and Rob Holland (oCERT) reported multiple boundary
+    errors within the searchwn() function in src/wn.c, the wngrep()
+    function in lib/search.c, the morphstr() and morphword() functions in
+    lib/morph.c, and the getindex() in lib/search.c, which lead to
+    stack-based buffer overflows.</li>
+    <li>Rob Holland (oCERT) reported two
+    boundary errors within the do_init() function in lib/morph.c, which
+    lead to stack-based buffer overflows via specially crafted
+    "WNSEARCHDIR" or "WNHOME" environment variables.</li>
+    <li>Rob Holland
+    (oCERT) reported multiple boundary errors in the bin_search() and
+    bin_search_key() functions in binsrch.c, which lead to stack-based
+    buffer overflows via specially crafted data files.</li>
+    <li>Rob Holland
+    (oCERT) reported a boundary error within the parse_index() function in
+    lib/search.c, which leads to a heap-based buffer overflow via specially
+    crafted data files.</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <ul>
+    <li>In case the application is accessible e.g. via a web server,
+    a remote attacker could pass overly long strings as arguments to the
+    "wm" binary, possibly leading to the execution of arbitrary code.</li>
+    <li>A local attacker could exploit the second vulnerability via
+    specially crafted "WNSEARCHDIR" or "WNHOME" environment variables,
+    possibly leading to the execution of arbitrary code with escalated
+    privileges.</li>
+    <li>A local attacker could exploit the third and
+    fourth vulnerability by making the application use specially crafted
+    data files, possibly leading to the execution of arbitrary code.</li>
+    </ul>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All WordNet users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-dicts/wordnet-3.0-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2149">CVE-2008-2149</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3908">CVE-2008-3908</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 21 Sep 2008 11:08:59 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 21 Sep 2008 11:09:31 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 26 Sep 2008 09:37:40 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200810-02.xml b/xml/htdocs/security/en/glsa/glsa-200810-02.xml
new file mode 100644
index 00000000..d729542a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200810-02.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200810-02">
+  <title>Portage: Untrusted search path local root vulnerability</title>
+  <synopsis>
+    A search path vulnerability in Portage allows local attackers to execute
+    commands with root privileges if emerge is called from untrusted
+    directories.
+  </synopsis>
+  <product type="ebuild">portage</product>
+  <announced>October 09, 2008</announced>
+  <revised>October 09, 2008: 01</revised>
+  <bug>239560</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-apps/portage" auto="yes" arch="*">
+      <unaffected range="ge">2.1.4.5</unaffected>
+      <vulnerable range="lt">2.1.4.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Portage is Gentoo's package manager which is responsible for
+    installing, compiling and updating all packages on the system through
+    the Gentoo rsync tree.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Gentoo Security Team discovered that several ebuilds, such as
+    sys-apps/portage, net-mail/fetchmail or app-editors/leo execute Python
+    code using "python -c", which includes the current working directory in
+    Python's module search path. For several ebuild functions, Portage did
+    not change the working directory from emerge's working directory.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could place a specially crafted Python module in a
+    directory (such as /tmp) and entice the root user to run commands such
+    as "emerge sys-apps/portage" from that directory, resulting in the
+    execution of arbitrary Python code with root privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not run "emerge" from untrusted working directories.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Portage users should upgrade to the latest version:
+    </p>
+    <code>
+    # cd /root
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/portage-2.1.4.5&quot;</code>
+    <p>
+    NOTE: To upgrade to Portage 2.1.4.5 using 2.1.4.4 or prior, you must
+    run emerge from a trusted working directory, such as "/root".
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4394">CVE-2008-4394</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 08 Oct 2008 16:50:57 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 08 Oct 2008 16:58:04 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200810-03.xml b/xml/htdocs/security/en/glsa/glsa-200810-03.xml
new file mode 100644
index 00000000..5f1653b5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200810-03.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200810-03">
+  <title>libspf2: DNS response buffer overflow</title>
+  <synopsis>
+    A memory management error in libspf2 might allow for remote execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">libspf2</product>
+  <announced>October 30, 2008</announced>
+  <revised>October 30, 2008: 01</revised>
+  <bug>242254</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-filter/libspf2" auto="yes" arch="*">
+      <unaffected range="ge">1.2.8</unaffected>
+      <vulnerable range="lt">1.2.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libspf2 is a library that implements the Sender Policy Framework,
+    allowing mail transfer agents to make sure that an email is authorized
+    by the domain name that it is coming from. Currently, only the exim MTA
+    uses libspf2 in Gentoo.
+    </p>
+  </background>
+  <description>
+    <p>
+    libspf2 uses a fixed-length buffer to receive DNS responses and does
+    not properly check the length of TXT records, leading to buffer
+    overflows.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could store a specially crafted DNS entry and entice
+    a user or automated system using libspf2 to lookup that SPF entry (e.g.
+    by sending an email to the MTA), possibly allowing for the execution of
+    arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libspf2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-filter/libspf2-1.2.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2469">CVE-2008-2469</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 18 Oct 2008 16:51:58 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 19 Oct 2008 19:27:11 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 23 Oct 2008 13:43:28 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200811-01.xml b/xml/htdocs/security/en/glsa/glsa-200811-01.xml
new file mode 100644
index 00000000..97f4e319
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200811-01.xml
@@ -0,0 +1,129 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200811-01">
+  <title>Opera: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Opera, allowing for the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">opera</product>
+  <announced>November 03, 2008</announced>
+  <revised>November 03, 2008: 01</revised>
+  <bug>235298</bug>
+  <bug>240500</bug>
+  <bug>243060</bug>
+  <bug>244980</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/opera" auto="yes" arch="*">
+      <unaffected range="ge">9.62</unaffected>
+      <vulnerable range="lt">9.62</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Opera is a fast web browser that is available free of charge.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in Opera:
+    </p>
+    <ul>
+    <li>Opera does not restrict the ability of a framed web page to change
+    the address associated with a different frame (CVE-2008-4195).</li>
+    <li>Chris Weber (Casaba Security) discovered a Cross-site scripting
+    vulnerability (CVE-2008-4196).</li>
+    <li>Michael A. Puls II discovered
+    that Opera can produce argument strings that contain uninitialized
+    memory, when processing custom shortcut and menu commands
+    (CVE-2008-4197).</li>
+    <li>Lars Kleinschmidt discovered that Opera, when
+    rendering an HTTP page that has loaded an HTTPS page into a frame,
+    displays a padlock icon and offers a security information dialog
+    reporting a secure connection (CVE-2008-4198).</li>
+    <li>Opera does not
+    prevent use of links from web pages to feed source files on the local
+    disk (CVE-2008-4199).</li>
+    <li>Opera does not ensure that the address
+    field of a news feed represents the feed's actual URL
+    (CVE-2008-4200).</li>
+    <li>Opera does not check the CRL override upon
+    encountering a certificate that lacks a CRL (CVE-2008-4292).</li>
+    <li>Chris (Matasano Security) reported that Opera may crash if it is
+    redirected by a malicious page to a specially crafted address
+    (CVE-2008-4694).</li>
+    <li>Nate McFeters reported that Opera runs Java
+    applets in the context of the local machine, if that applet has been
+    cached and a page can predict the cache path for that applet and load
+    it from the cache (CVE-2008-4695).</li>
+    <li>Roberto Suggi Liverani
+    (Security-Assessment.com) reported that Opera's History Search results
+    does not escape certain constructs correctly, allowing for the
+    injection of scripts into the page (CVE-2008-4696).</li>
+    <li>David
+    Bloom reported that Opera's Fast Forward feature incorrectly executes
+    scripts from a page held in a frame in the outermost page instead of
+    the page the JavaScript URL was located (CVE-2008-4697).</li>
+    <li>David
+    Bloom reported that Opera does not block some scripts when previewing a
+    news feed (CVE-2008-4698).</li>
+    <li>Opera does not correctly sanitize
+    content when certain parameters are passed to Opera's History Search,
+    allowing scripts to be injected into the History Search results page
+    (CVE-2008-4794).</li>
+    <li>Opera's links panel incorrectly causes
+    scripts from a page held in a frame to be executed in the outermost
+    page instead of the page where the URL was located
+    (CVE-2008-4795).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    These vulnerabilties allow remote attackers to execute arbitrary code,
+    to run scripts injected into Opera's History Search with elevated
+    privileges, to inject arbitrary web script or HTML into web pages, to
+    manipulate the address bar, to change Opera's preferences, to determine
+    the validity of local filenames, to read cache files, browsing history,
+    and subscribed feeds or to conduct other attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Opera users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/opera-9.62&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4195">CVE-2008-4195</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4196">CVE-2008-4196</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4197">CVE-2008-4197</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4198">CVE-2008-4198</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4199">CVE-2008-4199</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4200">CVE-2008-4200</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4292">CVE-2008-4292</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4694">CVE-2008-4694</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4695">CVE-2008-4695</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4696">CVE-2008-4696</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4697">CVE-2008-4697</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4698">CVE-2008-4698</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4794">CVE-2008-4794</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4795">CVE-2008-4795</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 13 Oct 2008 21:25:07 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 03 Nov 2008 18:39:54 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200811-02.xml b/xml/htdocs/security/en/glsa/glsa-200811-02.xml
new file mode 100644
index 00000000..ff6c7828
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200811-02.xml
@@ -0,0 +1,98 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200811-02">
+  <title>Gallery: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Gallery may lead to execution of arbitrary
+    code, disclosure of local files or theft of user's credentials.
+  </synopsis>
+  <product type="ebuild">gallery</product>
+  <announced>November 09, 2008</announced>
+  <revised>May 28, 2009: 02</revised>
+  <bug>234137</bug>
+  <bug>238113</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/gallery" auto="yes" arch="*">
+      <unaffected range="ge">2.2.6</unaffected>
+      <unaffected range="rge">1.5.9</unaffected>
+      <unaffected range="rge">1.5.10</unaffected>
+      <vulnerable range="lt">2.2.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Gallery is an open source web based photo album organizer.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in Gallery 1 and 2:
+    </p>
+    <ul>
+    <li>
+    Digital Security Research Group reported a directory traversal
+    vulnerability in contrib/phpBB2/modules.php in Gallery 1, when
+    register_globals is enabled (CVE-2008-3600).
+    </li>
+    <li>
+    Hanno Boeck reported that Gallery 1 and 2 did not set the secure flag
+    for the session cookie in an HTTPS session (CVE-2008-3662).
+    </li>
+    <li>
+    Alex Ustinov reported that Gallery 1 and 2 does not properly handle ZIP
+    archives containing symbolic links (CVE-2008-4129).
+    </li>
+    <li>
+    The vendor reported a Cross-Site Scripting vulnerability in Gallery 2
+    (CVE-2008-4130).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote attackers could send specially crafted requests to a server
+    running Gallery, allowing for the execution of arbitrary code when
+    register_globals is enabled, or read arbitrary files via directory
+    traversals otherwise. Attackers could also entice users to visit
+    crafted links allowing for theft of login credentials.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gallery 2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/gallery-2.2.6&quot;</code>
+    <p>
+    All Gallery 1 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/gallery-1.5.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3600">CVE-2008-3600</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3662">CVE-2008-3662</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4129">CVE-2008-4129</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4130">CVE-2008-4130</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 18 Oct 2008 20:31:05 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 21 Oct 2008 20:22:34 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 31 Oct 2008 00:12:12 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200811-03.xml b/xml/htdocs/security/en/glsa/glsa-200811-03.xml
new file mode 100644
index 00000000..ec1117e6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200811-03.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200811-03">
+  <title>FAAD2: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow in FAAD2 might lead to user-assisted execution of
+    arbitrary code via an MP4 file.
+  </synopsis>
+  <product type="ebuild">faad2</product>
+  <announced>November 09, 2008</announced>
+  <revised>November 09, 2008: 01</revised>
+  <bug>238445</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/faad2" auto="yes" arch="*">
+      <unaffected range="ge">2.6.1-r2</unaffected>
+      <vulnerable range="lt">2.6.1-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    FAAD2 is an open source MPEG-4 and MPEG-2 AAC decoder.
+    </p>
+  </background>
+  <description>
+    <p>
+    The ICST-ERCIS (Peking University) reported a heap-based buffer
+    overflow in the decodeMP4file() function in frontend/main.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    MPEG-4 (MP4) file in an application using FAAD2, possibly leading to
+    the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All FAAD2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/faad2-2.6.1-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4201">CVE-2008-4201</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 01 Oct 2008 21:20:46 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 21 Oct 2008 20:30:57 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 30 Oct 2008 23:45:59 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200811-04.xml b/xml/htdocs/security/en/glsa/glsa-200811-04.xml
new file mode 100644
index 00000000..7e424ef2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200811-04.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200811-04">
+  <title>Graphviz: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow in Graphviz might lead to user-assisted execution of
+    arbitrary code via a DOT file.
+  </synopsis>
+  <product type="ebuild">graphviz</product>
+  <announced>November 09, 2008</announced>
+  <revised>November 09, 2008: 01</revised>
+  <bug>240636</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/graphviz" auto="yes" arch="*">
+      <unaffected range="ge">2.20.3</unaffected>
+      <vulnerable range="lt">2.20.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Graphviz is an open source graph visualization software.
+    </p>
+  </background>
+  <description>
+    <p>
+    Roee Hay reported a stack-based buffer overflow in the push_subg()
+    function in parser.y when processing a DOT file with a large number of
+    Agraph_t elements.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or automated system to open a
+    specially crafted DOT file in an application using Graphviz, possibly
+    leading to the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Graphviz users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/graphviz-2.20.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4555">CVE-2008-4555</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 16 Oct 2008 18:49:15 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 21 Oct 2008 20:26:38 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 31 Oct 2008 00:00:32 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200811-05.xml b/xml/htdocs/security/en/glsa/glsa-200811-05.xml
new file mode 100644
index 00000000..a90a91ea
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200811-05.xml
@@ -0,0 +1,134 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200811-05">
+  <title>PHP: Multiple vulnerabilities</title>
+  <synopsis>
+    PHP contains several vulnerabilities including buffer and integer overflows
+    which could lead to the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">php</product>
+  <announced>November 16, 2008</announced>
+  <revised>November 16, 2008: 01</revised>
+  <bug>209148</bug>
+  <bug>212211</bug>
+  <bug>215266</bug>
+  <bug>228369</bug>
+  <bug>230575</bug>
+  <bug>234102</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/php" auto="yes" arch="*">
+      <unaffected range="ge">5.2.6-r6</unaffected>
+      <vulnerable range="lt">5.2.6-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHP is a widely-used general-purpose scripting language that is
+    especially suited for Web development and can be embedded into HTML.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several vulnerabilitites were found in PHP:
+    </p>
+    <ul>
+    <li>PHP ships a
+    vulnerable version of the PCRE library which allows for the
+    circumvention of security restrictions or even for remote code
+    execution in case of an application which accepts user-supplied regular
+    expressions (CVE-2008-0674).</li>
+    <li>Multiple crash issues in several
+    PHP functions have been discovered.</li>
+    <li>Ryan Permeh reported that
+    the init_request_info() function in sapi/cgi/cgi_main.c does not
+    properly consider operator precedence when calculating the length of
+    PATH_TRANSLATED (CVE-2008-0599).</li>
+    <li>An off-by-one error in the
+    metaphone() function may lead to memory corruption.</li>
+    <li>Maksymilian Arciemowicz of SecurityReason Research reported an
+    integer overflow, which is triggerable using printf() and related
+    functions (CVE-2008-1384).</li>
+    <li>Andrei Nigmatulin reported a
+    stack-based buffer overflow in the FastCGI SAPI, which has unknown
+    attack vectors (CVE-2008-2050).</li>
+    <li>Stefan Esser reported that PHP
+    does not correctly handle multibyte characters inside the
+    escapeshellcmd() function, which is used to sanitize user input before
+    its usage in shell commands (CVE-2008-2051).</li>
+    <li>Stefan Esser
+    reported that a short-coming in PHP's algorithm of seeding the random
+    number generator might allow for predictible random numbers
+    (CVE-2008-2107, CVE-2008-2108).</li>
+    <li>The IMAP extension in PHP uses
+    obsolete c-client API calls making it vulnerable to buffer overflows as
+    no bounds checking can be done (CVE-2008-2829).</li>
+    <li>Tavis Ormandy
+    reported a heap-based buffer overflow in pcre_compile.c in the PCRE
+    version shipped by PHP when processing user-supplied regular
+    expressions (CVE-2008-2371).</li>
+    <li>CzechSec reported that specially
+    crafted font files can lead to an overflow in the imageloadfont()
+    function in ext/gd/gd.c, which is part of the GD extension
+    (CVE-2008-3658).</li>
+    <li>Maksymilian Arciemowicz of SecurityReason
+    Research reported that a design error in PHP's stream wrappers allows
+    to circumvent safe_mode checks in several filesystem-related PHP
+    functions (CVE-2008-2665, CVE-2008-2666).</li>
+    <li>Laurent Gaffie
+    discovered a buffer overflow in the internal memnstr() function, which
+    is used by the PHP function explode() (CVE-2008-3659).</li>
+    <li>An
+    error in the FastCGI SAPI when processing a request with multiple dots
+    preceding the extension (CVE-2008-3660).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    These vulnerabilities might allow a remote attacker to execute
+    arbitrary code, to cause a Denial of Service, to circumvent security
+    restrictions, to disclose information, and to manipulate files.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/php-5.2.6-r6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0599">CVE-2008-0599</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0674">CVE-2008-0674</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1384">CVE-2008-1384</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2050">CVE-2008-2050</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2051">CVE-2008-2051</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2107">CVE-2008-2107</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2108">CVE-2008-2108</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2371">CVE-2008-2371</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2665">CVE-2008-2665</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2666">CVE-2008-2666</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2829">CVE-2008-2829</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3658">CVE-2008-3658</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3659">CVE-2008-3659</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3660">CVE-2008-3660</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 17 Mar 2008 01:12:26 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 10 Nov 2008 18:29:08 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 16 Nov 2008 16:06:26 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-01.xml b/xml/htdocs/security/en/glsa/glsa-200812-01.xml
new file mode 100644
index 00000000..b233c772
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-01.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-01">
+  <title>OptiPNG: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A vulnerability in OptiPNG might result in user-assisted execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">optipng</product>
+  <announced>December 02, 2008</announced>
+  <revised>December 02, 2008: 01</revised>
+  <bug>246522</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/optipng" auto="yes" arch="*">
+      <unaffected range="ge">0.6.2</unaffected>
+      <vulnerable range="lt">0.6.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OptiPNG is a PNG optimizer that recompresses image files to a smaller
+    size, without losing any information.
+    </p>
+  </background>
+  <description>
+    <p>
+    A buffer overflow in the BMP reader in OptiPNG has been reported.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to process a specially crafted
+    BMP image, possibly resulting in the execution of arbitrary code with
+    the privileges of the user running the application, or a Denial of
+    Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OptiPNG users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/optipng-0.6.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5101">CVE-2008-5101</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 22 Nov 2008 17:38:05 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 26 Nov 2008 23:15:20 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 26 Nov 2008 23:15:33 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-02.xml b/xml/htdocs/security/en/glsa/glsa-200812-02.xml
new file mode 100644
index 00000000..467cca5d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-02.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-02">
+  <title>enscript: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Two buffer overflows in enscript might lead to the execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">enscript</product>
+  <announced>December 02, 2008</announced>
+  <revised>December 02, 2008: 02</revised>
+  <bug>243228</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/enscript" auto="yes" arch="*">
+      <unaffected range="ge">1.6.4-r4</unaffected>
+      <vulnerable range="lt">1.6.4-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    enscript is a powerful ASCII to PostScript file converter.
+    </p>
+  </background>
+  <description>
+    <p>
+    Two stack-based buffer overflows in the read_special_escape() function
+    in src/psgen.c have been reported. Ulf Harnhammar of Secunia Research
+    discovered a vulnerability related to the "setfilename" command
+    (CVE-2008-3863), and Kees Cook of Ubuntu discovered a vulnerability
+    related to the "font" escape sequence (CVE-2008-4306).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user or automated system to process
+    specially crafted input with the special escapes processing enabled
+    using the "-e" option, possibly resulting in the execution of arbitrary
+    code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All enscript users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/enscript-1.6.4-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3863">CVE-2008-3863</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4306">CVE-2008-4306</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 27 Nov 2008 17:28:05 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 27 Nov 2008 17:37:26 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 27 Nov 2008 17:37:33 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-03.xml b/xml/htdocs/security/en/glsa/glsa-200812-03.xml
new file mode 100644
index 00000000..8918975e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-03.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-03">
+  <title>IPsec-Tools: racoon Denial of Service</title>
+  <synopsis>
+    IPsec-Tools' racoon is affected by a remote Denial of Service
+    vulnerability.
+  </synopsis>
+  <product type="ebuild">ipsec-tools</product>
+  <announced>December 02, 2008</announced>
+  <revised>December 02, 2008: 01</revised>
+  <bug>232831</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-firewall/ipsec-tools" auto="yes" arch="*">
+      <unaffected range="ge">0.7.1</unaffected>
+      <vulnerable range="lt">0.7.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    IPsec-Tools is a port of KAME's implementation of the IPsec utilities.
+    It contains a collection of network monitoring tools, including racoon,
+    ping, and ping6.
+    </p>
+  </background>
+  <description>
+    <p>
+    Two Denial of Service vulnerabilities have been reported in racoon:
+    </p>
+    <ul>
+    <li>
+    The vendor reported a memory leak in racoon/proposal.c that can be
+    triggered via invalid proposals (CVE-2008-3651).
+    </li>
+    <li>
+    Krzysztof Piotr Oledzk reported that src/racoon/handler.c does not
+    remove an "orphaned ph1" (phase 1) handle when it has been initiated
+    remotely (CVE-2008-3652).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit these vulnerabilities to cause a Denial of
+    Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All IPsec-Tools users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-firewall/ipsec-tools-0.7.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3651">CVE-2008-3651</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3652">CVE-2008-3652</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 26 Nov 2008 18:44:35 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 26 Nov 2008 20:25:15 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 26 Nov 2008 20:25:48 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-04.xml b/xml/htdocs/security/en/glsa/glsa-200812-04.xml
new file mode 100644
index 00000000..2eb97a2f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-04.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-04">
+  <title>lighttpd: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in lighttpd may lead to information disclosure or
+    a Denial of Service.
+  </synopsis>
+  <product type="ebuild">lighttpd</product>
+  <announced>December 02, 2008</announced>
+  <revised>December 02, 2008: 01</revised>
+  <bug>238180</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/lighttpd" auto="yes" arch="*">
+      <unaffected range="ge">1.4.20</unaffected>
+      <vulnerable range="lt">1.4.20</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    lighttpd is a lightweight high-performance web server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in lighttpd:
+    </p>
+    <ul>
+    <li>
+    Qhy reported a memory leak in the http_request_parse() function in
+    request.c (CVE-2008-4298).
+    </li>
+    <li>
+    Gaetan Bisson reported that URIs are not decoded before applying
+    url.redirect and url.rewrite rules (CVE-2008-4359).
+    </li>
+    <li>
+    Anders1 reported that mod_userdir performs case-sensitive comparisons
+    on filename components in configuration options, which is insufficient
+    when case-insensitive filesystems are used (CVE-2008-4360).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities to cause a Denial
+    of Service, to bypass intended access restrictions, to obtain sensitive
+    information, or to possibly modify data.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All lighttpd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/lighttpd-1.4.20&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4298">CVE-2008-4298</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4359">CVE-2008-4359</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4360">CVE-2008-4360</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 26 Nov 2008 18:41:57 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 26 Nov 2008 22:38:27 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 26 Nov 2008 22:39:43 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-05.xml b/xml/htdocs/security/en/glsa/glsa-200812-05.xml
new file mode 100644
index 00000000..a7c7e26b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-05.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-05">
+  <title>libsamplerate: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow vulnerability in libsamplerate might lead to the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">libsamplerate</product>
+  <announced>December 02, 2008</announced>
+  <revised>December 02, 2008: 01</revised>
+  <bug>237037</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libsamplerate" auto="yes" arch="*">
+      <unaffected range="ge">0.1.4</unaffected>
+      <vulnerable range="lt">0.1.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Secret Rabbit Code (aka libsamplerate) is a Sample Rate Converter for
+    audio.
+    </p>
+  </background>
+  <description>
+    <p>
+    Russell O'Connor reported a buffer overflow in src/src_sinc.c related
+    to low conversion ratios.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or automated system to process a
+    specially crafted audio file possibly leading to the execution of
+    arbitrary code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libsamplerate users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libsamplerate-0.1.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5008">CVE-2008-5008</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 07 Nov 2008 13:51:38 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 27 Nov 2008 16:25:38 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 27 Nov 2008 16:25:44 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-06.xml b/xml/htdocs/security/en/glsa/glsa-200812-06.xml
new file mode 100644
index 00000000..4073884f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-06.xml
@@ -0,0 +1,99 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-06">
+  <title>libxml2: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in libxml2 might lead to execution of arbitrary
+    code or Denial of Service.
+  </synopsis>
+  <product type="ebuild">libxml2</product>
+  <announced>December 02, 2008</announced>
+  <revised>December 02, 2008: 01</revised>
+  <bug>234099</bug>
+  <bug>237806</bug>
+  <bug>239346</bug>
+  <bug>245960</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/libxml2" auto="yes" arch="*">
+      <unaffected range="ge">2.7.2-r1</unaffected>
+      <vulnerable range="lt">2.7.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libxml2 is the XML (eXtended Markup Language) C parser and toolkit
+    initially developed for the Gnome project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities were reported in libxml2:
+    </p>
+    <ul>
+    <li>
+    Andreas Solberg reported that libxml2 does not properly detect
+    recursion during entity expansion in an attribute value
+    (CVE-2008-3281).
+    </li>
+    <li>
+    A heap-based buffer overflow has been reported in the
+    xmlParseAttValueComplex() function in parser.c (CVE-2008-3529).
+    </li>
+    <li>
+    Christian Weiske reported that predefined entity definitions in
+    entities are not properly handled (CVE-2008-4409).
+    </li>
+    <li>
+    Drew Yao of Apple Product Security reported an integer overflow in the
+    xmlBufferResize() function that can lead to an infinite loop
+    (CVE-2008-4225).
+    </li>
+    <li>
+    Drew Yao of Apple Product Security reported an integer overflow in the
+    xmlSAX2Characters() function leading to a memory corruption
+    (CVE-2008-4226).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or automated system to open a
+    specially crafted XML document with an application using libxml2,
+    possibly resulting in the exeution of arbitrary code or a high CPU and
+    memory consumption.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libxml2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/libxml2-2.7.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3281">CVE-2008-3281</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3529">CVE-2008-3529</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4409">CVE-2008-4409</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4225">CVE-2008-4225</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4226">CVE-2008-4226</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 01 Oct 2008 21:27:07 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 31 Oct 2008 00:21:31 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 31 Oct 2008 00:21:45 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-07.xml b/xml/htdocs/security/en/glsa/glsa-200812-07.xml
new file mode 100644
index 00000000..2fc8dbd3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-07.xml
@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-07">
+  <title>Mantis: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Mantis, the most severe of
+    which leading to the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mantisbt</product>
+  <announced>December 02, 2008</announced>
+  <revised>December 02, 2008: 01</revised>
+  <bug>238570</bug>
+  <bug>241940</bug>
+  <bug>242722</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/mantisbt" auto="yes" arch="*">
+      <unaffected range="ge">1.1.4-r1</unaffected>
+      <vulnerable range="lt">1.1.4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mantis is a PHP/MySQL/Web based bugtracking system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple issues have been reported in Mantis:
+    </p>
+    <ul>
+    <li>
+    EgiX reported that manage_proj_page.php does not correctly sanitize the
+    sort parameter before passing it to create_function() in
+    core/utility_api.php (CVE-2008-4687).
+    </li>
+    <li>
+    Privileges of viewers are not sufficiently checked before composing a
+    link with issue data in the source anchor (CVE-2008-4688).
+    </li>
+    <li>
+    Mantis does not unset the session cookie during logout (CVE-2008-4689).
+    </li>
+    <li>
+    Mantis does not set the secure flag for the session cookie in an HTTPS
+    session (CVE-2008-3102).
+    </li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    Remote unauthenticated attackers could exploit these vulnerabilities to
+    execute arbitrary PHP commands, disclose sensitive issue data, or
+    hijack a user's sessions.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mantis users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/mantisbt-1.1.4-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3102">CVE-2008-3102</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4687">CVE-2008-4687</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4688">CVE-2008-4688</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4689">CVE-2008-4689</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 31 Oct 2008 21:35:00 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 26 Nov 2008 19:39:16 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 26 Nov 2008 19:39:31 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-08.xml b/xml/htdocs/security/en/glsa/glsa-200812-08.xml
new file mode 100644
index 00000000..3f7fdd3f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-08.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-08">
+  <title>Mgetty: Insecure temporary file usage</title>
+  <synopsis>
+    Mgetty uses temporary files in an insecure manner, allowing for symlink
+    attacks.
+  </synopsis>
+  <product type="ebuild">mgetty</product>
+  <announced>December 06, 2008</announced>
+  <revised>December 23, 2008: 02</revised>
+  <bug>235806</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-dialup/mgetty" auto="yes" arch="*">
+      <unaffected range="ge">1.1.36-r3</unaffected>
+      <vulnerable range="lt">1.1.36-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Mgetty is a set of fax and voice modem programs.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dmitry E. Oboukhov reported that the "spooldir" directory in
+    fax/faxspool.in is created in an insecure manner.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit this vulnerability to overwrite
+    arbitrary files with the privileges of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Mgetty users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dialup/mgetty-1.1.36-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4936">CVE-2008-4936</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 22 Sep 2008 12:40:45 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 23 Sep 2008 11:36:13 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 23 Sep 2008 11:36:50 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-09.xml b/xml/htdocs/security/en/glsa/glsa-200812-09.xml
new file mode 100644
index 00000000..09f10f26
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-09.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-09">
+  <title>OpenSC: Insufficient protection of smart card PIN</title>
+  <synopsis>
+    Smart cards formatted using OpenSC do not sufficiently protect the PIN,
+    allowing attackers to reset it.
+  </synopsis>
+  <product type="ebuild">opensc</product>
+  <announced>December 10, 2008</announced>
+  <revised>December 10, 2008: 01</revised>
+  <bug>233543</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-libs/opensc" auto="yes" arch="*">
+      <unaffected range="ge">0.11.6</unaffected>
+      <vulnerable range="lt">0.11.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSC is a smart card application that allows reading and writing via
+    PKCS#11.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chaskiel M Grundman reported that OpenSC uses weak permissions (ADMIN
+    file control information of 00) for the 5015 directory on smart cards
+    and USB crypto tokens running Siemens CardOS M4.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A physically proximate attacker can exploit this vulnerability to
+    change the PIN on a smart card and use it for authentication, leading
+    to privilege escalation.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenSC users should upgrade to the latest version, and then check
+    and update their smart cards:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/opensc-0.11.6&quot;
+    # pkcs15-tool --test-update
+    # pkcs15-tool --test-update --update</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2235">CVE-2008-2235</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 26 Nov 2008 18:58:19 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 26 Nov 2008 19:57:21 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 26 Nov 2008 19:57:53 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-10.xml b/xml/htdocs/security/en/glsa/glsa-200812-10.xml
new file mode 100644
index 00000000..1d4daac8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-10.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-10">
+  <title>Archive::Tar: Directory traversal vulnerability</title>
+  <synopsis>
+    A directory traversal vulnerability has been discovered in Archive::Tar.
+  </synopsis>
+  <product type="ebuild">Archive-Tar</product>
+  <announced>December 10, 2008</announced>
+  <revised>December 10, 2008: 01</revised>
+  <bug>192989</bug>
+  <access>remote</access>
+  <affected>
+    <package name="perl-core/Archive-Tar" auto="yes" arch="*">
+      <unaffected range="ge">1.40</unaffected>
+      <vulnerable range="lt">1.40</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Archive::Tar is a Perl module for creation and manipulation of tar
+    files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jonathan Smith of rPath reported that Archive::Tar does not check for
+    ".." in file names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or automated system to extract a
+    specially crafted tar archive, overwriting files at arbitrary locations
+    outside of the specified directory.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Archive::Tar users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=perl-core/Archive-Tar-1.40&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4829">CVE-2007-4829</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 26 Nov 2008 18:55:42 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 26 Nov 2008 20:31:02 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 26 Nov 2008 20:31:20 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-11.xml b/xml/htdocs/security/en/glsa/glsa-200812-11.xml
new file mode 100644
index 00000000..29ed121f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-11.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-11">
+  <title>CUPS: Multiple vulnerabilities</title>
+  <synopsis>
+    Several remotely exploitable bugs have been found in CUPS, which allow
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">cups</product>
+  <announced>December 10, 2008</announced>
+  <revised>December 10, 2008: 01</revised>
+  <bug>238976</bug>
+  <bug>249727</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-print/cups" auto="yes" arch="*">
+      <unaffected range="ge">1.3.9-r1</unaffected>
+      <vulnerable range="lt">1.3.9-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CUPS is the Common Unix Printing System.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several buffer overflows were found in:
+    </p>
+    <ul>
+    <li>
+    The read_rle16 function in imagetops (CVE-2008-3639, found by
+    regenrecht, reported via ZDI)
+    </li>
+    <li>
+    The WriteProlog function in texttops (CVE-2008-3640, found by
+    regenrecht, reported via ZDI)
+    </li>
+    <li>
+    The Hewlett-Packard Graphics Language (HPGL) filter (CVE-2008-3641,
+    found by regenrecht, reported via iDefense)
+    </li>
+    <li>
+    The _cupsImageReadPNG function (CVE-2008-5286, reported by iljavs)
+    </li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send specially crafted input to a vulnerable
+    server, resulting in the remote execution of arbitrary code with the
+    privileges of the user running the server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    None this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CUPS users should upgrade to the latest version.
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-print/cups-1.3.9-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3639">CVE-2008-3639</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3640">CVE-2008-3640</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3641">CVE-2008-3641</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5286">CVE-2008-5286</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 29 Nov 2008 10:13:17 +0000">
+    craig
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 06 Dec 2008 18:09:49 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-12.xml b/xml/htdocs/security/en/glsa/glsa-200812-12.xml
new file mode 100644
index 00000000..66789b7f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-12.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-12">
+  <title>Honeyd: Insecure temporary file creation</title>
+  <synopsis>
+    An insecure temporary file usage has been reported in Honeyd, possibly
+    leading to symlink attacks.
+  </synopsis>
+  <product type="ebuild">honeyd</product>
+  <announced>December 12, 2008</announced>
+  <revised>December 12, 2008: 01</revised>
+  <bug>237481</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-analyzer/honeyd" auto="yes" arch="*">
+      <unaffected range="ge">1.5c-r1</unaffected>
+      <vulnerable range="lt">1.5c-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Honeyd is a small daemon that creates virtual hosts on a network.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dmitry E. Oboukhov reported an insecure temporary file usage within the
+    "test.sh" script.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could perform symlink attacks and overwrite arbitrary
+    files with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Honeyd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/honeyd-1.5c-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3928">CVE-2008-3928</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 18 Oct 2008 20:32:05 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 21 Oct 2008 20:17:52 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 11 Dec 2008 20:14:32 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-13.xml b/xml/htdocs/security/en/glsa/glsa-200812-13.xml
new file mode 100644
index 00000000..5de43c50
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-13.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-13">
+  <title>OpenOffice.org: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in OpenOffice.org might allow for user-assisted
+    execution of arbitrary code or symlink attacks.
+  </synopsis>
+  <product type="ebuild">openoffice openoffice-bin</product>
+  <announced>December 12, 2008</announced>
+  <revised>December 12, 2008: 01</revised>
+  <bug>235824</bug>
+  <bug>244995</bug>
+  <access>local, remote</access>
+  <affected>
+    <package name="app-office/openoffice" auto="yes" arch="*">
+      <unaffected range="ge">3.0.0</unaffected>
+      <vulnerable range="lt">3.0.0</vulnerable>
+    </package>
+    <package name="app-office/openoffice-bin" auto="yes" arch="*">
+      <unaffected range="ge">3.0.0</unaffected>
+      <vulnerable range="lt">3.0.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenOffice.org is an open source office productivity suite, including
+    word processing, spreadsheet, presentation, drawing, data charting,
+    formula editing, and file conversion facilities.
+    </p>
+  </background>
+  <description>
+    <p>
+    Two heap-based buffer overflows when processing WMF files
+    (CVE-2008-2237) and EMF files (CVE-2008-2238) were discovered. Dmitry
+    E. Oboukhov also reported an insecure temporary file usage within the
+    senddoc script (CVE-2008-4937).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    document, resulting in the remote execution of arbitrary code. A local
+    attacker could perform symlink attacks to overwrite arbitrary files on
+    the system. Both cases happen with the privileges of the user running
+    the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenOffice.org users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-3.0.0&quot;</code>
+    <p>
+    All OpenOffice.org binary users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-bin-3.0.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2237">CVE-2008-2237</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2238">CVE-2008-2238</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4937">CVE-2008-4937</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 08 Nov 2008 09:50:25 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 08 Nov 2008 09:56:21 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 11 Dec 2008 19:46:56 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-14.xml b/xml/htdocs/security/en/glsa/glsa-200812-14.xml
new file mode 100644
index 00000000..ea92aa68
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-14.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-14">
+  <title>aview: Insecure temporary file usage</title>
+  <synopsis>
+    An insecure temporary file usage has been reported in aview, leading to
+    symlink attacks.
+  </synopsis>
+  <product type="ebuild">aview</product>
+  <announced>December 14, 2008</announced>
+  <revised>December 14, 2008: 01</revised>
+  <bug>235808</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-gfx/aview" auto="yes" arch="*">
+      <unaffected range="ge">1.3.0_rc1-r1</unaffected>
+      <vulnerable range="lt">1.3.0_rc1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    aview is an ASCII image viewer and animation player.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dmitry E. Oboukhov reported that aview uses the "/tmp/aview$$.pgm" file
+    in an insecure manner when processing files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could perform symlink attacks to overwrite arbitrary
+    files on the system with the privileges of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All aview users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/aview-1.3.0_rc1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4935">CVE-2008-4935</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 22 Sep 2008 12:39:57 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 21 Oct 2008 20:48:01 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 11 Dec 2008 20:00:09 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-15.xml b/xml/htdocs/security/en/glsa/glsa-200812-15.xml
new file mode 100644
index 00000000..b1239c9c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-15.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-15">
+  <title>POV-Ray: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    POV-Ray includes a version of libpng that might allow for the execution of
+    arbitrary code when reading a specially crafted PNG file
+  </synopsis>
+  <product type="ebuild">povray</product>
+  <announced>December 14, 2008</announced>
+  <revised>December 14, 2008: 01</revised>
+  <bug>153538</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-gfx/povray" auto="yes" arch="*">
+      <unaffected range="ge">3.6.1-r4</unaffected>
+      <vulnerable range="lt">3.6.1-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    POV-Ray is a well known open-source ray tracer.
+    </p>
+  </background>
+  <description>
+    <p>
+    POV-Ray uses a statically linked copy of libpng to view and output PNG
+    files. The version shipped with POV-Ray is vulnerable to CVE-2008-3964,
+    CVE-2008-1382, CVE-2006-3334, CVE-2006-0481, CVE-2004-0768. A bug in
+    POV-Ray's build system caused it to load the old version when your
+    installed copy of libpng was >=media-libs/libpng-1.2.10.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could entice a user to load a specially crafted PNG file as
+    a texture, resulting in the execution of arbitrary code with the
+    permissions of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All POV-Ray users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/povray-3.6.1-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0768">CVE-2004-0768</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0481">CVE-2006-0481</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3334">CVE-2006-3334</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1382">CVE-2008-1382</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3964">CVE-2008-3964</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 04 Dec 2008 23:06:51 +0000">
+    mabi
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 06 Dec 2008 15:52:40 +0000">
+    mabi
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 11 Dec 2008 20:06:51 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-16.xml b/xml/htdocs/security/en/glsa/glsa-200812-16.xml
new file mode 100644
index 00000000..36f381b5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-16.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-16">
+  <title>Dovecot: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities were found in the Dovecot mailserver.
+  </synopsis>
+  <product type="ebuild">dovecot</product>
+  <announced>December 14, 2008</announced>
+  <revised>December 14, 2008: 01</revised>
+  <bug>240409</bug>
+  <bug>244962</bug>
+  <bug>245316</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/dovecot" auto="yes" arch="*">
+      <unaffected range="ge">1.1.7-r1</unaffected>
+      <vulnerable range="lt">1.1.7-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Dovecot is an IMAP and POP3 server written with security primarily in
+    mind.
+    </p>
+  </background>
+  <description>
+    <p>
+    Several vulnerabilities were found in Dovecot:
+    </p>
+    <ul>
+    <li>The "k"
+    right in the acl_plugin does not work as expected (CVE-2008-4577,
+    CVE-2008-4578)</li>
+    <li>The dovecot.conf is world-readable, providing
+    improper protection for the ssl_key_password setting
+    (CVE-2008-4870)</li>
+    <li>A permanent Denial of Service with broken mail
+    headers is possible (CVE-2008-4907)</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    These vulnerabilities might allow a remote attacker to cause a Denial
+    of Service, to circumvent security restrictions or allow local
+    attackers to disclose the passphrase of the SSL private key.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Dovecot users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/dovecot-1.1.7-r1&quot;</code>
+    <p>
+    Users should be aware that dovecot.conf will still be world-readable
+    after the update. If employing ssl_key_password, it should not be used
+    in dovecot.conf but in a separate file which should be included with
+    "include_try".
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4577">CVE-2008-4577</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4578">CVE-2008-4578</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4870">CVE-2008-4870</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4907">CVE-2008-4907</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 29 Nov 2008 10:07:16 +0000">
+    craig
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 06 Dec 2008 18:05:53 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-17.xml b/xml/htdocs/security/en/glsa/glsa-200812-17.xml
new file mode 100644
index 00000000..d7c769ce
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-17.xml
@@ -0,0 +1,122 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-17">
+  <title>Ruby: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Ruby that allow for
+    attacks including arbitrary code execution and Denial of Service.
+  </synopsis>
+  <product type="ebuild">ruby</product>
+  <announced>December 16, 2008</announced>
+  <revised>December 16, 2008: 01</revised>
+  <bug>225465</bug>
+  <bug>236060</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/ruby" auto="yes" arch="*">
+      <unaffected range="ge">1.8.6_p287-r1</unaffected>
+      <vulnerable range="lt">1.8.6_p287-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ruby is an interpreted object-oriented programming language. The
+    elaborate standard library includes an HTTP server ("WEBRick") and a
+    class for XML parsing ("REXML").
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in the Ruby interpreter
+    and its standard libraries. Drew Yao of Apple Product Security
+    discovered the following flaws:
+    </p>
+    <ul>
+    <li>Arbitrary code execution
+    or Denial of Service (memory corruption) in the rb_str_buf_append()
+    function (CVE-2008-2662).</li>
+    <li>Arbitrary code execution or Denial
+    of Service (memory corruption) in the rb_ary_stor() function
+    (CVE-2008-2663).</li>
+    <li>Memory corruption via alloca in the
+    rb_str_format() function (CVE-2008-2664).</li>
+    <li>Memory corruption
+    ("REALLOC_N") in the rb_ary_splice() and rb_ary_replace() functions
+    (CVE-2008-2725).</li>
+    <li>Memory corruption ("beg + rlen") in the
+    rb_ary_splice() and rb_ary_replace() functions (CVE-2008-2726).</li>
+    </ul> <p>
+    Furthermore, several other vulnerabilities have been reported:
+    </p>
+    <ul>
+    <li>Tanaka Akira reported an issue with resolv.rb that enables
+    attackers to spoof DNS responses (CVE-2008-1447).</li>
+    <li>Akira Tagoh
+    of RedHat discovered a Denial of Service (crash) issue in the
+    rb_ary_fill() function in array.c (CVE-2008-2376).</li>
+    <li>Several
+    safe level bypass vulnerabilities were discovered and reported by Keita
+    Yamaguchi (CVE-2008-3655).</li>
+    <li>Christian Neukirchen is credited
+    for discovering a Denial of Service (CPU consumption) attack in the
+    WEBRick HTTP server (CVE-2008-3656).</li>
+    <li>A fault in the dl module
+    allowed the circumvention of taintness checks which could possibly lead
+    to insecure code execution was reported by "sheepman"
+    (CVE-2008-3657).</li>
+    <li>Tanaka Akira again found a DNS spoofing
+    vulnerability caused by the resolv.rb implementation using poor
+    randomness (CVE-2008-3905).</li>
+    <li>Luka Treiber and Mitja Kolsek
+    (ACROS Security) disclosed a Denial of Service (CPU consumption)
+    vulnerability in the REXML module when dealing with recursive entity
+    expansion (CVE-2008-3790).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    These vulnerabilities allow remote attackers to execute arbitrary code,
+    spoof DNS responses, bypass Ruby's built-in security and taintness
+    checks, and cause a Denial of Service via crash or CPU exhaustion.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ruby users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/ruby-1.8.6_p287-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447">CVE-2008-1447</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2376">CVE-2008-2376</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2662">CVE-2008-2662</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2663">CVE-2008-2663</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2664">CVE-2008-2664</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2725">CVE-2008-2725</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2726">CVE-2008-2726</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3655">CVE-2008-3655</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3656">CVE-2008-3656</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3657">CVE-2008-3657</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3790">CVE-2008-3790</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3905">CVE-2008-3905</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 21 Sep 2008 11:43:41 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 10 Nov 2008 18:52:14 +0000">
+    hoffie
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 27 Nov 2008 16:38:46 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-18.xml b/xml/htdocs/security/en/glsa/glsa-200812-18.xml
new file mode 100644
index 00000000..f8a50316
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-18.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-18">
+  <title>JasPer: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple memory management errors in JasPer might lead to execution of
+    arbitrary code via jpeg2k files.
+  </synopsis>
+  <product type="ebuild">jasper</product>
+  <announced>December 16, 2008</announced>
+  <revised>December 16, 2008: 01</revised>
+  <bug>222819</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/jasper" auto="yes" arch="*">
+      <unaffected range="ge">1.900.1-r3</unaffected>
+      <vulnerable range="lt">1.900.1-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The JasPer Project is an open-source initiative to provide a free
+    software-based reference implementation of the codec specified in the
+    JPEG-2000 Part-1 (jpeg2k) standard.
+    </p>
+  </background>
+  <description>
+    <p>
+    Marc Espie and Christian Weisgerber have discovered multiple
+    vulnerabilities in JasPer:
+    </p>
+    <ul>
+    <li>
+    Multiple integer overflows might allow for insufficient memory
+    allocation, leading to heap-based buffer overflows (CVE-2008-3520).
+    </li>
+    <li>
+    The jas_stream_printf() function in libjasper/base/jas_stream.c uses
+    vsprintf() to write user-provided data to a static to a buffer, leading
+    to an overflow (CVE-2008-3522).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote attackers could entice a user or automated system to process
+    specially crafted jpeg2k files with an application using JasPer,
+    possibly leading to the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All JasPer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/jasper-1.900.1-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3520">CVE-2008-3520</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3522">CVE-2008-3522</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 13 Oct 2008 18:51:07 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 21 Oct 2008 20:38:03 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 15 Dec 2008 14:20:28 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-19.xml b/xml/htdocs/security/en/glsa/glsa-200812-19.xml
new file mode 100644
index 00000000..c01543ac
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-19.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-19">
+  <title>PowerDNS: Multiple vulnerabilities</title>
+  <synopsis>
+    Two vulnerabilities have been discovered in PowerDNS, possibly leading to a
+    Denial of Service and easing cache poisoning attacks.
+  </synopsis>
+  <product type="ebuild">pdns</product>
+  <announced>December 19, 2008</announced>
+  <revised>December 19, 2008: 01</revised>
+  <bug>234032</bug>
+  <bug>247079</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/pdns" auto="yes" arch="*">
+      <unaffected range="ge">2.9.21.2</unaffected>
+      <vulnerable range="lt">2.9.21.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The PowerDNS Nameserver is an authoritative-only nameserver which uses
+    a flexible backend architecture.
+    </p>
+  </background>
+  <description>
+    <p>
+    Daniel Drown reported an error when receiving a HINFO CH query
+    (CVE-2008-5277). Brian J. Dowling of Simplicity Communications
+    discovered a previously unknown security implication of the PowerDNS
+    behavior to not respond to certain queries it considers malformed
+    (CVE-2008-3337).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted queries to cause a
+    Denial of Service. The second vulnerability in itself does not pose a
+    security risk to PowerDNS Nameserver. However, not answering a query
+    for an invalid DNS record within a valid domain allows for a larger
+    spoofing window on third-party nameservers for domains being hosted by
+    PowerDNS Nameserver itself.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PowerDNS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/pdns-2.9.21.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3337">CVE-2008-3337</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5277">CVE-2008-5277</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 06 Sep 2008 21:05:59 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 06 Sep 2008 21:06:12 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 10 Sep 2008 17:38:51 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-20.xml b/xml/htdocs/security/en/glsa/glsa-200812-20.xml
new file mode 100644
index 00000000..7e174a8f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-20.xml
@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-20">
+  <title>phpCollab: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in phpCollab allowing for
+    remote injection of shell commands, PHP code and SQL statements.
+  </synopsis>
+  <product type="ebuild">phpcollab</product>
+  <announced>December 21, 2008</announced>
+  <revised>December 21, 2008: 01</revised>
+  <bug>235052</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phpcollab" auto="yes" arch="*">
+      <vulnerable range="le">2.5_rc3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpCollab is a web-enabled groupware and project management software
+    written in PHP. It uses SQL-based database backends.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been found in phpCollab:
+    </p>
+    <ul>
+    <li>rgod reported that data sent to general/sendpassword.php via the
+    loginForm parameter is not properly sanitized before being used in an
+    SQL statement (CVE-2006-1495).</li>
+    <li>Christian Hoffmann of Gentoo
+    Security discovered multiple vulnerabilites where input is
+    insufficiently sanitized before being used in an SQL statement, for
+    instance in general/login.php via the loginForm parameter.
+    (CVE-2008-4303).</li>
+    <li>Christian Hoffmann also found out that the
+    variable $SSL_CLIENT_CERT in general/login.php is not properly
+    sanitized before being used in a shell command. (CVE-2008-4304).</li>
+    <li>User-supplied data to installation/setup.php is not checked before
+    being written to include/settings.php which is executed later. This
+    issue was reported by Christian Hoffmann as well (CVE-2008-4305).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    These vulnerabilities enable remote attackers to execute arbitrary SQL
+    statements and PHP code. NOTE: Some of the SQL injection
+    vulnerabilities require the php.ini option "magic_quotes_gpc" to be
+    disabled. Furthermore, an attacker might be able to execute arbitrary
+    shell commands if "register_globals" is enabled, "magic_quotes_gpc" is
+    disabled, the PHP OpenSSL extension is not installed or loaded and the
+    file "installation/setup.php" has not been deleted after installation.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    phpCollab has been removed from the Portage tree. We recommend that
+    users unmerge phpCollab:
+    </p>
+    <code>
+    # emerge --unmerge &quot;www-apps/phpcollab&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1495">CVE-2006-1495</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4303">CVE-2008-4303</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4304">CVE-2008-4304</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4305">CVE-2008-4305</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 19 Oct 2008 20:05:40 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 07 Dec 2008 13:16:45 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 10 Dec 2008 16:51:12 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-21.xml b/xml/htdocs/security/en/glsa/glsa-200812-21.xml
new file mode 100644
index 00000000..1506ce51
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-21.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-21">
+  <title>ClamAV: Multiple vulnerabilities</title>
+  <synopsis>
+    Two vulnerabilities in ClamAV may allow for the remote execution of
+    arbitrary code or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>December 23, 2008</announced>
+  <revised>December 23, 2008: 01</revised>
+  <bug>245450</bug>
+  <bug>249833</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.94.2</unaffected>
+      <vulnerable range="lt">0.94.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Clam AntiVirus is a free anti-virus toolkit for UNIX, designed
+    especially for e-mail scanning on mail gateways.
+    </p>
+  </background>
+  <description>
+    <p>
+    Moritz Jodeit reported an off-by-one error within the
+    get_unicode_name() function in libclamav/vba_extract.c when processing
+    VBA project files (CVE-2008-5050). Ilja van Sprundel reported an
+    infinite recursion error within the cli_check_jpeg_exploit() function
+    in libclamav/special.c when processing JPEG files (CVE-2008-5314).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send a specially crafted VBA or JPEG file to
+    the clamd daemon, possibly resulting in the remote execution of
+    arbitrary code with the privileges of the user running the application
+    or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ClamAV users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.94.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5050">CVE-2008-5050</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5314">CVE-2008-5314</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 09 Dec 2008 22:40:43 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 21 Dec 2008 18:51:07 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 21 Dec 2008 18:56:43 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-22.xml b/xml/htdocs/security/en/glsa/glsa-200812-22.xml
new file mode 100644
index 00000000..bfd8f88d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-22.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-22">
+  <title>Ampache: Insecure temporary file usage</title>
+  <synopsis>
+    An insecure temporary file usage has been reported in Ampache, allowing for
+    symlink attacks.
+  </synopsis>
+  <product type="ebuild">ampache</product>
+  <announced>December 23, 2008</announced>
+  <revised>December 23, 2008: 01</revised>
+  <bug>237483</bug>
+  <access>local</access>
+  <affected>
+    <package name="www-apps/ampache" auto="yes" arch="*">
+      <unaffected range="ge">3.4.3</unaffected>
+      <vulnerable range="lt">3.4.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ampache is a PHP based tool for managing, updating and playing audio
+    files via a web interface.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dmitry E. Oboukhov reported an insecure temporary file usage within the
+    gather-messages.sh script.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could perform symlink attacks to overwrite arbitrary
+    files with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ampache users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/ampache-3.4.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3929">CVE-2008-3929</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 22 Sep 2008 12:37:47 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 11 Dec 2008 21:03:24 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 11 Dec 2008 21:03:37 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-23.xml b/xml/htdocs/security/en/glsa/glsa-200812-23.xml
new file mode 100644
index 00000000..133d969c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-23.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-23">
+  <title>Imlib2: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow vulnerability has been discovered in Imlib2.
+  </synopsis>
+  <product type="ebuild">imlib2</product>
+  <announced>December 23, 2008</announced>
+  <revised>December 23, 2008: 01</revised>
+  <bug>248057</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/imlib2" auto="yes" arch="*">
+      <unaffected range="ge">1.4.2-r1</unaffected>
+      <vulnerable range="lt">1.4.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Imlib2 is replacement library from the Enlightenment project for
+    libraries like libXpm.
+    </p>
+  </background>
+  <description>
+    <p>
+    Julien Danjou reported a pointer arithmetic error and a heap-based
+    buffer overflow within the load() function of the XPM image loader.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to process a specially crafted
+    XPM image, possibly resulting in the remote execution of arbitrary code
+    with the privileges of the user running the application, or a Denial of
+    Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Imlib2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/imlib2-1.4.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5187">CVE-2008-5187</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 07 Dec 2008 11:53:50 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 11 Dec 2008 12:38:00 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 11 Dec 2008 12:38:09 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200812-24.xml b/xml/htdocs/security/en/glsa/glsa-200812-24.xml
new file mode 100644
index 00000000..793a1734
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200812-24.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200812-24">
+  <title>VLC: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in VLC may lead to the remote execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">vlc</product>
+  <announced>December 24, 2008</announced>
+  <revised>December 24, 2008: 01</revised>
+  <bug>245774</bug>
+  <bug>249391</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/vlc" auto="yes" arch="*">
+      <unaffected range="ge">0.9.8a</unaffected>
+      <vulnerable range="lt">0.9.8a</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    VLC is a cross-platform media player and streaming server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tobias Klein reported the following vulnerabilities:
+    </p>
+    <ul>
+    <li>A
+    stack-based buffer overflow when processing CUE image files in
+    modules/access/vcd/cdrom.c (CVE-2008-5032).</li>
+    <li>A stack-based
+    buffer overflow when processing RealText (.rt) subtitle files in the
+    ParseRealText() function in modules/demux/subtitle.c
+    (CVE-2008-5036).</li>
+    <li>An integer overflow when processing RealMedia
+    (.rm) files in the ReadRealIndex() function in real.c in the Real
+    demuxer plugin, leading to a heap-based buffer overflow
+    (CVE-2008-5276).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted CUE
+    image file, RealMedia file or RealText subtitle file, possibly
+    resulting in the execution of arbitrary code with the privileges of the
+    user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All VLC users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/vlc-0.9.8a&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5032">CVE-2008-5032</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5036">CVE-2008-5036</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5276">CVE-2008-5276</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 15 Dec 2008 14:05:23 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 21 Dec 2008 19:55:55 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 21 Dec 2008 20:12:40 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200901-01.xml b/xml/htdocs/security/en/glsa/glsa-200901-01.xml
new file mode 100644
index 00000000..b0c27606
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200901-01.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200901-01">
+  <title>NDISwrapper: Arbitrary remote code execution</title>
+  <synopsis>
+    Multiple buffer overflows might lead to remote execution of arbitrary code
+    with root privileges.
+  </synopsis>
+  <product type="ebuild">ndiswrapper</product>
+  <announced>January 11, 2009</announced>
+  <revised>January 11, 2009: 01</revised>
+  <bug>239371</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-wireless/ndiswrapper" auto="yes" arch="*">
+      <unaffected range="ge">1.53-r1</unaffected>
+      <vulnerable range="lt">1.53-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    NDISwrapper is a Linux kernel module that enables the use of Microsoft
+    Windows drivers for wireless network devices.
+    </p>
+  </background>
+  <description>
+    <p>
+    Anders Kaseorg reported multiple buffer overflows related to long
+    ESSIDs.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A physically proximate attacker could send packets over a wireless
+    network that might lead to the execution of arbitrary code with root
+    privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All NDISwrapper users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-wireless/ndiswrapper-1.53-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4395">CVE-2008-4395</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 06 Nov 2008 16:33:13 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 26 Nov 2008 23:45:28 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 26 Nov 2008 23:45:36 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200901-02.xml b/xml/htdocs/security/en/glsa/glsa-200901-02.xml
new file mode 100644
index 00000000..26540205
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200901-02.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200901-02">
+  <title>JHead: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in JHead might lead to the execution of arbitrary
+    code or data loss.
+  </synopsis>
+  <product type="ebuild">jhead</product>
+  <announced>January 11, 2009</announced>
+  <revised>January 11, 2009: 01</revised>
+  <bug>242702</bug>
+  <bug>243238</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/jhead" auto="yes" arch="*">
+      <unaffected range="ge">2.84-r1</unaffected>
+      <vulnerable range="lt">2.84-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    JHead is an exif jpeg header manipulation tool.
+    </p>
+  </background>
+  <description>
+    <p>
+    Marc Merlin and John Dong reported multiple vulnerabilities in JHead:
+    </p>
+    <ul>
+    <li>
+    A buffer overflow in the DoCommand() function when processing the cmd
+    argument and related to potential string overflows (CVE-2008-4575).
+    </li>
+    <li>
+    An insecure creation of a temporary file (CVE-2008-4639).
+    </li>
+    <li>
+    A error when unlinking a file (CVE-2008-4640).
+    </li>
+    <li>
+    Insufficient escaping of shell metacharacters (CVE-2008-4641).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could possibly execute arbitrary code by enticing a
+    user or automated system to open a file with a long filename or via
+    unspecified vectors. It is also possible to trick a user into deleting
+    or overwriting files.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All JHead users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/jhead-2.84-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4575">CVE-2008-4575</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4639">CVE-2008-4639</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4640">CVE-2008-4640</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4641">CVE-2008-4641</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 26 Nov 2008 18:47:59 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 26 Nov 2008 21:08:46 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 10 Dec 2008 17:01:39 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200901-03.xml b/xml/htdocs/security/en/glsa/glsa-200901-03.xml
new file mode 100644
index 00000000..e50daca0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200901-03.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200901-03">
+  <title>pdnsd: Denial of Service and cache poisoning</title>
+  <synopsis>
+    Two errors in pdnsd allow for Denial of Service and cache poisoning.
+  </synopsis>
+  <product type="ebuild">pdnsd</product>
+  <announced>January 11, 2009</announced>
+  <revised>January 11, 2009: 01</revised>
+  <bug>231285</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/pdnsd" auto="yes" arch="*">
+      <unaffected range="ge">1.2.7</unaffected>
+      <vulnerable range="lt">1.2.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    pdnsd is a proxy DNS server with permanent caching that is designed to
+    cope with unreachable DNS servers.
+    </p>
+  </background>
+  <description>
+    <p>
+    Two issues have been reported in pdnsd:
+    </p>
+    <ul>
+    <li>
+    The p_exec_query() function in src/dns_query.c does not properly handle
+    many entries in the answer section of a DNS reply, related to a
+    "dangling pointer bug" (CVE-2008-4194).
+    </li>
+    <li>
+    The default value for query_port_start was set to 0, disabling UDP
+    source port randomization for outgoing queries (CVE-2008-1447).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit the second weakness to poison the cache of
+    pdnsd and thus spoof DNS traffic, which could e.g. lead to the
+    redirection of web or mail traffic to malicious sites. The first issue
+    can be exploited by enticing pdnsd to send a query to a malicious DNS
+    server, or using the port randomization weakness, and might lead to a
+    Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Port randomization can be enabled by setting the "query_port_start"
+    option to 1024 which would resolve the CVE-2008-1447 issue.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All pdnsd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/pdnsd-1.2.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447">CVE-2008-1447</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4194">CVE-2008-4194</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 26 Nov 2008 18:15:10 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 26 Nov 2008 23:10:06 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 26 Nov 2008 23:10:19 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200901-04.xml b/xml/htdocs/security/en/glsa/glsa-200901-04.xml
new file mode 100644
index 00000000..b7a5f160
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200901-04.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200901-04">
+  <title>D-Bus: Denial of Service</title>
+  <synopsis>
+    An error condition can cause D-Bus to crash.
+  </synopsis>
+  <product type="ebuild">dbus</product>
+  <announced>January 11, 2009</announced>
+  <revised>January 11, 2009: 01</revised>
+  <bug>240308</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-apps/dbus" auto="yes" arch="*">
+      <unaffected range="ge">1.2.3-r1</unaffected>
+      <vulnerable range="lt">1.2.3-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    D-Bus is a daemon providing a framework for applications to communicate
+    with one another.
+    </p>
+  </background>
+  <description>
+    <p>
+    schelte reported that the dbus_signature_validate() function can
+    trigger a failed assertion when processing a message containing a
+    malformed signature.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local user could send a specially crafted message to the D-Bus
+    daemon, leading to a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All D-Bus users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/dbus-1.2.3-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3834">CVE-2008-3834</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 26 Nov 2008 18:43:42 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 26 Nov 2008 21:51:45 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 26 Nov 2008 21:52:15 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200901-05.xml b/xml/htdocs/security/en/glsa/glsa-200901-05.xml
new file mode 100644
index 00000000..1dcd3213
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200901-05.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200901-05">
+  <title>Streamripper: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple buffer overflows have been discovered in Streamripper, allowing
+    for user-assisted execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">streamripper</product>
+  <announced>January 11, 2009</announced>
+  <revised>January 11, 2009: 01</revised>
+  <bug>249039</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/streamripper" auto="yes" arch="*">
+      <unaffected range="ge">1.64.0</unaffected>
+      <vulnerable range="lt">1.64.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Streamripper is a tool for extracting and recording mp3 files from a
+    Shoutcast stream.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Cornelius from Secunia Research reported multiple buffer
+    overflows in the http_parse_sc_header(), http_get_pls() and
+    http_get_m3u() functions in lib/http.c when parsing overly long HTTP
+    headers, or pls and m3u playlists with overly long entries.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to connect to a malicious server,
+    possibly resulting in the remote execution of arbitrary code with the
+    privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Streamripper users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/streamripper-1.64.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4829">CVE-2008-4829</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 07 Dec 2008 20:23:24 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 21 Dec 2008 20:28:31 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 21 Dec 2008 20:29:17 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200901-06.xml b/xml/htdocs/security/en/glsa/glsa-200901-06.xml
new file mode 100644
index 00000000..b347ddb1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200901-06.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200901-06">
+  <title>Tremulous: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow vulnerability has been discovered in Tremulous.
+  </synopsis>
+  <product type="ebuild">tremulous tremulous-bin</product>
+  <announced>January 11, 2009</announced>
+  <revised>January 11, 2009: 01</revised>
+  <bug>222119</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-fps/tremulous" auto="yes" arch="*">
+      <unaffected range="ge">1.1.0-r2</unaffected>
+      <vulnerable range="lt">1.1.0-r2</vulnerable>
+    </package>
+    <package name="games-fps/tremulous-bin" auto="yes" arch="*">
+      <vulnerable range="lt">1.1.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Tremulous is a team-based First Person Shooter game.
+    </p>
+  </background>
+  <description>
+    <p>
+    It has been reported that Tremulous includes a vulnerable version of
+    the ioQuake3 engine (GLSA 200605-12, CVE-2006-2236).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to connect to a malicious games
+    server, possibly resulting in the execution of arbitrary code with the
+    privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Tremulous users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-fps/tremulous-1.1.0-r2&quot;</code>
+    <p>
+    Note: The binary version of Tremulous has been removed from the Portage
+    tree.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2236">CVE-2006-2236</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200605-12.xml">GLSA 200605-12</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 13 Oct 2008 16:40:23 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 10 Jan 2009 22:54:22 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 10 Jan 2009 22:54:33 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200901-07.xml b/xml/htdocs/security/en/glsa/glsa-200901-07.xml
new file mode 100644
index 00000000..e83dcc2c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200901-07.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200901-07">
+  <title>MPlayer: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in MPlayer may lead to the execution of arbitrary
+    code or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">mplayer</product>
+  <announced>January 12, 2009</announced>
+  <revised>January 12, 2009: 01</revised>
+  <bug>231836</bug>
+  <bug>239130</bug>
+  <bug>251017</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/mplayer" auto="yes" arch="*">
+      <unaffected range="ge">1.0_rc2_p28058-r1 </unaffected>
+      <vulnerable range="lt">1.0_rc2_p28058-r1 </vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MPlayer is a media player including support for a wide range of audio
+    and video formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in MPlayer:
+    </p>
+    <ul>
+    <li>A
+    stack-based buffer overflow was found in the str_read_packet() function
+    in libavformat/psxstr.c when processing crafted STR files that
+    interleave audio and video sectors (CVE-2008-3162).</li>
+    <li>Felipe
+    Andres Manzano reported multiple integer underflows in the
+    demux_real_fill_buffer() function in demux_real.c when processing
+    crafted Real Media files that cause the stream_read() function to read
+    or write arbitrary memory (CVE-2008-3827).</li>
+    <li>Tobias Klein
+    reported a stack-based buffer overflow in the demux_open_vqf() function
+    in libmpdemux/demux_vqf.c when processing malformed TwinVQ files
+    (CVE-2008-5616).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted STR,
+    Real Media, or TwinVQ file to execute arbitrary code or cause a Denial of
+    Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MPlayer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/mplayer-1.0_rc2_p28058-r1 &quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3162">CVE-2008-3162</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3827">CVE-2008-3827</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5616">CVE-2008-5616</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 29 Nov 2008 14:10:43 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 11 Jan 2009 12:40:15 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 11 Jan 2009 14:37:53 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200901-08.xml b/xml/htdocs/security/en/glsa/glsa-200901-08.xml
new file mode 100644
index 00000000..955d3fde
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200901-08.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200901-08">
+  <title>Online-Bookmarks: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been reported in Online-Bookmarks.
+  </synopsis>
+  <product type="ebuild">online-bookmarks</product>
+  <announced>January 12, 2009</announced>
+  <revised>January 12, 2009: 01</revised>
+  <bug>235053</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/online-bookmarks" auto="yes" arch="*">
+      <unaffected range="ge">0.6.28</unaffected>
+      <vulnerable range="lt">0.6.28</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Online-Bookmarks is a web-based bookmark management system to store
+    your bookmarks, favorites and links.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were reported:
+    </p>
+    <ul><li>Authentication bypass when directly requesting certain pages
+    (CVE-2004-2155).</li>
+    <li>Insufficient input validation in the login
+    function in auth.inc (CVE-2006-6358).</li>
+    <li>Unspecified cross-site
+    scripting vulnerability (CVE-2006-6359).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities to bypass
+    authentication mechanisms, execute arbitrary SQL statements or inject
+    arbitrary web scripts.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Online-Bookmarks users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/online-bookmarks-0.6.28&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2155">CVE-2004-2155</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6358">CVE-2006-6358</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6359">CVE-2006-6359</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 22 Sep 2008 12:41:34 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 10 Jan 2009 23:26:51 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 10 Jan 2009 23:27:06 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200901-09.xml b/xml/htdocs/security/en/glsa/glsa-200901-09.xml
new file mode 100644
index 00000000..849447f2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200901-09.xml
@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200901-09">
+  <title>Adobe Reader: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Adobe Reader is vulnerable to execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">acroread</product>
+  <announced>January 13, 2009</announced>
+  <revised>January 13, 2009: 01</revised>
+  <bug>225483</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/acroread" auto="yes" arch="*">
+      <unaffected range="ge">8.1.3</unaffected>
+      <vulnerable range="lt">8.1.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Adobe Reader (formerly Adobe Acrobat Reader) is a closed-source PDF
+    reader.
+    </p>
+  </background>
+  <description>
+    <ul>
+    <li>
+    An unspecified vulnerability can be triggered by a malformed PDF
+    document, as demonstrated by 2008-HI2.pdf (CVE-2008-2549).
+    </li>
+    <li>
+    Peter Vreugdenhil, Dyon Balding, Will Dormann, Damian Frizza, and Greg
+    MacManus reported a stack-based buffer overflow in the util.printf
+    JavaScript function that incorrectly handles the format string argument
+    (CVE-2008-2992).
+    </li>
+    <li>
+    Greg MacManus of iDefense Labs reported an array index error that can
+    be leveraged for an out-of-bounds write, related to parsing of Type 1
+    fonts (CVE-2008-4812).
+    </li>
+    <li>
+    Javier Vicente Vallejo and Peter Vregdenhil, via Zero Day Initiative,
+    reported multiple unspecified memory corruption vulnerabilities
+    (CVE-2008-4813).
+    </li>
+    <li>
+    Thomas Garnier of SkyRecon Systems reported an unspecified
+    vulnerability in a JavaScript method, related to an "input validation
+    issue" (CVE-2008-4814).
+    </li>
+    <li>
+    Josh Bressers of Red Hat reported an untrusted search path
+    vulnerability (CVE-2008-4815).
+    </li>
+    <li>
+    Peter Vreugdenhil reported through iDefense that the Download Manager
+    can trigger a heap corruption via calls to the AcroJS function
+    (CVE-2008-4817).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted PDF
+    document, and local attackers could entice a user to run acroread from
+    an untrusted working directory. Both might result in the execution of
+    arbitrary code with the privileges of the user running the application,
+    or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Adobe Reader users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/acroread-8.1.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2549">CVE-2008-2549</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2992">CVE-2008-2992</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4812">CVE-2008-4812</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4813">CVE-2008-4813</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4814">CVE-2008-4814</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4815">CVE-2008-4815</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4817">CVE-2008-4817</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 26 Nov 2008 18:53:29 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 26 Nov 2008 20:51:39 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 26 Nov 2008 20:51:48 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200901-10.xml b/xml/htdocs/security/en/glsa/glsa-200901-10.xml
new file mode 100644
index 00000000..7d55910a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200901-10.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200901-10">
+  <title>GnuTLS: Certificate validation error</title>
+  <synopsis>
+    A certificate validation error in GnuTLS might allow for spoofing attacks.
+  </synopsis>
+  <product type="ebuild">gnutls</product>
+  <announced>January 14, 2009</announced>
+  <revised>January 14, 2009: 01</revised>
+  <bug>245850</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-libs/gnutls" auto="yes" arch="*">
+      <unaffected range="ge">2.4.1-r2</unaffected>
+      <vulnerable range="lt">2.4.1-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GnuTLS is an open-source implementation of TLS 1.0 and SSL 3.0.
+    </p>
+  </background>
+  <description>
+    <p>
+    Martin von Gagern reported that the _gnutls_x509_verify_certificate()
+    function in lib/x509/verify.c trusts certificate chains in which the
+    last certificate is an arbitrary trusted, self-signed certificate.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit this vulnerability and spoof arbitrary
+    names to conduct Man-In-The-Middle attacks and intercept sensitive
+    information.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GnuTLS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/gnutls-2.4.1-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4989">CVE-2008-4989</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 30 Nov 2008 19:06:26 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 10 Jan 2009 23:37:58 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 10 Jan 2009 23:38:09 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200901-11.xml b/xml/htdocs/security/en/glsa/glsa-200901-11.xml
new file mode 100644
index 00000000..ff9bcbcf
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200901-11.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200901-11">
+  <title>Avahi: Denial of Service</title>
+  <synopsis>
+    A Denial of Service vulnerability has been discovered in Avahi.
+  </synopsis>
+  <product type="ebuild">avahi</product>
+  <announced>January 14, 2009</announced>
+  <revised>January 14, 2009: 01</revised>
+  <bug>250913</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/avahi" auto="yes" arch="*">
+      <unaffected range="ge">0.6.24</unaffected>
+      <vulnerable range="lt">0.6.24</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Avahi is a system that facilitates service discovery on a local
+    network.
+    </p>
+  </background>
+  <description>
+    <p>
+    Hugo Dias reported a failed assertion in the
+    originates_from_local_legacy_unicast_socket() function in
+    avahi-core/server.c when processing mDNS packets with a source port of
+    0.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted packets to the daemon,
+    leading to its crash.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Avahi users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/avahi-0.6.24&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5081">CVE-2008-5081</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 11 Jan 2009 18:41:03 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 12 Jan 2009 22:42:38 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 12 Jan 2009 22:42:49 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200901-12.xml b/xml/htdocs/security/en/glsa/glsa-200901-12.xml
new file mode 100644
index 00000000..ab87f86d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200901-12.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200901-12">
+  <title>noip-updater: Execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow in noip-updater can lead to arbitrary code execution.
+  </synopsis>
+  <product type="ebuild">noip-updater</product>
+  <announced>January 18, 2009</announced>
+  <revised>January 18, 2009: 01</revised>
+  <bug>248709</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/noip-updater" auto="yes" arch="*">
+      <unaffected range="ge">2.1.9</unaffected>
+      <vulnerable range="lt">2.1.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    noip-updater is a tool used for updating IP addresses of dynamic DNS
+    records at no-ip.com.
+    </p>
+  </background>
+  <description>
+    <p>
+    xenomuta found out that the GetNextLine() function in noip2.c misses a
+    length check, leading to a stack-based buffer overflow.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this vulnerability to execute arbitrary
+    code by sending a specially crafted HTTP message to the client. NOTE:
+    Successful exploitation requires a man in the middle attack, a DNS
+    spoofing attack or a compromise of no-ip.com servers.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All noip-updater users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/noip-updater-2.1.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5297">CVE-2008-5297</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 29 Dec 2008 20:15:03 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 02 Jan 2009 11:49:22 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 11 Jan 2009 18:28:39 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200901-13.xml b/xml/htdocs/security/en/glsa/glsa-200901-13.xml
new file mode 100644
index 00000000..0debc868
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200901-13.xml
@@ -0,0 +1,95 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200901-13">
+  <title>Pidgin: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Pidgin, allowing for
+    remote arbitrary code execution, Denial of Service and service spoofing.
+  </synopsis>
+  <product type="ebuild">pidgin</product>
+  <announced>January 20, 2009</announced>
+  <revised>January 20, 2009: 01</revised>
+  <bug>230045</bug>
+  <bug>234135</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/pidgin" auto="yes" arch="*">
+      <unaffected range="ge">2.5.1</unaffected>
+      <vulnerable range="lt">2.5.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Pidgin (formerly Gaim) is an instant messaging client for a variety of
+    instant messaging protocols. It is based on the libpurple instant
+    messaging library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in Pidgin and the
+    libpurple library:
+    </p>
+    <ul><li>
+    A participant to the TippingPoint ZDI reported multiple integer
+    overflows in the msn_slplink_process_msg() function in the MSN protocol
+    implementation (CVE-2008-2927).
+    </li>
+    <li>
+    Juan Pablo Lopez Yacubian is credited for reporting a use-after-free
+    flaw in msn_slplink_process_msg() in the MSN protocol implementation
+    (CVE-2008-2955).
+    </li>
+    <li>
+    The included UPnP server does not limit the size of data to be
+    downloaded for UPnP service discovery, according to a report by Andrew
+    Hunt and Christian Grothoff (CVE-2008-2957).
+    </li>
+    <li>
+    Josh Triplett discovered that the NSS plugin for libpurple does not
+    properly verify SSL certificates (CVE-2008-3532).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted messages or files using
+    the MSN protocol which could result in the execution of arbitrary code
+    or crash Pidgin. NOTE: Successful exploitation might require the
+    victim's interaction. Furthermore, an attacker could conduct
+    man-in-the-middle attacks to obtain sensitive information using bad
+    certificates and cause memory and disk resources to exhaust.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Pidgin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/pidgin-2.5.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2927">CVE-2008-2927</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2955">CVE-2008-2955</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2957">CVE-2008-2957</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3532">CVE-2008-3532</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 06 Jul 2008 18:20:14 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 29 Nov 2008 14:01:14 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 02 Dec 2008 14:32:53 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200901-14.xml b/xml/htdocs/security/en/glsa/glsa-200901-14.xml
new file mode 100644
index 00000000..9660443d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200901-14.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200901-14">
+  <title>Scilab: Insecure temporary file usage</title>
+  <synopsis>
+    An insecure temporary file usage has been reported in Scilab, allowing for
+    symlink attacks.
+  </synopsis>
+  <product type="ebuild">scilab</product>
+  <announced>January 21, 2009</announced>
+  <revised>January 21, 2009: 01</revised>
+  <bug>245922</bug>
+  <access>local</access>
+  <affected>
+    <package name="sci-mathematics/scilab" auto="yes" arch="*">
+      <unaffected range="ge">4.1.2-r1</unaffected>
+      <vulnerable range="lt">4.1.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Scilab is a scientific software package for numerical computations.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dmitry E. Oboukhov reported an insecure temporary file usage within the
+    scilink, scidoc and scidem scripts.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could perform symlink attacks to overwrite arbitrary
+    files with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Scilab users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sci-mathematics/scilab-4.1.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4983">CVE-2008-4983</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 13 Jan 2009 17:29:36 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 13 Jan 2009 18:21:32 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 13 Jan 2009 18:21:45 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200901-15.xml b/xml/htdocs/security/en/glsa/glsa-200901-15.xml
new file mode 100644
index 00000000..394a657f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200901-15.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200901-15">
+  <title>Net-SNMP: Denial of Service</title>
+  <synopsis>
+    A vulnerability in Net-SNMP could lead to a Denial of Service.
+  </synopsis>
+  <product type="ebuild">net-snmp</product>
+  <announced>January 21, 2009</announced>
+  <revised>January 21, 2009: 01</revised>
+  <bug>245306</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/net-snmp" auto="yes" arch="*">
+      <unaffected range="ge">5.4.2.1</unaffected>
+      <vulnerable range="lt">5.4.2.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Net-SNMP is a collection of tools for generating and retrieving SNMP
+    data.
+    </p>
+  </background>
+  <description>
+    <p>
+    Oscar Mira-Sanchez reported an integer overflow in the
+    netsnmp_create_subtree_cache() function in agent/snmp_agent.c when
+    processing GETBULK requests.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send a specially crafted request to crash the
+    SNMP server. NOTE: The attacker needs to know the community string to
+    exploit this vulnerability.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Restrict access to trusted entities only.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Net-SNMP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/net-snmp-5.4.2.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4309">CVE-2008-4309</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 11 Jan 2009 17:57:13 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 12 Jan 2009 22:12:01 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 12 Jan 2009 22:12:09 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200902-01.xml b/xml/htdocs/security/en/glsa/glsa-200902-01.xml
new file mode 100644
index 00000000..19c3d56f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200902-01.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200902-01">
+  <title>sudo: Privilege escalation</title>
+  <synopsis>
+    A vulnerability in sudo may allow for privilege escalation.
+  </synopsis>
+  <product type="ebuild">sudo</product>
+  <announced>February 06, 2009</announced>
+  <revised>February 06, 2009: 01</revised>
+  <bug>256633</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-admin/sudo" auto="yes" arch="*">
+      <unaffected range="ge">1.7.0</unaffected>
+      <vulnerable range="lt">1.7.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    sudo allows a system administrator to give users the ability to run
+    commands as other users.
+    </p>
+  </background>
+  <description>
+    <p>
+    Harald Koenig discovered that sudo incorrectly handles group
+    specifications in Runas_Alias (and related) entries when a group is
+    specified in the list (using %group syntax, to allow a user to run
+    commands as any member of that group) and the user is already a member
+    of that group.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could possibly run commands as an arbitrary system
+    user (including root).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All sudo users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/sudo-1.7.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0034">CVE-2009-0034</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 02 Feb 2009 22:59:48 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 02 Feb 2009 23:20:12 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 06 Feb 2009 22:19:55 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200902-02.xml b/xml/htdocs/security/en/glsa/glsa-200902-02.xml
new file mode 100644
index 00000000..9b51c8ef
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200902-02.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200902-02">
+  <title>OpenSSL: Certificate validation error</title>
+  <synopsis>
+    An error in the OpenSSL certificate chain validation might allow for
+    spoofing attacks.
+  </synopsis>
+  <product type="ebuild">openssl</product>
+  <announced>February 12, 2009</announced>
+  <revised>February 12, 2009: 01</revised>
+  <bug>251346</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/openssl" auto="yes" arch="*">
+      <unaffected range="ge">0.9.8j</unaffected>
+      <vulnerable range="lt">0.9.8j</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer
+    (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general
+    purpose cryptography library.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Google Security Team reported that several functions incorrectly
+    check the result after calling the EVP_VerifyFinal() function, allowing
+    a malformed signature to be treated as a good signature rather than as
+    an error. This issue affects the signature checks on DSA and ECDSA keys
+    used with SSL/TLS.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit this vulnerability and spoof arbitrary
+    names to conduct Man-In-The-Middle attacks and intercept sensitive
+    information.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenSSL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/openssl-0.9.8j&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5077">CVE-2008-5077</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 13 Jan 2009 17:07:15 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 13 Jan 2009 17:07:33 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 13 Jan 2009 17:14:56 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200902-03.xml b/xml/htdocs/security/en/glsa/glsa-200902-03.xml
new file mode 100644
index 00000000..4567cfcd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200902-03.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200902-03">
+  <title>Valgrind: Untrusted search path</title>
+  <synopsis>
+    An untrusted search path vulnerability in Valgrind might result in the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">valgrind</product>
+  <announced>February 12, 2009</announced>
+  <revised>February 12, 2009: 01</revised>
+  <bug>245317</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-util/valgrind" auto="yes" arch="*">
+      <unaffected range="ge">3.4.0</unaffected>
+      <vulnerable range="lt">3.4.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Valgrind is an open-source memory debugger.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy reported that Valgrind loads a .valgrindrc file in the
+    current working directory, executing commands specified there.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could prepare a specially crafted .valgrindrc file and
+    entice a user to run Valgrind from the directory containing that file,
+    resulting in the execution of arbitrary code with the privileges of the
+    user running Valgrind.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not run "valgrind" from untrusted working directories.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Valgrind users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-util/valgrind-3.4.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4865">CVE-2008-4865</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 13 Jan 2009 17:33:22 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 13 Jan 2009 17:46:15 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 13 Jan 2009 17:47:39 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200902-04.xml b/xml/htdocs/security/en/glsa/glsa-200902-04.xml
new file mode 100644
index 00000000..4b2a2f13
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200902-04.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200902-04">
+  <title>xterm: User-assisted arbitrary commands execution</title>
+  <synopsis>
+    An error in the processing of special sequences in xterm may lead to
+    arbitrary commands execution.
+  </synopsis>
+  <product type="ebuild">xterm</product>
+  <announced>February 12, 2009</announced>
+  <revised>February 12, 2009: 01</revised>
+  <bug>253155</bug>
+  <access>remote</access>
+  <affected>
+    <package name="x11-terms/xterm" auto="yes" arch="*">
+      <unaffected range="ge">239</unaffected>
+      <vulnerable range="lt">239</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xterm is a terminal emulator for the X Window system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Paul Szabo reported an insufficient input sanitization when processing
+    Device Control Request Status String (DECRQSS) sequences.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to display a file containing
+    specially crafted DECRQSS sequences, possibly resulting in the remote
+    execution of arbitrary commands with the privileges of the user viewing
+    the file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xterm users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=x11-terms/xterm-239&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2383">CVE-2008-2383</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 28 Jan 2009 00:33:40 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 10 Feb 2009 10:22:45 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 10 Feb 2009 10:22:57 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200902-05.xml b/xml/htdocs/security/en/glsa/glsa-200902-05.xml
new file mode 100644
index 00000000..5b6218ce
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200902-05.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200902-05">
+  <title>KTorrent: Multiple vulnerabilitites</title>
+  <synopsis>
+    Two vulnerabilities in the web interface plugin in KTorrent allow for
+    remote execution of code and arbitrary torrent uploads.
+  </synopsis>
+  <product type="ebuild">ktorrent</product>
+  <announced>February 23, 2009</announced>
+  <revised>February 23, 2009: 01</revised>
+  <bug>244741</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-p2p/ktorrent" auto="yes" arch="*">
+      <unaffected range="ge">2.2.8</unaffected>
+      <vulnerable range="lt">2.2.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    KTorrent is a BitTorrent program for KDE.
+    </p>
+  </background>
+  <description>
+    <p>
+    The web interface plugin does not restrict access to the torrent upload
+    functionality (CVE-2008-5905) and does not sanitize request parameters
+    properly (CVE-2008-5906) .
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send specially crafted parameters to the web
+    interface that would allow for arbitrary torrent uploads and remote
+    code execution with the privileges of the KTorrent process.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disabling the web interface plugin will prevent exploitation of both
+    issues. Click "Plugins" in the configuration menu and uncheck the
+    checkbox left of "WebInterface", then apply the changes.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All KTorrent users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-p2p/ktorrent-2.2.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5905">CVE-2008-5905</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5906">CVE-2008-5906</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 06 Jan 2009 20:05:03 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 10 Jan 2009 00:24:20 +0000">
+    craig
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 10 Jan 2009 19:16:54 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200902-06.xml b/xml/htdocs/security/en/glsa/glsa-200902-06.xml
new file mode 100644
index 00000000..e0b35a64
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200902-06.xml
@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200902-06">
+  <title>GNU Emacs, XEmacs: Multiple vulnerabilities</title>
+  <synopsis>
+    Two vulnerabilities were found in GNU Emacs, possibly leading to
+    user-assisted execution of arbitrary code. One also affects edit-utils in
+    XEmacs.
+  </synopsis>
+  <product type="ebuild">emacs edit-utils</product>
+  <announced>February 23, 2009</announced>
+  <revised>February 23, 2009: 01</revised>
+  <bug>221197</bug>
+  <bug>236498</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-editors/emacs" auto="yes" arch="*">
+      <unaffected range="ge">22.2-r3</unaffected>
+      <unaffected range="rge">21.4-r17</unaffected>
+      <unaffected range="lt">19</unaffected>
+      <vulnerable range="lt">22.2-r3</vulnerable>
+    </package>
+    <package name="app-xemacs/edit-utils" auto="yes" arch="*">
+      <unaffected range="ge">2.39</unaffected>
+      <vulnerable range="lt">2.39</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GNU Emacs and XEmacs are highly extensible and customizable text
+    editors. edit-utils are miscellaneous extensions to XEmacs.
+    </p>
+  </background>
+  <description>
+    <p>
+    Morten Welinder reports about GNU Emacs and edit-utils in XEmacs: By
+    shipping a .flc accompanying a source file (.c for example) and setting
+    font-lock-support-mode to fast-lock-mode in the source file through
+    local variables, any Lisp code in the .flc file is executed without
+    warning (CVE-2008-2142).
+    </p>
+    <p>
+    Romain Francoise reported a security risk in a feature of GNU Emacs
+    related to interacting with Python. The vulnerability arises because
+    Python, by default, prepends the current directory to the module search
+    path, allowing for arbitrary code execution when launched from a
+    specially crafted directory (CVE-2008-3949).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote attackers could entice a user to open a specially crafted file
+    in GNU Emacs, possibly leading to the execution of arbitrary Emacs Lisp
+    code or arbitrary Python code with the privileges of the user running
+    GNU Emacs or XEmacs.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GNU Emacs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-editors/emacs-22.2-r3&quot;</code>
+    <p>
+    All edit-utils users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-xemacs/edit-utils-2.39&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2142">CVE-2008-2142</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3949">CVE-2008-3949</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 06 Jul 2008 22:12:00 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 12 Jul 2008 19:44:28 +0000">
+    vorlon
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 09 Feb 2009 22:47:35 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-01.xml b/xml/htdocs/security/en/glsa/glsa-200903-01.xml
new file mode 100644
index 00000000..140a7489
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-01.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-01">
+  <title>Vinagre: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A format string error in Vinagre may allow for the execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">vinagre</product>
+  <announced>March 06, 2009</announced>
+  <revised>March 06, 2009: 01</revised>
+  <bug>250314</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/vinagre" auto="yes" arch="*">
+      <unaffected range="ge">0.5.2</unaffected>
+      <vulnerable range="lt">0.5.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Vinagre is a VNC Client for the GNOME Desktop.
+    </p>
+  </background>
+  <description>
+    <p>
+    Alfredo Ortega (Core Security Technologies) reported a format string
+    error in the vinagre_utils_show_error() function in
+    src/vinagre-utils.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user into opening a specially crafted
+    .vnc file or connecting to a malicious server, possibly resulting in
+    the remote execution of arbitrary code with the privileges of the user
+    running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Vinagre users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/vinagre-0.5.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5660">CVE-2008-5660</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 13 Dec 2008 19:36:32 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 24 Feb 2009 22:12:27 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 24 Feb 2009 22:12:38 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-02.xml b/xml/htdocs/security/en/glsa/glsa-200903-02.xml
new file mode 100644
index 00000000..346cea31
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-02.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-02">
+  <title>ZNC: Privilege escalation</title>
+  <synopsis>
+    A vulnerability in ZNC allows for privilege escalation.
+  </synopsis>
+  <product type="ebuild">znc</product>
+  <announced>March 06, 2009</announced>
+  <revised>March 06, 2009: 01</revised>
+  <bug>260148</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-irc/znc" auto="yes" arch="*">
+      <unaffected range="ge">0.066</unaffected>
+      <vulnerable range="lt">0.066</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ZNC is an advanced IRC bouncer.
+    </p>
+  </background>
+  <description>
+    <p>
+    cnu discovered multiple CRLF injection vulnerabilities in ZNC's
+    webadmin module.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote authenticated attacker could modify the znc.conf configuration
+    file and gain privileges via newline characters in e.g. the QuitMessage
+    field, and possibly execute arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ZNC users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-irc/znc-0.066&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0759">CVE-2009-0759</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 05 Mar 2009 20:11:58 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 05 Mar 2009 22:51:15 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 06 Mar 2009 22:00:32 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-03.xml b/xml/htdocs/security/en/glsa/glsa-200903-03.xml
new file mode 100644
index 00000000..62372569
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-03.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-03">
+  <title>Audacity: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A boundary error in Audacity allows for the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">audacity</product>
+  <announced>March 06, 2009</announced>
+  <revised>March 06, 2009: 01</revised>
+  <bug>253493</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/audacity" auto="yes" arch="*">
+      <unaffected range="ge">1.3.6</unaffected>
+      <vulnerable range="lt">1.3.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Audacity is a free cross-platform audio editor.
+    </p>
+  </background>
+  <description>
+    <p>
+    Houssamix discovered a boundary error in the
+    String_parse::get_nonspace_quoted() function in
+    lib-src/allegro/strparse.cpp.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user into importing a specially
+    crafted *.gro file, resulting in the execution of arbitrary code or a
+    Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Audacity users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/audacity-1.3.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0490">CVE-2009-0490</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 05 Mar 2009 20:19:24 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 05 Mar 2009 23:00:03 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 06 Mar 2009 22:00:48 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-04.xml b/xml/htdocs/security/en/glsa/glsa-200903-04.xml
new file mode 100644
index 00000000..f1b07992
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-04.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-04">
+  <title>DevIL: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple boundary errors in DevIL may allow for the execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">devil</product>
+  <announced>March 06, 2009</announced>
+  <revised>March 06, 2009: 01</revised>
+  <bug>255217</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/devil" auto="yes" arch="*">
+      <unaffected range="ge">1.7.7</unaffected>
+      <vulnerable range="lt">1.7.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Developer's Image Library (DevIL) is a cross-platform image library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Stefan Cornelius (Secunia Research) discovered two boundary errors
+    within the iGetHdrHeader() function in src-IL/src/il_hdr.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    Radiance RGBE file, possibly resulting in the execution of arbitrary
+    code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All DevIL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/devil-1.7.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5262">CVE-2008-5262</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 05 Mar 2009 20:17:56 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 05 Mar 2009 23:09:26 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 06 Mar 2009 22:07:22 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-05.xml b/xml/htdocs/security/en/glsa/glsa-200903-05.xml
new file mode 100644
index 00000000..d2e3a210
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-05.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-05">
+  <title>PDFjam: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in the PDFjam scripts allow for local privilege
+    escalation.
+  </synopsis>
+  <product type="ebuild">pdfjam</product>
+  <announced>March 07, 2009</announced>
+  <revised>March 07, 2009: 01</revised>
+  <bug>252734</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-text/pdfjam" auto="yes" arch="*">
+      <unaffected range="ge">1.20-r1</unaffected>
+      <vulnerable range="lt">1.20-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PDFjam is a small collection of shell scripts to edit PDF documents,
+    including pdfnup, pdfjoin and pdf90.
+    </p>
+  </background>
+  <description>
+    <ul>
+    <li>
+    Martin Vaeth reported multiple untrusted search path vulnerabilities
+    (CVE-2008-5843).
+    </li>
+    <li>Marcus Meissner of the SUSE Security Team reported that
+    temporary files are created with a predictable name (CVE-2008-5743).
+    </li>
+    </ul> <p>
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could place a specially crafted Python module in the
+    current working directory or the /var/tmp directory, and entice a user
+    to run the PDFjam scripts, leading to the execution of arbitrary code
+    with the privileges of the user running the application. A local
+    attacker could also leverage symlink attacks to overwrite arbitrary
+    files.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PDFjam users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/pdfjam-1.20-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5843">CVE-2008-5843</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5743">CVE-2008-5743</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 23 Jan 2009 21:30:23 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 12 Feb 2009 16:57:17 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 12 Feb 2009 16:57:35 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-06.xml b/xml/htdocs/security/en/glsa/glsa-200903-06.xml
new file mode 100644
index 00000000..9d172377
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-06.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-06">
+  <title>nfs-utils: Access restriction bypass</title>
+  <synopsis>
+    An error in nfs-utils allows for bypass of the netgroups restriction.
+  </synopsis>
+  <product type="ebuild">nfs-utils</product>
+  <announced>March 07, 2009</announced>
+  <revised>March 07, 2009: 01</revised>
+  <bug>242696</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-fs/nfs-utils" auto="yes" arch="*">
+      <unaffected range="ge">1.1.3</unaffected>
+      <vulnerable range="lt">1.1.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    nfs-utils contains the client and daemon implementations for the NFS
+    protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    Michele Marcionelli reported that nfs-utils invokes the hosts_ctl()
+    function with the wrong order of arguments, which causes TCP Wrappers
+    to ignore netgroups.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could bypass intended access restrictions, i.e. NFS
+    netgroups, and gain access to restricted services.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All nfs-utils users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-fs/nfs-utils-1.1.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4552">CVE-2008-4552</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 11 Jan 2009 18:56:17 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 12 Feb 2009 18:22:47 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 12 Feb 2009 18:23:17 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-07.xml b/xml/htdocs/security/en/glsa/glsa-200903-07.xml
new file mode 100644
index 00000000..e65a0408
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-07.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-07">
+  <title>Samba: Data disclosure</title>
+  <synopsis>
+    A missing boundary check in Samba might lead to the disclosure of memory
+    contents.
+  </synopsis>
+  <product type="ebuild">samba</product>
+  <announced>March 07, 2009</announced>
+  <revised>March 07, 2009: 01</revised>
+  <bug>247620</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-fs/samba" auto="yes" arch="*">
+      <unaffected range="ge">3.0.33</unaffected>
+      <vulnerable range="lt">3.0.33</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Samba is a suite of SMB and CIFS client/server programs.
+    </p>
+  </background>
+  <description>
+    <p>
+    Samba does not properly check memory boundaries when handling trans,
+    rans2, and nttrans requests.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted requests to a Samba
+    daemon, leading to the disclosure of arbitrary memory or to a Denial of
+    Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Samba users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-fs/samba-3.0.33&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4314">CVE-2008-4314</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 11 Jan 2009 18:43:46 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 12 Feb 2009 18:28:04 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 12 Feb 2009 18:28:16 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-08.xml b/xml/htdocs/security/en/glsa/glsa-200903-08.xml
new file mode 100644
index 00000000..da5ee81f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-08.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-08">
+  <title>gEDA: Insecure temporary file creation</title>
+  <synopsis>
+    An insecure temporary file usage has been reported in gEDA, allowing for
+    symlink attacks.
+  </synopsis>
+  <product type="ebuild">geda</product>
+  <announced>March 07, 2009</announced>
+  <revised>March 07, 2009: 01</revised>
+  <bug>247538</bug>
+  <access>local</access>
+  <affected>
+    <package name="sci-electronics/geda" auto="yes" arch="*">
+      <unaffected range="ge">1.4.0-r1</unaffected>
+      <vulnerable range="lt">1.4.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    gEDA is an Electronic Design Automation tool used for electrical
+    circuit design.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dmitry E. Oboukhov reported an insecure temporary file usage within the
+    sch2eaglepos.sh script.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could perform symlink attacks to overwrite arbitrary
+    files with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All gEDA users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sci-electronics/geda-1.4.0-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5148">CVE-2008-5148</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 13 Jan 2009 17:58:50 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 12 Feb 2009 18:01:59 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 12 Feb 2009 18:02:15 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-09.xml b/xml/htdocs/security/en/glsa/glsa-200903-09.xml
new file mode 100644
index 00000000..5e656e07
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-09.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-09">
+  <title>OpenTTD: Execution of arbitrary code</title>
+  <synopsis>
+    Multiple buffer overflows in OpenTTD might allow for the execution of
+    arbitrary code in the server.
+  </synopsis>
+  <product type="ebuild">openttd</product>
+  <announced>March 07, 2009</announced>
+  <revised>March 07, 2009: 01</revised>
+  <bug>233929</bug>
+  <access>remote</access>
+  <affected>
+    <package name="games-simulation/openttd" auto="yes" arch="*">
+      <unaffected range="ge">0.6.3</unaffected>
+      <vulnerable range="lt">0.6.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenTTD is a clone of Transport Tycoon Deluxe.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple buffer overflows have been reported in OpenTTD, when storing
+    long for client names (CVE-2008-3547), in the TruncateString function
+    in src/gfx.cpp (CVE-2008-3576) and in src/openttd.cpp when processing a
+    large filename supplied to the "-g" parameter in the ttd_main function
+    (CVE-2008-3577).
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    An authenticated attacker could exploit these vulnerabilities to
+    execute arbitrary code with the privileges of the OpenTTD server.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenTTD users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=games-simulation/openttd-0.6.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3547">CVE-2008-3547</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3576">CVE-2008-3576</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3577">CVE-2008-3577</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 12 Feb 2009 19:13:14 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 13 Feb 2009 15:07:08 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 13 Feb 2009 15:08:05 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-10.xml b/xml/htdocs/security/en/glsa/glsa-200903-10.xml
new file mode 100644
index 00000000..e3d32fab
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-10.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-10">
+  <title>Irrlicht: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow might lead to the execution of arbitrary code or a Denial
+    of Service.
+  </synopsis>
+  <product type="ebuild">irrlicht</product>
+  <announced>March 07, 2009</announced>
+  <revised>March 07, 2009: 01</revised>
+  <bug>252203</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-games/irrlicht" auto="yes" arch="*">
+      <unaffected range="ge">1.5</unaffected>
+      <vulnerable range="lt">1.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Irrlicht Engine is an open source cross-platform high performance
+    realtime 3D engine written in C++.
+    </p>
+  </background>
+  <description>
+    <p>
+    An unspecified component of the B3D loader is vulnerable to a buffer
+    overflow due to missing boundary checks.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted .irr
+    file, possibly resulting in the execution of arbitrary code with the
+    privileges of the user running the application, or a Denial of Service
+    (crash).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All irrlicht users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-games/irrlicht-1.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5876">CVE-2008-5876</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 12 Feb 2009 19:12:26 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 04 Mar 2009 23:33:30 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 06 Mar 2009 22:13:18 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-11.xml b/xml/htdocs/security/en/glsa/glsa-200903-11.xml
new file mode 100644
index 00000000..d8c71d98
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-11.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-11">
+  <title>PyCrypto: Execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow in PyCrypto might lead to the execution of arbitrary code
+    when decrypting using ARC2.
+  </synopsis>
+  <product type="ebuild">pycrypto</product>
+  <announced>March 09, 2009</announced>
+  <revised>March 09, 2009: 01</revised>
+  <bug>258049</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-python/pycrypto" auto="yes" arch="*">
+      <unaffected range="ge">2.0.1-r8</unaffected>
+      <vulnerable range="lt">2.0.1-r8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PyCrypto is the Python Cryptography Toolkit.
+    </p>
+  </background>
+  <description>
+    <p>
+    Mike Wiacek of the Google Security Team reported a buffer overflow in
+    the ARC2 module when processing a large ARC2 key length.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or automated system to decrypt an
+    ARC2 stream in an application using PyCrypto, possibly resulting in the
+    execution of arbitrary code or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PyCrypto users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-python/pycrypto-2.0.1-r8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0544">CVE-2009-0544</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 07 Mar 2009 16:35:09 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 07 Mar 2009 18:22:46 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 07 Mar 2009 18:24:44 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-12.xml b/xml/htdocs/security/en/glsa/glsa-200903-12.xml
new file mode 100644
index 00000000..f7301ea3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-12.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-12">
+  <title>OptiPNG: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A vulnerability in OptiPNG might result in user-assisted execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">optipng</product>
+  <announced>March 09, 2009</announced>
+  <revised>March 09, 2009: 01</revised>
+  <bug>260265</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/optipng" auto="yes" arch="*">
+      <unaffected range="ge">0.6.2-r1</unaffected>
+      <vulnerable range="lt">0.6.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OptiPNG is a PNG optimizer that recompresses image files to a smaller
+    size, without losing any information.
+    </p>
+  </background>
+  <description>
+    <p>
+    Roy Tam reported a use-after-free vulnerability in the
+    GIFReadNextExtension() function in lib/pngxtern/gif/gifread.c leading
+    to a memory corruption when reading a GIF image.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to process a specially crafted
+    GIF image, possibly resulting in the execution of arbitrary code with
+    the privileges of the user running the application, or a Denial of
+    Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OptiPNG users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/optipng-0.6.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0749">CVE-2009-0749</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 07 Mar 2009 16:36:48 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 07 Mar 2009 18:09:51 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 07 Mar 2009 18:10:05 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-13.xml b/xml/htdocs/security/en/glsa/glsa-200903-13.xml
new file mode 100644
index 00000000..a424a5ca
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-13.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-13">
+  <title>MPFR: Denial of Service</title>
+  <synopsis>
+    Multiple buffer overflows in MPFR might lead to a Denial of Service.
+  </synopsis>
+  <product type="ebuild">mpfr</product>
+  <announced>March 09, 2009</announced>
+  <revised>March 09, 2009: 01</revised>
+  <bug>260968</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/mpfr" auto="yes" arch="*">
+      <unaffected range="ge">2.4.1</unaffected>
+      <vulnerable range="lt">2.4.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MPFR is a library for multiple-precision floating-point computations
+    with exact rounding.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple buffer overflows have been reported in the mpfr_snprintf() and
+    mpfr_vsnprintf() functions.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote user could exploit the vulnerability to cause a Denial of
+    Service in an application using MPFR via unknown vectors.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MPRF users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/mpfr-2.4.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0757">CVE-2009-0757</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 07 Mar 2009 16:35:53 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 07 Mar 2009 18:14:49 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 07 Mar 2009 18:14:57 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-14.xml b/xml/htdocs/security/en/glsa/glsa-200903-14.xml
new file mode 100644
index 00000000..5b6a14de
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-14.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-14">
+  <title>BIND: Incorrect signature verification</title>
+  <synopsis>
+    Incomplete verification of RSA and DSA certificates might lead to spoofed
+    records authenticated using DNSSEC.
+  </synopsis>
+  <product type="ebuild">bind</product>
+  <announced>March 09, 2009</announced>
+  <revised>March 09, 2009: 01</revised>
+  <bug>254134</bug>
+  <bug>257949</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/bind" auto="yes" arch="*">
+      <unaffected range="ge">9.4.3_p1</unaffected>
+      <vulnerable range="lt">9.4.3_p1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ISC BIND is the Internet Systems Consortium implementation of the
+    Domain Name System (DNS) protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    BIND does not properly check the return value from the OpenSSL
+    functions to verify DSA (CVE-2009-0025) and RSA (CVE-2009-0265)
+    certificates.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could bypass validation of the certificate chain to
+    spoof DNSSEC-authenticated records.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All BIND users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/bind-9.4.3_p1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0025">CVE-2009-0025</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0265">CVE-2009-0265</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 11 Jan 2009 17:55:00 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 09 Mar 2009 10:41:33 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 09 Mar 2009 10:41:40 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-15.xml b/xml/htdocs/security/en/glsa/glsa-200903-15.xml
new file mode 100644
index 00000000..bc95d87a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-15.xml
@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-15">
+  <title>git: Multiple vulnerabilties</title>
+  <synopsis>
+    Multiple vulnerabilities in gitweb allow for remote execution of arbitrary
+    commands.
+  </synopsis>
+  <product type="ebuild">git</product>
+  <announced>March 09, 2009</announced>
+  <revised>March 09, 2009: 01</revised>
+  <bug>251343</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-util/git" auto="yes" arch="*">
+      <unaffected range="ge">1.6.0.6</unaffected>
+      <vulnerable range="lt">1.6.0.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GIT - the stupid content tracker, the revision control system used by
+    the Linux kernel team.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in gitweb that is part of
+    the git package:
+    </p>
+    <ul>
+    <li>
+    Shell metacharacters related to git_search are not properly sanitized
+    (CVE-2008-5516).
+    </li>
+    <li>
+    Shell metacharacters related to git_snapshot and git_object are not
+    properly sanitized (CVE-2008-5517).
+    </li>
+    <li>
+    The diff.external configuration variable as set in a repository can be
+    executed by gitweb (CVE-2008-5916).
+    </li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A remote unauthenticated attacker can execute arbitrary commands via
+    shell metacharacters in a query, remote attackers with write access to
+    a git repository configuration can execute arbitrary commands with the
+    privileges of the user running gitweb by modifying the diff.external
+    configuration variable in the repository and sending a crafted query to
+    gitweb.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All git users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-util/git-1.6.0.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5516">CVE-2008-5516</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5517">CVE-2008-5517</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5916">CVE-2008-5916</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 11 Jan 2009 18:26:05 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 12 Feb 2009 18:42:55 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 12 Feb 2009 18:43:18 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-16.xml b/xml/htdocs/security/en/glsa/glsa-200903-16.xml
new file mode 100644
index 00000000..b5613d25
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-16.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-16">
+  <title>Epiphany: Untrusted search path</title>
+  <synopsis>
+    An untrusted search path vulnerability in Epiphany might result in the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">epiphany</product>
+  <announced>March 09, 2009</announced>
+  <revised>March 09, 2009: 01</revised>
+  <bug>257000</bug>
+  <access>local</access>
+  <affected>
+    <package name="www-client/epiphany" auto="yes" arch="*">
+      <unaffected range="ge">2.22.3-r2</unaffected>
+      <vulnerable range="lt">2.22.3-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Epiphany is a GNOME webbrowser based on the Mozilla rendering engine
+    Gecko.
+    </p>
+  </background>
+  <description>
+    <p>
+    James Vega reported an untrusted search path vulnerability in the
+    Python interface.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could entice a user to run Epiphany from a directory
+    containing a specially crafted python module, resulting in the
+    execution of arbitrary code with the privileges of the user running
+    Epiphany.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not run "epiphany" from untrusted working directories.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Epiphany users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/epiphany-2.22.3-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5985">CVE-2008-5985</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 07 Mar 2009 16:40:03 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 07 Mar 2009 18:06:14 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 07 Mar 2009 18:06:33 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-17.xml b/xml/htdocs/security/en/glsa/glsa-200903-17.xml
new file mode 100644
index 00000000..5386b2ca
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-17.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-17">
+  <title>Real VNC: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    The Real VNC client is vulnerable to execution of arbitrary code when
+    connecting to a malicious server.
+  </synopsis>
+  <product type="ebuild">vnc</product>
+  <announced>March 09, 2009</announced>
+  <revised>March 09, 2009: 01</revised>
+  <bug>255225</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/vnc" auto="yes" arch="*">
+      <unaffected range="ge">4.1.3</unaffected>
+      <vulnerable range="lt">4.1.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Real VNC is a remote desktop viewer display system.
+    </p>
+  </background>
+  <description>
+    <p>
+    An unspecified vulnerability has been discovered int the
+    CMsgReader::readRect() function in the VNC Viewer component, related to
+    the encoding type of RFB protocol data.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to connect to a malicious VNC
+    server, or leverage Man-in-the-Middle attacks, to cause the execution
+    of arbitrary code with the privileges of the user running the VNC
+    viewer.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Real VNC users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/vnc-4.1.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4770">CVE-2008-4770</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 28 Jan 2009 00:30:00 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 12 Feb 2009 16:35:19 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 12 Feb 2009 16:35:29 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-18.xml b/xml/htdocs/security/en/glsa/glsa-200903-18.xml
new file mode 100644
index 00000000..3e26da6e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-18.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-18">
+  <title>Openswan: Insecure temporary file creation</title>
+  <synopsis>
+    An insecure temporary file usage has been reported in Openswan, allowing
+    for symlink attacks.
+  </synopsis>
+  <product type="ebuild">openswan</product>
+  <announced>March 09, 2009</announced>
+  <revised>March 09, 2009: 01</revised>
+  <bug>238574</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-misc/openswan" auto="yes" arch="*">
+      <unaffected range="ge">2.4.13-r2</unaffected>
+      <vulnerable range="lt">2.4.13-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Openswan is an implementation of IPsec for Linux.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dmitry E. Oboukhov reported that the IPSEC livetest tool does not
+    handle the ipseclive.conn and ipsec.olts.remote.log temporary files
+    securely.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could perform symlink attacks to execute arbitrary
+    code and overwrite arbitrary files with the privileges of the user
+    running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Openswan users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/openswan-2.4.13-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4190">CVE-2008-4190</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 11 Jan 2009 18:17:28 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 12 Feb 2009 18:08:11 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 12 Feb 2009 18:08:22 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-19.xml b/xml/htdocs/security/en/glsa/glsa-200903-19.xml
new file mode 100644
index 00000000..810ea67d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-19.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-19">
+  <title>Xerces-C++: Denial of Service</title>
+  <synopsis>
+    An error in Xerces-C++ allows for a Denial of Service via malicious XML
+    schema files.
+  </synopsis>
+  <product type="ebuild">xerces-c</product>
+  <announced>March 09, 2009</announced>
+  <revised>March 09, 2009: 01</revised>
+  <bug>240496</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/xerces-c" auto="yes" arch="*">
+      <unaffected range="ge">3.0.0-r1</unaffected>
+      <vulnerable range="lt">3.0.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Xerces-C++ is a validating XML parser written in a portable subset of
+    C++.
+    </p>
+  </background>
+  <description>
+    <p>
+    Frank Rast reported that the XML parser in Xerces-C++ does not
+    correctly handle an XML schema definition with a large maxOccurs value,
+    which triggers excessive memory consumption during the validation of an
+    XML file.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or automated system to validate
+    an XML file using a specially crafted XML schema file, leading to a
+    Denial of Service (stack consumption and crash).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Xerces-C++ users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/xerces-c-3.0.0-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4482">CVE-2008-4482</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 11 Jan 2009 17:39:39 +0000">
+    falco
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 12 Feb 2009 18:13:38 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 12 Feb 2009 18:13:55 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-20.xml b/xml/htdocs/security/en/glsa/glsa-200903-20.xml
new file mode 100644
index 00000000..86836237
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-20.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-20">
+  <title>WebSVN: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in WebSVN allow for file overwrite and information
+    disclosure.
+  </synopsis>
+  <product type="ebuild">websvn</product>
+  <announced>March 09, 2009</announced>
+  <revised>March 09, 2009: 01</revised>
+  <bug>243852</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/websvn" auto="yes" arch="*">
+      <unaffected range="ge">2.1.0</unaffected>
+      <vulnerable range="lt">2.1.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    WebSVN is a web-based browsing tool for Subversion repositories written
+    in PHP.
+    </p>
+  </background>
+  <description>
+    <ul>
+    <li>
+    James Bercegay of GulfTech Security reported a Cross-site scripting
+    (XSS) vulnerability in the getParameterisedSelfUrl() function in
+    index.php (CVE-2008-5918) and a directory traversal vulnerability in
+    rss.php when magic_quotes_gpc is disabled (CVE-2008-5919).
+    </li>
+    <li>
+    Bas van Schaik reported that listing.php does not properly enforce
+    access restrictions when using an SVN authz file to authenticate users
+    (CVE-2009-0240).
+    </li>
+    </ul> <p>
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker can exploit these vulnerabilities to overwrite
+    arbitrary files, to read changelogs or diffs for restricted projects
+    and to hijack a user's session.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All WebSVN users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/websvn-2.1.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5918">CVE-2008-5918</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5919">CVE-2008-5919</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0240">CVE-2009-0240</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 24 Jan 2009 11:43:28 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 12 Feb 2009 17:56:35 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 12 Feb 2009 17:56:41 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-21.xml b/xml/htdocs/security/en/glsa/glsa-200903-21.xml
new file mode 100644
index 00000000..21536e76
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-21.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-21">
+  <title>cURL: Arbitrary file access</title>
+  <synopsis>
+    A vulnerability in cURL may allow for arbitrary file access.
+  </synopsis>
+  <product type="ebuild">curl</product>
+  <announced>March 09, 2009</announced>
+  <revised>March 09, 2009: 01</revised>
+  <bug>260361</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/curl" auto="yes" arch="*">
+      <unaffected range="ge">7.19.4</unaffected>
+      <vulnerable range="lt">7.19.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    cURL is a command line tool for transferring files with URL syntax,
+    supporting numerous protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    David Kierznowski reported that the redirect implementation accepts
+    arbitrary Location values when CURLOPT_FOLLOWLOCATION is enabled.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could possibly exploit this vulnerability to make
+    remote HTTP servers trigger arbitrary requests to intranet servers and
+    read or overwrite arbitrary files via a redirect to a file: URL, or, if
+    the libssh2 USE flag is enabled, execute arbitrary commands via a
+    redirect to an scp: URL.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All cURL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/curl-7.19.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0037">CVE-2009-0037</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 05 Mar 2009 20:06:34 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 05 Mar 2009 23:20:10 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 06 Mar 2009 22:09:58 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-22.xml b/xml/htdocs/security/en/glsa/glsa-200903-22.xml
new file mode 100644
index 00000000..5a69554d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-22.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-22">
+  <title>Ganglia: Execution of arbitrary code</title>
+  <synopsis>
+    A buffer-overflow in Ganglia's gmetad might lead to the execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">ganglia</product>
+  <announced>March 10, 2009</announced>
+  <revised>March 10, 2009: 01</revised>
+  <bug>255366</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-cluster/ganglia" auto="yes" arch="*">
+      <unaffected range="ge">3.1.1-r2</unaffected>
+      <vulnerable range="lt">3.1.1-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ganglia is a scalable distributed monitoring system for clusters and
+    grids.
+    </p>
+  </background>
+  <description>
+    <p>
+    Spike Spiegel reported a stack-based buffer overflow in the
+    process_path() function when processing overly long pathnames in
+    gmetad/server.c.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send a specially crafted request to the gmetad
+    service leading to the execution of arbitrary code or a Denial of
+    Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ganglia users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-cluster/ganglia-3.1.1-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0241">CVE-2009-0241</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 03 Feb 2009 00:12:46 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 12 Feb 2009 16:26:05 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 12 Feb 2009 16:27:02 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-23.xml b/xml/htdocs/security/en/glsa/glsa-200903-23.xml
new file mode 100644
index 00000000..a6d4f48f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-23.xml
@@ -0,0 +1,139 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-23">
+  <title>Adobe Flash Player: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been identified, the worst of which allow
+    arbitrary code execution on a user's system via a malicious Flash file.
+  </synopsis>
+  <product type="ebuild">adobe-flash</product>
+  <announced>March 10, 2009</announced>
+  <revised>May 28, 2009: 04</revised>
+  <bug>239543</bug>
+  <bug>251496</bug>
+  <bug>260264</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-plugins/adobe-flash" auto="yes" arch="*">
+      <unaffected range="ge">10.0.22.87</unaffected>
+      <vulnerable range="lt">10.0.22.87</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Adobe Flash Player is a renderer for the popular SWF file format,
+    which is commonly used to provide interactive websites, digital
+    experiences and mobile content.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in Adobe Flash Player:
+    </p>
+    <ul>
+    <li>The access scope of SystemsetClipboard() allows ActionScript
+    programs to execute the method without user interaction
+    (CVE-2008-3873).</li>
+    <li>The access scope of FileReference.browse() and
+    FileReference.download() allows ActionScript programs to execute the
+    methods without user interaction (CVE-2008-4401).</li>
+    <li>The Settings Manager controls can be disguised as normal graphical
+    elements. This so-called "clickjacking" vulnerability was disclosed by
+    Robert Hansen of SecTheory, Jeremiah Grossman of WhiteHat Security,
+    Eduardo Vela, Matthew Mastracci of DotSpots, and Liu Die Yu of
+    TopsecTianRongXin (CVE-2008-4503).</li>
+    <li>Adan Barth (UC Berkely) and Collin Jackson (Stanford University)
+    discovered a flaw occurring when interpreting HTTP response headers
+    (CVE-2008-4818).</li>
+    <li>Nathan McFeters and Rob Carter of Ernst and Young's Advanced
+    Security Center are credited for finding an unspecified vulnerability
+    facilitating DNS rebinding attacks (CVE-2008-4819).</li>
+    <li>When used in a Mozilla browser, Adobe Flash Player does not
+    properly interpret jar: URLs, according to a report by Gregory
+    Fleischer of pseudo-flaw.net (CVE-2008-4821).</li>
+    <li>Alex "kuza55" K. reported that Adobe Flash Player does not properly
+    interpret policy files (CVE-2008-4822).</li>
+    <li>The vendor credits Stefano Di Paola of Minded Security for
+    reporting that an ActionScript attribute is not interpreted properly
+    (CVE-2008-4823).</li>
+    <li>Riley Hassell and Josh Zelonis of iSEC Partners reported multiple
+    input validation errors (CVE-2008-4824).</li>
+    <li>The aforementioned researchers also reported that ActionScript 2
+    does not verify a member element's size when performing several known
+    and other unspecified actions, that DefineConstantPool accepts an
+    untrusted input value for a "constant count" and that character
+    elements are not validated when retrieved from a data structure,
+    possibly resulting in a null-pointer dereference (CVE-2008-5361,
+    CVE-2008-5362, CVE-2008-5363).</li>
+    <li>The vendor reported an unspecified arbitrary code execution
+    vulnerability (CVE-2008-5499).</li>
+    <li>Liu Die Yu of TopsecTianRongXin reported an unspecified flaw in the
+    Settings Manager related to "clickjacking" (CVE-2009-0114).</li>
+    <li>The vendor credits Roee Hay from IBM Rational Application Security
+    for reporting an input validation error when processing SWF files
+    (CVE-2009-0519).</li>
+    <li>Javier Vicente Vallejo reported via the iDefense VCP that Adobe
+    Flash does not remove object references properly, leading to a freed
+    memory dereference (CVE-2009-0520).</li>
+    <li>Josh Bressers of Red Hat and Tavis Ormandy of the Google Security
+    Team reported an untrusted search path vulnerability
+    (CVE-2009-0521).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted SWF
+    file, possibly resulting in the execution of arbitrary code with the
+    privileges of the user or a Denial of Service (crash). Furthermore a
+    remote attacker could gain access to sensitive information, disclose
+    memory contents by enticing a user to open a specially crafted PDF file
+    inside a Flash application, modify the victim's clipboard or render it
+    temporarily unusable, persuade a user into uploading or downloading
+    files, bypass security restrictions with the assistance of the user to
+    gain access to camera and microphone, conduct Cross-Site Scripting and
+    HTTP Header Splitting attacks, bypass the "non-root domain policy" of
+    Flash, and gain escalated privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Adobe Flash Player users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-plugins/adobe-flash-10.0.22.87&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3873">CVE-2008-3873</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4401">CVE-2008-4401</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4503">CVE-2008-4503</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4818">CVE-2008-4818</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4819">CVE-2008-4819</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4821">CVE-2008-4821</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4822">CVE-2008-4822</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4823">CVE-2008-4823</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4824">CVE-2008-4824</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5361">CVE-2008-5361</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5362">CVE-2008-5362</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5363">CVE-2008-5363</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5499">CVE-2008-5499</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0114">CVE-2009-0114</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0519">CVE-2009-0519</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0520">CVE-2009-0520</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0521">CVE-2009-0521</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 09 Mar 2009 11:37:22 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 09 Mar 2009 12:37:48 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-24.xml b/xml/htdocs/security/en/glsa/glsa-200903-24.xml
new file mode 100644
index 00000000..be0e7fc0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-24.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-24">
+  <title>Shadow: Privilege escalation</title>
+  <synopsis>
+    An insecure temporary file usage in Shadow may allow local users to gain
+    root privileges.
+  </synopsis>
+  <product type="ebuild">shadow</product>
+  <announced>March 10, 2009</announced>
+  <revised>March 10, 2009: 01</revised>
+  <bug>251320</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-apps/shadow" auto="yes" arch="*">
+      <unaffected range="ge">4.1.2.2</unaffected>
+      <vulnerable range="lt">4.1.2.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Shadow is a set of tools to deal with user accounts.
+    </p>
+  </background>
+  <description>
+    <p>
+    Paul Szabo reported a race condition in the "login" executable when
+    setting up tty permissions.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker belonging to the "utmp" group could use symlink
+    attacks to overwrite arbitrary files and possibly gain root privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Shadow users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/shadow-4.1.2.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5394">CVE-2008-5394</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 12 Feb 2009 19:41:17 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 08 Mar 2009 19:05:06 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 08 Mar 2009 19:05:15 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-25.xml b/xml/htdocs/security/en/glsa/glsa-200903-25.xml
new file mode 100644
index 00000000..71339ac5
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-25.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-25">
+  <title>Courier Authentication Library: SQL Injection vulnerability</title>
+  <synopsis>
+    An SQL injection vulnerability has been discovered in the Courier
+    Authentication Library.
+  </synopsis>
+  <product type="ebuild">courier-authlib</product>
+  <announced>March 11, 2009</announced>
+  <revised>March 11, 2009: 01</revised>
+  <bug>252576</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-libs/courier-authlib" auto="yes" arch="*">
+      <unaffected range="ge">0.62.2</unaffected>
+      <vulnerable range="lt">0.62.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Courier Authentication Library is a generic authentication API that
+    encapsulates the process of validating account passwords.
+    </p>
+  </background>
+  <description>
+    <p>
+    It has been reported that some parameters used in SQL queries are not
+    properly sanitized before being processed when using a non-Latin locale
+    Postgres database.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted input to an application
+    using the library, possibly resulting in the execution of arbitrary SQL
+    commands.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Courier Authentication Library users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/courier-authlib-0.62.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2380">CVE-2008-2380</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 07 Mar 2009 18:32:02 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 10 Mar 2009 12:55:53 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 11 Mar 2009 10:55:30 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-26.xml b/xml/htdocs/security/en/glsa/glsa-200903-26.xml
new file mode 100644
index 00000000..79d56957
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-26.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-26">
+  <title>TMSNC: Execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow in TMSNC might lead to the execution of arbitrary code
+    when processing an instant message.
+  </synopsis>
+  <product type="ebuild">tmsnc</product>
+  <announced>March 12, 2009</announced>
+  <revised>March 12, 2009: 01</revised>
+  <bug>229157</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/tmsnc" auto="yes" arch="*">
+      <vulnerable range="le">0.3.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    TMSNC is a Textbased client for the MSN instant messaging protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    Nico Golde reported a stack-based buffer overflow when processing a MSN
+    packet with a UBX command containing a large UBX payload length field.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send a specially crafted message, possibly
+    resulting in the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Since TMSNC is no longer maintained, we recommend that users unmerge
+    the vulnerable package and switch to another console-based MSN client
+    such as CenterIM or Pebrot:
+    </p>
+    <code>
+    # emerge --unmerge &quot;net-im/tmsnc&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2828">CVE-2008-2828</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 10 Mar 2009 22:52:54 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 11 Mar 2009 12:01:45 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 11 Mar 2009 12:02:24 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-27.xml b/xml/htdocs/security/en/glsa/glsa-200903-27.xml
new file mode 100644
index 00000000..b462eb40
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-27.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-27">
+  <title>ProFTPD: Multiple vulnerabilities</title>
+  <synopsis>
+    Two vulnerabilities in ProFTPD might allow for SQL injection attacks.
+  </synopsis>
+  <product type="ebuild">proftpd</product>
+  <announced>March 12, 2009</announced>
+  <revised>March 12, 2009: 01</revised>
+  <bug>258450</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-ftp/proftpd" auto="yes" arch="*">
+      <unaffected range="ge">1.3.2</unaffected>
+      <vulnerable range="lt">1.3.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ProFTPD is an advanced and very configurable FTP server.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were reported:
+    </p>
+    <ul><li>
+    Percent characters in the username are not properly handled, which
+    introduces a single quote character during variable substitution by
+    mod_sql (CVE-2009-0542).
+    </li>
+    <li>
+    Some invalid, encoded multibyte characters are not properly handled in
+    mod_sql_mysql and mod_sql_postgres when NLS support is enabled
+    (CVE-2009-0543).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted requests to the server,
+    possibly resulting in the execution of arbitrary SQL statements.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ProFTPD users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-ftp/proftpd-1.3.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0542">CVE-2009-0542</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0543">CVE-2009-0543</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 07 Mar 2009 18:36:42 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 12 Mar 2009 12:43:00 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 12 Mar 2009 12:43:09 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-28.xml b/xml/htdocs/security/en/glsa/glsa-200903-28.xml
new file mode 100644
index 00000000..a325ec6d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-28.xml
@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-28">
+  <title>libpng: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities were found in libpng, which might result in the
+    execution of arbitrary code
+  </synopsis>
+  <product type="ebuild">libpng</product>
+  <announced>March 15, 2009</announced>
+  <revised>March 15, 2009: 01</revised>
+  <bug>244808</bug>
+  <bug>255231</bug>
+  <bug>259578</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libpng" auto="yes" arch="*">
+      <unaffected range="ge">1.2.35</unaffected>
+      <vulnerable range="lt">1.2.35</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libpng is the official PNG reference library used to read, write and
+    manipulate PNG images.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities were discovered in libpng:
+    </p>
+    <ul>
+    <li>A
+    memory leak bug was reported in png_handle_tEXt(), a function that is
+    used while reading PNG images (CVE-2008-6218).</li>
+    <li>A memory
+    overwrite bug was reported by Jon Foster in png_check_keyword(), caused
+    by writing overlong keywords to a PNG file (CVE-2008-5907).</li>
+    <li>A
+    memory corruption issue, caused by an incorrect handling of an out of
+    memory condition has been reported by Tavis Ormandy of the Google
+    Security Team. That vulnerability affects direct uses of
+    png_read_png(), pCAL chunk and 16-bit gamma table handling
+    (CVE-2009-0040).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker may execute arbitrary code with the privileges of the
+    user opening a specially crafted PNG file by exploiting the erroneous
+    out-of-memory handling. An attacker may also exploit the
+    png_check_keyword() error to set arbitrary memory locations to 0, if
+    the application allows overlong, user-controlled keywords when writing
+    PNG files. The png_handle_tEXT() vulnerability may be exploited by an
+    attacker to potentially consume all memory on a users system when a
+    specially crafted PNG file is opened.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libpng users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libpng-1.2.35&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5907">CVE-2008-5907</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6218">CVE-2008-6218</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0040">CVE-2009-0040</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 11 Jan 2009 18:45:00 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 13 Feb 2009 19:13:22 +0000">
+    mabi
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 13 Mar 2009 19:09:44 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-29.xml b/xml/htdocs/security/en/glsa/glsa-200903-29.xml
new file mode 100644
index 00000000..f20a5047
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-29.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-29">
+  <title>BlueZ: Arbitrary code execution</title>
+  <synopsis>
+    Insufficient input validation in BlueZ may lead to arbitrary code execution
+    or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">bluez-utils bluez-libs</product>
+  <announced>March 16, 2009</announced>
+  <revised>March 16, 2009: 01</revised>
+  <bug>230591</bug>
+  <access>local, remote</access>
+  <affected>
+    <package name="net-wireless/bluez-utils" auto="yes" arch="*">
+      <unaffected range="ge">3.36</unaffected>
+      <vulnerable range="lt">3.36</vulnerable>
+    </package>
+    <package name="net-wireless/bluez-libs" auto="yes" arch="*">
+      <unaffected range="ge">3.36</unaffected>
+      <vulnerable range="lt">3.36</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    BlueZ is a set of Bluetooth tools and system daemons for Linux.
+    </p>
+  </background>
+  <description>
+    <p>
+    It has been reported that the Bluetooth packet parser does not validate
+    string length fields in SDP packets.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A physically proximate attacker using a Bluetooth device with an
+    already established trust relationship could send specially crafted
+    requests, possibly leading to arbitrary code execution or a crash.
+    Exploitation may also be triggered by a local attacker registering a
+    service record via a UNIX socket or D-Bus interface.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All bluez-utils users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-wireless/bluez-utils-3.36&quot;</code>
+    <p>
+    All bluez-libs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-wireless/bluez-libs-3.36&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2374">CVE-2008-2374</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 11 Mar 2009 19:03:24 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 11 Mar 2009 19:04:53 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 13 Mar 2009 12:49:09 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-30.xml b/xml/htdocs/security/en/glsa/glsa-200903-30.xml
new file mode 100644
index 00000000..c30604c4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-30.xml
@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-30">
+  <title>Opera: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities were found in Opera, the worst of which allow for
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">opera</product>
+  <announced>March 16, 2009</announced>
+  <revised>March 17, 2009: 02</revised>
+  <bug>247229</bug>
+  <bug>261032</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/opera" auto="yes" arch="*">
+      <unaffected range="ge">9.64</unaffected>
+      <vulnerable range="lt">9.64</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Opera is a fast web browser that is available free of charge.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities were discovered in Opera:
+    </p>
+    <ul>
+    <li>Vitaly McLain reported a heap-based buffer overflow when processing
+    host names in file:// URLs (CVE-2008-5178).</li>
+    <li>Alexios Fakos reported a vulnerability in the HTML parsing engine
+    when processing web pages that trigger an invalid pointer calculation
+    and heap corruption (CVE-2008-5679).</li>
+    <li>Red XIII reported that certain text-area contents can be
+    manipulated to cause a buffer overlow (CVE-2008-5680).</li>
+    <li>David Bloom discovered that unspecified "scripted URLs" are not
+    blocked during the feed preview (CVE-2008-5681).</li>
+    <li>Robert Swiecki of the Google Security Team reported a Cross-site
+    scripting vulnerability (CVE-2008-5682).</li>
+    <li>An unspecified vulnerability reveals random data
+    (CVE-2008-5683).</li>
+    <li>Tavis Ormandy of the Google Security Team reported a vulnerability
+    when processing JPEG images that may corrupt memory
+    (CVE-2009-0914).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted JPEG
+    image to cause a Denial of Service or execute arbitrary code, to
+    process an overly long file:// URL or to open a specially crafted web
+    page to execute arbitrary code. He could also read existing
+    subscriptions and force subscriptions to arbitrary feed URLs, as well
+    as inject arbitrary web script or HTML via built-in XSLT templates.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Opera users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/opera-9.64&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5178">CVE-2008-5178</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5679">CVE-2008-5679</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5680">CVE-2008-5680</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5681">CVE-2008-5681</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5682">CVE-2008-5682</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5683">CVE-2008-5683</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0914">CVE-2009-0914</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 07 Mar 2009 09:16:02 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 09 Mar 2009 15:15:16 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 16 Mar 2009 21:43:27 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-31.xml b/xml/htdocs/security/en/glsa/glsa-200903-31.xml
new file mode 100644
index 00000000..38e8333d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-31.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-31">
+  <title>libcdaudio: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A vulnerability in libcdaudio might allow for the remote execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">libcdaudio</product>
+  <announced>March 17, 2009</announced>
+  <revised>March 17, 2009: 01</revised>
+  <bug>245649</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libcdaudio" auto="yes" arch="*">
+      <unaffected range="ge">0.99.12-r1</unaffected>
+      <vulnerable range="lt">0.99.12-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libcdaudio is a library of CD audio related routines.
+    </p>
+  </background>
+  <description>
+    <p>
+    A heap-based buffer overflow has been reported in the
+    cddb_read_disc_data() function in cddb.c when processing overly long
+    CDDB data.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to connect to a malicious CDDB
+    server, possibly resulting in the remote execution of arbitrary code
+    with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libcdaudio users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libcdaudio-0.99.12-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5030">CVE-2008-5030</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 16 Mar 2009 12:45:13 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 16 Mar 2009 12:45:24 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-32.xml b/xml/htdocs/security/en/glsa/glsa-200903-32.xml
new file mode 100644
index 00000000..6ebea927
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-32.xml
@@ -0,0 +1,100 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-32">
+  <title>phpMyAdmin: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in phpMyAdmin, the worst of
+    which may allow for remote code execution.
+  </synopsis>
+  <product type="ebuild">phpmyadmin</product>
+  <announced>March 18, 2009</announced>
+  <revised>March 18, 2009: 01</revised>
+  <bug>237781</bug>
+  <bug>244914</bug>
+  <bug>246831</bug>
+  <bug>250752</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/phpmyadmin" auto="yes" arch="*">
+      <unaffected range="ge">2.11.9.4</unaffected>
+      <vulnerable range="lt">2.11.9.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpMyAdmin is a web-based management tool for MySQL databases.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in phpMyAdmin:
+    </p>
+    <ul>
+    <li>
+    libraries/database_interface.lib.php in phpMyAdmin allows remote
+    authenticated users to execute arbitrary code via a request to
+    server_databases.php with a sort_by parameter containing PHP sequences,
+    which are processed by create_function (CVE-2008-4096).
+    </li>
+    <li>
+    Cross-site scripting (XSS) vulnerability in pmd_pdf.php allows remote
+    attackers to inject arbitrary web script or HTML via the db parameter,
+    a different vector than CVE-2006-6942 and CVE-2007-5977
+    (CVE-2008-4775).
+    </li>
+    <li>
+    Cross-site request forgery (CSRF) vulnerability in phpMyAdmin allows
+    remote authenticated attackers to perform unauthorized actions as the
+    administrator via a link or IMG tag to tbl_structure.php with a
+    modified table parameter. NOTE: this can be leveraged to conduct SQL
+    injection attacks and execute arbitrary code (CVE-2008-5621).
+    </li>
+    <li>
+    Multiple cross-site request forgery (CSRF) vulnerabilities in
+    phpMyAdmin allow remote attackers to conduct SQL injection attacks via
+    unknown vectors related to the table parameter, a different vector than
+    CVE-2008-5621 (CVE-2008-5622).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker may execute arbitrary code with the rights of the
+    webserver, inject and execute SQL with the rights of phpMyAdmin or
+    conduct XSS attacks against other users.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpMyAdmin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/phpmyadmin-2.11.9.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6942">CVE-2006-6942</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5977">CVE-2007-5977</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4096">CVE-2008-4096</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4775">CVE-2008-4775</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5621">CVE-2008-5621</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5622">CVE-2008-5622</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 23 Sep 2008 18:59:26 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 14 Mar 2009 23:58:57 +0000">
+    mabi
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 16 Mar 2009 21:41:59 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-33.xml b/xml/htdocs/security/en/glsa/glsa-200903-33.xml
new file mode 100644
index 00000000..ba1f37dd
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-33.xml
@@ -0,0 +1,112 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-33">
+  <title>FFmpeg: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in FFmpeg may lead to the remote execution of
+    arbitrary code or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">ffmpeg gst-plugins-ffmpeg mplayer</product>
+  <announced>March 19, 2009</announced>
+  <revised>March 19, 2009: 01</revised>
+  <bug>231831</bug>
+  <bug>231834</bug>
+  <bug>245313</bug>
+  <bug>257217</bug>
+  <bug>257381</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-video/ffmpeg" auto="yes" arch="*">
+      <unaffected range="ge">0.4.9_p20090201</unaffected>
+      <vulnerable range="lt">0.4.9_p20090201</vulnerable>
+    </package>
+    <package name="media-plugins/gst-plugins-ffmpeg" auto="yes" arch="*">
+      <unaffected range="ge">0.10.5</unaffected>
+      <vulnerable range="lt">0.10.5</vulnerable>
+    </package>
+    <package name="media-video/mplayer" auto="yes" arch="*">
+      <unaffected range="ge">1.0_rc2_p28450</unaffected>
+      <vulnerable range="lt">1.0_rc2_p28450</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    FFmpeg is a complete solution to record, convert and stream audio and
+    video. gst-plugins-ffmpeg is a FFmpeg based gstreamer plugin which
+    includes a vulnerable copy of FFmpeg code. Mplayer is a multimedia
+    player which also includes a vulnerable copy of the code.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities were found in FFmpeg:
+    </p>
+    <ul><li>astrange
+    reported a stack-based buffer overflow in the str_read_packet() in
+    libavformat/psxstr.c when processing .str files (CVE-2008-3162).</li>
+    <li>Multiple buffer overflows in libavformat/utils.c
+    (CVE-2008-4866).</li>
+    <li>A buffer overflow in libavcodec/dca.c
+    (CVE-2008-4867).</li>
+    <li>An unspecified vulnerability in the
+    avcodec_close() function in libavcodec/utils.c (CVE-2008-4868).</li>
+    <li>Unspecified memory leaks (CVE-2008-4869).</li>
+    <li>Tobias Klein
+    repoerted a NULL pointer dereference due to an integer signedness error
+    in the fourxm_read_header() function in libavformat/4xm.c
+    (CVE-2009-0385).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted media
+    file, possibly leading to the execution of arbitrary code with the
+    privileges of the user running the application, or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All FFmpeg users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/ffmpeg-0.4.9_p20090201&quot;</code>
+    <p>
+    All gst-plugins-ffmpeg users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-plugins/gst-plugins-ffmpeg-0.10.5&quot;</code>
+    <p>
+    All Mplayer users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-video/mplayer-1.0_rc2_p28450&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3162 ">CVE-2008-3162</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4866">CVE-2008-4866</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4867">CVE-2008-4867</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4868">CVE-2008-4868</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4869">CVE-2008-4869</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0385">CVE-2009-0385</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 31 Oct 2008 21:30:59 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 17 Mar 2009 22:05:30 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 17 Mar 2009 22:05:39 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-34.xml b/xml/htdocs/security/en/glsa/glsa-200903-34.xml
new file mode 100644
index 00000000..a8997940
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-34.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-34">
+  <title>Amarok: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple vulnerabilities in Amarok might allow for user-assisted execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">amarok</product>
+  <announced>March 20, 2009</announced>
+  <revised>March 20, 2009: 01</revised>
+  <bug>254896</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/amarok" auto="yes" arch="*">
+      <unaffected range="ge">1.4.10-r2</unaffected>
+      <vulnerable range="lt">1.4.10-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Amarok is an advanced music player.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tobias Klein has discovered multiple vulnerabilities in Amarok:
+    </p>
+    <ul>
+    <li>Multiple integer overflows in the Audible::Tag::readTag()
+    function in metadata/audible/audibletag.cpp trigger heap-based buffer
+    overflows (CVE-2009-0135).</li>
+    <li>Multiple array index errors in the
+    Audible::Tag::readTag() function in metadata/audible/audibletag.cpp can
+    lead to invalid pointer dereferences, or the writing of a 0x00 byte to
+    an arbitrary memory location after an allocation failure
+    (CVE-2009-0136).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    Audible Audio (.aa) file with a large "nlen" or "vlen" tag value to
+    execute arbitrary code or cause a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Amarok users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/amarok-1.4.10-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0135">CVE-2009-0135</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0136">CVE-2009-0136</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 19 Mar 2009 13:02:32 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 20 Mar 2009 19:39:32 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 20 Mar 2009 19:54:30 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-35.xml b/xml/htdocs/security/en/glsa/glsa-200903-35.xml
new file mode 100644
index 00000000..30c2d012
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-35.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-35">
+  <title>Muttprint: Insecure temporary file usage</title>
+  <synopsis>
+    An insecure temporary file usage in Muttprint allows for symlink attacks.
+  </synopsis>
+  <product type="ebuild">muttprint</product>
+  <announced>March 23, 2009</announced>
+  <revised>March 23, 2009: 01</revised>
+  <bug>250554</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-misc/muttprint" auto="yes" arch="*">
+      <unaffected range="ge">0.72d-r1</unaffected>
+      <vulnerable range="lt">0.72d-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Muttprint formats the output of mail clients to a good-looking printing
+    using LaTeX.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dmitry E. Oboukhov reported an insecure usage of the temporary file
+    "/tmp/muttprint.log" in the muttprint script.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could perform symlink attacks to overwrite arbitrary
+    files with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Muttprint users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-misc/muttprint-0.72d-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5368">CVE-2008-5368</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 22 Mar 2009 20:25:26 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 22 Mar 2009 21:59:17 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 22 Mar 2009 21:59:46 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-36.xml b/xml/htdocs/security/en/glsa/glsa-200903-36.xml
new file mode 100644
index 00000000..c2739062
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-36.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-36">
+  <title>MLDonkey: Information disclosure</title>
+  <synopsis>
+    A vulnerability in the MLDonkey web interface allows remote attackers to
+    disclose arbitrary files.
+  </synopsis>
+  <product type="ebuild">mldonkey</product>
+  <announced>March 23, 2009</announced>
+  <revised>March 23, 2009: 01</revised>
+  <bug>260072</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-p2p/mldonkey" auto="yes" arch="*">
+      <unaffected range="ge">3.0.0</unaffected>
+      <vulnerable range="lt">3.0.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MLDonkey is a multi-network P2P application written in Ocaml, coming
+    with its own Gtk GUI, web and telnet interface.
+    </p>
+  </background>
+  <description>
+    <p>
+    Michael Peselnik reported that src/utils/lib/url.ml in the web
+    interface of MLDonkey does not handle file names with leading double
+    slashes properly.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could gain access to arbitrary files readable by the
+    user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable the web interface or restrict access to it.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MLDonkey users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-p2p/mldonkey-3.0.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0753">CVE-2009-0753</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 22 Mar 2009 20:26:47 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 22 Mar 2009 20:38:08 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 22 Mar 2009 22:00:11 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-37.xml b/xml/htdocs/security/en/glsa/glsa-200903-37.xml
new file mode 100644
index 00000000..2a6bd645
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-37.xml
@@ -0,0 +1,97 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-37">
+  <title>Ghostscript: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple integer overflows in the Ghostscript ICC library might allow for
+    user-assisted execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">ghostscript-gpl ghostscript-esp ghostscript-gnu</product>
+  <announced>March 23, 2009</announced>
+  <revised>March 23, 2009: 01</revised>
+  <bug>261087</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/ghostscript-gpl" auto="yes" arch="*">
+      <unaffected range="ge">8.64-r2</unaffected>
+      <vulnerable range="lt">8.64-r2</vulnerable>
+    </package>
+    <package name="app-text/ghostscript-gnu" auto="yes" arch="*">
+      <unaffected range="ge">8.62.0</unaffected>
+      <vulnerable range="lt">8.62.0</vulnerable>
+    </package>
+    <package name="app-text/ghostscript-esp" auto="yes" arch="*">
+      <vulnerable range="le">8.15.4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ghostscript is an interpreter for the PostScript language and the
+    Portable Document Format (PDF).
+    </p>
+  </background>
+  <description>
+    <p>
+    Jan Lieskovsky from the Red Hat Security Response Team discovered the
+    following vulnerabilities in Ghostscript's ICC Library:
+    </p>
+    <ul>
+    <li>Multiple integer overflows (CVE-2009-0583).</li>
+    <li>Multiple
+    insufficient bounds checks on certain variable sizes
+    (CVE-2009-0584).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    PostScript file containing images and a malicious ICC profile, possibly
+    resulting in the execution of arbitrary code with the privileges of the
+    user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GPL Ghostscript users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/ghostscript-gpl-8.64-r2&quot;</code>
+    <p>
+    All GNU Ghostscript users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/ghostscript-gnu-8.62.0&quot;</code>
+    <p>
+    We recommend that users unmerge ESP Ghostscript and use GPL or GNU
+    Ghostscript instead:
+    </p>
+    <code>
+    # emerge --unmerge &quot;app-text/ghostscript-esp&quot;</code>
+    <p>
+    For installation instructions, see above.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0583">CVE-2009-0583</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0584">CVE-2009-0584</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 22 Mar 2009 20:18:05 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 22 Mar 2009 21:04:31 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 23 Mar 2009 13:39:36 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-38.xml b/xml/htdocs/security/en/glsa/glsa-200903-38.xml
new file mode 100644
index 00000000..4ef1e781
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-38.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-38">
+  <title>Squid: Multiple Denial of Service vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been found in Squid which allow for remote
+    Denial of Service attacks.
+  </synopsis>
+  <product type="ebuild">Squid</product>
+  <announced>March 24, 2009</announced>
+  <revised>March 24, 2009: 01</revised>
+  <bug>216319</bug>
+  <bug>257585</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-proxy/squid" auto="yes" arch="*">
+      <unaffected range="ge">2.7.6</unaffected>
+      <vulnerable range="lt">2.7.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Squid is a full-featured web proxy cache.
+    </p>
+  </background>
+  <description>
+    <ul>
+    <li>The arrayShrink function in lib/Array.c can cause an array to
+    shrink to 0 entries, which triggers an assert error. NOTE: this issue
+    is due to an incorrect fix for CVE-2007-6239 (CVE-2008-1612).</li>
+    <li>An invalid version number in a HTTP request may trigger an
+    assertion in HttpMsg.c and HttpStatusLine.c (CVE-2009-0478).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    The issues allows for Denial of Service attacks against the service via
+    an HTTP request with an invalid version number and other specially
+    crafted requests.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Squid users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-proxy/squid-2.7.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6239">CVE-2007-6239</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1612">CVE-2008-1612</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0478">CVE-2009-0478</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200801-05.xml">GLSA-200801-05</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 09 Mar 2009 14:14:34 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 16 Mar 2009 14:25:11 +0000">
+    craig
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 24 Mar 2009 16:45:49 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-39.xml b/xml/htdocs/security/en/glsa/glsa-200903-39.xml
new file mode 100644
index 00000000..b7e4da5e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-39.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-39">
+  <title>pam_krb5: Privilege escalation</title>
+  <synopsis>
+    Two vulnerabilities in pam_krb5 might allow local users to elevate their
+    privileges or overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">pam_krb5</product>
+  <announced>March 25, 2009</announced>
+  <revised>March 25, 2009: 01</revised>
+  <bug>257075</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-auth/pam_krb5" auto="yes" arch="*">
+      <unaffected range="ge">3.12</unaffected>
+      <vulnerable range="lt">3.12</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    pam_krb5 is a a Kerberos v5 PAM module.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were discovered:
+    </p>
+    <ul><li>pam_krb5
+    does not properly initialize the Kerberos libraries for setuid use
+    (CVE-2009-0360).</li>
+    <li>Derek Chan reported that calls to
+    pam_setcred() are not properly handled when running setuid
+    (CVE-2009-0361).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could set an environment variable to point to a
+    specially crafted Kerberos configuration file and launch a PAM-based
+    setuid application to elevate privileges, or change ownership and
+    overwrite arbitrary files.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All pam_krb5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-auth/pam_krb5-3.12&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0360">CVE-2009-0360</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0361">CVE-2009-0361</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 05 Mar 2009 20:23:59 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 09 Mar 2009 12:57:24 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 09 Mar 2009 12:57:36 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-40.xml b/xml/htdocs/security/en/glsa/glsa-200903-40.xml
new file mode 100644
index 00000000..d30e4c1f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-40.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-40">
+  <title>Analog: Denial of Service</title>
+  <synopsis>
+    A Denial of Service vulnerability was discovered in Analog.
+  </synopsis>
+  <product type="ebuild">analog</product>
+  <announced>March 29, 2009</announced>
+  <revised>March 29, 2009: 01</revised>
+  <bug>249140</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-admin/analog" auto="yes" arch="*">
+      <unaffected range="ge">6.0-r2</unaffected>
+      <vulnerable range="lt">6.0-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Analog is a a webserver log analyzer.
+    </p>
+  </background>
+  <description>
+    <p>
+    Diego E. Petteno reported that the Analog package in Gentoo is built
+    with its own copy of bzip2, making it vulnerable to CVE-2008-1372 (GLSA
+    200804-02).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could place specially crafted log files into a log
+    directory being analyzed by analog, e.g. /var/log/apache, resulting in
+    a crash when being processed by the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Analog users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/analog-6.0-r2&quot;</code>
+    <p>
+    NOTE: Analog is now linked against the system bzip2 library.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1372">CVE-2008-1372</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200804-02.xml">GLSA 200804-02</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 21 Dec 2008 20:13:59 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 26 Mar 2009 12:22:59 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 26 Mar 2009 12:23:07 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200903-41.xml b/xml/htdocs/security/en/glsa/glsa-200903-41.xml
new file mode 100644
index 00000000..266cd8be
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200903-41.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200903-41">
+  <title>gedit: Untrusted search path</title>
+  <synopsis>
+    A vulnerability in gedit might allow local attackers to execute arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">gedit</product>
+  <announced>March 30, 2009</announced>
+  <revised>March 30, 2009: 01</revised>
+  <bug>257004</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-editors/gedit" auto="yes" arch="*">
+      <unaffected range="rge">2.22.3-r1</unaffected>
+      <unaffected range="ge">2.24.3</unaffected>
+      <vulnerable range="lt">2.24.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    gedit is a text editor for the GNOME desktop.
+    </p>
+  </background>
+  <description>
+    <p>
+    James Vega reported that gedit uses the current working directory when
+    searching for python modules, a vulnerability related to CVE-2008-5983.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could entice a user to open gedit from a specially
+    crafted environment, possibly resulting in the execution of arbitrary
+    code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not run gedit from untrusted working directories.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All gedit 2.22.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-editors/gedit-2.22.3-r1&quot;</code>
+    <p>
+    All gedit 2.24.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-editors/gedit-2.24.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5983">CVE-2008-5983</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0314">CVE-2009-0314</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 23 Mar 2009 09:17:57 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 30 Mar 2009 11:46:10 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 30 Mar 2009 11:46:20 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-01.xml b/xml/htdocs/security/en/glsa/glsa-200904-01.xml
new file mode 100644
index 00000000..aea890dc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-01.xml
@@ -0,0 +1,98 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-01">
+  <title>Openfire: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities were discovered in Openfire, the worst of which
+    may allow remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">openfire</product>
+  <announced>April 02, 2009</announced>
+  <revised>April 02, 2009: 01</revised>
+  <bug>246008</bug>
+  <bug>254309</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/openfire" auto="yes" arch="*">
+      <unaffected range="ge">3.6.3</unaffected>
+      <vulnerable range="lt">3.6.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ignite Realtime Openfire is a fast real-time collaboration server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Two vulnerabilities have been reported by Federico Muttis, from CORE
+    IMPACT's Exploit Writing Team:
+    </p>
+    <ul>
+    <li>
+    Multiple missing or incomplete input validations in several .jsps
+    (CVE-2009-0496).
+    </li>
+    <li>
+    Incorrect input validation of the "log" parameter in log.jsp
+    (CVE-2009-0497).
+    </li>
+    </ul> <p>
+    Multiple vulnerabilities have been reported by Andreas Kurtz:
+    </p>
+    <ul>
+    <li>
+    Erroneous built-in exceptions to input validation in login.jsp
+    (CVE-2008-6508).
+    </li>
+    <li>
+    Unsanitized user input to the "type" parameter in
+    sipark-log-summary.jsp used in SQL statement. (CVE-2008-6509)
+    </li>
+    <li>
+    A Cross-Site-Scripting vulnerability due to unsanitized input to the
+    "url" parameter. (CVE-2008-6510, CVE-2008-6511)
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could execute arbitrary code on clients' systems by
+    uploading a specially crafted plugin, bypassing authentication.
+    Additionally, an attacker could read arbitrary files on the server or
+    execute arbitrary SQL statements. Depending on the server's
+    configuration the attacker might also execute code on the server via an
+    SQL injection.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Openfire users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/openfire-3.6.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6508">CVE-2008-6508</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6509">CVE-2008-6509</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6510">CVE-2008-6510</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6511">CVE-2008-6511</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0496">CVE-2009-0496</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0497">CVE-2009-0497</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 21 Mar 2009 10:46:26 +0000">
+    mabi
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 21 Mar 2009 11:36:24 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-02.xml b/xml/htdocs/security/en/glsa/glsa-200904-02.xml
new file mode 100644
index 00000000..f4528125
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-02.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-02">
+  <title>GLib: Execution of arbitrary code</title>
+  <synopsis>
+    Multiple integer overflows might allow for the execution of arbitrary code
+    when performing base64 conversion.
+  </synopsis>
+  <product type="ebuild">glib</product>
+  <announced>April 03, 2009</announced>
+  <revised>April 05, 2009: 02</revised>
+  <bug>249214</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/glib" auto="yes" arch="*">
+      <unaffected range="ge">2.18.4-r1</unaffected>
+      <unaffected range="rge">2.16.6-r1</unaffected>
+      <unaffected range="lt">2</unaffected>
+      <vulnerable range="lt">2.18.4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The GLib is a library of C routines that is used by a multitude of
+    programs.
+    </p>
+  </background>
+  <description>
+    <p>
+    Diego E. Petteno` reported multiple integer overflows in glib/gbase64.c
+    when converting a long string from or to a base64 representation.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or automated system to perform a
+    base64 conversion via an application using GLib, possibly resulting in
+    the execution of arbitrary code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GLib 2.18 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/glib-2.18.4-r1&quot;</code>
+    <p>
+    All GLib 2.16 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/glib-2.16.6-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4316">CVE-2008-4316</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 02 Apr 2009 12:01:03 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 02 Apr 2009 12:09:57 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 02 Apr 2009 12:10:20 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-03.xml b/xml/htdocs/security/en/glsa/glsa-200904-03.xml
new file mode 100644
index 00000000..ab8c2de0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-03.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-03">
+  <title>Gnumeric: Untrusted search path</title>
+  <synopsis>
+    An untrusted search path vulnerability in Gnumeric might result in the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">gnumeric</product>
+  <announced>April 03, 2009</announced>
+  <revised>April 03, 2009: 01</revised>
+  <bug>257012</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-office/gnumeric" auto="yes" arch="*">
+      <unaffected range="ge">1.8.4-r1</unaffected>
+      <vulnerable range="lt">1.8.4-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Gnumeric spreadsheet is a versatile application developed as part
+    of the GNOME Office project.
+    </p>
+  </background>
+  <description>
+    <p>
+    James Vega reported an untrusted search path vulnerability in the
+    GObject Python interpreter wrapper in Gnumeric.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could entice a user to run Gnumeric from a directory
+    containing a specially crafted python module, resulting in the
+    execution of arbitrary code with the privileges of the user running
+    Gnumeric.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not run "gnumeric" from untrusted working directories.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Gnumeric users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-office/gnumeric-1.8.4-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0318">CVE-2009-0318</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Thu, 02 Apr 2009 12:39:58 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 02 Apr 2009 12:40:05 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-04.xml b/xml/htdocs/security/en/glsa/glsa-200904-04.xml
new file mode 100644
index 00000000..71eeea22
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-04.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-04">
+  <title>WeeChat: Denial of Service</title>
+  <synopsis>
+    A processing error in WeeChat might lead to a Denial of Service.
+  </synopsis>
+  <product type="ebuild">weechat</product>
+  <announced>April 04, 2009</announced>
+  <revised>April 04, 2009: 01</revised>
+  <bug>262997</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-irc/weechat" auto="yes" arch="*">
+      <unaffected range="ge">0.2.6.1</unaffected>
+      <vulnerable range="lt">0.2.6.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Wee Enhanced Environment for Chat (WeeChat) is a light and extensible
+    console IRC client.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sebastien Helleu reported an array out-of-bounds error in the colored
+    message handling.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send a specially crafted PRIVMSG command,
+    possibly leading to a Denial of Service (application crash).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All WeeChat users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-irc/weechat-0.2.6.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0661">CVE-2009-0661</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 04 Apr 2009 15:10:01 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 04 Apr 2009 15:21:46 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 04 Apr 2009 17:18:54 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-05.xml b/xml/htdocs/security/en/glsa/glsa-200904-05.xml
new file mode 100644
index 00000000..cfe50f7a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-05.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-05">
+  <title>ntp: Certificate validation error</title>
+  <synopsis>
+    An error in the OpenSSL certificate chain validation in ntp might allow for
+    spoofing attacks.
+  </synopsis>
+  <product type="ebuild">ntp</product>
+  <announced>April 05, 2009</announced>
+  <revised>April 05, 2009: 01</revised>
+  <bug>254098</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/ntp" auto="yes" arch="*">
+      <unaffected range="ge">4.2.4_p6</unaffected>
+      <vulnerable range="lt">4.2.4_p6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ntp contains the client and daemon implementations for the Network Time
+    Protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    It has been reported that ntp incorrectly checks the return value of
+    the EVP_VerifyFinal(), a vulnerability related to CVE-2008-5077 (GLSA
+    200902-02).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit this vulnerability to spoof arbitrary
+    names to conduct Man-In-The-Middle attacks and intercept sensitive
+    information.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ntp users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/ntp-4.2.4_p6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5077">CVE-2008-5077</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0021">CVE-2009-0021</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200902-02.xml">GLSA 200902-02</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 31 Mar 2009 11:41:38 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 31 Mar 2009 11:41:46 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-06.xml b/xml/htdocs/security/en/glsa/glsa-200904-06.xml
new file mode 100644
index 00000000..0b9a568a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-06.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-06">
+  <title>Eye of GNOME: Untrusted search path</title>
+  <synopsis>
+    An untrusted search path vulnerability in the Eye of GNOME might result in
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">eog</product>
+  <announced>April 06, 2009</announced>
+  <revised>April 06, 2009: 01</revised>
+  <bug>257002</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-gfx/eog" auto="yes" arch="*">
+      <unaffected range="ge">2.22.3-r3</unaffected>
+      <vulnerable range="lt">2.22.3-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Eye of GNOME is the official image viewer for the GNOME Desktop
+    environment.
+    </p>
+  </background>
+  <description>
+    <p>
+    James Vega reported an untrusted search path vulnerability in the
+    GObject Python interpreter wrapper in the Eye of GNOME, a vulnerabiliy
+    related to CVE-2008-5983.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could entice a user to run the Eye of GNOME from a
+    directory containing a specially crafted python module, resulting in
+    the execution of arbitrary code with the privileges of the user running
+    the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not run "eog" from untrusted working directories.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Eye of GNOME users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/eog-2.22.3-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5983">CVE-2008-5983</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5987">CVE-2008-5987</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 06 Apr 2009 11:38:51 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 06 Apr 2009 11:40:09 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-07.xml b/xml/htdocs/security/en/glsa/glsa-200904-07.xml
new file mode 100644
index 00000000..9150bf93
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-07.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-07">
+  <title>Xpdf: Untrusted search path</title>
+  <synopsis>
+    A vulnerability in Xpdf might allow local attackers to execute arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">xpdf</product>
+  <announced>April 07, 2009</announced>
+  <revised>April 07, 2009: 01</revised>
+  <bug>242930</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-text/xpdf" auto="yes" arch="*">
+      <unaffected range="ge">3.02-r2</unaffected>
+      <vulnerable range="lt">3.02-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Xpdf is a PDF file viewer that runs under the X Window System.
+    </p>
+  </background>
+  <description>
+    <p>
+    Erik Wallin reported that Gentoo's Xpdf attempts to read the "xpdfrc"
+    file from the current working directory if it cannot find a ".xpdfrc"
+    file in the user's home directory. This is caused by a missing
+    definition of the SYSTEM_XPDFRC macro when compiling a repackaged
+    version of Xpdf.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could entice a user to run "xpdf" from a directory
+    containing a specially crafted "xpdfrc" file, resulting in the
+    execution of arbitrary code when attempting to, e.g., print a file.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not run Xpdf from untrusted working directories.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Xpdf users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/xpdf-3.02-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1144">CVE-2009-1144</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 04 Apr 2009 12:41:57 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 04 Apr 2009 12:52:05 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 04 Apr 2009 12:52:11 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-08.xml b/xml/htdocs/security/en/glsa/glsa-200904-08.xml
new file mode 100644
index 00000000..5ee7a6de
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-08.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-08">
+  <title>OpenSSL: Denial of Service</title>
+  <synopsis>
+    An error in OpenSSL might allow for a Denial of Service when printing
+    certificate details.
+  </synopsis>
+  <product type="ebuild">openssl</product>
+  <announced>April 07, 2009</announced>
+  <revised>April 07, 2009: 01</revised>
+  <bug>263751</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/openssl" auto="yes" arch="*">
+      <unaffected range="ge">0.9.8k</unaffected>
+      <vulnerable range="lt">0.9.8k</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer
+    (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general
+    purpose cryptography library.
+    </p>
+  </background>
+  <description>
+    <p>
+    The ASN1_STRING_print_ex() function does not properly check the
+    provided length of a BMPString or UniversalString, leading to an
+    invalid memory access.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or automated system to print a
+    specially crafted certificate, possibly leading to a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenSSL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/openssl-0.9.8k&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0590">CVE-2009-0590</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 04 Apr 2009 13:16:21 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 04 Apr 2009 13:41:11 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 04 Apr 2009 13:41:45 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-09.xml b/xml/htdocs/security/en/glsa/glsa-200904-09.xml
new file mode 100644
index 00000000..51e82265
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-09.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-09">
+  <title>MIT Kerberos 5: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilites in MIT Kerberos 5 might allow remote
+    unauthenticated users to execute arbitrary code with root privileges.
+  </synopsis>
+  <product type="ebuild">mit-krb5</product>
+  <announced>April 08, 2009</announced>
+  <revised>April 08, 2009: 01</revised>
+  <bug>262736</bug>
+  <bug>263398</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-crypt/mit-krb5" auto="yes" arch="*">
+      <unaffected range="ge">1.6.3-r6</unaffected>
+      <vulnerable range="lt">1.6.3-r6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    MIT Kerberos 5 is a suite of applications that implement the Kerberos
+    network protocol. kadmind is the MIT Kerberos 5 administration daemon,
+    KDC is the Key Distribution Center.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in MIT Kerberos 5:
+    </p>
+    <ul>
+    <li>A free() call on an uninitialized pointer in the ASN.1 decoder
+    when decoding an invalid encoding (CVE-2009-0846).</li>
+    <li>A buffer
+    overread in the SPNEGO GSS-API application, reported by Apple Product
+    Security (CVE-2009-0844).</li>
+    <li>A NULL pointer dereference in the
+    SPNEGO GSS-API application, reported by Richard Evans
+    (CVE-2009-0845).</li>
+    <li>An incorrect length check inside an ASN.1
+    decoder leading to spurious malloc() failures (CVE-2009-0847).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A remote unauthenticated attacker could exploit the first vulnerability
+    to cause a Denial of Service or, in unlikely circumstances, execute
+    arbitrary code on the host running krb5kdc or kadmind with root
+    privileges and compromise the Kerberos key database. Exploitation of
+    the other vulnerabilities might lead to a Denial of Service in kadmind,
+    krb5kdc, or other daemons performing authorization against Kerberos
+    that utilize GSS-API or an information disclosure.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All MIT Kerberos 5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-crypt/mit-krb5-1.6.3-r6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0844">CVE-2009-0844</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0845">CVE-2009-0845</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0846">CVE-2009-0846</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0847">CVE-2009-0847</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 08 Apr 2009 01:07:26 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 08 Apr 2009 18:19:31 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-10.xml b/xml/htdocs/security/en/glsa/glsa-200904-10.xml
new file mode 100644
index 00000000..8cc5e073
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-10.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-10">
+  <title>Avahi: Denial of Service</title>
+  <synopsis>
+    An error in Avahi might lead to a Denial of Service via network and CPU
+    consumption.
+  </synopsis>
+  <product type="ebuild">avahi</product>
+  <announced>April 08, 2009</announced>
+  <revised>April 08, 2009: 01</revised>
+  <bug>260971</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/avahi" auto="yes" arch="*">
+      <unaffected range="ge">0.6.24-r2</unaffected>
+      <vulnerable range="lt">0.6.24-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Avahi is a system that facilitates service discovery on a local
+    network.
+    </p>
+  </background>
+  <description>
+    <p>
+    Rob Leslie reported that the
+    originates_from_local_legacy_unicast_socket() function in
+    avahi-core/server.c does not account for the network byte order of a
+    port number when processing incoming multicast packets, leading to a
+    multicast packet storm.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted legacy unicast mDNS
+    query packets to the Avahi daemon, resulting in a Denial of Service due
+    to network bandwidth and CPU consumption.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Avahi users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/avahi-0.6.24-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0758">CVE-2009-0758</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 04 Apr 2009 13:49:21 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 04 Apr 2009 13:56:36 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 04 Apr 2009 13:57:02 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-11.xml b/xml/htdocs/security/en/glsa/glsa-200904-11.xml
new file mode 100644
index 00000000..9a28ec0c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-11.xml
@@ -0,0 +1,97 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-11">
+  <title>Tor: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Tor might allow for heap corruption, Denial of
+    Service, escalation of privileges and information disclosure.
+  </synopsis>
+  <product type="ebuild">tor</product>
+  <announced>April 08, 2009</announced>
+  <revised>April 08, 2009: 01</revised>
+  <bug>250018</bug>
+  <bug>256078</bug>
+  <bug>258833</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/tor" auto="yes" arch="*">
+      <unaffected range="ge">0.2.0.34</unaffected>
+      <vulnerable range="lt">0.2.0.34</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Tor is an implementation of second generation Onion Routing, a
+    connection-oriented anonymizing communication service.
+    </p>
+  </background>
+  <description>
+    <ul>
+    <li>
+    Theo de Raadt reported that the application does not properly drop
+    privileges to the primary groups of the user specified via the "User"
+    configuration option (CVE-2008-5397).
+    </li>
+    <li>
+    rovv reported that the "ClientDNSRejectInternalAddresses" configuration
+    option is not always enforced (CVE-2008-5398).
+    </li>
+    <li>
+    Ilja van Sprundel reported a heap-corruption vulnerability that might
+    be remotely triggerable on some platforms (CVE-2009-0414).
+    </li>
+    <li>
+    It has been reported that incomplete IPv4 addresses are treated as
+    valid, violating the specification (CVE-2009-0939).
+    </li>
+    <li>
+    Three unspecified vulnerabilities have also been reported
+    (CVE-2009-0936, CVE-2009-0937, CVE-2009-0938).
+    </li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could escalate privileges by leveraging unintended
+    supplementary group memberships of the Tor process. A remote attacker
+    could exploit these vulnerabilities to cause a heap corruption with
+    unknown impact and attack vectors, to cause a Denial of Service via CPU
+    consuption or daemon crash, and to weaken anonymity provided by the
+    service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Tor users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/tor-0.2.0.34&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5397">CVE-2008-5397</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5398">CVE-2008-5398</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0414">CVE-2009-0414</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0936">CVE-2009-0936</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0937">CVE-2009-0937</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0938">CVE-2009-0938</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0939">CVE-2009-0939</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 25 Jan 2009 14:41:40 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 12 Feb 2009 16:48:01 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 12 Feb 2009 16:48:17 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-12.xml b/xml/htdocs/security/en/glsa/glsa-200904-12.xml
new file mode 100644
index 00000000..bd1ef845
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-12.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-12">
+  <title>Wicd: Information disclosure</title>
+  <synopsis>
+    A vulnerability in Wicd may allow for disclosure of sensitive information.
+  </synopsis>
+  <product type="ebuild">wicd</product>
+  <announced>April 10, 2009</announced>
+  <revised>April 10, 2009: 01</revised>
+  <bug>258596</bug>
+  <access>local</access>
+  <affected>
+    <package name="net-misc/wicd" auto="yes" arch="*">
+      <unaffected range="ge">1.5.9</unaffected>
+      <vulnerable range="lt">1.5.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Wicd is an open source wired and wireless network manager for Linux.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tiziano Mueller of Gentoo discovered that the DBus configuration file
+    for Wicd allows arbitrary users to own the org.wicd.daemon object.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could exploit this vulnerability to receive messages
+    that were intended for the Wicd daemon, possibly including credentials
+    e.g. for wireless networks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Wicd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/wicd-1.5.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0489">CVE-2009-0489</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 08 Apr 2009 22:52:50 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 09 Apr 2009 11:29:45 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 09 Apr 2009 21:59:43 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-13.xml b/xml/htdocs/security/en/glsa/glsa-200904-13.xml
new file mode 100644
index 00000000..7d0955d2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-13.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-13">
+  <title>Ventrilo: Denial of Service</title>
+  <synopsis>
+    A vulnerability has been discovered in Ventrilo, allowing for a Denial of
+    Service.
+  </synopsis>
+  <product type="ebuild">ventrilo-server-bin</product>
+  <announced>April 14, 2009</announced>
+  <revised>April 14, 2009: 01</revised>
+  <bug>234819</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/ventrilo-server-bin" auto="yes" arch="*">
+      <unaffected range="ge">3.0.3</unaffected>
+      <vulnerable range="lt">3.0.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ventrilo is a Voice over IP group communication server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Luigi Auriemma reported a NULL pointer dereference in Ventrilo when
+    processing packets with an invalid version number followed by another
+    packet.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted packets to the server,
+    resulting in a crash.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ventrilo users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/ventrilo-server-bin-3.0.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3680">CVE-2008-3680</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 14 Apr 2009 12:02:23 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 14 Apr 2009 12:03:30 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-14.xml b/xml/htdocs/security/en/glsa/glsa-200904-14.xml
new file mode 100644
index 00000000..3281dca6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-14.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-14">
+  <title>F-PROT Antivirus: Multiple Denial of Service vulnerabilities</title>
+  <synopsis>
+    Multiple errors in F-PROT Antivirus may lead to a Denial of Service.
+  </synopsis>
+  <product type="ebuild">f-prot</product>
+  <announced>April 14, 2009</announced>
+  <revised>April 17, 2009: 04</revised>
+  <bug>232665</bug>
+  <bug>253497</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/f-prot" auto="yes" arch="*">
+      <unaffected range="ge">6.0.2</unaffected>
+      <vulnerable range="lt">6.0.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    F-PROT Antivirus is a multi-platform virus scanner for workstations and
+    mail servers.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were found:
+    </p>
+    <ul>
+    <li>Multiple errors when processing UPX, ASPack or Microsoft Office
+    files (CVE-2008-3243).</li>
+    <li>Infinite Sergio Alvarez of n.runs AG reported an invalid memory
+    access when processing a CHM file with a large nb_dir value
+    (CVE-2008-3244).</li>
+    <li>Jonathan Brossard from iViZ Techno Solutions reported that F-PROT
+    Antivirus does not correctly process ELF binaries with corrupted
+    headers (CVE-2008-5747).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or automated system to scan a
+    specially crafted file, leading to a crash or infinite loop.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All F-PROT Antivirus users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/f-prot-6.0.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3243">CVE-2008-3243</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3244">CVE-2008-3244</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5747">CVE-2008-5747</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 08 Apr 2009 22:38:56 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 10 Apr 2009 21:12:22 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 10 Apr 2009 21:13:03 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-15.xml b/xml/htdocs/security/en/glsa/glsa-200904-15.xml
new file mode 100644
index 00000000..9dcf58ec
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-15.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-15">
+  <title>mpg123: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    An error in mpg123 might allow for the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">mpg123</product>
+  <announced>April 16, 2009</announced>
+  <revised>April 16, 2009: 01</revised>
+  <bug>265342</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-sound/mpg123" auto="yes" arch="*">
+      <unaffected range="ge">1.7.2</unaffected>
+      <vulnerable range="lt">1.7.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    mpg123 is a realtime MPEG 1.0/2.0/2.5 audio player for layers 1, 2 and
+    3.
+    </p>
+  </background>
+  <description>
+    <p>
+    The vendor reported a signedness error in the store_id3_text() function
+    in id3.c, allowing for out-of-bounds memory access.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open an MPEG-1 Audio Layer 3
+    (MP3) file containing a specially crafted ID3 tag, possibly resulting
+    in the execution of arbitrary code with the privileges of the user
+    running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All mpg123 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/mpg123-1.7.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1301">CVE-2009-1301</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 11 Apr 2009 20:51:15 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 11 Apr 2009 21:15:29 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 16 Apr 2009 21:52:59 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-16.xml b/xml/htdocs/security/en/glsa/glsa-200904-16.xml
new file mode 100644
index 00000000..26917c5f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-16.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-16">
+  <title>libsndfile: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow vulnerability in libsndfile might allow remote attackers
+    to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">libsndfile</product>
+  <announced>April 17, 2009</announced>
+  <revised>April 17, 2009: 01</revised>
+  <bug>261173</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libsndfile" auto="yes" arch="*">
+      <unaffected range="ge">1.0.19</unaffected>
+      <vulnerable range="lt">1.0.19</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libsndfile is a C library for reading and writing files containing
+    sampled sound.
+    </p>
+  </background>
+  <description>
+    <p>
+    Alin Rad Pop from Secunia Research reported an integer overflow when
+    processing CAF description chunks, leading to a heap-based buffer
+    overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted CAF
+    file, resulting in the remote execution of arbitrary code with the
+    privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libsndfile users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libsndfile-1.0.19&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0186">CVE-2009-0186</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 15 Apr 2009 20:06:42 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 16 Apr 2009 18:44:04 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 16 Apr 2009 18:44:13 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-17.xml b/xml/htdocs/security/en/glsa/glsa-200904-17.xml
new file mode 100644
index 00000000..dd49db41
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-17.xml
@@ -0,0 +1,102 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-17">
+  <title>Adobe Reader: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Adobe Reader is vulnerable to execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">acroread</product>
+  <announced>April 18, 2009</announced>
+  <revised>April 18, 2009: 01</revised>
+  <bug>259992</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/acroread" auto="yes" arch="*">
+      <unaffected range="ge">8.1.4</unaffected>
+      <vulnerable range="lt">8.1.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Adobe Reader (formerly Adobe Acrobat Reader) is a closed-source PDF
+    reader.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in Adobe Reader:
+    </p>
+    <ul>
+    <li>
+    Alin Rad Pop of Secunia Research reported a heap-based buffer overflow
+    when processing PDF files containing a malformed JBIG2 symbol
+    dictionary segment (CVE-2009-0193).
+    </li>
+    <li>
+    A buffer overflow related to a non-JavaScript function call and
+    possibly an embedded JBIG2 image stream has been reported
+    (CVE-2009-0658).
+    </li>
+    <li>
+    Tenable Network Security reported a stack-based buffer overflow that
+    can be triggered via a crafted argument to the getIcon() method of a
+    Collab object (CVE-2009-0927).
+    </li>
+    <li>
+    Sean Larsson of iDefense Labs reported a heap-based buffer overflow
+    when processing a PDF file containing a JBIG2 stream with a size
+    inconsistency related to an unspecified table (CVE-2009-0928).
+    </li>
+    <li>
+    Jonathan Brossard of the iViZ Security Research Team reported an
+    unspecified vulnerability related to JBIG2 and input validation
+    (CVE-2009-1061).
+    </li>
+    <li>
+    Will Dormann of CERT/CC reported a vulnerability lading to memory
+    corruption related to JBIG2 (CVE-2009-1062).
+    </li>
+    </ul> <p>
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted PDF
+    document, possibly leading to the execution of arbitrary code with the
+    privileges of the user running the application, or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Adobe Reader users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/acroread-8.1.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0193">CVE-2009-0193</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0658">CVE-2009-0658</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0927">CVE-2009-0927</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0928">CVE-2009-0928</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1061">CVE-2009-1061</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1062">CVE-2009-1062</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 14 Apr 2009 12:25:56 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 16 Apr 2009 22:30:05 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 16 Apr 2009 22:30:15 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-18.xml b/xml/htdocs/security/en/glsa/glsa-200904-18.xml
new file mode 100644
index 00000000..57290405
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-18.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-18">
+  <title>udev: Multiple vulnerabilities</title>
+  <synopsis>
+    Two errors in udev allow for a local root compromise and a Denial of
+    Service.
+  </synopsis>
+  <product type="ebuild">udev</product>
+  <announced>April 18, 2009</announced>
+  <revised>April 18, 2009: 01</revised>
+  <bug>266290</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-fs/udev" auto="yes" arch="*">
+      <unaffected range="ge">124-r2</unaffected>
+      <vulnerable range="lt">124-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    udev is the device manager used in the Linux 2.6 kernel series.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sebastian Krahmer of SUSE discovered the following two vulnerabilities:
+    </p>
+    <ul>
+    <li>udev does not verify the origin of NETLINK messages
+    properly (CVE-2009-1185).</li>
+    <li>A buffer overflow exists in the
+    util_path_encode() function in lib/libudev-util.c (CVE-2009-1186).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could gain root privileges by sending specially
+    crafted NETLINK messages to udev or cause a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All udev users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-fs/udev-124-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1185">CVE-2009-1185</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1186">CVE-2009-1186</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 16 Apr 2009 09:13:51 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 16 Apr 2009 09:38:24 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 18 Apr 2009 18:32:47 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-19.xml b/xml/htdocs/security/en/glsa/glsa-200904-19.xml
new file mode 100644
index 00000000..076d6a4c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-19.xml
@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-19">
+  <title>LittleCMS: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple errors in LittleCMS allow for attacks including the remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">littlecms</product>
+  <announced>April 19, 2009</announced>
+  <revised>April 19, 2009: 01</revised>
+  <bug>260269</bug>
+  <bug>264604</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/lcms" auto="yes" arch="*">
+      <unaffected range="ge">1.18-r1</unaffected>
+      <vulnerable range="lt">1.18-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    LittleCMS, or short lcms, is a color management system for working with
+    ICC profiles. It is used by many applications including GIMP and
+    Firefox.
+    </p>
+  </background>
+  <description>
+    <p>
+    RedHat reported a null-pointer dereference flaw while processing
+    monochrome ICC profiles (CVE-2009-0793).
+    </p>
+    <p>
+    Chris Evans of Google discovered the following vulnerabilities:
+    </p>
+    <ul>
+    <li>LittleCMS contains severe memory leaks (CVE-2009-0581).</li>
+    <li>LittleCMS is prone to multiple integer overflows, leading to a
+    heap-based buffer overflow (CVE-2009-0723).</li>
+    <li>The
+    ReadSetOfCurves() function is vulnerable to stack-based buffer
+    overflows when called from code paths without a bounds check on channel
+    counts (CVE-2009-0733).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or automated system to open a
+    specially crafted file containing a malicious ICC profile, possibly
+    resulting in the execution of arbitrary code with the privileges of the
+    user running the application or memory exhaustion, leading to a Denial
+    of Service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All LittleCMS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/lcms-1.18-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0581">CVE-2009-0581</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0723">CVE-2009-0723</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0733">CVE-2009-0733</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0793">CVE-2009-0793</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 12 Apr 2009 15:32:46 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 18 Apr 2009 22:41:26 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 19 Apr 2009 12:36:20 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200904-20.xml b/xml/htdocs/security/en/glsa/glsa-200904-20.xml
new file mode 100644
index 00000000..52fec8a4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200904-20.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200904-20">
+  <title>CUPS: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple errors in CUPS might allow for the remote execution of arbitrary
+    code or DNS rebinding attacks.
+  </synopsis>
+  <product type="ebuild">cups</product>
+  <announced>April 23, 2009</announced>
+  <revised>April 23, 2009: 01</revised>
+  <bug>263070</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-print/cups" auto="yes" arch="*">
+      <unaffected range="ge">1.3.10</unaffected>
+      <vulnerable range="lt">1.3.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CUPS, the Common Unix Printing System, is a full-featured print server.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following issues were reported in CUPS:
+    </p>
+    <ul>
+    <li>iDefense
+    reported an integer overflow in the _cupsImageReadTIFF() function in
+    the "imagetops" filter, leading to a heap-based buffer overflow
+    (CVE-2009-0163).</li>
+    <li>Aaron Siegel of Apple Product Security
+    reported that the CUPS web interface does not verify the content of the
+    "Host" HTTP header properly (CVE-2009-0164).</li>
+    <li>Braden Thomas and
+    Drew Yao of Apple Product Security reported that CUPS is vulnerable to
+    CVE-2009-0146, CVE-2009-0147 and CVE-2009-0166, found earlier in xpdf
+    and poppler.</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker might send or entice a user to send a specially
+    crafted print job to CUPS, possibly resulting in the execution of
+    arbitrary code with the privileges of the configured CUPS user -- by
+    default this is "lp", or a Denial of Service. Furthermore, the web
+    interface could be used to conduct DNS rebinding attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CUPS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-print/cups-1.3.10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0146">CVE-2009-0146</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0147">CVE-2009-0147</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0163">CVE-2009-0163</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0164">CVE-2009-0164</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0166">CVE-2009-0166</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 20 Apr 2009 08:43:52 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 20 Apr 2009 11:20:52 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 21 Apr 2009 19:42:53 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200905-01.xml b/xml/htdocs/security/en/glsa/glsa-200905-01.xml
new file mode 100644
index 00000000..b27f1fae
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200905-01.xml
@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200905-01">
+  <title>Asterisk: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been found in Asterisk allowing for Denial of
+    Service and username disclosure.
+  </synopsis>
+  <product type="ebuild">asterisk</product>
+  <announced>May 02, 2009</announced>
+  <revised>May 02, 2009: 01</revised>
+  <bug>218966</bug>
+  <bug>224835</bug>
+  <bug>232696</bug>
+  <bug>232698</bug>
+  <bug>237476</bug>
+  <bug>250748</bug>
+  <bug>254304</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/asterisk" auto="yes" arch="*">
+      <unaffected range="ge">1.2.32</unaffected>
+      <vulnerable range="lt">1.2.32</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Asterisk is an open source telephony engine and toolkit.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in the IAX2 channel
+    driver when performing the 3-way handshake (CVE-2008-1897), when
+    handling a large number of POKE requests (CVE-2008-3263), when handling
+    authentication attempts (CVE-2008-5558) and when handling firmware
+    download (FWDOWNL) requests (CVE-2008-3264). Asterisk does also not
+    correctly handle SIP INVITE messages that lack a "From" header
+    (CVE-2008-2119), and responds differently to a failed login attempt
+    depending on whether the user account exists (CVE-2008-3903,
+    CVE-2009-0041).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote unauthenticated attackers could send specially crafted data to
+    Asterisk, possibly resulting in a Denial of Service via a daemon crash,
+    call-number exhaustion, CPU or traffic consumption. Remote
+    unauthenticated attackers could furthermore enumerate valid usernames
+    to facilitate brute force login attempts.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Asterisk users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/asterisk-1.2.32&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1897">CVE-2008-1897</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2119">CVE-2008-2119</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3263">CVE-2008-3263</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3264">CVE-2008-3264</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3903">CVE-2008-3903</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5558">CVE-2008-5558</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0041">CVE-2009-0041</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 02 Apr 2009 12:17:04 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 02 Apr 2009 12:31:27 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 02 Apr 2009 12:32:59 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200905-02.xml b/xml/htdocs/security/en/glsa/glsa-200905-02.xml
new file mode 100644
index 00000000..9942a7dc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200905-02.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200905-02">
+  <title>Cscope: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple vulnerabilities in Cscope might allow for the remote execution of
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">cscope</product>
+  <announced>May 24, 2009</announced>
+  <revised>May 24, 2009: 01</revised>
+  <bug>263023</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-util/cscope" auto="yes" arch="*">
+      <unaffected range="ge">15.7a</unaffected>
+      <vulnerable range="lt">15.7a</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cscope is a developer's tool for browsing source code.
+    </p>
+  </background>
+  <description>
+    <p>
+    James Peach of Apple discovered a stack-based buffer overflow in
+    cscope's handling of long file system paths (CVE-2009-0148). Multiple
+    stack-based buffer overflows were reported in the putstring function
+    when processing an overly long function name or symbol in a source code
+    file (CVE-2009-1577).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    source file, possibly resulting in the remote execution of arbitrary
+    code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cscope users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-util/cscope-15.7a&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0148">CVE-2009-0148</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1577">CVE-2009-1577</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 03 May 2009 18:51:15 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 04 May 2009 12:25:17 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 04 May 2009 12:25:25 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200905-03.xml b/xml/htdocs/security/en/glsa/glsa-200905-03.xml
new file mode 100644
index 00000000..c07b5fa0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200905-03.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200905-03">
+  <title>IPSec Tools: Denial of Service</title>
+  <synopsis>
+    Multiple errors in the IPSec Tools racoon daemon might allow remote
+    attackers to cause a Denial of Service.
+  </synopsis>
+  <product type="ebuild">ipsec-tools</product>
+  <announced>May 24, 2009</announced>
+  <revised>May 24, 2009: 01</revised>
+  <bug>267135</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-firewall/ipsec-tools" auto="yes" arch="*">
+      <unaffected range="ge">0.7.2</unaffected>
+      <vulnerable range="lt">0.7.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The IPSec Tools are a port of KAME's IPsec utilities to the Linux-2.6
+    IPsec implementation. They include racoon, an Internet Key Exchange
+    daemon for automatically keying IPsec connections.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities have been found in the racoon daemon as
+    shipped with IPSec Tools:
+    </p>
+    <ul>
+    <li>Neil Kettle reported that
+    racoon/isakmp_frag.c is prone to a null-pointer dereference
+    (CVE-2009-1574).</li>
+    <li>Multiple memory leaks exist in (1) the
+    eay_check_x509sign() function in racoon/crypto_openssl.c and (2)
+    racoon/nattraversal.c (CVE-2009-1632).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted fragmented ISAKMP
+    packets without a payload or exploit vectors related to X.509
+    certificate authentication and NAT traversal, possibly resulting in a
+    crash of the racoon daemon.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All IPSec Tools users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-firewall/ipsec-tools-0.7.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1574">CVE-2009-1574</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1632">CVE-2009-1632</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 06 May 2009 21:47:03 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 07 May 2009 10:56:09 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 23 May 2009 07:52:41 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200905-04.xml b/xml/htdocs/security/en/glsa/glsa-200905-04.xml
new file mode 100644
index 00000000..6ece3329
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200905-04.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200905-04">
+  <title>GnuTLS: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in GnuTLS might result in a Denial of Service,
+    spoofing or the generation of invalid keys.
+  </synopsis>
+  <product type="ebuild">gnutls</product>
+  <announced>May 24, 2009</announced>
+  <revised>May 24, 2009: 01</revised>
+  <bug>267774</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-libs/gnutls" auto="yes" arch="*">
+      <unaffected range="ge">2.6.6</unaffected>
+      <vulnerable range="lt">2.6.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GnuTLS is an Open Source implementation of the TLS 1.0 and SSL 3.0
+    protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were found in GnuTLS:
+    </p>
+    <ul>
+    <li>Miroslav Kratochvil reported that lib/pk-libgcrypt.c does not
+    properly handle corrupt DSA signatures, possibly leading to a
+    double-free vulnerability (CVE-2009-1415).</li>
+    <li>Simon Josefsson
+    reported that GnuTLS generates RSA keys stored in DSA structures when
+    creating a DSA key (CVE-2009-1416).</li>
+    <li>Romain Francoise reported
+    that the _gnutls_x509_verify_certificate() function in
+    lib/x509/verify.c does not perform time checks, resulting in the
+    "gnutls-cli" program accepting X.509 certificates with validity times
+    in the past or future (CVE-2009-1417).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or automated system to process a
+    specially crafted DSA certificate, possibly resulting in a Denial of
+    Service condition. NOTE: This issue might have other unspecified impact
+    including the execution of arbitrary code. Furthermore, a remote
+    attacker could spoof signatures on certificates and the "gnutls-cli"
+    application can be tricked into accepting an invalid certificate.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GnuTLS users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/gnutls-2.6.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1415">CVE-2009-1415</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1416">CVE-2009-1416</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1417">CVE-2009-1417</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 06 May 2009 18:48:21 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 07 May 2009 11:40:21 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 24 May 2009 11:17:39 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200905-05.xml b/xml/htdocs/security/en/glsa/glsa-200905-05.xml
new file mode 100644
index 00000000..db47fa83
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200905-05.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200905-05">
+  <title>FreeType: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple integer overflows in FreeType might allow for the remote execution
+    of arbitrary code or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">freetype</product>
+  <announced>May 24, 2009</announced>
+  <revised>May 25, 2009: 02</revised>
+  <bug>263032</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/freetype" auto="yes" arch="*">
+      <unaffected range="ge">2.3.9-r1</unaffected>
+      <unaffected range="lt">2.0</unaffected>
+      <vulnerable range="lt">2.3.9-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    FreeType is a high-quality and portable font engine.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy reported multiple integer overflows in the
+    cff_charset_compute_cids() function in cff/cffload.c, sfnt/tccmap.c and
+    the ft_smooth_render_generic() function in smooth/ftsmooth.c, possibly
+    leading to heap or stack-based buffer overflows.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or automated system to open a
+    specially crafted font file, possibly resulting in the execution of
+    arbitrary code with the privileges of the user running the application,
+    or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All FreeType users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/freetype-2.3.9-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0946">CVE-2009-0946</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 06 May 2009 18:49:58 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 07 May 2009 11:07:09 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 24 May 2009 13:55:28 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200905-06.xml b/xml/htdocs/security/en/glsa/glsa-200905-06.xml
new file mode 100644
index 00000000..8ba48999
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200905-06.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200905-06">
+  <title>acpid: Denial of Service</title>
+  <synopsis>
+    An error in acpid might allow remote attackers to cause a Denial of
+    Service.
+  </synopsis>
+  <product type="ebuild">acpid</product>
+  <announced>May 24, 2009</announced>
+  <revised>May 24, 2009: 01</revised>
+  <bug>268079</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-power/acpid" auto="yes" arch="*">
+      <unaffected range="ge">1.0.10</unaffected>
+      <vulnerable range="lt">1.0.10</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    acpid is a daemon for the Advanced Configuration and Power Interface
+    (ACPI).
+    </p>
+  </background>
+  <description>
+    <p>
+    The acpid daemon allows opening a large number of UNIX sockets without
+    closing them, triggering an infinite loop.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Remote attackers can cause a Denial of Service (CPU consumption and
+    connectivity loss).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All acpid users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-power/acpid-1.0.10&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0798">CVE-2009-0798</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 24 May 2009 00:11:41 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 24 May 2009 00:29:02 +0000">
+    craig
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 24 May 2009 18:05:05 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200905-07.xml b/xml/htdocs/security/en/glsa/glsa-200905-07.xml
new file mode 100644
index 00000000..f9df3614
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200905-07.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200905-07">
+  <title>Pidgin: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Pidgin might allow for the remote execution of
+    arbitrary code or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">pidgin</product>
+  <announced>May 25, 2009</announced>
+  <revised>May 25, 2009: 01</revised>
+  <bug>270811</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/pidgin" auto="yes" arch="*">
+      <unaffected range="ge">2.5.6</unaffected>
+      <vulnerable range="lt">2.5.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Pidgin (formerly Gaim) is an instant messaging client for a variety of
+    instant messaging protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in Pidgin:
+    </p>
+    <ul>
+    <li>Veracode reported a boundary error in the "XMPP SOCKS5 bytestream
+    server" when initiating an outgoing file transfer (CVE-2009-1373).</li>
+    <li>Ka-Hing Cheung reported a heap corruption flaw in the QQ protocol
+    handler (CVE-2009-1374).</li>
+    <li>A memory corruption flaw in
+    "PurpleCircBuffer" was disclosed by Josef Andrysek
+    (CVE-2009-1375).</li>
+    <li>The previous fix for CVE-2008-2927 contains a
+    cast from uint64 to size_t, possibly leading to an integer overflow
+    (CVE-2009-1376, GLSA 200901-13).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted messages or files using
+    the MSN, XMPP or QQ protocols, possibly resulting in the execution of
+    arbitrary code with the privileges of the user running the application,
+    or a Denial of Service. NOTE: Successful exploitation might require the
+    victim's interaction.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Pidgin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/pidgin-2.5.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1373">CVE-2009-1373</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1374">CVE-2009-1374</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1375">CVE-2009-1375</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1376">CVE-2009-1376</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200901-13.xml">GLSA 200901-13</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 25 May 2009 17:46:41 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 25 May 2009 17:46:49 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200905-08.xml b/xml/htdocs/security/en/glsa/glsa-200905-08.xml
new file mode 100644
index 00000000..83a563e1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200905-08.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200905-08">
+  <title>NTP: Remote execution of arbitrary code</title>
+  <synopsis>
+    Multiple errors in the NTP client and server programs might allow for the
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">ntp</product>
+  <announced>May 26, 2009</announced>
+  <revised>May 26, 2009: 01</revised>
+  <bug>263033</bug>
+  <bug>268962</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/ntp" auto="yes" arch="*">
+      <unaffected range="ge">4.2.4_p7</unaffected>
+      <vulnerable range="lt">4.2.4_p7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    NTP contains the client and daemon implementations for the Network Time
+    Protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been found in the programs included in
+    the NTP package:
+    </p>
+    <ul>
+    <li>Apple Product Security reported a
+    boundary error in the cookedprint() function in ntpq/ntpq.c, possibly
+    leading to a stack-based buffer overflow (CVE-2009-0159).</li>
+    <li>Chris Ries of CMU reported a boundary error within the
+    crypto_recv() function in ntpd/ntp_crypto.c, possibly leading to a
+    stack-based buffer overflow (CVE-2009-1252).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker might send a specially crafted package to a machine
+    running ntpd, possibly resulting in the remote execution of arbitrary
+    code with the privileges of the user running the daemon, or a Denial of
+    Service. NOTE: Successful exploitation requires the "autokey" feature
+    to be enabled. This feature is only available if NTP was built with the
+    'ssl' USE flag.
+    </p>
+    <p>
+    Furthermore, a remote attacker could entice a user into connecting to a
+    malicious server using ntpq, possibly resulting in the remote execution
+    of arbitrary code with the privileges of the user running the
+    application, or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    You can protect against CVE-2009-1252 by disabling the 'ssl' USE flag
+    and recompiling NTP.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All NTP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/ntp-4.2.4_p7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0159">CVE-2009-0159</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1252">CVE-2009-1252</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Mon, 25 May 2009 17:26:27 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 25 May 2009 17:27:05 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200905-09.xml b/xml/htdocs/security/en/glsa/glsa-200905-09.xml
new file mode 100644
index 00000000..8a5e3a0e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200905-09.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200905-09">
+  <title>libsndfile: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple heap-based buffer overflow vulnerabilities in libsndfile might
+    allow remote attackers to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">libsndfile</product>
+  <announced>May 27, 2009</announced>
+  <revised>May 27, 2009: 01</revised>
+  <bug>269863</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libsndfile" auto="yes" arch="*">
+      <unaffected range="ge">1.0.20</unaffected>
+      <vulnerable range="lt">1.0.20</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libsndfile is a C library for reading and writing files containing
+    sampled sound.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities have been found in libsndfile:
+    </p>
+    <ul>
+    <li>Tobias Klein reported that the header_read() function in
+    src/common.c uses user input for calculating a buffer size, possibly
+    leading to a heap-based buffer overflow (CVE-2009-1788).</li>
+    <li>The
+    vendor reported a boundary error in the aiff_read_header() function in
+    src/aiff.c, possibly leading to a heap-based buffer overflow
+    (CVE-2009-1791).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted AIFF
+    or VOC file in a program using libsndfile, possibly resulting in the
+    execution of arbitrary code with the privileges of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libsndfile users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libsndfile-1.0.20&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1788">CVE-2009-1788</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1791">CVE-2009-1791</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 22 May 2009 17:42:40 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 25 May 2009 09:17:01 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 25 May 2009 11:57:08 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200906-01.xml b/xml/htdocs/security/en/glsa/glsa-200906-01.xml
new file mode 100644
index 00000000..6b961601
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200906-01.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200906-01">
+  <title>libpng: Information disclosure</title>
+  <synopsis>
+    A vulnerability has been discovered in libpng that allows for information
+    disclosure.
+  </synopsis>
+  <product type="ebuild">libpng</product>
+  <announced>June 27, 2009</announced>
+  <revised>June 27, 2009: 01</revised>
+  <bug>272970</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libpng" auto="yes" arch="*">
+      <unaffected range="ge">1.2.37</unaffected>
+      <vulnerable range="lt">1.2.37</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libpng is the official PNG reference library used to read, write and
+    manipulate PNG images.
+    </p>
+  </background>
+  <description>
+    <p>
+    Jeff Phillips discovered that libpng does not properly parse 1-bit
+    interlaced images with width values that are not divisible by 8, which
+    causes libpng to include uninitialized bits in certain rows of a PNG
+    file.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker might entice a user to open a specially crafted PNG
+    file, possibly resulting in the disclosure of sensitive memory
+    portions.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libpng users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libpng-1.2.37&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2042">CVE-2009-2042</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 21 Jun 2009 18:15:41 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 21 Jun 2009 18:23:22 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 27 Jun 2009 23:12:55 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200906-02.xml b/xml/htdocs/security/en/glsa/glsa-200906-02.xml
new file mode 100644
index 00000000..d9cfc64d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200906-02.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200906-02">
+  <title>Ruby: Denial of Service</title>
+  <synopsis>
+    A flaw in the Ruby standard library might allow remote attackers to cause a
+    Denial of Service attack.
+  </synopsis>
+  <product type="ebuild">ruby</product>
+  <announced>June 28, 2009</announced>
+  <revised>June 28, 2009: 01</revised>
+  <bug>273213</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/ruby" auto="yes" arch="*">
+      <unaffected range="ge">1.8.6_p369</unaffected>
+      <vulnerable range="lt">1.8.6_p369</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ruby is an interpreted object-oriented programming language. The
+    elaborate standard library includes the "BigDecimal" class.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tadayoshi Funaba reported that BigDecimal in
+    ext/bigdecimal/bigdecimal.c does not properly handle string arguments
+    containing overly long numbers.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit this issue to remotely cause a Denial
+    of Service attack.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ruby users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/ruby-1.8.6_p369&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1904">CVE-2009-1904</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sun, 21 Jun 2009 14:29:50 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 28 Jun 2009 21:32:27 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200906-03.xml b/xml/htdocs/security/en/glsa/glsa-200906-03.xml
new file mode 100644
index 00000000..4cb6b327
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200906-03.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200906-03">
+  <title>phpMyAdmin: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple errors in phpMyAdmin might allow the remote execution of arbitrary
+    code or a Cross-Site Scripting attack.
+  </synopsis>
+  <product type="ebuild">phpmyadmin</product>
+  <announced>June 29, 2009</announced>
+  <revised>June 29, 2009: 01</revised>
+  <bug>263711</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-db/phpmyadmin" auto="yes" arch="*">
+      <unaffected range="ge">2.11.9.5</unaffected>
+      <vulnerable range="lt">2.11.9.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpMyAdmin is a web-based management tool for MySQL databases.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in phpMyAdmin:
+    </p>
+    <ul>
+    <li>Greg Ose discovered that the setup script does not sanitize input
+    properly, leading to the injection of arbitrary PHP code into the
+    configuration file (CVE-2009-1151).</li>
+    <li>Manuel Lopez Gallego and
+    Santiago Rodriguez Collazo reported that data from cookies used in the
+    "Export" page is not properly sanitized (CVE-2009-1150).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A remote unauthorized attacker could exploit the first vulnerability to
+    execute arbitrary code with the privileges of the user running
+    phpMyAdmin and conduct Cross-Site Scripting attacks using the second
+    vulnerability.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Removing the "scripts/setup.php" file protects you from CVE-2009-1151.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All phpMyAdmin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-db/phpmyadmin-2.11.9.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1150">CVE-2009-1150</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1151">CVE-2009-1151</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 27 Jun 2009 20:32:40 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 29 Jun 2009 22:35:56 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200906-04.xml b/xml/htdocs/security/en/glsa/glsa-200906-04.xml
new file mode 100644
index 00000000..34440d4f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200906-04.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200906-04">
+  <title>Apache Tomcat JK Connector: Information disclosure</title>
+  <synopsis>
+    An error in the Apache Tomcat JK Connector might allow for an information
+    disclosure flaw.
+  </synopsis>
+  <product type="ebuild">mod_jk</product>
+  <announced>June 29, 2009</announced>
+  <revised>June 29, 2009: 01</revised>
+  <bug>265455</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apache/mod_jk" auto="yes" arch="*">
+      <unaffected range="ge">1.2.27</unaffected>
+      <vulnerable range="lt">1.2.27</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache Tomcat JK Connector (aka mod_jk) connects the Tomcat
+    application server with the Apache HTTP Server.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Red Hat Security Response Team discovered that mod_jk does not
+    properly handle (1) requests setting the "Content-Length" header while
+    not providing data and (2) clients sending repeated requests very
+    quickly.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A remote attacker could send specially crafted requests or a large
+    number of requests at a time, possibly resulting in the disclosure of a
+    response intended for another client.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Apache Tomcat JK Connector users should upgrade to the latest
+    version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apache/mod_jk-1.2.27&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5519">CVE-2008-5519</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 24 Jun 2009 16:46:40 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 28 Jun 2009 12:27:09 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 29 Jun 2009 22:42:43 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200906-05.xml b/xml/htdocs/security/en/glsa/glsa-200906-05.xml
new file mode 100644
index 00000000..cc9eee55
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200906-05.xml
@@ -0,0 +1,154 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200906-05">
+  <title>Wireshark: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Wireshark which allow for
+    Denial of Service or remote code execution.
+  </synopsis>
+  <product type="ebuild">wireshark</product>
+  <announced>June 30, 2009</announced>
+  <revised>June 30, 2009: 02</revised>
+  <bug>242996</bug>
+  <bug>248425</bug>
+  <bug>258013</bug>
+  <bug>264571</bug>
+  <bug>271062</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/wireshark" auto="yes" arch="*">
+      <unaffected range="ge">1.0.8</unaffected>
+      <vulnerable range="lt">1.0.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Wireshark is a versatile network protocol analyzer.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in Wireshark:
+    </p>
+    <ul>
+    <li>
+    David Maciejak discovered a vulnerability in packet-usb.c in the USB
+    dissector via a malformed USB Request Block (URB) (CVE-2008-4680).
+    </li>
+    <li>
+    Florent Drouin and David Maciejak reported an unspecified vulnerability
+    in the Bluetooth RFCOMM dissector (CVE-2008-4681).
+    </li>
+    <li>
+    A malformed Tamos CommView capture file (aka .ncf file) with an
+    "unknown/unexpected packet type" triggers a failed assertion in wtap.c
+    (CVE-2008-4682).
+    </li>
+    <li>
+    An unchecked packet length parameter in the dissect_btacl() function in
+    packet-bthci_acl.c in the Bluetooth ACL dissector causes an erroneous
+    tvb_memcpy() call (CVE-2008-4683).
+    </li>
+    <li>
+    A vulnerability where packet-frame does not properly handle exceptions
+    thrown by post dissectors caused by a certain series of packets
+    (CVE-2008-4684).
+    </li>
+    <li>
+    Mike Davies reported a use-after-free vulnerability in the
+    dissect_q931_cause_ie() function in packet-q931.c in the Q.931
+    dissector via certain packets that trigger an exception
+    (CVE-2008-4685).
+    </li>
+    <li>
+    The Security Vulnerability Research Team of Bkis reported that the SMTP
+    dissector could consume excessive amounts of CPU and memory
+    (CVE-2008-5285).
+    </li>
+    <li>
+    The vendor reported that the WLCCP dissector could go into an infinite
+    loop (CVE-2008-6472).
+    </li>
+    <li>
+    babi discovered a buffer overflow in wiretap/netscreen.c via a
+    malformed NetScreen snoop file (CVE-2009-0599).
+    </li>
+    <li>
+    A specially crafted Tektronix K12 text capture file can cause an
+    application crash (CVE-2009-0600).
+    </li>
+    <li>
+    A format string vulnerability via format string specifiers in the HOME
+    environment variable (CVE-2009-0601).
+    </li>
+    <li>THCX Labs reported a format string vulnerability in the
+    PROFINET/DCP (PN-DCP) dissector via a PN-DCP packet with format string
+    specifiers in the station name (CVE-2009-1210).
+    </li>
+    <li>An unspecified vulnerability with unknown impact and attack vectors
+    (CVE-2009-1266).
+    </li>
+    <li>
+    Marty Adkins and Chris Maynard discovered a parsing error in the
+    dissector for the Check Point High-Availability Protocol (CPHAP)
+    (CVE-2009-1268).
+    </li>
+    <li>
+    Magnus Homann discovered a parsing error when loading a Tektronix .rf5
+    file (CVE-2009-1269).
+    </li>
+    <li>The vendor reported that the PCNFSD dissector could crash
+    (CVE-2009-1829).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit these vulnerabilities by sending
+    specially crafted packets on a network being monitored by Wireshark or
+    by enticing a user to read a malformed packet trace file which can
+    trigger a Denial of Service (application crash or excessive CPU and
+    memory usage) and possibly allow for the execution of arbitrary code
+    with the privileges of the user running Wireshark.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Wireshark users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/wireshark-1.0.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4680">CVE-2008-4680</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4681">CVE-2008-4681</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4682">CVE-2008-4682</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4683">CVE-2008-4683</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4684">CVE-2008-4684</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4685">CVE-2008-4685</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5285">CVE-2008-5285</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6472">CVE-2008-6472</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0599">CVE-2009-0599</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0600">CVE-2009-0600</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0601">CVE-2009-0601</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1210">CVE-2009-1210</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1266">CVE-2009-1266</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1268">CVE-2009-1268</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1269">CVE-2009-1269</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1829">CVE-2009-1829</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 22 May 2009 11:33:22 +0000">
+    craig
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 29 Jun 2009 22:09:27 +0000">
+    craig
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200907-01.xml b/xml/htdocs/security/en/glsa/glsa-200907-01.xml
new file mode 100644
index 00000000..0523645a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200907-01.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200907-01">
+  <title>libwmf: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    libwmf bundles an old GD version which contains a "use-after-free"
+    vulnerability.
+  </synopsis>
+  <product type="ebuild">libwmf</product>
+  <announced>July 02, 2009</announced>
+  <revised>July 02, 2009: 01</revised>
+  <bug>268161</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libwmf" auto="yes" arch="*">
+      <unaffected range="ge">0.2.8.4-r3</unaffected>
+      <vulnerable range="lt">0.2.8.4-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libwmf is a library for converting WMF files.
+    </p>
+  </background>
+  <description>
+    <p>
+    The embedded fork of the GD library introduced a "use-after-free"
+    vulnerability in a modification which is specific to libwmf.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted WMF
+    file, possibly resulting in the execution of arbitrary code with the
+    privileges of the user running the application, or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libwmf users should upgrade to the latest version which no longer
+    builds the GD library:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libwmf-0.2.8.4-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1364">CVE-2009-1364</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 22 May 2009 17:28:39 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 24 May 2009 00:52:28 +0000">
+    craig
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 29 Jun 2009 22:09:20 +0000">
+    craig
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200907-02.xml b/xml/htdocs/security/en/glsa/glsa-200907-02.xml
new file mode 100644
index 00000000..72aad7b6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200907-02.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200907-02">
+  <title>ModSecurity: Denial of Service</title>
+  <synopsis>
+    Two vulnerabilities in ModSecurity might lead to a Denial of Service.
+  </synopsis>
+  <product type="ebuild">mod_security</product>
+  <announced>July 02, 2009</announced>
+  <revised>July 02, 2009: 01</revised>
+  <bug>262302</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apache/mod_security" auto="yes" arch="*">
+      <unaffected range="ge">2.5.9</unaffected>
+      <vulnerable range="lt">2.5.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ModSecurity is a popular web application firewall for the Apache HTTP
+    server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities were discovered in ModSecurity:
+    </p>
+    <ul>
+    <li>Juan Galiana Lara of ISecAuditors discovered a NULL pointer
+    dereference when processing multipart requests without a part header
+    name (CVE-2009-1902).</li>
+    <li>Steve Grubb of Red Hat reported that the
+    "PDF XSS protection" feature does not properly handle HTTP requests to
+    a PDF file that do not use the GET method (CVE-2009-1903).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker might send requests containing specially crafted
+    multipart data or send certain requests to access a PDF file, possibly
+    resulting in a Denial of Service (crash) of the Apache HTTP daemon.
+    NOTE: The PDF XSS protection is not enabled by default.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ModSecurity users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apache/mod_security-2.5.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1902">CVE-2009-1902</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1903">CVE-2009-1903</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 12 Jun 2009 22:17:27 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 27 Jun 2009 20:29:14 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 02 Jul 2009 11:54:37 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200907-03.xml b/xml/htdocs/security/en/glsa/glsa-200907-03.xml
new file mode 100644
index 00000000..84868968
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200907-03.xml
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200907-03">
+  <title>APR Utility Library: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in the Apache Portable Runtime Utility Library
+    might enable remote attackers to cause a Denial of Service or disclose
+    sensitive information.
+  </synopsis>
+  <product type="ebuild">apr-util</product>
+  <announced>July 04, 2009</announced>
+  <revised>July 04, 2009: 01</revised>
+  <bug>268643</bug>
+  <bug>272260</bug>
+  <bug>274193</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/apr-util" auto="yes" arch="*">
+      <unaffected range="ge">1.3.7</unaffected>
+      <vulnerable range="lt">1.3.7</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache Portable Runtime Utility Library (aka apr-util) provides an
+    interface to functionality such as XML parsing, string matching and
+    databases connections.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in the APR Utility
+    Library:
+    </p>
+    <ul>
+    <li>Matthew Palmer reported a heap-based buffer
+    underflow while compiling search patterns in the
+    apr_strmatch_precompile() function in strmatch/apr_strmatch.c
+    (CVE-2009-0023).</li>
+    <li>kcope reported that the expat XML parser in
+    xml/apr_xml.c does not limit the amount of XML entities expanded
+    recursively (CVE-2009-1955).</li>
+    <li>C. Michael Pilato reported an
+    off-by-one error in the apr_brigade_vprintf() function in
+    buckets/apr_brigade.c (CVE-2009-1956).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities to cause a Denial
+    of Service (crash or memory exhaustion) via an Apache HTTP server
+    running mod_dav or mod_dav_svn, or using several configuration files.
+    Additionally, a remote attacker could disclose sensitive information or
+    cause a Denial of Service by sending a specially crafted input. NOTE:
+    Only big-endian architectures such as PPC and HPPA are affected by the
+    latter flaw.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Apache Portable Runtime Utility Library users should upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/apr-util-1.3.7&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0023">CVE-2009-0023</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1955">CVE-2009-1955</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1956">CVE-2009-1956</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 26 Jun 2009 08:48:34 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 28 Jun 2009 12:16:58 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 04 Jul 2009 07:45:32 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200907-04.xml b/xml/htdocs/security/en/glsa/glsa-200907-04.xml
new file mode 100644
index 00000000..cf09ec7e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200907-04.xml
@@ -0,0 +1,96 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200907-04">
+  <title>Apache: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in the Apache HTTP daemon allow for local
+    privilege escalation, information disclosure or Denial of Service attacks.
+  </synopsis>
+  <product type="ebuild">apache</product>
+  <announced>July 12, 2009</announced>
+  <revised>July 12, 2009: 01</revised>
+  <bug>268154</bug>
+  <bug>271470</bug>
+  <bug>276426</bug>
+  <bug>276792</bug>
+  <access>local, remote</access>
+  <affected>
+    <package name="www-servers/apache" auto="yes" arch="*">
+      <unaffected range="ge">2.2.11-r2</unaffected>
+      <vulnerable range="lt">2.2.11-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache HTTP server is one of the most popular web servers on the
+    Internet.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in the Apache HTTP
+    server:
+    </p>
+    <ul>
+    <li>Jonathan Peatfield reported that the
+    "Options=IncludesNoEXEC" argument to the "AllowOverride" directive is
+    not processed properly (CVE-2009-1195).</li>
+    <li>Sander de Boer
+    discovered that the AJP proxy module (mod_proxy_ajp) does not correctly
+    handle POST requests that do not contain a request body
+    (CVE-2009-1191).</li>
+    <li>The vendor reported that the HTTP proxy
+    module (mod_proxy_http), when being used as a reverse proxy, does not
+    properly handle requests containing more data as stated in the
+    "Content-Length" header (CVE-2009-1890).</li>
+    <li>Francois Guerraz
+    discovered that mod_deflate does not abort the compression of large
+    files even when the requesting connection is closed prematurely
+    (CVE-2009-1891).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker could circumvent restrictions put up by the server
+    administrator and execute arbitrary commands with the privileges of the
+    user running the Apache server. A remote attacker could send multiple
+    requests to a server with the AJP proxy module, possibly resulting in
+    the disclosure of a request intended for another client, or cause a
+    Denial of Service by sending specially crafted requests to servers
+    running mod_proxy_http or mod_deflate.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Remove "include", "proxy_ajp", "proxy_http" and "deflate" from
+    APACHE2_MODULES in make.conf and rebuild Apache, or disable the
+    aforementioned modules in the Apache configuration.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Apache users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/apache-2.2.11-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1195">CVE-2009-1195</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1191">CVE-2009-1191</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1890">CVE-2009-1890</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1891">CVE-2009-1891</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 11 Jul 2009 20:22:24 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 11 Jul 2009 21:34:40 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 12 Jul 2009 15:17:06 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200907-05.xml b/xml/htdocs/security/en/glsa/glsa-200907-05.xml
new file mode 100644
index 00000000..8facbd6b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200907-05.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200907-05">
+  <title>git: git-daemon Denial of Service</title>
+  <synopsis>
+    An error in git-daemon might lead to a Denial of Service via resource
+    consumption.
+  </synopsis>
+  <product type="ebuild">git</product>
+  <announced>July 12, 2009</announced>
+  <revised>July 12, 2009: 01</revised>
+  <bug>273905</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-util/git" auto="yes" arch="*">
+      <unaffected range="ge">1.6.3.3</unaffected>
+      <vulnerable range="lt">1.6.3.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    git - the stupid content tracker, the revision control system used by
+    the Linux kernel team.
+    </p>
+  </background>
+  <description>
+    <p>
+    Shawn O. Pearce reported that git-daemon runs into an infinite loop
+    when handling requests that contain unrecognized arguments.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote unauthenticated attacker could send a specially crafted
+    request to git-daemon, possibly leading to a Denial of Service (CPU
+    consumption).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All git users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-util/git-1.6.3.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2108">CVE-2009-2108</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 10 Jul 2009 18:02:51 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 11 Jul 2009 00:41:19 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 11 Jul 2009 00:41:24 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200907-06.xml b/xml/htdocs/security/en/glsa/glsa-200907-06.xml
new file mode 100644
index 00000000..67e59973
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200907-06.xml
@@ -0,0 +1,125 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200907-06">
+  <title>Adobe Reader: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Adobe Reader is vulnerable to remote code execution via crafted PDF files.
+  </synopsis>
+  <product type="ebuild">acroread</product>
+  <announced>July 12, 2009</announced>
+  <revised>July 12, 2009: 01</revised>
+  <bug>267846</bug>
+  <bug>273908</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/acroread" auto="yes" arch="*">
+      <unaffected range="ge">8.1.6</unaffected>
+      <vulnerable range="lt">8.1.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Adobe Reader is a PDF reader released by Adobe.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in Adobe Reader:
+    </p>
+    <ul>
+    <li>Alin Rad Pop of Secunia Research reported a heap-based buffer
+    overflow in the JBIG2 filter (CVE-2009-0198).
+    </li>
+    <li>Mark Dowd of the IBM Internet Security Systems X-Force and
+    Nicolas Joly of VUPEN Security reported multiple heap-based buffer
+    overflows in the JBIG2 filter (CVE-2009-0509, CVE-2009-0510,
+    CVE-2009-0511, CVE-2009-0512, CVE-2009-0888, CVE-2009-0889)
+    </li>
+    <li>Arr1val reported that multiple methods in the JavaScript API
+    might lead to memory corruption when called with crafted arguments
+    (CVE-2009-1492, CVE-2009-1493).
+    </li>
+    <li>
+    An anonymous researcher reported a stack-based buffer overflow related
+    to U3D model files with a crafted extension block (CVE-2009-1855).
+    </li>
+    <li>
+    Jun Mao and Ryan Smith of iDefense Labs reported an integer overflow
+    related to the FlateDecode filter, which triggers a heap-based buffer
+    overflow (CVE-2009-1856).
+    </li>
+    <li>
+    Haifei Li of Fortinet's FortiGuard Global Security Research Team
+    reported a memory corruption vulnerability related to TrueType fonts
+    (CVE-2009-1857).
+    </li>
+    <li>
+    The Apple Product Security Team reported a memory corruption
+    vulnerability in the JBIG2 filter (CVE-2009-1858).
+    </li>
+    <li>
+    Matthew Watchinski of Sourcefire VRT reported an unspecified memory
+    corruption (CVE-2009-1859).
+    </li>
+    <li>
+    Will Dormann of CERT reported multiple heap-based buffer overflows when
+    processing JPX (aka JPEG2000) stream that trigger heap memory
+    corruption (CVE-2009-1861).
+    </li>
+    <li>
+    Multiple unspecified vulnerabilities have been discovered
+    (CVE-2009-2028).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    document, possibly resulting in the execution of arbitrary code with
+    the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Adobe Reader users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/acroread-8.1.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0198">CVE-2009-0198</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0509">CVE-2009-0509</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0510">CVE-2009-0510</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0511">CVE-2009-0511</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0512">CVE-2009-0512</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0888">CVE-2009-0888</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0889">CVE-2009-0889</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1492">CVE-2009-1492</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1493">CVE-2009-1493</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1855">CVE-2009-1855</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1856">CVE-2009-1856</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1857">CVE-2009-1857</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1858">CVE-2009-1858</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1859">CVE-2009-1859</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1861">CVE-2009-1861</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2028">CVE-2009-2028</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 21 Jun 2009 19:11:36 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 09 Jul 2009 17:45:58 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 09 Jul 2009 17:47:39 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200907-07.xml b/xml/htdocs/security/en/glsa/glsa-200907-07.xml
new file mode 100644
index 00000000..e746b2ae
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200907-07.xml
@@ -0,0 +1,95 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200907-07">
+  <title>ModPlug: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    ModPlug contains several buffer overflows that could lead to the execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">libmodplug gst-plugins-bad</product>
+  <announced>July 12, 2009</announced>
+  <revised>July 12, 2009: 01</revised>
+  <bug>266913</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libmodplug" auto="yes" arch="*">
+      <unaffected range="ge">0.8.7</unaffected>
+      <vulnerable range="lt">0.8.7</vulnerable>
+    </package>
+    <package name="media-libs/gst-plugins-bad" auto="yes" arch="*">
+      <unaffected range="ge">0.10.11</unaffected>
+      <vulnerable range="lt">0.10.11</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ModPlug is a library for playing MOD-like music.
+    </p>
+  </background>
+  <description>
+    <p>
+    Two vulnerabilities have been reported in ModPlug:
+    </p>
+    <ul>
+    <li>
+    dummy reported an integer overflow in the CSoundFile::ReadMed()
+    function when processing a MED file with a crafted song comment or song
+    name, which triggers a heap-based buffer overflow (CVE-2009-1438).
+    </li>
+    <li>
+    Manfred Tremmel and Stanislav Brabec reported a buffer overflow in the
+    PATinst() function when processing a long instrument name
+    (CVE-2009-1513).
+    </li>
+    </ul> <p>
+    The GStreamer Bad plug-ins (gst-plugins-bad) before 0.10.11 built a
+    vulnerable copy of ModPlug.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to read specially crafted files,
+    possibly resulting in the execution of arbitrary code with the
+    privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ModPlug users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libmodplug-0.8.7&quot;</code>
+    <p>
+    gst-plugins-bad 0.10.11 and later versions do not include the ModPlug
+    plug-in (it has been moved to media-plugins/gst-plugins-modplug). All
+    gst-plugins-bad users should upgrade to the latest version and install
+    media-plugins/gst-plugins-modplug:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/gst-plugins-bad-0.10.11&quot;
+    # emerge --ask --verbose &quot;media-plugins/gst-plugins-modplug&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1438">CVE-2009-1438</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1513">CVE-2009-1513</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 10 Jul 2009 13:45:14 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 11 Jul 2009 01:50:33 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 11 Jul 2009 01:50:38 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200907-08.xml b/xml/htdocs/security/en/glsa/glsa-200907-08.xml
new file mode 100644
index 00000000..f2bfa883
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200907-08.xml
@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200907-08">
+  <title>Multiple Ralink wireless drivers: Execution of arbitrary code</title>
+  <synopsis>
+    An integer overflow in multiple Ralink wireless drivers might lead to the
+    execution of arbitrary code with elevated privileges.
+  </synopsis>
+  <product type="ebuild">rt2400 rt2500 rt2570 rt61 ralink-rt61</product>
+  <announced>July 12, 2009</announced>
+  <revised>July 12, 2009: 01</revised>
+  <bug>257023</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-wireless/rt2400" auto="yes" arch="*">
+      <vulnerable range="le">1.2.2_beta3</vulnerable>
+    </package>
+    <package name="net-wireless/rt2500" auto="yes" arch="*">
+      <vulnerable range="le">1.1.0_pre2007071515</vulnerable>
+    </package>
+    <package name="net-wireless/rt2570" auto="yes" arch="*">
+      <vulnerable range="le">20070209</vulnerable>
+    </package>
+    <package name="net-wireless/rt61" auto="yes" arch="*">
+      <vulnerable range="le">1.1.0_beta2</vulnerable>
+    </package>
+    <package name="net-wireless/ralink-rt61" auto="yes" arch="*">
+      <vulnerable range="le">1.1.1.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    All listed packages are external kernel modules that provide drivers
+    for multiple Ralink devices. ralink-rt61 is released by ralinktech.com,
+    the other packages by the rt2x00.serialmonkey.com project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Aviv reported an integer overflow in multiple Ralink wireless card
+    drivers when processing a probe request packet with a long SSID,
+    possibly related to an integer signedness error.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A physically proximate attacker could send specially crafted packets to
+    a user who has wireless networking enabled, possibly resulting in the
+    execution of arbitrary code with root privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Unload the kernel modules.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All external kernel modules have been masked and we recommend that
+    users unmerge those drivers. The Linux mainline kernel has equivalent
+    support for these devices and the vulnerability has been resolved in
+    stable versions of sys-kernel/gentoo-sources.
+    </p>
+    <code>
+    # emerge --unmerge &quot;net-wireless/rt2400&quot;
+    # emerge --unmerge &quot;net-wireless/rt2500&quot;
+    # emerge --unmerge &quot;net-wireless/rt2570&quot;
+    # emerge --unmerge &quot;net-wireless/rt61&quot;
+    # emerge --unmerge &quot;net-wireless/ralink-rt61&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0282">CVE-2009-0282</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 09 Jul 2009 18:18:38 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 09 Jul 2009 18:30:24 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 12 Jul 2009 15:41:07 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200907-09.xml b/xml/htdocs/security/en/glsa/glsa-200907-09.xml
new file mode 100644
index 00000000..995d4e4a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200907-09.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200907-09">
+  <title>Cyrus-SASL: Execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow in Cyrus-SASL might allow for the execution of arbitrary
+    code in applications or daemons that authenticate using SASL.
+  </synopsis>
+  <product type="ebuild">cyrus-sasl</product>
+  <announced>July 12, 2009</announced>
+  <revised>July 12, 2009: 01</revised>
+  <bug>270261</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/cyrus-sasl" auto="yes" arch="*">
+      <unaffected range="ge">2.1.23</unaffected>
+      <vulnerable range="lt">2.1.23</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Cyrus-SASL is an implementation of the Simple Authentication and
+    Security Layer.
+    </p>
+  </background>
+  <description>
+    <p>
+    James Ralston reported that in certain situations, Cyrus-SASL does not
+    properly terminate strings which can result in buffer overflows when
+    performing Base64 encoding.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote unauthenticated user might send specially crafted packets to a
+    daemon using Cyrus-SASL, possibly resulting in the execution of
+    arbitrary code with the privileges of the user running the daemon or a
+    Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Cyrus-SASL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/cyrus-sasl-2.1.23&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0688">CVE-2009-0688</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 09 Jul 2009 18:32:29 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 09 Jul 2009 21:10:28 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 10 Jul 2009 10:41:22 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200907-10.xml b/xml/htdocs/security/en/glsa/glsa-200907-10.xml
new file mode 100644
index 00000000..0dd56011
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200907-10.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200907-10">
+  <title>Syslog-ng: Chroot escape</title>
+  <synopsis>
+    Syslog-ng does not properly initialize its chroot jail allowing for an
+    escape if a separate vulnerability in Syslog-ng is exploited.
+  </synopsis>
+  <product type="ebuild">syslog-ng</product>
+  <announced>July 12, 2009</announced>
+  <revised>July 12, 2009: 01</revised>
+  <bug>247278</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-admin/syslog-ng" auto="yes" arch="*">
+      <unaffected range="rge">2.0.10</unaffected>
+      <unaffected range="ge">2.1.3</unaffected>
+      <vulnerable range="lt">2.1.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Syslog-ng is a flexible and scalable system logger.
+    </p>
+  </background>
+  <description>
+    <p>
+    Florian Grandel reported that Syslog-ng does not call chdir() before
+    chroot() which leads to an inherited file descriptor to the current
+    working directory.
+    </p>
+  </description>
+  <impact type="low">
+    <p>
+    A local attacker might exploit a separate vulnerability in Syslog-ng
+    and use this vulnerability to escape the chroot jail.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Syslog-ng 2.0 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/syslog-ng-2.0.10&quot;</code>
+    <p>
+    All Syslog-ng 2.1 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/syslog-ng-2.1.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5110">CVE-2008-5110</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 10 Jul 2009 11:11:22 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 10 Jul 2009 11:21:31 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 10 Jul 2009 11:21:44 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200907-11.xml b/xml/htdocs/security/en/glsa/glsa-200907-11.xml
new file mode 100644
index 00000000..2dce701c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200907-11.xml
@@ -0,0 +1,112 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200907-11">
+  <title>GStreamer plug-ins: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple vulnerabilities in multiple GStreamer plug-ins might allow for the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">gst-plugins-good gst-plugins-base gst-plugins-libpng</product>
+  <announced>July 12, 2009</announced>
+  <revised>July 12, 2009: 01</revised>
+  <bug>256096</bug>
+  <bug>261594</bug>
+  <bug>272972</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/gst-plugins-good" auto="yes" arch="*">
+      <unaffected range="ge">0.10.14</unaffected>
+      <vulnerable range="lt">0.10.14</vulnerable>
+    </package>
+    <package name="media-libs/gst-plugins-base" auto="yes" arch="*">
+      <unaffected range="ge">0.10.22</unaffected>
+      <vulnerable range="lt">0.10.22</vulnerable>
+    </package>
+    <package name="media-plugins/gst-plugins-libpng" auto="yes" arch="*">
+      <unaffected range="ge">0.10.14-r1</unaffected>
+      <vulnerable range="lt">0.10.14-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The GStreamer plug-ins provide decoders to the GStreamer open source
+    media framework.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in several GStreamer
+    plug-ins:
+    </p>
+    <ul>
+    <li>
+    Tobias Klein reported two heap-based buffer overflows and an array
+    index error in the qtdemux_parse_samples() function in gst-plugins-good
+    when processing a QuickTime media .mov file (CVE-2009-0386,
+    CVE-2009-0387, CVE-2009-0397).
+    </li>
+    <li>
+    Thomas Hoger of the Red Hat Security Response Team reported an integer
+    overflow that can lead to a heap-based buffer overflow in the
+    gst_vorbis_tag_add_coverart() function in gst-plugins-base when
+    processing COVERART tags (CVE-2009-0586).
+    </li>
+    <li>
+    Tielei Wang of ICST-ERCIS, Peking University reported multiple integer
+    overflows leading to buffer overflows in gst-plugins-libpng when
+    processing a PNG file (CVE-2009-1932).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or automated system using a
+    GStreamer plug-in to process a specially crafted file, resulting in the
+    execution of arbitrary code or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All gst-plugins-good users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/gst-plugins-good-0.10.14&quot;</code>
+    <p>
+    All gst-plugins-base users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/gst-plugins-base-0.10.22&quot;</code>
+    <p>
+    All gst-plugins-libpng users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-plugins/gst-plugins-libpng-0.10.14-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0386">CVE-2009-0386</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0387">CVE-2009-0387</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0397">CVE-2009-0397</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0586">CVE-2009-0586</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1932">CVE-2009-1932</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 10 Jul 2009 13:44:55 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 11 Jul 2009 01:19:25 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 11 Jul 2009 01:21:49 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200907-12.xml b/xml/htdocs/security/en/glsa/glsa-200907-12.xml
new file mode 100644
index 00000000..d429c31c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200907-12.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200907-12">
+  <title>ISC DHCP: dhcpclient Remote execution of arbitrary code</title>
+  <synopsis>
+    A buffer overflow in dhclient as included in the ISC DHCP implementation
+    allows for the remote execution of arbitrary code with root privileges.
+  </synopsis>
+  <product type="ebuild">dhcp</product>
+  <announced>July 14, 2009</announced>
+  <revised>July 14, 2009: 01</revised>
+  <bug>277729</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/dhcp" auto="yes" arch="*">
+      <unaffected range="ge">3.1.1-r1</unaffected>
+      <vulnerable range="lt">3.1.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ISC DHCP is the reference implementation of the Dynamic Host
+    Configuration Protocol as specified in RFC 2131.
+    </p>
+  </background>
+  <description>
+    <p>
+    The Mandriva Linux Engineering Team has reported a stack-based buffer
+    overflow in the subnet-mask handling of dhclient.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker might set up a rogue DHCP server in a victim's local
+    network, possibly leading to the execution of arbitrary code with root
+    privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ISC DHCP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/dhcp-3.1.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0692">CVE-2009-0692</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 12 Jul 2009 14:21:43 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 12 Jul 2009 14:58:48 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 14 Jul 2009 17:38:51 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200907-13.xml b/xml/htdocs/security/en/glsa/glsa-200907-13.xml
new file mode 100644
index 00000000..db9d0b1c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200907-13.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200907-13">
+  <title>PulseAudio: Local privilege escalation</title>
+  <synopsis>
+    A vulnerability in PulseAudio may allow a local user to execute code with
+    escalated privileges.
+  </synopsis>
+  <product type="ebuild">pulseaudio</product>
+  <announced>July 16, 2009</announced>
+  <revised>July 16, 2009: 01</revised>
+  <bug>276986</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-sound/pulseaudio" auto="yes" arch="*">
+      <unaffected range="ge">0.9.9-r54</unaffected>
+      <vulnerable range="lt">0.9.9-r54</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PulseAudio is a network-enabled sound server with an advanced plug-in
+    system.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tavis Ormandy and Julien Tinnes of the Google Security Team discovered
+    that the pulseaudio binary is installed setuid root, and does not drop
+    privileges before re-executing itself. The vulnerability has
+    independently been reported to oCERT by Yorick Koster.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local user who has write access to any directory on the file system
+    containing /usr/bin can exploit this vulnerability using a race
+    condition to execute arbitrary code with root privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Ensure that the file system holding /usr/bin does not contain
+    directories that are writable for unprivileged users.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PulseAudio users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/pulseaudio-0.9.9-r54&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1894">CVE-2009-1894</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 09 Jul 2009 16:33:42 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 09 Jul 2009 16:51:52 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 16 Jul 2009 14:13:15 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200907-14.xml b/xml/htdocs/security/en/glsa/glsa-200907-14.xml
new file mode 100644
index 00000000..c28ca2de
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200907-14.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200907-14">
+  <title>Rasterbar libtorrent: Directory traversal</title>
+  <synopsis>
+    A directory traversal vulnerability in Rasterbar libtorrent might allow a
+    remote attacker to overwrite arbitrary files.
+  </synopsis>
+  <product type="ebuild">rb_libtorrent deluge</product>
+  <announced>July 17, 2009</announced>
+  <revised>July 17, 2009: 01</revised>
+  <bug>273156</bug>
+  <bug>273961</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-libs/rb_libtorrent" auto="yes" arch="*">
+      <unaffected range="ge">0.13-r1</unaffected>
+      <vulnerable range="lt">0.13-r1</vulnerable>
+    </package>
+    <package name="net-p2p/deluge" auto="yes" arch="*">
+      <unaffected range="ge">1.1.9</unaffected>
+      <vulnerable range="lt">1.1.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Rasterbar libtorrent is a C++ BitTorrent implementation focusing on
+    efficiency and scalability. Deluge is a BitTorrent client that ships a
+    copy of libtorrent.
+    </p>
+  </background>
+  <description>
+    <p>
+    census reported a directory traversal vulnerability in
+    src/torrent_info.cpp that can be triggered via .torrent files.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or automated system using
+    Rasterbar libtorrent to load a specially crafted BitTorrent file to
+    create or overwrite arbitrary files using dot dot sequences in
+    filenames.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Rasterbar libtorrent users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/rb_libtorrent-0.13-r1&quot;</code>
+    <p>
+    All Deluge users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-p2p/deluge-1.1.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1760">CVE-2009-1760</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 10 Jul 2009 10:55:00 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 11 Jul 2009 02:02:27 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 17 Jul 2009 06:51:09 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200907-15.xml b/xml/htdocs/security/en/glsa/glsa-200907-15.xml
new file mode 100644
index 00000000..b928bdf2
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200907-15.xml
@@ -0,0 +1,96 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200907-15">
+  <title>Nagios: Execution of arbitrary code</title>
+  <synopsis>
+    Multiple vulnerabilities in Nagios may lead to the execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">nagios-core</product>
+  <announced>July 19, 2009</announced>
+  <revised>July 19, 2009: 01</revised>
+  <bug>245887</bug>
+  <bug>249876</bug>
+  <bug>275288</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/nagios-core" auto="yes" arch="*">
+      <unaffected range="ge">3.0.6-r2</unaffected>
+      <vulnerable range="lt">3.0.6-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Nagios is an open source host, service and network monitoring program.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in Nagios:
+    </p>
+    <ul>
+    <li>
+    Paul reported that statuswml.cgi does not properly sanitize shell
+    metacharacters in the (1) ping and (2) traceroute parameters
+    (CVE-2009-2288).
+    </li>
+    <li>
+    Nagios does not properly verify whether an authenticated user is
+    authorized to run certain commands (CVE-2008-5027).
+    </li>
+    <li>
+    Andreas Ericsson reported that Nagios does not perform validity checks
+    to verify HTTP requests, leading to Cross-Site Request Forgery
+    (CVE-2008-5028).
+    </li>
+    <li>
+    An unspecified vulnerability in Nagios related to CGI programs,
+    "adaptive external commands," and "writing newlines and submitting
+    service comments" has been reported (CVE-2008-6373).
+    </li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A remote authenticated or unauthenticated attacker may exploit these
+    vulnerabilities to execute arbitrary commands or elevate privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Nagios users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/nagios-core-3.0.6-r2&quot;</code>
+    <p>
+    NOTE: Users of the Nagios 2 branch can update to version 2.12-r1 which
+    contains a patch to fix CVE-2009-2288. However, that branch is not
+    supported upstream or in Gentoo and we are unaware whether the other
+    vulnerabilities affect 2.x installations.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5027">CVE-2008-5027</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5028">CVE-2008-5028</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6373">CVE-2008-6373</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2288">CVE-2009-2288</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 10 Jul 2009 13:14:06 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 19 Jul 2009 15:48:17 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 19 Jul 2009 15:48:53 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200907-16.xml b/xml/htdocs/security/en/glsa/glsa-200907-16.xml
new file mode 100644
index 00000000..42588aa4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200907-16.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200907-16">
+  <title>Python: Integer overflows</title>
+  <synopsis>
+    Multiple integer overflows in Python have an unspecified impact.
+  </synopsis>
+  <product type="ebuild">python</product>
+  <announced>July 19, 2009</announced>
+  <revised>July 19, 2009: 01</revised>
+  <bug>246991</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/python" auto="yes" arch="*">
+      <unaffected range="ge">2.5.4-r2</unaffected>
+      <unaffected range="rge">2.4.6</unaffected>
+      <vulnerable range="lt">2.5.4-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Python is an interpreted, interactive, object-oriented programming
+    language.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Evans reported multiple integer overflows in the expandtabs
+    method, as implemented by (1) the string_expandtabs function in
+    Objects/stringobject.c and (2) the unicode_expandtabs function in
+    Objects/unicodeobject.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities in Python
+    applications or daemons that pass user-controlled input to vulnerable
+    functions. The security impact is currently unknown but may include the
+    execution of arbitrary code or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Python 2.5 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/python-2.5.4-r2&quot;</code>
+    <p>
+    All Python 2.4 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/python-2.4.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5031">CVE-2008-5031</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 10 Jul 2009 13:26:22 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 19 Jul 2009 15:28:36 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 19 Jul 2009 15:28:41 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200908-01.xml b/xml/htdocs/security/en/glsa/glsa-200908-01.xml
new file mode 100644
index 00000000..5617dd17
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200908-01.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200908-01">
+  <title>OpenSC: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities were found in OpenSC.
+  </synopsis>
+  <product type="ebuild">opensc</product>
+  <announced>August 01, 2009</announced>
+  <revised>August 01, 2009: 01</revised>
+  <bug>260514</bug>
+  <bug>269920</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-libs/opensc" auto="yes" arch="*">
+      <unaffected range="ge">0.11.8</unaffected>
+      <vulnerable range="lt">0.11.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSC provides a set of libraries and utilities to access smart cards.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities were found in OpenSC:
+    </p>
+    <ul>
+    <li>b.badrignans discovered that OpenSC incorrectly initialises private
+    data objects (CVE-2009-0368).</li>
+    <li>Miquel Comas Marti discovered
+    that src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used
+    with unspecified third-party PKCS#11 modules, generates RSA keys with
+    incorrect public exponents (CVE-2009-1603).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    The first vulnerabilty allows physically proximate attackers to bypass
+    intended PIN requirements and read private data objects. The second
+    vulnerability allows attackers to read the cleartext form of messages
+    that were intended to be encrypted.
+    </p>
+    <p>
+    NOTE: Smart cards which were initialised using an affected version of
+    OpenSC need to be modified or re-initialised. See the vendor's advisory
+    for details.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenSC users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/opensc-0.11.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0368">CVE-2009-0368</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1603">CVE-2009-1603</uri>
+    <uri link="http://www.opensc-project.org/pipermail/opensc-announce/2009-February/000023.html">OpenSC Security Advisory</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 24 Jun 2009 16:49:20 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 29 Jul 2009 17:15:19 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 01 Aug 2009 12:35:17 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200908-02.xml b/xml/htdocs/security/en/glsa/glsa-200908-02.xml
new file mode 100644
index 00000000..2cb6ab71
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200908-02.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200908-02">
+  <title>BIND: Denial of Service</title>
+  <synopsis>
+    Dynamic Update packets can cause a Denial of Service in the BIND daemon.
+  </synopsis>
+  <product type="ebuild">bind</product>
+  <announced>August 01, 2009</announced>
+  <revised>August 01, 2009: 01</revised>
+  <bug>279508</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/bind" auto="yes" arch="*">
+      <unaffected range="ge">9.4.3_p3</unaffected>
+      <vulnerable range="lt">9.4.3_p3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ISC BIND is the Internet Systems Consortium implementation of the
+    Domain Name System (DNS) protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    Matthias Urlichs reported that the dns_db_findrdataset() function fails
+    when the prerequisite section of the dynamic update message contains a
+    record of type "ANY" and where at least one RRset for this FQDN exists
+    on the server.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote unauthenticated attacker could send a specially crafted
+    dynamic update message to the BIND daemon (named), leading to a Denial
+    of Service (daemon crash). This vulnerability affects all primary
+    (master) servers -- it is not limited to those that are configured to
+    allow dynamic updates.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Configure a firewall that performs Deep Packet Inspection to prevent
+    nsupdate messages from reaching named. Alternatively, expose only
+    secondary (slave) servers to untrusted networks.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All BIND users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/bind-9.4.3_p3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0696">CVE-2009-0696</uri>
+    <uri link="https://www.isc.org/node/474">ISC advisory</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 28 Jul 2009 21:43:47 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 01 Aug 2009 20:00:21 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200908-03.xml b/xml/htdocs/security/en/glsa/glsa-200908-03.xml
new file mode 100644
index 00000000..60dbda51
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200908-03.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200908-03">
+  <title>libTIFF: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple boundary checking vulnerabilities in libTIFF may allow for the
+    remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">tiff</product>
+  <announced>August 07, 2009</announced>
+  <revised>August 07, 2009: 01</revised>
+  <bug>276339</bug>
+  <bug>276988</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/tiff" auto="yes" arch="*">
+      <unaffected range="ge">3.8.2-r8</unaffected>
+      <vulnerable range="lt">3.8.2-r8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libTIFF provides support for reading and manipulating TIFF (Tagged
+    Image File Format) images.
+    </p>
+  </background>
+  <description>
+    <p>
+    Two vulnerabilities have been reported in libTIFF:
+    </p>
+    <ul>
+    <li>
+    wololo reported a buffer underflow in the LZWDecodeCompat() function
+    (CVE-2009-2285).
+    </li>
+    <li>
+    Tielei Wang of ICST-ERCIS, Peking University reported two integer
+    overflows leading to heap-based buffer overflows in the tiff2rgba and
+    rgb2ycbcr tools (CVE-2009-2347).
+    </li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted TIFF
+    file with an application making use of libTIFF or the tiff2rgba and
+    rgb2ycbcr tools, possibly resulting in the execution of arbitrary code
+    with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libTIFF users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/tiff-3.8.2-r8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2285">CVE-2009-2285</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2347">CVE-2009-2347</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 09 Jul 2009 08:33:26 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 11 Jul 2009 02:17:53 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 05 Aug 2009 13:20:56 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200908-04.xml b/xml/htdocs/security/en/glsa/glsa-200908-04.xml
new file mode 100644
index 00000000..c4872d37
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200908-04.xml
@@ -0,0 +1,115 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200908-04">
+  <title>Adobe products: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Adobe Reader and Adobe Flash Player allow for
+    attacks including the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">adobe-flash acroread</product>
+  <announced>August 07, 2009</announced>
+  <revised>August 07, 2009: 01</revised>
+  <bug>278813</bug>
+  <bug>278819</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-plugins/adobe-flash" auto="yes" arch="*">
+      <unaffected range="ge">10.0.32.18</unaffected>
+      <vulnerable range="lt">10.0.32.18</vulnerable>
+    </package>
+    <package name="app-text/acroread" auto="yes" arch="*">
+      <unaffected range="ge">9.1.3</unaffected>
+      <vulnerable range="lt">9.1.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Adobe Flash Player is a closed-source playback software for Flash SWF
+    files. Adobe Reader is a closed-source PDF reader that plays Flash
+    content as well.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in Adobe Flash Player:
+    </p>
+    <ul>
+    <li>lakehu of Tencent Security Center reported an unspecified
+    memory corruption vulnerability (CVE-2009-1862).</li>
+    <li>Mike Wroe
+    reported an unspecified vulnerability, related to "privilege
+    escalation" (CVE-2009-1863).</li>
+    <li>An anonymous researcher through
+    iDefense reported an unspecified heap-based buffer overflow
+    (CVE-2009-1864).</li>
+    <li>Chen Chen of Venustech reported an
+    unspecified "null pointer vulnerability" (CVE-2009-1865).</li>
+    <li>Chen
+    Chen of Venustech reported an unspecified stack-based buffer overflow
+    (CVE-2009-1866).</li>
+    <li>Joran Benker reported that Adobe Flash Player
+    facilitates "clickjacking" attacks (CVE-2009-1867).</li>
+    <li>Jun Mao of
+    iDefense reported a heap-based buffer overflow, related to URL parsing
+    (CVE-2009-1868).</li>
+    <li>Roee Hay of IBM Rational Application Security
+    reported an unspecified integer overflow (CVE-2009-1869).</li>
+    <li>Gareth Heyes and Microsoft Vulnerability Research reported that the
+    sandbox in Adobe Flash Player allows for information disclosure, when
+    "SWFs are saved to the hard drive" (CVE-2009-1870).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted PDF
+    file or web site containing Adobe Flash (SWF) contents, possibly
+    resulting in the execution of arbitrary code with the privileges of the
+    user running the application, or a Denial of Service (application
+    crash). Furthermore, a remote attacker could trick a user into clicking
+    a button on a dialog by supplying a specially crafted SWF file and
+    disclose sensitive information by exploiting a sandbox issue.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Adobe Flash Player users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-plugins/adobe-flash-10.0.32.18&quot;</code>
+    <p>
+    All Adobe Reader users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/acroread-9.1.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1862">CVE-2009-1862</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1863">CVE-2009-1863</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1864">CVE-2009-1864</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1865">CVE-2009-1865</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1866">CVE-2009-1866</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1867">CVE-2009-1867</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1868">CVE-2009-1868</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1869">CVE-2009-1869</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1870">CVE-2009-1870</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 01 Aug 2009 14:34:28 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 05 Aug 2009 13:16:39 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 05 Aug 2009 13:32:24 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200908-05.xml b/xml/htdocs/security/en/glsa/glsa-200908-05.xml
new file mode 100644
index 00000000..f8313393
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200908-05.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200908-05">
+  <title>Subversion: Remote execution of arbitrary code</title>
+  <synopsis>
+    Multiple integer overflows, leading to heap-based buffer overflows in the
+    Subversion client and server might allow remote attackers to execute
+    arbitrary code.
+  </synopsis>
+  <product type="ebuild">subversion</product>
+  <announced>August 18, 2009</announced>
+  <revised>August 18, 2009: 01</revised>
+  <bug>280494</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-util/subversion" auto="yes" arch="*">
+      <unaffected range="ge">1.6.4</unaffected>
+      <vulnerable range="lt">1.6.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Subversion is a versioning system designed to be a replacement for CVS.
+    </p>
+  </background>
+  <description>
+    <p>
+    Matt Lewis of Google reported multiple integer overflows in the
+    libsvn_delta library, possibly leading to heap-based buffer overflows.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker with commit access could exploit this vulnerability
+    by sending a specially crafted commit to a Subversion server, or a
+    remote attacker could entice a user to check out or update a repository
+    from a malicious Subversion server, possibly resulting in the execution
+    of arbitrary code with the privileges of the user running the server or
+    client.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Subversion users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-util/subversion-1.6.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2411">CVE-2009-2411</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 09 Aug 2009 20:48:04 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 18 Aug 2009 19:08:11 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 18 Aug 2009 21:24:46 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200908-06.xml b/xml/htdocs/security/en/glsa/glsa-200908-06.xml
new file mode 100644
index 00000000..0d162b0f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200908-06.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200908-06">
+  <title>CDF: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple heap-based buffer overflows in CDF might result in the execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">cdf</product>
+  <announced>August 18, 2009</announced>
+  <revised>August 18, 2009: 01</revised>
+  <bug>278679</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sci-libs/cdf" auto="yes" arch="*">
+      <unaffected range="ge">3.3.0</unaffected>
+      <vulnerable range="lt">3.3.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CDF is a library for the Common Data Format which is a self-describing
+    data format for the storage and manipulation of scalar and
+    multidimensional data. It is developed by the NASA.
+    </p>
+  </background>
+  <description>
+    <p>
+    Leon Juranic reported multiple heap-based buffer overflows for instance
+    in the ReadAEDRList64(), SearchForRecord_r_64(), LastRecord64(), and
+    CDFsel64() functions.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted CDF
+    file, possibly resulting in the execution of arbitrary code with the
+    privileges of the user running the application, or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CDF users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sci-libs/cdf-3.3.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2850">CVE-2009-2850</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 09 Aug 2009 15:21:56 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 14 Aug 2009 16:20:48 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 18 Aug 2009 21:24:15 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200908-07.xml b/xml/htdocs/security/en/glsa/glsa-200908-07.xml
new file mode 100644
index 00000000..60dfa23f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200908-07.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200908-07">
+  <title>Perl Compress::Raw modules: Denial of Service</title>
+  <synopsis>
+    An off-by-one error in Compress::Raw::Zlib and Compress::Raw::Bzip2 might
+    lead to a Denial of Service.
+  </synopsis>
+  <product type="ebuild">Compress-Raw-Zlib Compress-Raw-Bzip2</product>
+  <announced>August 18, 2009</announced>
+  <revised>August 18, 2009: 01</revised>
+  <bug>273141</bug>
+  <bug>281955</bug>
+  <access>remote</access>
+  <affected>
+    <package name="perl-core/Compress-Raw-Zlib" auto="yes" arch="*">
+      <unaffected range="ge">2.020</unaffected>
+      <vulnerable range="lt">2.020</vulnerable>
+    </package>
+    <package name="perl-core/Compress-Raw-Bzip2" auto="yes" arch="*">
+      <unaffected range="ge">2.020</unaffected>
+      <vulnerable range="lt">2.020</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Compress::Raw::Zlib and Compress::Raw::Bzip2 are Perl low-level
+    interfaces to the zlib and bzip2 compression libraries.
+    </p>
+  </background>
+  <description>
+    <p>
+    Leo Bergolth reported an off-by-one error in the inflate() function in
+    Zlib.xs of Compress::Raw::Zlib, possibly leading to a heap-based buffer
+    overflow (CVE-2009-1391).
+    </p>
+    <p>
+    Paul Marquess discovered a similar vulnerability in the bzinflate()
+    function in Bzip2.xs of Compress::Raw::Bzip2 (CVE-2009-1884).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker might entice a user or automated system (for instance
+    running SpamAssassin or AMaViS) to process specially crafted files,
+    possibly resulting in a Denial of Service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Compress::Raw::Zlib users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=perl-core/Compress-Raw-Zlib-2.020&quot;</code>
+    <p>
+    All Compress::Raw::Bzip2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=perl-core/Compress-Raw-Bzip2-2.020&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1391">CVE-2009-1391</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1884">CVE-2009-1884</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 19 Jul 2009 17:33:05 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 04 Aug 2009 18:43:38 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 05 Aug 2009 13:32:50 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200908-08.xml b/xml/htdocs/security/en/glsa/glsa-200908-08.xml
new file mode 100644
index 00000000..e1419628
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200908-08.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200908-08">
+  <title>ISC DHCP: dhcpd Denial of Service</title>
+  <synopsis>
+    dhcpd as included in the ISC DHCP implementation does not properly handle
+    special conditions, leading to a Denial of Service.
+  </synopsis>
+  <product type="ebuild">dhcp</product>
+  <announced>August 18, 2009</announced>
+  <revised>August 18, 2009: 01</revised>
+  <bug>275231</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/dhcp" auto="yes" arch="*">
+      <unaffected range="ge">3.1.2_p1</unaffected>
+      <vulnerable range="lt">3.1.2_p1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ISC DHCP is the reference implementation of the Dynamic Host
+    Configuration Protocol as specified in RFC 2131.
+    </p>
+  </background>
+  <description>
+    <p>
+    Christoph Biedl discovered that dhcpd does not properly handle certain
+    DHCP requests when configured both using "dhcp-client-identifier" and
+    "hardware ethernet".
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker might send a specially crafted request to dhcpd,
+    possibly resulting in a Denial of Service (daemon crash).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ISC DHCP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/dhcp-3.1.2_p1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1892">CVE-2009-1892</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 28 Jul 2009 17:01:31 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 04 Aug 2009 19:40:02 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 05 Aug 2009 13:32:31 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200908-09.xml b/xml/htdocs/security/en/glsa/glsa-200908-09.xml
new file mode 100644
index 00000000..29c1c620
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200908-09.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200908-09">
+  <title>DokuWiki: Local file inclusion</title>
+  <synopsis>
+    An input sanitation error in DokuWiki might lead to the dislosure of local
+    files or even the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">dokuwiki</product>
+  <announced>August 18, 2009</announced>
+  <revised>August 19, 2009: 02</revised>
+  <bug>272431</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/dokuwiki" auto="yes" arch="*">
+      <unaffected range="ge">20090214b</unaffected>
+      <vulnerable range="lt">20090214b</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    DokuWiki is a standards compliant Wiki system written in PHP.
+    </p>
+  </background>
+  <description>
+    <p>
+    girex reported that data from the "config_cascade" parameter in
+    inc/init.php is not properly sanitized before being used.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this vulnerability to execute PHP code
+    from arbitrary local, or, when the used PHP version supports ftp://
+    URLs, also from remote files via FTP. Furthermore, it is possible to
+    disclose the contents of local files. NOTE: Successful exploitation
+    requires the PHP option "register_globals" to be enabled.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Disable "register_globals" in php.ini.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All DokuWiki users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/dokuwiki-2009-02-14b&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1960">CVE-2009-1960</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 19 Jul 2009 18:47:33 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 04 Aug 2009 19:07:45 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 05 Aug 2009 13:32:43 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200908-10.xml b/xml/htdocs/security/en/glsa/glsa-200908-10.xml
new file mode 100644
index 00000000..53664442
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200908-10.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200908-10">
+  <title>Dillo: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    An integer overflow in the PNG handling of Dillo might result in the remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">dillo</product>
+  <announced>August 18, 2009</announced>
+  <revised>August 18, 2009: 01</revised>
+  <bug>276432</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/dillo" auto="yes" arch="*">
+      <unaffected range="ge">2.1.1</unaffected>
+      <vulnerable range="lt">2.1.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Dillo is a graphical web browser known for its speed and small
+    footprint.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tilei Wang reported an integer overflow in the Png_datainfo_callback()
+    function, possibly leading to a heap-based buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open an HTML document
+    containing a specially crafted, large PNG image, possibly resulting in
+    the execution of arbitrary code with the privileges of the user running
+    the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Dillo users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/dillo-2.1.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2294">CVE-2009-2294</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 28 Jul 2009 16:58:47 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 04 Aug 2009 19:13:24 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 05 Aug 2009 13:32:35 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-01.xml b/xml/htdocs/security/en/glsa/glsa-200909-01.xml
new file mode 100644
index 00000000..59738f2a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-01.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-01">
+  <title>Linux-PAM: Privilege escalation</title>
+  <synopsis>
+    An error in the handling of user names of Linux-PAM might allow remote
+    attackers to cause a Denial of Service or escalate privileges.
+  </synopsis>
+  <product type="ebuild">pam</product>
+  <announced>September 07, 2009</announced>
+  <revised>September 07, 2009: 01</revised>
+  <bug>261512</bug>
+  <access>remote</access>
+  <affected>
+    <package name="sys-libs/pam" auto="yes" arch="*">
+      <unaffected range="ge">1.0.4</unaffected>
+      <vulnerable range="lt">1.0.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Linux-PAM (Pluggable Authentication Modules) is an architecture
+    allowing the separation of the development of privilege granting
+    software from the development of secure and appropriate authentication
+    schemes.
+    </p>
+  </background>
+  <description>
+    <p>
+    Marcus Granado repoted that Linux-PAM does not properly handle user
+    names that contain Unicode characters. This is related to integer
+    signedness errors in the pam_StrTok() function in libpam/pam_misc.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit this vulnerability to cause a Denial of
+    Service. A remote authenticated attacker could exploit this
+    vulnerability to log in to a system with the account of a user that has
+    a similar user name, but with non-ASCII characters.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Linux-PAM users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-libs/pam-1.0.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0887">CVE-2009-0887</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 10 Jul 2009 18:01:34 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 28 Aug 2009 16:33:27 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 Aug 2009 03:38:46 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-02.xml b/xml/htdocs/security/en/glsa/glsa-200909-02.xml
new file mode 100644
index 00000000..5c59b8b0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-02.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-02">
+  <title>libvorbis: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A processing error in libvorbis might result in the execution of arbitrary
+    code or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">libvorbis</product>
+  <announced>September 07, 2009</announced>
+  <revised>September 07, 2009: 01</revised>
+  <bug>280590</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/libvorbis" auto="yes" arch="*">
+      <unaffected range="ge">1.2.3</unaffected>
+      <vulnerable range="lt">1.2.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    libvorbis is the reference implementation of the Xiph.org Ogg Vorbis
+    audio file format. It is used by many applications for playback of Ogg
+    Vorbis files.
+    </p>
+  </background>
+  <description>
+    <p>
+    Lucas Adamski reported that libvorbis does not correctly process file
+    headers, related to static mode headers and encoding books.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to play a specially crafted OGG
+    Vorbis file using an application that uses libvorbis, possibly
+    resulting in the execution of arbitrary code with the privileges of the
+    user running the application, or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All libvorbis users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libvorbis-1.2.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2663">CVE-2009-2663</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 31 Aug 2009 02:17:32 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 31 Aug 2009 02:42:12 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 Aug 2009 03:38:56 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-03.xml b/xml/htdocs/security/en/glsa/glsa-200909-03.xml
new file mode 100644
index 00000000..13f56901
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-03.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-03">
+  <title>Apache Portable Runtime, APR Utility Library: Execution of arbitrary code</title>
+  <synopsis>
+    Multiple integer overflows in the Apache Portable Runtime and its Utility
+    Library might allow for the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">apr apr-util</product>
+  <announced>September 09, 2009</announced>
+  <revised>September 09, 2009: 01</revised>
+  <bug>280514</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/apr" auto="yes" arch="*">
+      <unaffected range="ge">1.3.8</unaffected>
+      <vulnerable range="lt">1.3.8</vulnerable>
+    </package>
+    <package name="dev-libs/apr-util" auto="yes" arch="*">
+      <unaffected range="ge">1.3.9</unaffected>
+      <vulnerable range="lt">1.3.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Apache Portable Runtime (aka APR) provides a set of APIs for
+    creating platform-independent applications. The Apache Portable Runtime
+    Utility Library (aka APR-Util) provides an interface to functionality
+    such as XML parsing, string matching and databases connections.
+    </p>
+  </background>
+  <description>
+    <p>
+    Matt Lewis reported multiple Integer overflows in the apr_rmm_malloc(),
+    apr_rmm_calloc(), and apr_rmm_realloc() functions in misc/apr_rmm.c of
+    APR-Util and in memory/unix/apr_pools.c of APR, both occurring when
+    aligning memory blocks.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to connect to a malicious server
+    with software that uses the APR or act as a malicious client to a
+    server that uses the APR (such as Subversion or Apache servers),
+    possibly resulting in the execution of arbitrary code with the
+    privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Apache Portable Runtime users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/apr-1.3.8&quot;</code>
+    <p>
+    All APR Utility Library users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/apr-util-1.3.9&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2412">CVE-2009-2412</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 06 Aug 2009 13:32:21 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 06 Aug 2009 13:46:29 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 24 Aug 2009 20:40:13 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-04.xml b/xml/htdocs/security/en/glsa/glsa-200909-04.xml
new file mode 100644
index 00000000..186ccdfc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-04.xml
@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-04">
+  <title>Clam AntiVirus: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in ClamAV allow for the remote execution of
+    arbitrary code or Denial of Service.
+  </synopsis>
+  <product type="ebuild">clamav</product>
+  <announced>September 09, 2009</announced>
+  <revised>September 09, 2009: 01</revised>
+  <bug>264834</bug>
+  <bug>265545</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-antivirus/clamav" auto="yes" arch="*">
+      <unaffected range="ge">0.95.2</unaffected>
+      <vulnerable range="lt">0.95.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Clam AntiVirus (short: ClamAV) is an anti-virus toolkit for UNIX,
+    designed especially for e-mail scanning on mail gateways.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been found in ClamAV:
+    </p>
+    <ul>
+    <li>The
+    vendor reported a Divide-by-zero error in the PE ("Portable
+    Executable"; Windows .exe) file handling of ClamAV
+    (CVE-2008-6680).</li>
+    <li>Jeffrey Thomas Peckham found a flaw in
+    libclamav/untar.c, possibly resulting in an infinite loop when
+    processing TAR archives in clamd and clamscan (CVE-2009-1270).</li>
+    <li>Martin Olsen reported a vulnerability in the CLI_ISCONTAINED macro
+    in libclamav/others.h, when processing UPack archives
+    (CVE-2009-1371).</li>
+    <li>Nigel disclosed a stack-based buffer overflow
+    in the "cli_url_canon()" function in libclamav/phishcheck.c when
+    processing URLs (CVE-2009-1372).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user or automated system to process a
+    specially crafted UPack archive or a file containing a specially
+    crafted URL, possibly resulting in the remote execution of arbitrary
+    code with the privileges of the user running the application, or a
+    Denial of Service. Furthermore, a remote attacker could cause a Denial
+    of Service by supplying a specially crafted TAR archive or PE
+    executable to a Clam AntiVirus instance.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Clam AntiVirus users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-antivirus/clamav-0.95.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6680">CVE-2008-6680</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1270">CVE-2009-1270</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1371">CVE-2009-1371</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1372">CVE-2009-1372</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 01 Jun 2009 22:30:28 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 28 Aug 2009 09:13:38 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 Aug 2009 03:38:38 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-05.xml b/xml/htdocs/security/en/glsa/glsa-200909-05.xml
new file mode 100644
index 00000000..4c87a875
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-05.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-05">
+  <title>Openswan: Denial of Service</title>
+  <synopsis>
+    Multiple vulnerabilities in the pluto IKE daemon of Openswan might allow
+    remote attackers to cause a Denial of Service.
+  </synopsis>
+  <product type="ebuild">openswan</product>
+  <announced>September 09, 2009</announced>
+  <revised>September 09, 2009: 01</revised>
+  <bug>264346</bug>
+  <bug>275233</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/openswan" auto="yes" arch="*">
+      <unaffected range="ge">2.4.15</unaffected>
+      <vulnerable range="lt">2.4.15</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Openswan is an implementation of IPsec for Linux.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in Openswan:
+    </p>
+    <ul>
+    <li>Gerd v. Egidy reported a NULL pointer dereference in the Dead Peer
+    Detection of the pluto IKE daemon as included in Openswan
+    (CVE-2009-0790).</li>
+    <li>The Orange Labs vulnerability research team
+    discovered multiple vulnerabilities in the ASN.1 parser
+    (CVE-2009-2185).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities by sending
+    specially crafted R_U_THERE or R_U_THERE_ACK packets, or a specially
+    crafted X.509 certificate containing a malicious Relative Distinguished
+    Name (RDN), UTCTIME string or GENERALIZEDTIME string to cause a Denial
+    of Service of the pluto IKE daemon.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Openswan users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/openswan-2.4.15&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0790">CVE-2009-0790</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2185">CVE-2009-2185</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 12 Jun 2009 22:25:11 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 28 Aug 2009 16:52:25 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 Aug 2009 03:39:02 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-06.xml b/xml/htdocs/security/en/glsa/glsa-200909-06.xml
new file mode 100644
index 00000000..56d7b652
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-06.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-06">
+  <title>aMule: Parameter injection</title>
+  <synopsis>
+    An input validation error in aMule enables remote attackers to pass
+    arbitrary parameters to a victim's media player.
+  </synopsis>
+  <product type="ebuild">amule</product>
+  <announced>September 09, 2009</announced>
+  <revised>September 09, 2009: 01</revised>
+  <bug>268163</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-p2p/amule" auto="yes" arch="*">
+      <unaffected range="ge">2.2.5</unaffected>
+      <vulnerable range="lt">2.2.5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    aMule is an eMule-like client for the eD2k and Kademlia networks,
+    supporting multiple platforms.
+    </p>
+  </background>
+  <description>
+    <p>
+    Sam Hocevar discovered that the aMule preview function does not
+    properly sanitize file names.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to download a file with a
+    specially crafted file name to inject arbitrary arguments to the
+    victim's video player.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All aMule users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-p2p/amule-2.2.5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1440">CVE-2009-1440</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 28 Jul 2009 16:58:04 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 28 Aug 2009 08:22:54 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 Aug 2009 03:38:32 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-07.xml b/xml/htdocs/security/en/glsa/glsa-200909-07.xml
new file mode 100644
index 00000000..96d6baa0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-07.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-07">
+  <title>TkMan: Insecure temporary file usage</title>
+  <synopsis>
+    An insecure temporary file usage has been reported in TkMan, allowing for
+    symlink attacks.
+  </synopsis>
+  <product type="ebuild">tkman</product>
+  <announced>September 09, 2009</announced>
+  <revised>September 09, 2009: 01</revised>
+  <bug>247540</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-text/tkman" auto="yes" arch="*">
+      <unaffected range="ge">2.2-r1</unaffected>
+      <vulnerable range="lt">2.2-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    TkMan is a graphical, hypertext manual page and Texinfo browser for
+    UNIX.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dmitry E. Oboukhov reported that TkMan does not handle the
+    "/tmp/tkman#####" and "/tmp/ll" temporary files securely.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could perform symlink attacks to overwrite arbitrary
+    files with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All TkMan users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/tkman-2.2-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5137">CVE-2008-5137</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 19 Jul 2009 18:23:29 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 28 Aug 2009 07:32:36 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 Aug 2009 03:37:41 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-08.xml b/xml/htdocs/security/en/glsa/glsa-200909-08.xml
new file mode 100644
index 00000000..b6469a76
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-08.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-08">
+  <title>C* music player: Insecure temporary file usage</title>
+  <synopsis>
+    An insecure temporary file usage has been reported in the C* music player,
+    allowing for symlink attacks.
+  </synopsis>
+  <product type="ebuild">cmus</product>
+  <announced>September 09, 2009</announced>
+  <revised>September 09, 2009: 01</revised>
+  <bug>250474</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-sound/cmus" auto="yes" arch="*">
+      <unaffected range="ge">2.2.0-r1</unaffected>
+      <vulnerable range="lt">2.2.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The C* Music Player (cmus) is a modular and very configurable
+    ncurses-based audio player.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dmitry E. Oboukhov reported that cmus-status-display does not handle
+    the "/tmp/cmus-status" temporary file securely.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could perform symlink attacks to overwrite arbitrary
+    files with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All C* music player users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-sound/cmus-2.2.0-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5375">CVE-2008-5375</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 23 Jun 2009 20:29:45 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 28 Aug 2009 07:44:23 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 Aug 2009 03:37:47 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-09.xml b/xml/htdocs/security/en/glsa/glsa-200909-09.xml
new file mode 100644
index 00000000..f901c03a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-09.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-09">
+  <title>Screenie: Insecure temporary file usage</title>
+  <synopsis>
+    An insecure temporary file usage has been reported in Screenie, allowing
+    for symlink attacks.
+  </synopsis>
+  <product type="ebuild">screenie</product>
+  <announced>September 09, 2009</announced>
+  <revised>September 09, 2009: 01</revised>
+  <bug>250476</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-misc/screenie" auto="yes" arch="*">
+      <unaffected range="ge">1.30.0-r1</unaffected>
+      <vulnerable range="lt">1.30.0-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Screenie is a small screen frontend that is designed to be a session
+    handler.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dmitry E. Oboukhov reported that Screenie does not handle
+    "/tmp/.screenie.#####" temporary files securely.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could perform symlink attacks to overwrite arbitrary
+    files with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Screenie users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-misc/screenie-1.30.0-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5371">CVE-2008-5371</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 12 Jun 2009 22:09:23 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 28 Aug 2009 07:52:34 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 Aug 2009 03:37:54 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-10.xml b/xml/htdocs/security/en/glsa/glsa-200909-10.xml
new file mode 100644
index 00000000..e6c011a3
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-10.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-10">
+  <title>LMBench: Insecure temporary file usage</title>
+  <synopsis>
+    Multiple insecure temporary file usage issues have been reported in
+    LMBench, allowing for symlink attacks.
+  </synopsis>
+  <product type="ebuild">lmbench</product>
+  <announced>September 09, 2009</announced>
+  <revised>September 09, 2009: 01</revised>
+  <bug>246015</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-benchmarks/lmbench" auto="yes" arch="*">
+      <vulnerable range="le">3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    LMBench is a suite of simple, portable benchmarks for UNIX platforms.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dmitry E. Oboukhov reported that the rccs and STUFF scripts do not
+    handle "/tmp/sdiff.#####" temporary files securely. NOTE: There might
+    be further occurances of insecure temporary file usage.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could perform symlink attacks to overwrite arbitrary
+    files with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    LMBench has been removed from Portage. We recommend that users unmerge
+    LMBench:
+    </p>
+    <code>
+    # emerge --unmerge app-benchmarks/lmbench</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4968">CVE-2008-4968</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 10 Jul 2009 10:54:15 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 28 Aug 2009 07:58:27 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 Aug 2009 03:38:05 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-11.xml b/xml/htdocs/security/en/glsa/glsa-200909-11.xml
new file mode 100644
index 00000000..26e36b1d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-11.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-11">
+  <title>GCC-XML: Insecure temporary file usage</title>
+  <synopsis>
+    An insecure temporary file usage has been reported in GCC-XML allowing for
+    symlink attacks.
+  </synopsis>
+  <product type="ebuild">gccxml</product>
+  <announced>September 09, 2009</announced>
+  <revised>September 09, 2009: 01</revised>
+  <bug>245765</bug>
+  <access>local</access>
+  <affected>
+    <package name="dev-cpp/gccxml" auto="yes" arch="*">
+      <unaffected range="ge">0.9.0_pre20090516</unaffected>
+      <vulnerable range="lt">0.9.0_pre20090516</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GCC-XML is an XML output extension to the C++ front-end of GCC.
+    </p>
+  </background>
+  <description>
+    <p>
+    Dmitry E. Oboukhov reported that find_flags in GCC-XML does not handle
+    "/tmp/*.cxx" temporary files securely.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could perform symlink attacks to overwrite arbitrary
+    files with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GCC-XML users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-cpp/gccxml-0.9.0_pre20090516&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4957">CVE-2008-4957</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 25 May 2009 20:39:27 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 28 Aug 2009 08:04:45 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 Aug 2009 03:38:17 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-12.xml b/xml/htdocs/security/en/glsa/glsa-200909-12.xml
new file mode 100644
index 00000000..d0575495
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-12.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-12">
+  <title>HTMLDOC: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple insecure calls to the sscanf() function in HTMLDOC might result in
+    the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">htmldoc</product>
+  <announced>September 12, 2009</announced>
+  <revised>September 12, 2009: 01</revised>
+  <bug>278186</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/htmldoc" auto="yes" arch="*">
+      <unaffected range="ge">1.8.27-r1</unaffected>
+      <vulnerable range="lt">1.8.27-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    HTMLDOC is a HTML indexer and HTML to PS and PDF converter.
+    </p>
+  </background>
+  <description>
+    <p>
+    ANTHRAX666 reported an insecure call to the sscanf() function in the
+    set_page_size() function in htmldoc/util.cxx. Nico Golde of the Debian
+    Security Team found two more insecure calls in the write_type1()
+    function in htmldoc/ps-pdf.cxx and the htmlLoadFontWidths() function in
+    htmldoc/htmllib.cxx.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to process a specially crafted
+    HTML file using htmldoc, possibly resulting in the execution of
+    arbitrary code with the privileges of the user running the application.
+    NOTE: Additional vectors via specially crafted AFM font metric files do
+    not cross trust boundaries, as the files can only be modified by
+    privileged users.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All HTMLDOC users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/htmldoc-1.8.27-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3050">CVE-2009-3050</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 26 Aug 2009 18:35:26 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 26 Aug 2009 18:45:17 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 06 Sep 2009 09:53:24 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-13.xml b/xml/htdocs/security/en/glsa/glsa-200909-13.xml
new file mode 100644
index 00000000..36414faf
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-13.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-13">
+  <title>irssi: Execution of arbitrary code</title>
+  <synopsis>
+    A remotely exploitable off-by-one error leading to a heap overflow was
+    found in irssi which might result in the execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">irssi</product>
+  <announced>September 12, 2009</announced>
+  <revised>September 12, 2009: 01</revised>
+  <bug>271875</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-irc/irssi" auto="yes" arch="*">
+      <unaffected range="ge">0.8.13-r1</unaffected>
+      <vulnerable range="lt">0.8.13-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    irssi is a modular textUI IRC client with IPv6 support.
+    </p>
+  </background>
+  <description>
+    <p>
+    Nemo discovered an off-by-one error leading to a heap overflow in
+    irssi's event_wallops() parsing function.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker might entice a user to connect to a malicious IRC
+    server, use a man-in-the-middle attack to redirect a user to such a
+    server or use ircop rights to send a specially crafted WALLOPS message,
+    which might result in the execution of arbitrary code with the
+    privileges of the user running irssi.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All irssi users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-irc/irssi-0.8.13-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1959">CVE-2009-1959</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 10 Jun 2009 19:45:21 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 02 Jul 2009 19:15:53 +0000">
+    craig
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 12 Sep 2009 16:10:35 +0000">
+    craig
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-14.xml b/xml/htdocs/security/en/glsa/glsa-200909-14.xml
new file mode 100644
index 00000000..4025274f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-14.xml
@@ -0,0 +1,115 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-14">
+  <title>Horde: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Horde and two modules,
+    allowing for the execution of arbitrary code, information disclosure, or
+    Cross-Site Scripting.
+  </synopsis>
+  <product type="ebuild">horde horde-imp horde-passwd</product>
+  <announced>September 12, 2009</announced>
+  <revised>September 12, 2009: 01</revised>
+  <bug>256125</bug>
+  <bug>262976</bug>
+  <bug>262978</bug>
+  <bug>277294</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/horde" auto="yes" arch="*">
+      <unaffected range="ge">3.3.4</unaffected>
+      <vulnerable range="lt">3.3.4</vulnerable>
+    </package>
+    <package name="www-apps/horde-imp" auto="yes" arch="*">
+      <unaffected range="ge">4.3.4</unaffected>
+      <vulnerable range="lt">4.3.4</vulnerable>
+    </package>
+    <package name="www-apps/horde-passwd" auto="yes" arch="*">
+      <unaffected range="ge">3.1.1</unaffected>
+      <vulnerable range="lt">3.1.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Horde is a web application framework written in PHP. Horde IMP, the
+    "Internet Messaging Program", is a Webmail module and Horde Passwd is a
+    password changing module for Horde.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in Horde:
+    </p>
+    <ul>
+    <li>Gunnar Wrobel reported an input sanitation and directory traversal
+    flaw in framework/Image/Image.php, related to the "Horde_Image driver
+    name" (CVE-2009-0932).</li>
+    <li>Gunnar Wrobel reported that data sent
+    to horde/services/portal/cloud_search.php is not properly sanitized
+    before used in the output (CVE-2009-0931).</li>
+    <li>It was reported
+    that data sent to framework/Text_Filter/Filter/xss.php is not properly
+    sanitized before used in the output (CVE-2008-5917).</li>
+    </ul> <p>
+    Horde Passwd: David Wharton reported that data sent via the "backend"
+    parameter to passwd/main.php is not properly sanitized before used in
+    the output (CVE-2009-2360).
+    </p>
+    <p>
+    Horde IMP: Gunnar Wrobel reported that data sent to smime.php, pgp.php,
+    and message.php is not properly sanitized before used in the output
+    (CVE-2009-0930).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote authenticated attacker could exploit these vulnerabilities to
+    execute arbitrary PHP files on the server, or disclose the content of
+    arbitrary files, both only if the file is readable to the web server. A
+    remote authenticated attacker could conduct Cross-Site Scripting
+    attacks. NOTE: Some Cross-Site Scripting vectors are limited to the
+    usage of Microsoft Internet Explorer.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Horde users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-3.3.4&quot;</code>
+    <p>
+    All Horde IMP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-imp-4.3.4&quot;</code>
+    <p>
+    All Horde Passwd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-passwd-3.1.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5917">CVE-2008-5917</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0930">CVE-2009-0930</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0931">CVE-2009-0931</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0932">CVE-2009-0932</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2360">CVE-2009-2360</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Wed, 02 Sep 2009 04:40:46 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 02 Sep 2009 04:40:52 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-15.xml b/xml/htdocs/security/en/glsa/glsa-200909-15.xml
new file mode 100644
index 00000000..80ad0184
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-15.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-15">
+  <title>Lynx: Arbitrary command execution</title>
+  <synopsis>
+    An incomplete fix for an issue related to the Lynx URL handler might allow
+    for the remote execution of arbitrary commands.
+  </synopsis>
+  <product type="ebuild">lynx</product>
+  <announced>September 12, 2009</announced>
+  <revised>September 12, 2009: 01</revised>
+  <bug>243058</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-client/lynx" auto="yes" arch="*">
+      <unaffected range="ge">2.8.6-r4</unaffected>
+      <vulnerable range="lt">2.8.6-r4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Lynx is a fully-featured WWW client for users running
+    cursor-addressable, character-cell display devices such as vt100
+    terminals and terminal emulators.
+    </p>
+  </background>
+  <description>
+    <p>
+    Clint Ruoho reported that the fix for CVE-2005-2929 (GLSA 200511-09)
+    only disabled the lynxcgi:// handler when not using the advanced mode.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker can entice a user to access a malicious HTTP server,
+    causing Lynx to execute arbitrary commands. NOTE: The advanced mode is
+    not enabled by default. Successful exploitation requires the
+    "lynxcgi://" protocol to be registered with lynx on the victim's
+    system.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Lynx users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-client/lynx-2.8.6-r4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2929">CVE-2005-2929</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4690">CVE-2008-4690</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200511-09.xml">GLSA 200511-09</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 07 Aug 2009 11:47:31 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 28 Aug 2009 08:16:43 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 Aug 2009 03:37:19 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-16.xml b/xml/htdocs/security/en/glsa/glsa-200909-16.xml
new file mode 100644
index 00000000..c50c13ad
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-16.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-16">
+  <title>Wireshark: Denial of Service</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Wireshark which allow for
+    Denial of Service.
+  </synopsis>
+  <product type="ebuild">wireshark</product>
+  <announced>September 13, 2009</announced>
+  <revised>September 13, 2009: 01</revised>
+  <bug>278564</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/wireshark" auto="yes" arch="*">
+      <unaffected range="ge">1.2.1</unaffected>
+      <vulnerable range="lt">1.2.1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Wireshark is a versatile network protocol analyzer.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities were discovered in Wireshark:
+    </p>
+    <ul>
+    <li>A
+    buffer overflow in the IPMI dissector related to an array index error
+    (CVE-2009-2559).</li>
+    <li>Multiple unspecified vulnerabilities in the
+    Bluetooth L2CAP, RADIUS, and MIOP dissectors (CVE-2009-2560).</li>
+    <li>An unspecified vulnerability in the sFlow dissector
+    (CVE-2009-2561).</li>
+    <li>An unspecified vulnerability in the AFS
+    dissector (CVE-2009-2562).</li>
+    <li>An unspecified vulnerability in the
+    Infiniband dissector when running on unspecified platforms
+    (CVE-2009-2563).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities by sending
+    specially crafted packets on a network being monitored by Wireshark or
+    by enticing a user to read a malformed packet trace file to cause a
+    Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Wireshark users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/wireshark-1.2.1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2559">CVE-2009-2559</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2560">CVE-2009-2560</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2561">CVE-2009-2561</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2562">CVE-2009-2562</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2563">CVE-2009-2563</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 25 Aug 2009 10:03:54 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 25 Aug 2009 13:10:41 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 25 Aug 2009 13:28:12 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-17.xml b/xml/htdocs/security/en/glsa/glsa-200909-17.xml
new file mode 100644
index 00000000..400d7d8b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-17.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-17">
+  <title>ZNC: Directory traversal</title>
+  <synopsis>
+    A directory traversal was found in ZNC, allowing for overwriting of
+    arbitrary files.
+  </synopsis>
+  <product type="ebuild">znc</product>
+  <announced>September 13, 2009</announced>
+  <revised>September 13, 2009: 01</revised>
+  <bug>278684</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-irc/znc" auto="yes" arch="*">
+      <unaffected range="ge">0.074</unaffected>
+      <vulnerable range="lt">0.074</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ZNC is an advanced IRC bouncer.
+    </p>
+  </background>
+  <description>
+    <p>
+    The vendor reported a directory traversal vulnerability when processing
+    DCC SEND requests.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote, authenticated user could send a specially crafted DCC SEND
+    request to overwrite arbitrary files with the privileges of the user
+    running ZNC, and possibly cause the execution of arbitrary code e.g. by
+    uploading a malicious ZNC module.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ZNC users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-irc/znc-0.074&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2658">CVE-2009-2658</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 14 Aug 2009 18:19:47 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 14 Aug 2009 18:28:31 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 Aug 2009 08:50:23 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-18.xml b/xml/htdocs/security/en/glsa/glsa-200909-18.xml
new file mode 100644
index 00000000..5ecfc534
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-18.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-18">
+  <title>nginx: Remote execution of arbitrary code</title>
+  <synopsis>
+    A buffer underflow vulnerability in the request URI processing of nginx
+    might enable remote attackers to execute arbitrary code or cause a Denial
+    of Service.
+  </synopsis>
+  <product type="ebuild">nginx</product>
+  <announced>September 18, 2009</announced>
+  <revised>September 18, 2009: 01</revised>
+  <bug>285162</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/nginx" auto="yes" arch="*">
+      <unaffected range="rge">0.5.38</unaffected>
+      <unaffected range="rge">0.6.39</unaffected>
+      <unaffected range="ge">0.7.62</unaffected>
+      <vulnerable range="lt">0.7.62</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    nginx is a robust, small and high performance HTTP and reverse proxy
+    server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Chris Ries reported a heap-based buffer underflow in the
+    ngx_http_parse_complex_uri() function in http/ngx_http_parse.c when
+    parsing the request URI.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker might send a specially crafted request URI to a nginx
+    server, possibly resulting in the remote execution of arbitrary code
+    with the privileges of the user running the server, or a Denial of
+    Service. NOTE: By default, nginx runs as the "nginx" user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All nginx 0.5.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/nginx-0.5.38&quot;</code>
+    <p>
+    All nginx 0.6.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/nginx-0.6.39&quot;</code>
+    <p>
+    All nginx 0.7.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/nginx-0.7.62&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2629">CVE-2009-2629</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 14 Sep 2009 19:21:09 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 14 Sep 2009 19:51:52 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 18 Sep 2009 19:40:49 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-19.xml b/xml/htdocs/security/en/glsa/glsa-200909-19.xml
new file mode 100644
index 00000000..96207670
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-19.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-19">
+  <title>Dnsmasq: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Dnsmasq might result in the remote execution of
+    arbitrary code, or a Denial of Service.
+  </synopsis>
+  <product type="ebuild">dnsmasq</product>
+  <announced>September 20, 2009</announced>
+  <revised>September 20, 2009: 01</revised>
+  <bug>282653</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/dnsmasq" auto="yes" arch="*">
+      <unaffected range="ge">2.5.0</unaffected>
+      <vulnerable range="lt">2.5.0</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Dnsmasq is a lightweight, easy to configure DNS forwarder and DHCP
+    server. It includes support for Trivial FTP (TFTP).
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in the TFTP functionality
+    included in Dnsmasq:
+    </p>
+    <ul>
+    <li>Pablo Jorge and Alberto Solino
+    discovered a heap-based buffer overflow (CVE-2009-2957).</li>
+    <li>An
+    anonymous researcher reported a NULL pointer reference
+    (CVE-2009-2958).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker in the local network could exploit these
+    vulnerabilities by sending specially crafted TFTP requests to a machine
+    running Dnsmasq, possibly resulting in the remote execution of
+    arbitrary code with the privileges of the user running the daemon, or a
+    Denial of Service. NOTE: The TFTP server is not enabled by default.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    You can disable the TFTP server either at buildtime by not enabling the
+    "tftp" USE flag, or at runtime. Make sure "--enable-tftp" is not set in
+    the DNSMASQ_OPTS variable in the /etc/conf.d/dnsmasq file and
+    "enable-tftp" is not set in /etc/dnsmasq.conf, either of which would
+    enable TFTP support if it is compiled in.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Dnsmasq users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/dnsmasq-2.5.0&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2957">CVE-2009-2957</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2958">CVE-2009-2958</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 01 Sep 2009 10:28:12 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 20 Sep 2009 18:56:49 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200909-20.xml b/xml/htdocs/security/en/glsa/glsa-200909-20.xml
new file mode 100644
index 00000000..01bdfe91
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200909-20.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200909-20">
+  <title>cURL: Certificate validation error</title>
+  <synopsis>
+    An error in the X.509 certificate handling of cURL might enable remote
+    attackers to conduct man-in-the-middle attacks.
+  </synopsis>
+  <product type="ebuild">curl</product>
+  <announced>September 25, 2009</announced>
+  <revised>September 25, 2009: 01</revised>
+  <bug>281515</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/curl" auto="yes" arch="*">
+      <unaffected range="ge">7.19.6</unaffected>
+      <vulnerable range="lt">7.19.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    cURL is a command line tool for transferring files with URL syntax,
+    supporting numerous protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    Scott Cantor reported that cURL does not properly handle fields in
+    X.509 certificates that contain an ASCII NUL (\0) character.
+    Specifically, the processing of such fields is stopped at the first
+    occurence of a NUL character. This type of vulnerability was recently
+    discovered by Dan Kaminsky and Moxie Marlinspike.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker might employ a specially crafted X.509 certificate
+    (that for instance contains a NUL character in the Common Name field)
+    to conduct man-in-the-middle attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All cURL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/curl-7.19.6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2417">CVE-2009-2417</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 13 Sep 2009 18:08:24 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 14 Sep 2009 12:08:01 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 25 Sep 2009 18:22:08 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200910-01.xml b/xml/htdocs/security/en/glsa/glsa-200910-01.xml
new file mode 100644
index 00000000..d3f4428e
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200910-01.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200910-01">
+  <title>Wget: Certificate validation error</title>
+  <synopsis>
+    An error in the X.509 certificate handling of Wget might enable remote
+    attackers to conduct man-in-the-middle attacks.
+  </synopsis>
+  <product type="ebuild">wget</product>
+  <announced>October 20, 2009</announced>
+  <revised>October 20, 2009: 01</revised>
+  <bug>286058</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/wget" auto="yes" arch="*">
+      <unaffected range="ge">1.12</unaffected>
+      <vulnerable range="lt">1.12</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GNU Wget is a free software package for retrieving files using HTTP,
+    HTTPS and FTP, the most widely-used Internet protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    The vendor reported that Wget does not properly handle Common Name (CN)
+    fields in X.509 certificates that contain an ASCII NUL (\0) character.
+    Specifically, the processing of such fields is stopped at the first
+    occurrence of a NUL character. This type of vulnerability was recently
+    discovered by Dan Kaminsky and Moxie Marlinspike.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker might employ a specially crafted X.509 certificate,
+    containing a NUL character in the Common Name field to conduct
+    man-in-the-middle attacks on SSL connections made using Wget.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Wget users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/wget-1.12&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3490">CVE-2009-3490</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 07 Oct 2009 19:10:37 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 07 Oct 2009 19:14:43 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 20 Oct 2009 19:38:52 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200910-02.xml b/xml/htdocs/security/en/glsa/glsa-200910-02.xml
new file mode 100644
index 00000000..730e83c8
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200910-02.xml
@@ -0,0 +1,92 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200910-02">
+  <title>Pidgin: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Pidgin, leading to the
+    remote execution of arbitrary code, unauthorized information disclosure, or
+    Denial of Service.
+  </synopsis>
+  <product type="ebuild">pidgin</product>
+  <announced>October 22, 2009</announced>
+  <revised>October 22, 2009: 01</revised>
+  <bug>276000</bug>
+  <bug>281545</bug>
+  <bug>283324</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/pidgin" auto="yes" arch="*">
+      <unaffected range="ge">2.5.9-r1</unaffected>
+      <vulnerable range="lt">2.5.9-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Pidgin is a client for a variety of instant messaging protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities were found in Pidgin:
+    </p>
+    <ul>
+    <li>Yuriy
+    Kaminskiy reported that the OSCAR protocol implementation in Pidgin
+    misinterprets the ICQWebMessage message type as the ICQSMS message
+    type, triggering an allocation of a large amount of memory
+    (CVE-2009-1889).</li>
+    <li>Federico Muttis of Core Security Technologies
+    reported that the msn_slplink_process_msg() function in
+    libpurple/protocols/msn/slplink.c in libpurple as used in Pidgin
+    doesn't properly process incoming SLP messages, triggering an overwrite
+    of an arbitrary memory location (CVE-2009-2694). NOTE: This issue
+    reportedly exists because of an incomplete fix for CVE-2009-1376 (GLSA
+    200905-07).</li>
+    <li>bugdave reported that protocols/jabber/auth.c in
+    libpurple as used in Pidgin does not follow the "require TSL/SSL"
+    preference when connecting to older Jabber servers that do not follow
+    the XMPP specification, resulting in a connection to the server without
+    the expected encryption (CVE-2009-3026).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send specially crafted SLP (via MSN) or ICQ web
+    messages, possibly leading to execution of arbitrary code with the
+    privileges of the user running Pidgin, unauthorized information
+    disclosure, or a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Pidgin users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/pidgin-2.5.9-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1376">CVE-2009-1376</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1889">CVE-2009-1889</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2694">CVE-2009-2694</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3026">CVE-2009-3026</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200905-07.xml">GLSA 200905-07</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 31 Aug 2009 02:16:12 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 31 Aug 2009 07:10:07 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 22 Oct 2009 19:06:35 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200910-03.xml b/xml/htdocs/security/en/glsa/glsa-200910-03.xml
new file mode 100644
index 00000000..e97184cb
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200910-03.xml
@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200910-03">
+  <title>Adobe Reader: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Adobe Reader might result in the execution of
+    arbitrary code, or other attacks.
+  </synopsis>
+  <product type="ebuild">acroread</product>
+  <announced>October 25, 2009</announced>
+  <revised>October 25, 2009: 01</revised>
+  <bug>289016</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-text/acroread" auto="yes" arch="*">
+      <unaffected range="ge">9.2</unaffected>
+      <vulnerable range="lt">9.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Adobe Reader (formerly Adobe Acrobat Reader) is a closed-source PDF
+    reader.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities were discovered in Adobe Reader. For further
+    information please consult the CVE entries and the Adobe Security
+    Bulletin referenced below.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker might entice a user to open a specially crafted PDF
+    file, possibly resulting in the execution of arbitrary code with the
+    privileges of the user running the application, Denial of Service, the
+    creation of arbitrary files on the victim's system, "Trust Manager"
+    bypass, or social engineering attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Adobe Reader users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/acroread-9.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.adobe.com/support/security/bulletins/apsb09-15.html">APSB09-15</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0045">CVE-2007-0045</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0048">CVE-2007-0048</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2979">CVE-2009-2979</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2980">CVE-2009-2980</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2981">CVE-2009-2981</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2982">CVE-2009-2982</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2983">CVE-2009-2983</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2985">CVE-2009-2985</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2986">CVE-2009-2986</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2988">CVE-2009-2988</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2990">CVE-2009-2990</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2991">CVE-2009-2991</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2993">CVE-2009-2993</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2994">CVE-2009-2994</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2996">CVE-2009-2996</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2997">CVE-2009-2997</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2998">CVE-2009-2998</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3431">CVE-2009-3431</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3458">CVE-2009-3458</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3459">CVE-2009-3459</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3462">CVE-2009-3462</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 24 Oct 2009 18:48:21 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sat, 24 Oct 2009 23:09:06 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 24 Oct 2009 23:09:17 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200911-01.xml b/xml/htdocs/security/en/glsa/glsa-200911-01.xml
new file mode 100644
index 00000000..869fe1c0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200911-01.xml
@@ -0,0 +1,96 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200911-01">
+  <title>Horde: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in the Horde Application Framework can allow for
+    arbitrary files to be overwritten and cross-site scripting attacks.
+  </synopsis>
+  <product type="ebuild">horde horde-webmail horde-groupware</product>
+  <announced>November 06, 2009</announced>
+  <revised>November 06, 2009: 01</revised>
+  <bug>285052</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/horde" auto="yes" arch="*">
+      <unaffected range="ge">3.3.5</unaffected>
+      <vulnerable range="lt">3.3.5</vulnerable>
+    </package>
+    <package name="www-apps/horde-webmail" auto="yes" arch="*">
+      <unaffected range="ge">1.2.4</unaffected>
+      <vulnerable range="lt">1.2.4</vulnerable>
+    </package>
+    <package name="www-apps/horde-groupware" auto="yes" arch="*">
+      <unaffected range="ge">1.2.4</unaffected>
+      <vulnerable range="lt">1.2.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Horde is a web application framework written in PHP.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in Horde:
+    </p>
+    <ul>
+    <li>Stefan Esser of Sektion1 reported an error within the form library
+    when handling image form fields (CVE-2009-3236).</li>
+    <li>Martin
+    Geisler and David Wharton reported that an error exists in the MIME
+    viewer library when viewing unknown text parts and the preferences
+    system in services/prefs.php when handling number preferences
+    (CVE-2009-3237).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote authenticated attacker could exploit these vulnerabilities to
+    overwrite arbitrary files on the server, provided that the user has
+    write permissions. A remote authenticated attacker could conduct
+    Cross-Site Scripting attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Horde users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-3.3.5&quot;</code>
+    <p>
+    All Horde webmail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-webmail-1.2.4&quot;</code>
+    <p>
+    All Horde groupware users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-groupware-1.2.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3236">CVE-2009-3236</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3237">CVE-2009-3237</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 20 Oct 2009 19:14:03 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 28 Oct 2009 17:35:14 +0000">
+    chainsaw
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 06 Nov 2009 12:02:09 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200911-02.xml b/xml/htdocs/security/en/glsa/glsa-200911-02.xml
new file mode 100644
index 00000000..e7ed9d7a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200911-02.xml
@@ -0,0 +1,240 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200911-02">
+  <title>Sun JDK/JRE: Multiple vulnerabilites</title>
+  <synopsis>
+    Multiple vulnerabilites in the Sun JDK and JRE allow for several attacks,
+    including the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">sun-jre-bin sun-jdk emul-linux-x86-java blackdown-jre blackdown-jdk</product>
+  <announced>November 17, 2009</announced>
+  <revised>November 17, 2009: 01</revised>
+  <bug>182824</bug>
+  <bug>231337</bug>
+  <bug>250012</bug>
+  <bug>263810</bug>
+  <bug>280409</bug>
+  <bug>291817</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/sun-jre-bin" auto="yes" arch="*">
+      <unaffected range="rge">1.5.0.22</unaffected>
+      <unaffected range="ge">1.6.0.17</unaffected>
+      <vulnerable range="lt">1.6.0.17</vulnerable>
+    </package>
+    <package name="dev-java/sun-jdk" auto="yes" arch="*">
+      <unaffected range="rge">1.5.0.22</unaffected>
+      <unaffected range="ge">1.6.0.17</unaffected>
+      <vulnerable range="lt">1.6.0.17</vulnerable>
+    </package>
+    <package name="dev-java/blackdown-jre" auto="yes" arch="*">
+      <vulnerable range="le">1.4.2.03-r14</vulnerable>
+    </package>
+    <package name="dev-java/blackdown-jdk" auto="yes" arch="*">
+      <vulnerable range="le">1.4.2.03-r16</vulnerable>
+    </package>
+    <package name="app-emulation/emul-linux-x86-java" auto="yes" arch="*">
+      <unaffected range="rge">1.5.0.22</unaffected>
+      <unaffected range="ge">1.6.0.17</unaffected>
+      <vulnerable range="lt">1.6.0.17</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Sun Java Development Kit (JDK) and the Sun Java Runtime Environment
+    (JRE) provide the Sun Java platform.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilites have been reported in the Sun Java
+    implementation. Please review the CVE identifiers referenced below and
+    the associated Sun Alerts for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted JAR
+    archive, applet, or Java Web Start application, possibly resulting in
+    the execution of arbitrary code with the privileges of the user running
+    the application. Furthermore, a remote attacker could cause a Denial of
+    Service affecting multiple services via several vectors, disclose
+    information and memory contents, write or execute local files, conduct
+    session hijacking attacks via GIFAR files, steal cookies, bypass the
+    same-origin policy, load untrusted JAR files, establish network
+    connections to arbitrary hosts and posts via several vectors, modify
+    the list of supported graphics configurations, bypass HMAC-based
+    authentication systems, escalate privileges via several vectors and
+    cause applet code to be executed with older, possibly vulnerable
+    versions of the JRE.
+    </p>
+    <p>
+    NOTE: Some vulnerabilities require a trusted environment, user
+    interaction, a DNS Man-in-the-Middle or Cross-Site-Scripting attack.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Sun JRE 1.5.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jre-bin-1.5.0.22&quot;</code>
+    <p>
+    All Sun JRE 1.6.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jre-bin-1.6.0.17&quot;</code>
+    <p>
+    All Sun JDK 1.5.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jdk-1.5.0.22&quot;</code>
+    <p>
+    All Sun JDK 1.6.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jdk-1.6.0.17&quot;</code>
+    <p>
+    All users of the precompiled 32bit Sun JRE 1.5.x should upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/emul-linux-x86-java-1.5.0.22&quot;</code>
+    <p>
+    All users of the precompiled 32bit Sun JRE 1.6.x should upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/emul-linux-x86-java-1.6.0.17&quot;</code>
+    <p>
+    All Sun JRE 1.4.x, Sun JDK 1.4.x, Blackdown JRE, Blackdown JDK and
+    precompiled 32bit Sun JRE 1.4.x users are strongly advised to unmerge
+    Java 1.4:
+    </p>
+    <code>
+    # emerge --unmerge =app-emulation/emul-linux-x86-java-1.4*
+    # emerge --unmerge =dev-java/sun-jre-bin-1.4*
+    # emerge --unmerge =dev-java/sun-jdk-1.4*
+    # emerge --unmerge dev-java/blackdown-jdk
+    # emerge --unmerge dev-java/blackdown-jre</code>
+    <p>
+    Gentoo is ceasing support for the 1.4 generation of the Sun Java
+    Platform in accordance with upstream. All 1.4 JRE and JDK versions are
+    masked and will be removed shortly.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2086">CVE-2008-2086</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3103">CVE-2008-3103</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3104">CVE-2008-3104</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3105">CVE-2008-3105</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3106">CVE-2008-3106</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3107">CVE-2008-3107</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3108">CVE-2008-3108</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3109">CVE-2008-3109</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3110">CVE-2008-3110</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3111">CVE-2008-3111</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3112">CVE-2008-3112</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3113">CVE-2008-3113</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3114">CVE-2008-3114</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3115">CVE-2008-3115</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5339">CVE-2008-5339</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5340">CVE-2008-5340</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5341">CVE-2008-5341</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5342">CVE-2008-5342</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5343">CVE-2008-5343</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5344">CVE-2008-5344</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5345">CVE-2008-5345</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5346">CVE-2008-5346</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5347">CVE-2008-5347</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5348">CVE-2008-5348</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5349">CVE-2008-5349</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5350">CVE-2008-5350</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5351">CVE-2008-5351</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5352">CVE-2008-5352</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5353">CVE-2008-5353</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5354">CVE-2008-5354</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5355">CVE-2008-5355</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5356">CVE-2008-5356</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5357">CVE-2008-5357</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5358">CVE-2008-5358</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5359">CVE-2008-5359</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5360">CVE-2008-5360</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1093">CVE-2009-1093</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1094">CVE-2009-1094</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1095">CVE-2009-1095</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1096">CVE-2009-1096</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1097">CVE-2009-1097</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1098">CVE-2009-1098</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1099">CVE-2009-1099</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1100">CVE-2009-1100</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1101">CVE-2009-1101</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1102">CVE-2009-1102</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1103">CVE-2009-1103</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1104">CVE-2009-1104</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1105">CVE-2009-1105</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1106">CVE-2009-1106</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1107">CVE-2009-1107</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2409">CVE-2009-2409</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2475">CVE-2009-2475</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2476">CVE-2009-2476</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2670">CVE-2009-2670</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2671">CVE-2009-2671</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2672">CVE-2009-2672</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2673">CVE-2009-2673</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2674">CVE-2009-2674</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2675">CVE-2009-2675</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2676">CVE-2009-2676</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2689">CVE-2009-2689</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2690">CVE-2009-2690</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2716">CVE-2009-2716</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2718">CVE-2009-2718</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2719">CVE-2009-2719</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2720">CVE-2009-2720</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2721">CVE-2009-2721</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2722">CVE-2009-2722</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2723">CVE-2009-2723</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2724">CVE-2009-2724</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3728">CVE-2009-3728</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3729">CVE-2009-3729</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3865">CVE-2009-3865</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3866">CVE-2009-3866</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3867">CVE-2009-3867</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3868">CVE-2009-3868</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3869">CVE-2009-3869</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3871">CVE-2009-3871</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3872">CVE-2009-3872</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3873">CVE-2009-3873</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3874">CVE-2009-3874</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3875">CVE-2009-3875</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3876">CVE-2009-3876</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3877">CVE-2009-3877</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3879">CVE-2009-3879</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3880">CVE-2009-3880</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3881">CVE-2009-3881</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3882">CVE-2009-3882</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3883">CVE-2009-3883</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3884">CVE-2009-3884</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3886">CVE-2009-3886</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 07 Apr 2009 06:55:57 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 17 Nov 2009 19:42:31 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200911-03.xml b/xml/htdocs/security/en/glsa/glsa-200911-03.xml
new file mode 100644
index 00000000..06c25cff
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200911-03.xml
@@ -0,0 +1,99 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200911-03">
+  <title>UW IMAP toolkit: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been found in the UW IMAP toolkit and the
+    c-client library, the worst of which leading to the execution of arbitrary
+    code.
+  </synopsis>
+  <product type="ebuild">c-client uw-imap</product>
+  <announced>November 25, 2009</announced>
+  <revised>November 25, 2009: 01</revised>
+  <bug>245425</bug>
+  <bug>252567</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-libs/c-client" auto="yes" arch="*">
+      <unaffected range="ge">2007e</unaffected>
+      <vulnerable range="lt">2007e</vulnerable>
+    </package>
+    <package name="net-mail/uw-imap" auto="yes" arch="*">
+      <unaffected range="ge">2007e</unaffected>
+      <vulnerable range="lt">2007e</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The UW IMAP toolkit is a daemon for the IMAP and POP3 network mail
+    protocols. The c-client library provides an API for IMAP, POP3 and
+    other protocols.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities were found in the UW IMAP toolkit:
+    </p>
+    <ul>
+    <li>Aron Andersson and Jan Sahlin of Bitsec reported boundary errors in
+    the "tmail" and "dmail" utilities when processing overly long mailbox
+    names, leading to stack-based buffer overflows (CVE-2008-5005).</li>
+    <li>An error in smtp.c in the c-client library was found, leading to a
+    NULL pointer dereference vulnerability (CVE-2008-5006).</li>
+    <li>Ludwig
+    Nussel reported an off-by-one error in the rfc822_output_char()
+    function in the RFC822BUFFER routines in the c-client library, as used
+    by the UW IMAP toolkit (CVE-2008-5514).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could send an e-mail to a destination mailbox name
+    composed of a username and '+' character followed by a long string,
+    possibly leading to the execution of arbitrary code. A local attacker
+    could gain privileges by specifying a long folder extension argument to
+    the tmail or dmail program. Furthermore, a remote attacker could send a
+    specially crafted mail message to the UW IMAP toolkit or another daemon
+    using the c-client library, leading to a Denial of Service. A remote
+    SMTP server could respond to the QUIT command with a close of the TCP
+    connection instead of the expected 221 response code, possibly leading
+    to a Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All c-client library users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/c-client-2007e&quot;</code>
+    <p>
+    All UW IMAP toolkit users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/uw-imap-2007e&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5005">CVE-2008-5005</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5006">CVE-2008-5006</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5514">CVE-2008-5514</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 13 Jan 2009 17:17:18 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 13 Jan 2009 17:27:25 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 25 Nov 2009 13:23:47 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200911-04.xml b/xml/htdocs/security/en/glsa/glsa-200911-04.xml
new file mode 100644
index 00000000..46bdc39c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200911-04.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200911-04">
+  <title>dstat: Untrusted search path</title>
+  <synopsis>
+    An untrusted search path vulnerability in the dstat might result in the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">dstat</product>
+  <announced>November 25, 2009</announced>
+  <revised>November 25, 2009: 01</revised>
+  <bug>293497</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-apps/dstat" auto="yes" arch="*">
+      <unaffected range="ge">0.6.9-r1</unaffected>
+      <vulnerable range="lt">0.6.9-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    dstat is a versatile system resource monitor written in Python.
+    </p>
+  </background>
+  <description>
+    <p>
+    Robert Buchholz of the Gentoo Security Team reported that dstat
+    includes the current working directory and subdirectories in the Python
+    module search path (sys.path) before calling "import".
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could entice a user to run "dstat" from a directory
+    containing a specially crafted Python module, resulting in the
+    execution of arbitrary code with the privileges of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not run "dstat" from untrusted working directories.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All dstat users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/dstat-0.6.9-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3894">CVE-2009-3894</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 17 Nov 2009 12:30:20 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 17 Nov 2009 12:35:21 +0000">
+    rbu
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 25 Nov 2009 13:40:09 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200911-05.xml b/xml/htdocs/security/en/glsa/glsa-200911-05.xml
new file mode 100644
index 00000000..b594167c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200911-05.xml
@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200911-05">
+  <title>Wireshark: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Wireshark, allowing for
+    the remote execution of arbitrary code, or Denial of Service.
+  </synopsis>
+  <product type="ebuild">wireshark</product>
+  <announced>November 25, 2009</announced>
+  <revised>November 25, 2009: 01</revised>
+  <bug>285280</bug>
+  <bug>290710</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/wireshark" auto="yes" arch="*">
+      <unaffected range="ge">1.2.3</unaffected>
+      <vulnerable range="lt">1.2.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Wireshark is a versatile network protocol analyzer.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in Wireshark:
+    </p>
+    <ul><li>Ryan Giobbi reported an integer overflow in wiretap/erf.c
+    (CVE-2009-3829).</li>
+    <li>The vendor reported multiple unspecified
+    vulnerabilities in the Bluetooth L2CAP, RADIUS, and MIOP dissectors
+    (CVE-2009-2560), in the OpcUa dissector (CVE-2009-3241), in packet.c in
+    the GSM A RR dissector (CVE-2009-3242), in the TLS dissector
+    (CVE-2009-3243), in the Paltalk dissector (CVE-2009-3549), in the
+    DCERPC/NT dissector (CVE-2009-3550), and in the
+    dissect_negprot_response() function in packet-smb.c in the SMB
+    dissector (CVE-2009-3551).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted "erf"
+    file using Wireshark, possibly resulting in the execution of arbitrary
+    code with the privileges of the user running the application. A remote
+    attacker could furthermore send specially crafted packets on a network
+    being monitored by Wireshark or entice a user to open a malformed
+    packet trace file using Wireshark, possibly resulting in a Denial of
+    Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Wireshark users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/wireshark-1.2.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2560">CVE-2009-2560</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3241">CVE-2009-3241</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3242">CVE-2009-3242</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3243">CVE-2009-3243</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3549">CVE-2009-3549</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3550">CVE-2009-3550</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3551">CVE-2009-3551</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3829">CVE-2009-3829</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 04 Nov 2009 23:06:15 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 04 Nov 2009 23:24:04 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 25 Nov 2009 15:36:13 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200911-06.xml b/xml/htdocs/security/en/glsa/glsa-200911-06.xml
new file mode 100644
index 00000000..5ab8b37d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200911-06.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200911-06">
+  <title>PEAR Net_Traceroute: Command injection</title>
+  <synopsis>
+    An input sanitation error in PEAR Net_Traceroute might allow remote
+    attackers to execute arbitrary commands.
+  </synopsis>
+  <product type="ebuild">PEAR-Net_Traceroute</product>
+  <announced>November 26, 2009</announced>
+  <revised>November 26, 2009: 01</revised>
+  <bug>294264</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-php/PEAR-Net_Traceroute" auto="yes" arch="*">
+      <unaffected range="ge">0.21.2</unaffected>
+      <vulnerable range="lt">0.21.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PEAR Net_Traceroute is an OS independent wrapper class for executing
+    traceroute calls from PHP.
+    </p>
+  </background>
+  <description>
+    <p>
+    Pasquale Imperato reported that the $host parameter to the traceroute()
+    function in Traceroute.php is not properly sanitized before being
+    passed to exec().
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit this vulnerability when user input is
+    passed directly to PEAR Net_Traceroute in a PHP script, possibly
+    resulting in the remote execution of arbitrary shell commands with the
+    privileges of the user running the affected PHP script.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Ensure that all data that is passed to the traceroute() function is
+    properly shell escaped (for instance using the escapeshellcmd()
+    function).
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PEAR Net_Traceroute users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-php/PEAR-Net_Traceroute-0.21.2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4025">CVE-2009-4025</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 26 Nov 2009 07:38:17 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 26 Nov 2009 07:53:00 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 26 Nov 2009 19:14:35 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200912-01.xml b/xml/htdocs/security/en/glsa/glsa-200912-01.xml
new file mode 100644
index 00000000..b8efbb45
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200912-01.xml
@@ -0,0 +1,97 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200912-01">
+  <title>OpenSSL: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in OpenSSL might allow remote attackers to conduct
+    multiple attacks, including the injection of arbitrary data into encrypted
+    byte streams.
+  </synopsis>
+  <product type="ebuild">openssl</product>
+  <announced>December 01, 2009</announced>
+  <revised>December 02, 2009: 02</revised>
+  <bug>270305</bug>
+  <bug>280591</bug>
+  <bug>292022</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/openssl" auto="yes" arch="*">
+      <unaffected range="ge">0.9.8l-r2</unaffected>
+      <vulnerable range="lt">0.9.8l-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer
+    (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general
+    purpose cryptography library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in OpenSSL:
+    </p>
+    <ul>
+    <li>Marsh Ray of PhoneFactor and Martin Rex of SAP independently
+    reported that the TLS protocol does not properly handle session
+    renegotiation requests (CVE-2009-3555).</li>
+    <li>The MD2 hash algorithm is no longer considered to be
+    cryptographically strong, as demonstrated by Dan Kaminsky. Certificates
+    using this algorithm are no longer accepted (CVE-2009-2409).</li>
+    <li>Daniel Mentz and Robin Seggelmann reported the following
+    vulnerabilities related to DTLS: A use-after-free flaw (CVE-2009-1379)
+    and a NULL pointer dereference (CVE-2009-1387) in the
+    dtls1_retrieve_buffered_fragment() function in src/d1_both.c, multiple
+    memory leaks in the dtls1_process_out_of_seq_message() function in
+    src/d1_both.c (CVE-2009-1378), and a processing error related to a
+    large amount of DTLS records with a future epoch in the
+    dtls1_buffer_record() function in ssl/d1_pkt.c
+    (CVE-2009-1377).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote unauthenticated attacker, acting as a Man in the Middle, could
+    inject arbitrary plain text into a TLS session, possibly leading to the
+    ability to send requests as if authenticated as the victim. A remote
+    attacker could furthermore send specially crafted DTLS packages to a
+    service using OpenSSL for DTLS support, possibly resulting in a Denial
+    of Service. Also, a remote attacker might be able to create rogue
+    certificates, facilitated by a MD2 collision. NOTE: The amount of
+    computation needed for this attack is still very large.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All OpenSSL users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/openssl-0.9.8l-r2&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1377">CVE-2009-1377</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1378">CVE-2009-1378</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1379">CVE-2009-1379</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1387">CVE-2009-1387</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2409">CVE-2009-2409</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555">CVE-2009-3555</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 23 Nov 2009 21:29:47 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 30 Nov 2009 13:42:39 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 01 Dec 2009 21:28:40 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-200912-02.xml b/xml/htdocs/security/en/glsa/glsa-200912-02.xml
new file mode 100644
index 00000000..f09e90a1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-200912-02.xml
@@ -0,0 +1,118 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="200912-02">
+  <title>Ruby on Rails: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in Rails, the worst of which
+    leading to the execution of arbitrary SQL statements.
+  </synopsis>
+  <product type="ebuild">rails</product>
+  <announced>December 20, 2009</announced>
+  <revised>December 20, 2009: 01</revised>
+  <bug>200159</bug>
+  <bug>237385</bug>
+  <bug>247549</bug>
+  <bug>276279</bug>
+  <bug>283396</bug>
+  <bug>294797</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-ruby/rails" auto="yes" arch="*">
+      <unaffected range="ge">2.3.5</unaffected>
+      <unaffected range="rge">2.2.3-r1</unaffected>
+      <vulnerable range="lt">2.2.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ruby on Rails is a web-application and persistence framework.
+    </p>
+  </background>
+  <description>
+    <p>
+    The following vulnerabilities were discovered:
+    </p>
+    <ul>
+    <li>sameer
+    reported that lib/action_controller/cgi_process.rb removes the
+    :cookie_only attribute from the default session options
+    (CVE-2007-6077), due to an incomplete fix for CVE-2007-5380 (GLSA
+    200711-17).</li>
+    <li>Tobias Schlottke reported that the :limit and
+    :offset parameters of ActiveRecord::Base.find() are not properly
+    sanitized before being processed (CVE-2008-4094).</li>
+    <li>Steve from
+    Coderrr reported that the CRSF protection in protect_from_forgery()
+    does not parse the text/plain MIME format (CVE-2008-7248).</li>
+    <li>Nate reported a documentation error that leads to the assumption
+    that a block returning nil passed to
+    authenticate_or_request_with_http_digest() would deny access to the
+    requested resource (CVE-2009-2422).</li>
+    <li>Brian Mastenbrook reported
+    an input sanitation flaw, related to multibyte characters
+    (CVE-2009-3009).</li>
+    <li>Gabe da Silveira reported an input sanitation
+    flaw in the strip_tags() function (CVE-2009-4214).</li>
+    <li>Coda Hale
+    reported an information disclosure vulnerability related to HMAC
+    digests (CVE-2009-3086).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send specially crafted requests to a vulnerable
+    application, possibly leading to the execution of arbitrary SQL
+    statements or a circumvention of access control. A remote attacker
+    could also conduct session fixation attacks to hijack a user's session
+    or bypass the CSRF protection mechanism, or furthermore conduct
+    Cross-Site Scripting attacks or forge a digest via multiple attempts.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ruby on Rails 2.3.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-ruby/rails-2.3.5&quot;</code>
+    <p>
+    All Ruby on Rails 2.2.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;=dev-ruby/rails-2.2.3-r1&quot;</code>
+    <p>
+    NOTE: All applications using Ruby on Rails should also be configured to
+    use the latest version available by running "rake rails:update" inside
+    the application directory.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5380">CVE-2007-5380</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6077">CVE-2007-6077</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4094">CVE-2008-4094</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7248">CVE-2008-7248</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2422">CVE-2009-2422</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3009">CVE-2009-3009</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3086">CVE-2009-3086</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4214">CVE-2009-4214</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200711-17.xml">GLSA 200711-17</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 30 Nov 2008 18:11:48 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 11 Mar 2009 19:07:59 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 19 Mar 2009 12:17:35 +0000">
+    p-y
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201001-01.xml b/xml/htdocs/security/en/glsa/glsa-201001-01.xml
new file mode 100644
index 00000000..9063161f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201001-01.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201001-01">
+  <title>NTP: Denial of Service</title>
+  <synopsis>
+    A Denial of Service condition in ntpd can cause excessive CPU or bandwidth
+    consumption.
+  </synopsis>
+  <product type="ebuild">ntp</product>
+  <announced>January 03, 2010</announced>
+  <revised>January 03, 2010: 01</revised>
+  <bug>290881</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/ntp" auto="yes" arch="*">
+      <unaffected range="ge">4.2.4_p7-r1</unaffected>
+      <vulnerable range="lt">4.2.4_p7-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    NTP is a set of the Network Time Protocol programs.
+    </p>
+  </background>
+  <description>
+    <p>
+    Robin Park and Dmitri Vinokurov discovered that ntp_request.c in ntpd
+    does not handle MODE_PRIVATE packets correctly, causing a continuous
+    exchange of MODE_PRIVATE error responses between two NTP daemons or
+    causing high CPU load on a single host.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote, unauthenticated attacker could send a specially crafted
+    MODE_PRIVATE packet, allowing for a Denial of Service condition (CPU
+    and bandwidth consumption).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All NTP users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/ntp-4.2.4_p7-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3563">CVE-2009-3563</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 10 Dec 2009 20:02:44 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 30 Dec 2009 15:53:37 +0000">
+    craig
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 03 Jan 2010 00:05:58 +0000">
+    craig
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201001-02.xml b/xml/htdocs/security/en/glsa/glsa-201001-02.xml
new file mode 100644
index 00000000..4d68d073
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201001-02.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201001-02">
+  <title>Adobe Flash Player: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Adobe Flash Player might allow remote attackers
+    to execute arbitrary code or cause a Denial of Service.
+  </synopsis>
+  <product type="ebuild">adobe-flash</product>
+  <announced>January 03, 2010</announced>
+  <revised>January 03, 2010: 01</revised>
+  <bug>296407</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-plugins/adobe-flash" auto="yes" arch="*">
+      <unaffected range="ge">10.0.42.34</unaffected>
+      <vulnerable range="lt">10.0.42.34</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Adobe Flash Player is a renderer for the SWF file format, which is
+    commonly used to provide interactive websites.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in Adobe Flash Player:
+    </p>
+    <ul><li>An anonymous researcher working with the Zero Day
+    Initiative reported that Adobe Flash Player does not properly process
+    JPEG files (CVE-2009-3794).</li>
+    <li>Jim Cheng of EffectiveUI reported
+    an unspecified data injection vulnerability (CVE-2009-3796).</li>
+    <li>Bing Liu of Fortinet's FortiGuard Labs reported multiple
+    unspecified memory corruption vulnerabilities (CVE-2009-3797,
+    CVE-2009-3798).</li>
+    <li>Damian Put reported an integer overflow in the
+    Verifier::parseExceptionHandlers() function (CVE-2009-3799).</li>
+    <li>Will Dormann of CERT reported multiple unspecified Denial of
+    Service vulnerabilities (CVE-2009-3800).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted SWF
+    file, possibly resulting in the remote execution of arbitrary code with
+    the privileges of the user running the application, or a Denial of
+    Service via unknown vectors.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Adobe Flash Player users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-plugins/adobe-flash-10.0.42.34&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3794">CVE-2009-3794</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3796">CVE-2009-3796</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3797">CVE-2009-3797</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3798">CVE-2009-3798</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3799">CVE-2009-3799</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3800">CVE-2009-3800</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 18 Dec 2009 01:11:11 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 31 Dec 2009 14:21:28 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 03 Jan 2010 17:18:41 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201001-03.xml b/xml/htdocs/security/en/glsa/glsa-201001-03.xml
new file mode 100644
index 00000000..09e9ee24
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201001-03.xml
@@ -0,0 +1,118 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201001-03">
+  <title>PHP: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities were found in PHP, the worst of which leading to
+    the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">php</product>
+  <announced>January 05, 2010</announced>
+  <revised>January 05, 2010: 01</revised>
+  <bug>249875</bug>
+  <bug>255121</bug>
+  <bug>260576</bug>
+  <bug>261192</bug>
+  <bug>266125</bug>
+  <bug>274670</bug>
+  <bug>280602</bug>
+  <bug>285434</bug>
+  <bug>292132</bug>
+  <bug>293888</bug>
+  <bug>297369</bug>
+  <bug>297370</bug>
+  <access>local remote</access>
+  <affected>
+    <package name="dev-lang/php" auto="yes" arch="*">
+      <unaffected range="ge">5.2.12</unaffected>
+      <vulnerable range="lt">5.2.12</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    PHP is a widely-used general-purpose scripting language that is
+    especially suited for Web development and can be embedded into HTML.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in PHP. Please review the
+    CVE identifiers referenced below and the associated PHP release notes
+    for details.
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A context-dependent attacker could execute arbitrary code via a
+    specially crafted string containing an HTML entity when the mbstring
+    extension is enabled. Furthermore a remote attacker could execute
+    arbitrary code via a specially crafted GD graphics file.
+    </p>
+    <p>
+    A remote attacker could also cause a Denial of Service via a malformed
+    string passed to the json_decode() function, via a specially crafted
+    ZIP file passed to the php_zip_make_relative_path() function, via a
+    malformed JPEG image passed to the exif_read_data() function, or via
+    temporary file exhaustion. It is also possible for an attacker to spoof
+    certificates, bypass various safe_mode and open_basedir restrictions
+    when certain criteria are met, perform Cross-site scripting attacks,
+    more easily perform SQL injection attacks, manipulate settings of other
+    virtual hosts on the same server via a malicious .htaccess entry when
+    running on Apache, disclose memory portions, and write arbitrary files
+    via a specially crafted ZIP archive. Some vulnerabilities with unknown
+    impact and attack vectors have been reported as well.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All PHP users should upgrade to the latest version. As PHP is
+    statically linked against a vulnerable version of the c-client library
+    when the imap or kolab USE flag is enabled (GLSA 200911-03), users
+    should upgrade net-libs/c-client beforehand:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-libs/c-client-2007e&quot;
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/php-5.2.12&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5498">CVE-2008-5498</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5514">CVE-2008-5514</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5557">CVE-2008-5557</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5624">CVE-2008-5624</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5625">CVE-2008-5625</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5658">CVE-2008-5658</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5814">CVE-2008-5814</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5844">CVE-2008-5844</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7002">CVE-2008-7002</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0754">CVE-2009-0754</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1271">CVE-2009-1271</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1272">CVE-2009-1272</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2626">CVE-2009-2626</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2687">CVE-2009-2687</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3291">CVE-2009-3291</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3292">CVE-2009-3292</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3293">CVE-2009-3293</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3546">CVE-2009-3546</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3557">CVE-2009-3557</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3558">CVE-2009-3558</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4017">CVE-2009-4017</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4142">CVE-2009-4142</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4143">CVE-2009-4143</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200911-03.xml">GLSA 200911-03</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Fri, 06 Nov 2009 10:26:06 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 26 Nov 2009 09:22:21 +0000">
+    rbu
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201001-04.xml b/xml/htdocs/security/en/glsa/glsa-201001-04.xml
new file mode 100644
index 00000000..4a2f22b1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201001-04.xml
@@ -0,0 +1,107 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201001-04">
+  <title>VirtualBox: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in VirtualBox were found, the worst of which
+    allowing for privilege escalation.
+  </synopsis>
+  <product type="ebuild">virtualbox-bin virtualbox-ose virtualbox-guest-additions virtualbox-ose-additions</product>
+  <announced>January 13, 2010</announced>
+  <revised>January 13, 2010: 01</revised>
+  <bug>288836</bug>
+  <bug>294678</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-emulation/virtualbox-bin" auto="yes" arch="*">
+      <unaffected range="ge">3.0.12</unaffected>
+      <vulnerable range="lt">3.0.12</vulnerable>
+    </package>
+    <package name="app-emulation/virtualbox-ose" auto="yes" arch="*">
+      <unaffected range="ge">3.0.12</unaffected>
+      <vulnerable range="lt">3.0.12</vulnerable>
+    </package>
+    <package name="app-emulation/virtualbox-guest-additions" auto="yes" arch="*">
+      <unaffected range="ge">3.0.12</unaffected>
+      <vulnerable range="lt">3.0.12</vulnerable>
+    </package>
+    <package name="app-emulation/virtualbox-ose-additions" auto="yes" arch="*">
+      <unaffected range="ge">3.0.12</unaffected>
+      <vulnerable range="lt">3.0.12</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The VirtualBox family provides powerful x86 virtualization products.
+    </p>
+  </background>
+  <description>
+    <p>
+    Thomas Biege of SUSE discovered multiple vulnerabilities:
+    </p>
+    <ul><li>A shell metacharacter injection in popen() (CVE-2009-3692) and
+    a possible buffer overflow in strncpy() in the VBoxNetAdpCtl
+    configuration tool.</li>
+    <li>An unspecified vulnerability in VirtualBox
+    Guest Additions (CVE-2009-3940).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A local, unprivileged attacker with the permission to run VirtualBox
+    could gain root privileges. A guest OS local user could cause a Denial
+    of Service (memory consumption) on the guest OS via unknown vectors.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All users of the binary version of VirtualBox should upgrade to the
+    latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/virtualbox-bin-3.0.12&quot;</code>
+    <p>
+    All users of the Open Source version of VirtualBox should upgrade to
+    the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/virtualbox-ose-3.0.12&quot;</code>
+    <p>
+    All users of the binary VirtualBox Guest Additions should upgrade to
+    the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/virtualbox-guest-additions-3.0.12&quot;</code>
+    <p>
+    All users of the Open Source VirtualBox Guest Additions should upgrade
+    to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/virtualbox-ose-additions-3.0.12&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3692">CVE-2009-3692</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3940">CVE-2009-3940</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 09 Nov 2009 23:19:24 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 05 Jan 2010 20:50:17 +0000">
+    craig
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 10 Jan 2010 19:41:20 +0000">
+    craig
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201001-05.xml b/xml/htdocs/security/en/glsa/glsa-201001-05.xml
new file mode 100644
index 00000000..51bfb5f0
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201001-05.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201001-05">
+  <title>net-snmp: Authorization bypass</title>
+  <synopsis>
+    A remote attacker can bypass the tcp-wrappers client authorization in
+    net-snmp.
+  </synopsis>
+  <product type="ebuild">net-snmp</product>
+  <announced>January 13, 2010</announced>
+  <revised>January 13, 2010: 01</revised>
+  <bug>250429</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/net-snmp" auto="yes" arch="*">
+      <unaffected range="ge">5.4.2.1-r1</unaffected>
+      <vulnerable range="lt">5.4.2.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    net-snmp bundles software for generating and retrieving SNMP data.
+    </p>
+  </background>
+  <description>
+    <p>
+    The netsnmp_udp_fmtaddr() function (snmplib/snmpUDPDomain.c), when
+    using TCP wrappers for client authorization, does not properly parse
+    hosts.allow rules.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote, unauthenticated attacker could bypass the ACL filtering,
+    possibly resulting in the execution of arbitrary SNMP queries.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    If possible, protect net-snmp with custom iptables rules:
+    </p>
+    <code>
+    iptables -s [client] -d [host] -p udp --dport 161 -j ACCEPT
+    iptables -s 0.0.0.0/0 -d [host] -p udp --dport 161 -j DROP</code>
+  </workaround>
+  <resolution>
+    <p>
+    All net-snmp users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/net-snmp-5.4.2.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6123">CVE-2008-6123</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 28 Sep 2009 18:16:15 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 05 Jan 2010 21:17:32 +0000">
+    craig
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 10 Jan 2010 19:40:57 +0000">
+    craig
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201001-06.xml b/xml/htdocs/security/en/glsa/glsa-201001-06.xml
new file mode 100644
index 00000000..fc4830e4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201001-06.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201001-06">
+  <title>aria2: Multiple vulnerabilities</title>
+  <synopsis>
+    A buffer overflow and a format string vulnerability in aria2 allow remote
+    attackers to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">aria2</product>
+  <announced>January 13, 2010</announced>
+  <revised>January 13, 2010: 01</revised>
+  <bug>288291</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/aria2" auto="yes" arch="*">
+      <unaffected range="ge">1.6.3</unaffected>
+      <vulnerable range="lt">1.6.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    aria2 is a download utility with resuming and segmented downloading
+    with HTTP/HTTPS/FTP/BitTorrent support.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tatsuhiro Tsujikawa reported a buffer overflow in
+    DHTRoutingTableDeserializer.cc (CVE-2009-3575) and a format string
+    vulnerability in the AbstractCommand::onAbort() function in
+    src/AbstractCommand.cc (CVE-2009-3617).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote, unauthenticated attacker could possibly execute arbitrary
+    code with the privileges of the user running the application or cause a
+    Denial of Service (application crash).
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    Do not use DHT (CVE-2009-3575) and disable logging (CVE-2009-3617).
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All aria2 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/aria2-1.6.3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3575">CVE-2009-3575</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3617">CVE-2009-3617</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 06 Nov 2009 09:27:41 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 05 Jan 2010 21:05:40 +0000">
+    craig
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 10 Jan 2010 19:40:46 +0000">
+    craig
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201001-07.xml b/xml/htdocs/security/en/glsa/glsa-201001-07.xml
new file mode 100644
index 00000000..071aa2c1
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201001-07.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201001-07">
+  <title>Blender: Untrusted search path</title>
+  <synopsis>
+    An untrusted search path vulnerability in Blender might result in the
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">blender</product>
+  <announced>January 13, 2010</announced>
+  <revised>January 13, 2010: 01</revised>
+  <bug>245310</bug>
+  <access>local</access>
+  <affected>
+    <package name="media-gfx/blender" auto="yes" arch="*">
+      <unaffected range="ge">2.48a-r3</unaffected>
+      <vulnerable range="lt">2.48a-r3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Blender is a 3D Creation/Animation/Publishing System.
+    </p>
+  </background>
+  <description>
+    <p>
+    Steffen Joeris reported that Blender's BPY_interface calls
+    PySys_SetArgv() in such a way that Python prepends sys.path with an
+    empty string.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A local attacker could entice a user to run "blender" from a directory
+    containing a specially crafted Python module, resulting in the
+    execution of arbitrary code with the privileges of the user running the
+    application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Blender users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/blender-2.48a-r3&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4863">CVE-2008-4863</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 30 Nov 2008 19:04:32 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 05 Jan 2010 21:25:09 +0000">
+    craig
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 10 Jan 2010 19:40:27 +0000">
+    craig
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201001-08.xml b/xml/htdocs/security/en/glsa/glsa-201001-08.xml
new file mode 100644
index 00000000..babfc096
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201001-08.xml
@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201001-08">
+  <title>SquirrelMail: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities were found in SquirrelMail of which the worst
+    results in remote code execution.
+  </synopsis>
+  <product type="ebuild">squirrelmail</product>
+  <announced>January 13, 2010</announced>
+  <revised>January 13, 2010: 01</revised>
+  <bug>269567</bug>
+  <bug>270671</bug>
+  <access>remote</access>
+  <affected>
+    <package name="mail-client/squirrelmail" auto="yes" arch="*">
+      <unaffected range="ge">1.4.19</unaffected>
+      <vulnerable range="lt">1.4.19</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SquirrelMail is a standards-based webmail package written in PHP.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities were found in SquirrelMail:
+    </p>
+    <ul><li>Niels
+    Teusink reported multiple input sanitation flaws in certain encrypted
+    strings in e-mail headers, related to contrib/decrypt_headers.php,
+    PHP_SELF and the query string (aka QUERY_STRING) (CVE-2009-1578).
+    </li>
+    <li>Niels Teusink also reported that the map_yp_alias() function
+    in functions/imap_general.php does not filter shell metacharacters in a
+    username and that the original patch was incomplete (CVE-2009-1381,
+    CVE-2009-1579).
+    </li>
+    <li>Tomas Hoger discovered an unspecified session fixation
+    vulnerability (CVE-2009-1580).
+    </li>
+    <li>Luc Beurton reported that functions/mime.php does not protect
+    the application's content from Cascading Style Sheets (CSS) positioning
+    in HTML e-mail messages (CVE-2009-1581).
+    </li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    The vulnerabilities allow remote attackers to execute arbitrary code
+    with the privileges of the user running the web server, to hijack web
+    sessions via a crafted cookie, to spoof the user interface and to
+    conduct Cross-Site Scripting and phishing attacks, via a specially
+    crafted message.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SquirrelMail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=mail-client/squirrelmail-1.4.19&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1381">CVE-2009-1381</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1578">CVE-2009-1578</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1579">CVE-2009-1579</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1580">CVE-2009-1580</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1581">CVE-2009-1581</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Tue, 05 Jan 2010 21:49:10 +0000">
+    craig
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 13 Jan 2010 21:54:28 +0000">
+    craig
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201001-09.xml b/xml/htdocs/security/en/glsa/glsa-201001-09.xml
new file mode 100644
index 00000000..db1255a6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201001-09.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201001-09">
+  <title>Ruby: Terminal Control Character Injection</title>
+  <synopsis>
+    An input sanitation flaw in the WEBrick HTTP server included in Ruby might
+    allow remote attackers to inject arbitrary control characters into terminal
+    sessions.
+  </synopsis>
+  <product type="ebuild">ruby</product>
+  <announced>January 14, 2010</announced>
+  <revised>January 14, 2010: 01</revised>
+  <bug>300468</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-lang/ruby" auto="yes" arch="*">
+      <unaffected range="ge">1.8.7_p249</unaffected>
+      <unaffected range="rge">1.8.6_p388</unaffected>
+      <vulnerable range="lt">1.8.7_p249</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Ruby is an interpreted scripting language for quick and easy
+    object-oriented programming. It comes bundled with a HTTP server
+    ("WEBrick").
+    </p>
+  </background>
+  <description>
+    <p>
+    Giovanni Pellerano, Alessandro Tanasi and Francesco Ongaro reported
+    that WEBrick does not filter terminal control characters, for instance
+    when handling HTTP logs.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could send a specially crafted HTTP request to a
+    WEBrick server to inject arbitrary terminal control characters,
+    possibly resulting in the execution of arbitrary commands, data loss,
+    or other unspecified impact. This could also be used to facilitate
+    other attacks.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Ruby 1.8.7 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/ruby-1.8.7_p249&quot;</code>
+    <p>
+    All Ruby 1.8.6 users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-lang/ruby-1.8.6_p388&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4492">CVE-2009-4492</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 13 Jan 2010 19:56:42 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Wed, 13 Jan 2010 20:40:12 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 13 Jan 2010 20:40:18 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201003-01.xml b/xml/htdocs/security/en/glsa/glsa-201003-01.xml
new file mode 100644
index 00000000..8cdf7b8a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201003-01.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201003-01">
+  <title>sudo: Privilege escalation</title>
+  <synopsis>
+    Two vulnerabilities in sudo might allow local users to escalate privileges
+    and execute arbitrary code with root privileges.
+  </synopsis>
+  <product type="ebuild">sudo</product>
+  <announced>March 03, 2010</announced>
+  <revised>March 03, 2010: 01</revised>
+  <bug>306865</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-admin/sudo" auto="yes" arch="*">
+      <unaffected range="ge">1.7.2_p4</unaffected>
+      <vulnerable range="lt">1.7.2_p4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    sudo allows a system administrator to give users the ability to run
+    commands as other users.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in sudo:
+    </p>
+    <ul>
+    <li>Glenn Waller and neonsignal reported that sudo does not properly
+    handle access control of the "sudoedit" pseudo-command
+    (CVE-2010-0426).</li>
+    <li>Harald Koenig reported that sudo does not
+    properly set supplementary groups when using the "runas_default" option
+    (CVE-2010-0427).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker with privileges to use "sudoedit" or the privilege to
+    execute commands with the "runas_default" setting enabled could
+    leverage these vulnerabilities to execute arbitrary code with elevated
+    privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    CVE-2010-0426: Revoke all "sudoedit" privileges, or use the full path
+    to sudoedit. CVE-2010-0427: Remove all occurrences of the
+    "runas_default" setting.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All sudo users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/sudo-1.7.2_p4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0426">CVE-2010-0426</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0427">CVE-2010-0427</uri>
+  </references>
+  <metadata tag="requester" timestamp="Tue, 02 Mar 2010 19:53:26 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Tue, 02 Mar 2010 20:22:07 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Wed, 03 Mar 2010 16:28:38 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-01.xml b/xml/htdocs/security/en/glsa/glsa-201006-01.xml
new file mode 100644
index 00000000..da2a6fbc
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-01.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-01">
+  <title>FreeType 1: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple vulnerabilities in FreeType might result in the remote execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">freetype</product>
+  <announced>June 01, 2010</announced>
+  <revised>June 01, 2010: 01</revised>
+  <bug>271234</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/freetype" auto="yes" arch="*">
+      <unaffected range="ge">1.4_pre20080316-r2</unaffected>
+      <vulnerable range="lt">1.4_pre20080316-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    FreeType is a True Type Font rendering library.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple issues found in FreeType 2 were also discovered in FreeType 1.
+    For details on these issues, please review the Gentoo Linux Security
+    Advisories and CVE identifiers referenced below.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted TTF
+    file, possibly resulting in the execution of arbitrary code with the
+    privileges of the user running FreeType.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All FreeType 1 users should upgrade to an unaffected version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/freetype-1.4_pre20080316-r2&quot;</code>
+    <p>
+    NOTE: This is a legacy GLSA. Updates for all affected architectures are
+    available since May 27, 2009. It is likely that your system is already
+    no longer affected by this issue.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1861">CVE-2006-1861</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2754">CVE-2007-2754</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200607-02.xml">GLSA 200607-02</uri>
+    <uri link="http://www.gentoo.org/security/en/glsa/glsa-200705-22.xml">GLSA 200705-22</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 01 Jun 2009 22:26:35 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 30 May 2010 10:59:47 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 30 May 2010 15:32:56 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-02.xml b/xml/htdocs/security/en/glsa/glsa-201006-02.xml
new file mode 100644
index 00000000..9ddb3e23
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-02.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-02">
+  <title>CamlImages: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple integer overflows in CamlImages might result in the remote
+    execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">camlimages</product>
+  <announced>June 01, 2010</announced>
+  <revised>June 01, 2010: 01</revised>
+  <bug>276235</bug>
+  <bug>290222</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-ml/camlimages" auto="yes" arch="*">
+      <unaffected range="ge">3.0.2</unaffected>
+      <vulnerable range="lt">3.0.2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    CamlImages is an image processing library for Objective Caml.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tielei Wang reported multiple integer overflows, possibly leading to
+    heap-based buffer overflows in the (1) read_png_file() and
+    read_png_file_as_rgb24() functions, when processing a PNG image
+    (CVE-2009-2295) and (2) gifread.c and jpegread.c files when processing
+    GIF or JPEG images (CVE-2009-2660).
+    </p>
+    <p>
+    Other integer overflows were also found in tiffread.c (CVE-2009-3296).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted,
+    overly large PNG, GIF, TIFF, or JPEG image using an application that
+    uses the CamlImages library, possibly resulting in the execution of
+    arbitrary code with the privileges of the user running the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All CamlImages users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose =dev-ml/camlimages-3.0.2</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2295">CVE-2009-2295</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2660">CVE-2009-2660</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3296">CVE-2009-3296</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sun, 09 Aug 2009 15:21:06 +0000">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 14 Aug 2009 12:48:53 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 01 Jun 2010 09:26:19 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-03.xml b/xml/htdocs/security/en/glsa/glsa-201006-03.xml
new file mode 100644
index 00000000..ca09ecec
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-03.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-03">
+  <title>ImageMagick: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    An integer overflow in ImageMagick might allow remote attackers to cause
+    the remote execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">imagemagick</product>
+  <announced>June 01, 2010</announced>
+  <revised>June 01, 2010: 01</revised>
+  <bug>271502</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-gfx/imagemagick" auto="yes" arch="*">
+      <unaffected range="ge">6.5.2.9</unaffected>
+      <vulnerable range="lt">6.5.2.9</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ImageMagick is a collection of tools and libraries for manipulating
+    various image formats.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tielei Wang has discovered that the XMakeImage() function in
+    magick/xwindow.c is prone to an integer overflow, possibly leading to a
+    buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted
+    image, possibly resulting in the remote execution of arbitrary code
+    with the privileges of the user running the application, or a Denial of
+    Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All ImageMagick users should upgrade to an unaffected version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/imagemagick-6.5.2.9&quot;</code>
+    <p>
+    NOTE: This is a legacy GLSA. Updates for all affected architectures are
+    available since June 4, 2009. It is likely that your system is already
+    no longer affected by this issue.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1882">CVE-2009-1882</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 03 Jun 2009 18:15:07 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 30 May 2010 11:23:27 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 30 May 2010 15:32:51 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-04.xml b/xml/htdocs/security/en/glsa/glsa-201006-04.xml
new file mode 100644
index 00000000..9c80a091
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-04.xml
@@ -0,0 +1,94 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-04">
+  <title>xine-lib: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple vulnerabilities in xine-lib might result in the remote execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">xine-lib</product>
+  <announced>June 01, 2010</announced>
+  <revised>June 01, 2010: 01</revised>
+  <bug>234777</bug>
+  <bug>249041</bug>
+  <bug>260069</bug>
+  <bug>265250</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/xine-lib" auto="yes" arch="*">
+      <unaffected range="ge">1.1.16.3</unaffected>
+      <vulnerable range="lt">1.1.16.3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    xine-lib is the core library package for the xine media player, and
+    other players such as Amarok, Codeine/Dragon Player and Kaffeine.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilites have been reported in xine-lib. Please review
+    the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to play a specially crafted video
+    file or stream with a player using xine-lib, potentially resulting in
+    the execution of arbitrary code with the privileges of the user running
+    the application.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All xine-lib users should upgrade to an unaffected version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/xine-lib-1.1.16.3&quot;</code>
+    <p>
+    NOTE: This is a legacy GLSA. Updates for all affected architectures are
+    available since April 10, 2009. It is likely that your system is
+    already no longer affected by this issue.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3231">CVE-2008-3231</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5233">CVE-2008-5233</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5234">CVE-2008-5234</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5235">CVE-2008-5235</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5236">CVE-2008-5236</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5237">CVE-2008-5237</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5238">CVE-2008-5238</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5239">CVE-2008-5239</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5240">CVE-2008-5240</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5241">CVE-2008-5241</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5242">CVE-2008-5242</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5243">CVE-2008-5243</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5244">CVE-2008-5244</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5245">CVE-2008-5245</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5246">CVE-2008-5246</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5247">CVE-2008-5247</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5248">CVE-2008-5248</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0698">CVE-2009-0698</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1274">CVE-2009-1274</uri>
+  </references>
+  <metadata tag="requester" timestamp="Wed, 03 Sep 2008 18:16:02 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 30 May 2010 10:31:16 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 30 May 2010 15:39:41 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-05.xml b/xml/htdocs/security/en/glsa/glsa-201006-05.xml
new file mode 100644
index 00000000..872a66fe
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-05.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-05">
+  <title>Wireshark: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities were found in Wireshark.
+  </synopsis>
+  <product type="ebuild">wireshark</product>
+  <announced>June 01, 2010</announced>
+  <revised>June 01, 2010: 01</revised>
+  <bug>297388</bug>
+  <bug>318935</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-analyzer/wireshark" auto="yes" arch="*">
+      <unaffected range="ge">1.2.8-r1</unaffected>
+      <vulnerable range="lt">1.2.8-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Wireshark is a versatile network protocol analyzer.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities were found in the Daintree SNA file parser,
+    the SMB, SMB2, IPMI, and DOCSIS dissectors. For further information
+    please consult the CVE entries referenced below.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could cause a Denial of Service and possibly execute
+    arbitrary code via crafted packets or malformed packet trace files.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Wireshark users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/wireshark-1.2.8-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4376">CVE-2009-4376</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4377">CVE-2009-4377</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4378">CVE-2009-4378</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1455">CVE-2010-1455</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 08 Jan 2010 17:26:37 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 27 May 2010 13:48:39 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 27 May 2010 17:50:20 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-06.xml b/xml/htdocs/security/en/glsa/glsa-201006-06.xml
new file mode 100644
index 00000000..fc48d80f
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-06.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-06">
+  <title>Transmission: Multiple vulnerabilities</title>
+  <synopsis>
+    Stack-based buffer overflows in Transmission may allow for remote execution
+    of arbitrary code.
+  </synopsis>
+  <product type="ebuild">transmission</product>
+  <announced>June 01, 2010</announced>
+  <revised>June 01, 2010: 01</revised>
+  <bug>309831</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-p2p/transmission" auto="yes" arch="*">
+      <unaffected range="ge">1.92</unaffected>
+      <vulnerable range="lt">1.92</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Transmission is a cross-platform BitTorrent client.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple stack-based buffer overflows in the tr_magnetParse() function
+    in libtransmission/magnet.c have been discovered.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could cause a Denial of Service or possibly execute
+    arbitrary code via a crafted magnet URL with a large number of tr or ws
+    links.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Transmission users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-p2p/transmission-1.92&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1853">CVE-2010-1853</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 22 May 2010 11:12:44 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 27 May 2010 13:42:12 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 27 May 2010 17:53:20 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-07.xml b/xml/htdocs/security/en/glsa/glsa-201006-07.xml
new file mode 100644
index 00000000..02ee9716
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-07.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-07">
+  <title>SILC: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities were discovered in SILC Toolkit and SILC Client,
+    the worst of which allowing for execution of arbitrary code.
+  </synopsis>
+  <product type="ebuild">silc-toolkit silc-client</product>
+  <announced>June 01, 2010</announced>
+  <revised>June 01, 2010: 01</revised>
+  <bug>284561</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-im/silc-toolkit" auto="yes" arch="*">
+      <unaffected range="ge">1.1.10</unaffected>
+      <vulnerable range="lt">1.1.10</vulnerable>
+    </package>
+    <package name="net-im/silc-client" auto="yes" arch="*">
+      <unaffected range="ge">1.1.8</unaffected>
+      <vulnerable range="lt">1.1.8</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    SILC (Secure Internet Live Conferencing protocol) Toolkit is a software
+    development kit for use in clients, and SILC Client is an IRSSI-based
+    text client.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities were discovered in SILC Toolkit and SILC
+    Client. For further information please consult the CVE entries
+    referenced below.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could overwrite stack locations and possibly execute
+    arbitrary code via a crafted OID value, Content-Length header or format
+    string specifiers in a nickname field or channel name.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All SILC Toolkit users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/silc-toolkit-1.1.10&quot;</code>
+    <p>
+    All SILC Client users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-im/silc-client-1.1.8&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7159">CVE-2008-7159</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7160">CVE-2008-7160</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3051">CVE-2009-3051</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3163">CVE-2009-3163</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 22 May 2010 11:17:59 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 27 May 2010 13:36:35 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 27 May 2010 17:55:42 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-08.xml b/xml/htdocs/security/en/glsa/glsa-201006-08.xml
new file mode 100644
index 00000000..186578fa
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-08.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-08">
+  <title>nano: Multiple vulnerabilities</title>
+  <synopsis>
+    Race conditions when editing files could lead to symlink attacks or changes
+    of ownerships of important files.
+  </synopsis>
+  <product type="ebuild">nano</product>
+  <announced>June 01, 2010</announced>
+  <revised>June 01, 2010: 01</revised>
+  <bug>315355</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-editors/nano" auto="yes" arch="*">
+      <unaffected range="ge">2.2.4</unaffected>
+      <vulnerable range="lt">2.2.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    nano is a GNU GPL'd Pico clone with more functionality.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple race condition vulnerabilities have been discovered in nano.
+    For further information please consult the CVE entries referenced
+    below.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Under certain conditions, a local, user-assisted attacker could
+    possibly overwrite arbitrary files via a symlink attack on an
+    attacker-owned file that is being edited by the victim, or change the
+    ownership of arbitrary files.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All nano users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-editors/nano-2.2.4&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1160">CVE-2010-1160</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1161">CVE-2010-1161</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 30 Apr 2010 14:22:38 +0000">
+    chiiph
+  </metadata>
+  <metadata tag="submitter" timestamp="Thu, 27 May 2010 14:24:42 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 27 May 2010 17:43:51 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-09.xml b/xml/htdocs/security/en/glsa/glsa-201006-09.xml
new file mode 100644
index 00000000..a9a7fe2c
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-09.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-09">
+  <title>sudo: Privilege escalation</title>
+  <synopsis>
+    A flaw in sudo's -e option may allow local attackers to execute arbitrary
+    commands.
+  </synopsis>
+  <product type="ebuild">sudo</product>
+  <announced>June 01, 2010</announced>
+  <revised>June 01, 2010: 01</revised>
+  <bug>321697</bug>
+  <access>local</access>
+  <affected>
+    <package name="app-admin/sudo" auto="yes" arch="*">
+      <unaffected range="ge">1.7.2_p6</unaffected>
+      <vulnerable range="lt">1.7.2_p6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    sudo allows a system administrator to give users the ability to run
+    commands as other users.
+    </p>
+  </background>
+  <description>
+    <p>
+    The command matching functionality does not properly handle when a file
+    in the current working directory has the same name as a pseudo-command
+    in the sudoers file and the PATH contains an entry for ".".
+    </p>
+  </description>
+  <impact type="high">
+    <p>
+    A local attacker with the permission to run sudoedit could, under
+    certain circumstances, execute arbitrary commands as whichever user he
+    has permission to run sudoedit as, typically root.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All sudo users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-admin/sudo-1.7.2_p6&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1163">CVE-2010-1163</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 29 May 2010 20:27:33 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 30 May 2010 14:58:46 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sun, 30 May 2010 18:08:55 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-10.xml b/xml/htdocs/security/en/glsa/glsa-201006-10.xml
new file mode 100644
index 00000000..b88a4d0d
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-10.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-10">
+  <title>multipath-tools: World-writeable socket</title>
+  <synopsis>
+    multipath-tools does not set correct permissions on the socket file, making
+    it possible to send arbitrary commands to the multipath daemon for local
+    users.
+  </synopsis>
+  <product type="ebuild">multipath-tools</product>
+  <announced>June 01, 2010</announced>
+  <revised>June 01, 2010: 01</revised>
+  <bug>264564</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-fs/multipath-tools" auto="yes" arch="*">
+      <unaffected range="ge">0.4.8-r1</unaffected>
+      <vulnerable range="lt">0.4.8-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    multipath-tools are used to drive the Device Mapper multipathing
+    driver.
+    </p>
+  </background>
+  <description>
+    <p>
+    multipath-tools uses world-writable permissions for the socket file
+    (/var/run/multipathd.sock).
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    Local users could send arbitrary commands to the multipath daemon,
+    causing cluster failures and data loss.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    chmod o-rwx /var/run/multipath.sock
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All multipath-tools users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=sys-fs/multipath-tools-0.4.8-r1&quot;</code>
+    <p>
+    NOTE: This is a legacy GLSA. Updates for all affected architectures are
+    available since November 13, 2009. It is likely that your system is
+    already no longer affected by this issue.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0115">CVE-2009-0115</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 29 Jan 2010 23:30:44 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 09 Apr 2010 17:36:36 +0000">
+    craig
+  </metadata>
+  <metadata tag="bugReady" timestamp="Tue, 01 Jun 2010 12:41:09 +0000">
+    keytoaster
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-11.xml b/xml/htdocs/security/en/glsa/glsa-201006-11.xml
new file mode 100644
index 00000000..2658ba91
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-11.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-11">
+  <title>BIND: Multiple vulnerabilities</title>
+  <synopsis>
+    Several cache poisoning vulnerabilities have been found in BIND.
+  </synopsis>
+  <product type="ebuild">BIND</product>
+  <announced>June 01, 2010</announced>
+  <revised>June 01, 2010: 01</revised>
+  <bug>301548</bug>
+  <bug>308035</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-dns/bind" auto="yes" arch="*">
+      <unaffected range="ge">9.4.3_p5</unaffected>
+      <vulnerable range="lt">9.4.3_p5</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    ISC BIND is the Internet Systems Consortium implementation of the
+    Domain Name System (DNS) protocol.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple cache poisoning vulnerabilities were discovered in BIND. For
+    further information please consult the CVE entries and the ISC Security
+    Bulletin referenced below.
+    </p>
+    <p>
+    Note: CVE-2010-0290 and CVE-2010-0382 exist because of an incomplete
+    fix and a regression for CVE-2009-4022.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker could exploit this weakness to poison the cache of a
+    recursive resolver and thus spoof DNS traffic, which could e.g. lead to
+    the redirection of web or mail traffic to malicious sites.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All BIND users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-dns/bind-9.4.3_p5&quot;</code>
+  </resolution>
+  <references>
+    <uri link="https://www.isc.org/advisories/CVE2009-4022">ISC Advisory</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4022">CVE-2009-4022</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0097">CVE-2010-0097</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0290">CVE-2010-0290</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0382">CVE-2010-0382</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 29 Mar 2010 22:15:31 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 09 Apr 2010 17:11:37 +0000">
+    craig
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 27 May 2010 18:23:04 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-12.xml b/xml/htdocs/security/en/glsa/glsa-201006-12.xml
new file mode 100644
index 00000000..064ea87a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-12.xml
@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-12">
+  <title>Fetchmail: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been reported in Fetchmail, allowing remote
+    attackers to execute arbitrary code or to conduct Man-in-the-Middle
+    attacks.
+  </synopsis>
+  <product type="ebuild">fetchmail</product>
+  <announced>June 01, 2010</announced>
+  <revised>June 01, 2010: 01</revised>
+  <bug>280537</bug>
+  <bug>307761</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-mail/fetchmail" auto="yes" arch="*">
+      <unaffected range="ge">6.3.14</unaffected>
+      <vulnerable range="lt">6.3.14</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Fetchmail is a remote mail retrieval and forwarding utility.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in Fetchmail:
+    </p>
+    <ul>
+    <li>The sdump() function might trigger a heap-based buffer overflow
+    during the escaping of non-printable characters with the high bit set
+    from an X.509 certificate (CVE-2010-0562).</li>
+    <li>The vendor reported
+    that Fetchmail does not properly handle Common Name (CN) fields in
+    X.509 certificates that contain an ASCII NUL character. Specifically,
+    the processing of such fields is stopped at the first occurrence of a
+    NUL character. This type of vulnerability was recently discovered by
+    Dan Kaminsky and Moxie Marlinspike (CVE-2009-2666).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to connect with Fetchmail to a
+    specially crafted SSL-enabled server in verbose mode, possibly
+    resulting in the execution of arbitrary code with the privileges of the
+    user running the application. NOTE: The issue is only existent on
+    platforms on which char is signed.
+    </p>
+    <p>
+    Furthermore, a remote attacker might employ a specially crafted X.509
+    certificate, containing a NUL character in the Common Name field to
+    conduct man-in-the-middle attacks on SSL connections made using
+    Fetchmail.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Fetchmail users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-mail/fetchmail-6.3.14&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0562">CVE-2010-0562</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2666">CVE-2009-2666</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 29 Mar 2010 22:13:20 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 11 Apr 2010 12:34:40 +0000">
+    craig
+  </metadata>
+  <metadata tag="bugReady" timestamp="Thu, 27 May 2010 17:49:00 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-13.xml b/xml/htdocs/security/en/glsa/glsa-201006-13.xml
new file mode 100644
index 00000000..ce2367e4
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-13.xml
@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-13">
+  <title>Smarty: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in the Smarty template engine might allow remote
+    attackers to execute arbitrary PHP code.
+  </synopsis>
+  <product type="ebuild">smarty</product>
+  <announced>June 02, 2010</announced>
+  <revised>June 02, 2010: 01</revised>
+  <bug>212147</bug>
+  <bug>243856</bug>
+  <bug>270494</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-php/smarty" auto="yes" arch="*">
+      <unaffected range="ge">2.6.23</unaffected>
+      <vulnerable range="lt">2.6.23</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Smarty is a template engine for PHP.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been discovered in Smarty:
+    </p>
+    <ul>
+    <li>The vendor reported that the modifier.regex_replace.php plug-in
+    contains an input sanitation flaw related to the ASCII NUL character
+    (CVE-2008-1066).</li>
+    <li>The vendor reported that the
+    _expand_quoted_text() function in libs/Smarty_Compiler.class.php
+    contains an input sanitation flaw via multiple vectors (CVE-2008-4810,
+    CVE-2008-4811).</li>
+    <li>Nine:Situations:Group::bookoo reported that
+    the smarty_function_math() function in libs/plugins/function.math.php
+    contains input sanitation flaw (CVE-2009-1669).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    These issues might allow a remote attacker to execute arbitrary PHP
+    code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Smarty users should upgrade to an unaffected version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-php/smarty-2.6.23&quot;</code>
+    <p>
+    NOTE: This is a legacy GLSA. Updates for all affected architectures are
+    available since June 2, 2009. It is likely that your system is already
+    no longer affected by this issue.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1066">CVE-2008-1066</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4810">CVE-2008-4810</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4811">CVE-2008-4811</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1669">CVE-2009-1669</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 15 Mar 2008 21:06:13 +0000">
+    p-y
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 19 Sep 2008 19:51:21 +0000">
+    p-y
+  </metadata>
+  <metadata tag="submitter" timestamp="Sun, 30 May 2010 11:16:44 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-14.xml b/xml/htdocs/security/en/glsa/glsa-201006-14.xml
new file mode 100644
index 00000000..4e89a94b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-14.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-14">
+  <title>Newt: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    A heap-based buffer overflow in the Newt library might allow remote,
+    user-assisted attackers to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">newt</product>
+  <announced>June 02, 2010</announced>
+  <revised>June 02, 2010: 01</revised>
+  <bug>285854</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-libs/newt" auto="yes" arch="*">
+      <unaffected range="ge">0.52.10-r1</unaffected>
+      <vulnerable range="lt">0.52.10-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Newt is a library for displaying text mode user interfaces.
+    </p>
+  </background>
+  <description>
+    <p>
+    Miroslav Lichvar reported that Newt is prone to a heap-based buffer
+    overflow in textbox.c.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to enter a specially crafted
+    string into a text dialog box rendered by Newt, possibly resulting in
+    the remote execution of arbitrary code with the privileges of the user
+    running the application, or a Denial of Service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Newt users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-libs/newt-0.52.10-r1&quot;</code>
+    <p>
+    NOTE: This is a legacy GLSA. Updates for all affected architectures are
+    available since October 26, 2009. It is likely that your system is
+    already no longer affected by this issue.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2905">CVE-2009-2905</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 06 Nov 2009 09:28:48 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 31 May 2010 05:47:34 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 May 2010 05:47:41 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-15.xml b/xml/htdocs/security/en/glsa/glsa-201006-15.xml
new file mode 100644
index 00000000..7559c614
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-15.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-15">
+  <title>XEmacs: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    Multiple integer overflow errors in XEmacs might allow remote,
+    user-assisted attackers to execute arbitrary code.
+  </synopsis>
+  <product type="ebuild">xemacs</product>
+  <announced>June 03, 2010</announced>
+  <revised>June 03, 2010: 01</revised>
+  <bug>275397</bug>
+  <access>remote</access>
+  <affected>
+    <package name="app-editors/xemacs" auto="yes" arch="*">
+      <unaffected range="ge">21.4.22-r1</unaffected>
+      <vulnerable range="lt">21.4.22-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    XEmacs is a highly extensible and customizable text editor.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tielei Wang reported multiple integer overflow vulnerabilities in the
+    tiff_instantiate(), png_instantiate() and jpeg_instantiate() functions
+    in glyphs-eimage.c, all possibly leading to heap-based buffer
+    overflows.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted TIFF,
+    JPEG or PNG file using XEmacs, possibly resulting in the remote
+    execution of arbitrary code with the privileges of the user running the
+    application, or a Denial of Service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All XEmacs users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-editors/xemacs-21.4.22-r1&quot;</code>
+    <p>
+    NOTE: This is a legacy GLSA. Updates for all affected architectures are
+    available since July 26, 2009. It is likely that your system is already
+    no longer affected by this issue.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2688">CVE-2009-2688</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 30 Jul 2009 20:43:44 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 31 May 2010 06:40:54 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 May 2010 06:41:02 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-16.xml b/xml/htdocs/security/en/glsa/glsa-201006-16.xml
new file mode 100644
index 00000000..4e5b9584
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-16.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-16">
+  <title>GD: User-assisted execution of arbitrary code</title>
+  <synopsis>
+    The GD library is prone to a buffer overflow vulnerability.
+  </synopsis>
+  <product type="ebuild">gd</product>
+  <announced>June 03, 2010</announced>
+  <revised>June 03, 2010: 01</revised>
+  <bug>292130</bug>
+  <access>remote</access>
+  <affected>
+    <package name="media-libs/gd" auto="yes" arch="*">
+      <unaffected range="ge">2.0.35-r1</unaffected>
+      <vulnerable range="lt">2.0.35-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    GD is a graphic library for fast image creation.
+    </p>
+  </background>
+  <description>
+    <p>
+    Tomas Hoger reported that the _gdGetColors() function in gd_gd.c does
+    not properly verify the colorsTotal struct member, possibly leading to
+    a buffer overflow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could entice a user to open a specially crafted image
+    file with a program using the GD library, possibly resulting in the
+    remote execution of arbitrary code with the privileges of the user
+    running the application, or a Denial of Service condition.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All GD users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/gd-2.0.35-r1&quot;</code>
+    <p>
+    NOTE: This is a legacy GLSA. Updates for all affected architectures are
+    available since November 21, 2009. It is likely that your system is
+    already no longer affected by this issue.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3546">CVE-2009-3546</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 18 Dec 2009 02:08:27 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 31 May 2010 05:59:40 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 May 2010 05:59:48 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-17.xml b/xml/htdocs/security/en/glsa/glsa-201006-17.xml
new file mode 100644
index 00000000..bee58a6b
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-17.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-17">
+  <title>lighttpd: Denial of Service</title>
+  <synopsis>
+    A processing error in lighttpd might result in a Denial of Service
+    condition.
+  </synopsis>
+  <product type="ebuild">lighttpd</product>
+  <announced>June 03, 2010</announced>
+  <revised>June 03, 2010: 01</revised>
+  <bug>303213</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-servers/lighttpd" auto="yes" arch="*">
+      <unaffected range="ge">1.4.25-r1</unaffected>
+      <vulnerable range="lt">1.4.25-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    lighttpd is a lightweight high-performance web server.
+    </p>
+  </background>
+  <description>
+    <p>
+    Li Ming reported that lighttpd does not properly process packets that
+    are sent overly slow.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker might send specially crafted packets to a server
+    running lighttpd, possibly resulting in a Denial of Service condition
+    via host memory exhaustion.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All lighttpd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-servers/lighttpd-1.4.25-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0295">CVE-2010-0295</uri>
+  </references>
+  <metadata tag="requester" timestamp="Mon, 15 Mar 2010 14:19:51 +0000">
+    keytoaster
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 31 May 2010 15:20:53 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 May 2010 15:20:59 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-18.xml b/xml/htdocs/security/en/glsa/glsa-201006-18.xml
new file mode 100644
index 00000000..5f37aa8a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-18.xml
@@ -0,0 +1,143 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-18">
+  <title>Oracle JRE/JDK: Multiple vulnerabilities</title>
+  <synopsis>
+    The Oracle JDK and JRE are vulnerable to multiple unspecified
+    vulnerabilities.
+  </synopsis>
+  <product type="ebuild">sun-jre-bin sun-jdk emul-linux-x86-java</product>
+  <announced>June 04, 2010</announced>
+  <revised>June 04, 2010: 01</revised>
+  <bug>306579</bug>
+  <bug>314531</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/sun-jre-bin" auto="yes" arch="*">
+      <unaffected range="ge">1.6.0.20</unaffected>
+      <vulnerable range="lt">1.6.0.20</vulnerable>
+    </package>
+    <package name="dev-java/sun-jdk" auto="yes" arch="*">
+      <unaffected range="ge">1.6.0.20</unaffected>
+      <vulnerable range="lt">1.6.0.20</vulnerable>
+    </package>
+    <package name="app-emulation/emul-linux-x86-java" auto="yes" arch="*">
+      <unaffected range="ge">1.6.0.20</unaffected>
+      <vulnerable range="lt">1.6.0.20</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    The Oracle Java Development Kit (JDK) (formerly known as Sun JDK) and
+    the Oracle Java Runtime Environment (JRE) (formerly known as Sun JRE)
+    provide the Oracle Java platform (formerly known as Sun Java Platform).
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in the Oracle Java
+    implementation. Please review the CVE identifiers referenced below and
+    the associated Oracle Critical Patch Update Advisory for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities to cause
+    unspecified impact, possibly including remote execution of arbitrary
+    code.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Oracle JRE 1.6.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jre-bin-1.6.0.20&quot;</code>
+    <p>
+    All Oracle JDK 1.6.x users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=dev-java/sun-jdk-1.6.0.20&quot;</code>
+    <p>
+    All users of the precompiled 32bit Oracle JRE 1.6.x should upgrade to
+    the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/emul-linux-x86-java-1.6.0.20&quot;</code>
+    <p>
+    All Oracle JRE 1.5.x, Oracle JDK 1.5.x, and precompiled 32bit Oracle
+    JRE 1.5.x users are strongly advised to unmerge Java 1.5:
+    </p>
+    <code>
+    # emerge --unmerge =app-emulation/emul-linux-x86-java-1.5*
+    # emerge --unmerge =dev-java/sun-jre-bin-1.5*
+    # emerge --unmerge =dev-java/sun-jdk-1.5*</code>
+    <p>
+    Gentoo is ceasing support for the 1.5 generation of the Oracle Java
+    Platform in accordance with upstream. All 1.5 JRE versions are masked
+    and will be removed shortly. All 1.5 JDK versions are marked as
+    "build-only" and will be masked for removal shortly. Users are advised
+    to change their default user and system Java implementation to an
+    unaffected version. For example:
+    </p>
+    <code>
+    # java-config --set-system-vm sun-jdk-1.6</code>
+    <p>
+    For more information, please consult the Gentoo Linux Java
+    documentation.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555">CVE-2009-3555</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0082">CVE-2010-0082</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0084">CVE-2010-0084</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0085">CVE-2010-0085</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0087">CVE-2010-0087</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0088">CVE-2010-0088</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0089">CVE-2010-0089</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0090">CVE-2010-0090</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0091">CVE-2010-0091</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0092">CVE-2010-0092</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0093">CVE-2010-0093</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0094">CVE-2010-0094</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0095">CVE-2010-0095</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0837">CVE-2010-0837</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0838">CVE-2010-0838</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0839">CVE-2010-0839</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0840">CVE-2010-0840</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0841">CVE-2010-0841</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0842">CVE-2010-0842</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0843">CVE-2010-0843</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0844">CVE-2010-0844</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0845">CVE-2010-0845</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0846">CVE-2010-0846</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0847">CVE-2010-0847</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0848">CVE-2010-0848</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0849">CVE-2010-0849</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0850">CVE-2010-0850</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0886">CVE-2010-0886</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0887">CVE-2010-0887</uri>
+    <uri link="http://www.gentoo.org/doc/en/java.xml#doc_chap4">Gentoo Linux Java documentation</uri>
+    <uri link="http://www.oracle.com/technology/deploy/security/critical-patch-updates/javacpumar2010.html">Oracle Java SE and Java for Business Critical Patch Update Advisory - March 2010</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 02 Apr 2010 09:43:04 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Fri, 02 Apr 2010 09:59:07 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Fri, 04 Jun 2010 05:06:52 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-19.xml b/xml/htdocs/security/en/glsa/glsa-201006-19.xml
new file mode 100644
index 00000000..875da00a
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-19.xml
@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-19">
+  <title>Bugzilla: Multiple vulnerabilities</title>
+  <synopsis>
+    Bugzilla is prone to multiple medium severity vulnerabilities.
+  </synopsis>
+  <product type="ebuild">bugzilla</product>
+  <announced>June 04, 2010</announced>
+  <revised>June 04, 2010: 02</revised>
+  <bug>239564</bug>
+  <bug>258592</bug>
+  <bug>264572</bug>
+  <bug>284824</bug>
+  <bug>303437</bug>
+  <bug>303725</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/bugzilla" auto="yes" arch="*">
+      <unaffected range="ge">3.2.6</unaffected>
+      <vulnerable range="lt">3.2.6</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Bugzilla is a bug tracking system from the Mozilla project.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in Bugzilla. Please review
+    the CVE identifiers referenced below for details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker might be able to disclose local files, bug
+    information, passwords, and other data under certain circumstances.
+    Furthermore, a remote attacker could conduct SQL injection, Cross-Site
+    Scripting (XSS) or Cross-Site Request Forgery (CSRF) attacks via
+    various vectors.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Bugzilla users should upgrade to an unaffected version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=www-apps/bugzilla-3.2.6&quot;</code>
+    <p>
+    Bugzilla 2.x and 3.0 have reached their end of life. There will be no
+    more security updates. All Bugzilla 2.x and 3.0 users should update to
+    a supported Bugzilla 3.x version.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4437">CVE-2008-4437</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6098">CVE-2008-6098</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0481">CVE-2009-0481</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0482">CVE-2009-0482</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0483">CVE-2009-0483</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0484">CVE-2009-0484</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0485">CVE-2009-0485</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0486">CVE-2009-0486</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1213">CVE-2009-1213</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3125">CVE-2009-3125</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3165">CVE-2009-3165</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3166">CVE-2009-3166</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3387">CVE-2009-3387</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3989">CVE-2009-3989</uri>
+  </references>
+  <metadata tag="submitter" timestamp="Sat, 14 Feb 2009 18:17:01 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Sat, 10 Oct 2009 16:01:17 +0000">
+    jaervosz
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-20.xml b/xml/htdocs/security/en/glsa/glsa-201006-20.xml
new file mode 100644
index 00000000..5d593140
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-20.xml
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-20">
+  <title>Asterisk: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in Asterisk might allow remote attackers to cause
+    a Denial of Service condition, or conduct other attacks.
+  </synopsis>
+  <product type="ebuild">asterisk</product>
+  <announced>June 04, 2010</announced>
+  <revised>June 04, 2010: 01</revised>
+  <bug>281107</bug>
+  <bug>283624</bug>
+  <bug>284892</bug>
+  <bug>295270</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-misc/asterisk" auto="yes" arch="*">
+      <unaffected range="ge">1.2.37</unaffected>
+      <vulnerable range="lt">1.2.37</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Asterisk is an open source telephony engine and toolkit.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in Asterisk:
+    </p>
+    <ul>
+    <li>Nick Baggott reported that Asterisk does not properly process
+    overly long ASCII strings in various packets (CVE-2009-2726).</li>
+    <li>Noam Rathaus and Blake Cornell reported a flaw in the IAX2 protocol
+    implementation (CVE-2009-2346).</li>
+    <li>amorsen reported an input
+    processing error in the RTP protocol implementation
+    (CVE-2009-4055).</li>
+    <li>Patrik Karlsson reported an information
+    disclosure flaw related to the REGISTER message (CVE-2009-3727).</li>
+    <li>A vulnerability was found in the bundled Prototype JavaScript
+    library, related to AJAX calls (CVE-2008-7220).</li>
+    </ul>
+  </description>
+  <impact type="normal">
+    <p>
+    A remote attacker could exploit these vulnerabilities by sending a
+    specially crafted package, possibly causing a Denial of Service
+    condition, or resulting in information disclosure.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All Asterisk users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-misc/asterisk-1.2.37&quot;</code>
+    <p>
+    NOTE: This is a legacy GLSA. Updates for all affected architectures are
+    available since January 5, 2010. It is likely that your system is
+    already no longer affected by this issue.
+    </p>
+  </resolution>
+  <references>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2726">CVE-2009-2726</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2346">CVE-2009-2346</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4055">CVE-2009-4055</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3727">CVE-2009-3727</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7220">CVE-2008-7220</uri>
+  </references>
+  <metadata tag="requester" timestamp="Fri, 06 Nov 2009 13:21:43 +0000">
+    craig
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 31 May 2010 15:08:16 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 31 May 2010 15:08:22 +0000">
+    a3li
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/glsa-201006-21.xml b/xml/htdocs/security/en/glsa/glsa-201006-21.xml
new file mode 100644
index 00000000..034229db
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/glsa-201006-21.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+
+<glsa id="201006-21">
+  <title>UnrealIRCd: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities in UnrealIRCd might allow remote attackers to
+    compromise the "unrealircd" account, or cause a Denial of Service.
+  </synopsis>
+  <product type="ebuild">unrealircd</product>
+  <announced>June 14, 2010</announced>
+  <revised>June 14, 2010: 02</revised>
+  <bug>260806</bug>
+  <bug>323691</bug>
+  <access>remote</access>
+  <affected>
+    <package name="net-irc/unrealircd" auto="yes" arch="*">
+      <unaffected range="ge">3.2.8.1-r1</unaffected>
+      <vulnerable range="lt">3.2.8.1-r1</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    UnrealIRCd is an Internet Relay Chat (IRC) daemon.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been reported in UnrealIRCd:
+    </p>
+    <ul>
+    <li>The vendor reported a buffer overflow in the user authorization
+    code (CVE-2009-4893).</li>
+    <li>The vendor reported that the distributed source code of UnrealIRCd
+    was compromised and altered to include a system() call that could be
+    called with arbitrary user input (CVE-2010-2075).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    A remote attacker could exploit these vulnerabilities to cause the
+    execution of arbitrary commands with the privileges of the user running
+    UnrealIRCd, or a Denial of Service condition. NOTE: By default
+    UnrealIRCd on Gentoo is run with the privileges of the "unrealircd"
+    user.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    All UnrealIRCd users should upgrade to the latest version:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose &quot;&gt;=net-irc/unrealircd-3.2.8.1-r1&quot;</code>
+  </resolution>
+  <references>
+    <uri link="http://www.unrealircd.com/txt/unrealsecadvisory.20090413.txt">UnrealIRCd Security Advisory 20090413</uri>
+    <uri link="http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt">UnrealIRCd Security Advisory 20100612</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4893">CVE-2009-4893</uri>
+    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2075">CVE-2010-2075</uri>
+  </references>
+  <metadata tag="requester" timestamp="Sat, 12 Jun 2010 21:31:31 +0000">
+    a3li
+  </metadata>
+  <metadata tag="submitter" timestamp="Mon, 14 Jun 2010 17:00:57 +0000">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="Mon, 14 Jun 2010 17:17:46 +0000">
+    vorlon
+  </metadata>
+</glsa>
diff --git a/xml/htdocs/security/en/glsa/index.xml b/xml/htdocs/security/en/glsa/index.xml
new file mode 100644
index 00000000..008373e6
--- /dev/null
+++ b/xml/htdocs/security/en/glsa/index.xml
@@ -0,0 +1,31 @@
+<?xml version='1.0' encoding="utf-8"?>
+<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
+<!DOCTYPE guide SYSTEM "/dtd/guide.dtd">
+
+<guide link="/security/en/glsa/index.xml">
+<title>Gentoo Linux Security Advisories</title>
+
+<author title="Author">
+  <mail link="security@gentoo.org">Security Team</mail>
+</author>
+
+<abstract>
+This index is automatically generated from XML source. Please contact the
+Gentoo Linux Security Team (security@gentoo.org) for related inquiries.
+</abstract>
+
+<license/>
+<version>0.7</version>
+<date>every 60 minutes</date>
+
+<chapter>
+<title>GLSA Chronological Index</title>
+<section>
+<body>
+
+<glsaindex/>
+
+</body>
+</section>
+</chapter>
+</guide>