YJL

About a few days ago:

~ $ glsa-check -d 201203-19 | head -12
            GLSA 201203-19: 
Chromium: Multiple vulnerabilities             
============================================================================
Synopsis:          Multiple vulnerabilities have been reported in Chromium,
                   some of which may allow execution of arbitrary code.
Announced on:      March 25, 2012
Last revised on:   March 25, 2012 : 01

Affected package:  www-client/chromium
Affected archs:    All
Vulnerable:        <17.0.963.83
Unaffected:        >=17.0.963.83

I noticed this GLSA issue, but I held up until I finally decided to upgrade Chromium, I don't really use Chromium (or V8).

~ $ sudo genlop -lu | egrep '(chromium|v8)' | tail -4
     Wed Mar 28 03:17:23 2012 <<< dev-lang/v8-3.7.12.20
     Wed Mar 28 03:17:24 2012 >>> dev-lang/v8-3.7.12.29
     Wed Mar 28 05:10:52 2012 <<< www-client/chromium-17.0.963.56
     Wed Mar 28 05:12:07 2012 >>> www-client/chromium-17.0.963.83

Just right now:

~ $ glsa-check -d 201203-24 | head -18
          GLSA 201203-24: 
Chromium, V8: Multiple vulnerabilities           
============================================================================
Synopsis:          Multiple vulnerabilities have been reported in Chromium
                   and V8, some of which may allow execution of arbitrary
                   code.
Announced on:      March 30, 2012
Last revised on:   March 30, 2012 : 01

Affected package:  dev-lang/v8
Affected archs:    All
Vulnerable:        <3.8.9.16
Unaffected:        >=3.8.9.16

Affected package:  www-client/chromium
Affected archs:    All
Vulnerable:        <18.0.1025.142
Unaffected:        >=18.0.1025.142

I said "Oh, come on!"

~ $ sudo genlop -t -S '(chromium|v8)' | tail -6
     Wed Mar 28 03:17:24 2012 >>> dev-lang/v8v8
       merge time: 4 minutes and 44 seconds.

     Wed Mar 28 05:12:07 2012 >>> www-client/chromiumchromium
       merge time: 1 hour, 54 minutes and 43 seconds.

(I think I found a bug with -S in genlop, see the repeating package name?)

Only Chromium uses v8 and I don't run JavaScript scripts outside of browsers. I think I am going to unmerge Chromium.

If you primarily are a Chromium user, enjoy the merging! ;p

The time has only passed 20% of March and GLSA has already had more issues than last month:


Sync your Portage tree and check with glsa-check -l to see if your system have holes. If it does, what are you waiting for? Update now and don't forget to subscribe to the feed of GLSA.