You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
331 lines
10 KiB
331 lines
10 KiB
<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/dtd/glsa.dtd,v 1.17 2008/04/04 17:04:39 neysx Exp $ -->
|
|
<!ELEMENT glsa (title,synopsis,product,announced,revised,bug*,access?,affected,background?,description,impact,workaround,resolution,references,license?,metadata*)>
|
|
<!ATTLIST glsa id CDATA #REQUIRED>
|
|
|
|
<!--
|
|
Element: title
|
|
Description: Provides a 4-5 word description about the advisory
|
|
Example: <title>Buffer overflow vulnerability found in openssl-0.9.5</title>
|
|
-->
|
|
<!ELEMENT title (#PCDATA)>
|
|
|
|
<!--
|
|
Element: synopsis
|
|
Description: Small, to-the-point description about the GLSA
|
|
|
|
Example: <synopsis>
|
|
rsync has an exploitable buffer overflow that can lead to
|
|
remote compromise
|
|
</synopsis>
|
|
-->
|
|
<!ELEMENT synopsis (#PCDATA)>
|
|
|
|
<!--
|
|
Element: product
|
|
Description: Defines what type of security announcement this is.
|
|
|
|
Valid types are:
|
|
- ebuild A Portage-provided ebuild has a security
|
|
issue
|
|
- informational This GLSA is purely informational, no Gentoo
|
|
system is affected
|
|
- infrastructure The security issue involves the Gentoo
|
|
infrastructure
|
|
|
|
The text contains one keyword that defines the issue.
|
|
Note: All type values but 'ebuild' are considered deprecated.
|
|
|
|
Example: <product type="ebuild">openssl</product>
|
|
Example: <product type="infrastructure">rsync mirror</product>
|
|
-->
|
|
<!ELEMENT product (#PCDATA)>
|
|
<!ATTLIST product type (ebuild|infrastructure|informational) #REQUIRED>
|
|
|
|
<!--
|
|
Element: announced
|
|
Description: Date when the advisory is publicised
|
|
The format must be "YYYY-mm-dd"
|
|
|
|
Example: <announced>2003-11-20</announced>
|
|
-->
|
|
<!ELEMENT announced (#PCDATA)>
|
|
|
|
<!--
|
|
Element: revised
|
|
Description: Last revision date of the GLSA
|
|
Attribute: @count: number of revisions
|
|
|
|
Example: <revised count="02">2003-11-20</revised>
|
|
-->
|
|
<!ELEMENT revised (#PCDATA)>
|
|
<!ATTLIST revised count CDATA "01">
|
|
|
|
<!--
|
|
Element: bug
|
|
Description: Number of the bug on bugs.gentoo.org, if any
|
|
Occurrence: The bug element can occur 0, 1 or more times
|
|
|
|
Example: <bug>34200</bug>
|
|
-->
|
|
<!ELEMENT bug (#PCDATA)>
|
|
|
|
<!--
|
|
Element: access
|
|
Description: Type of access necessary to exploit the security issue
|
|
This element should only be used when product@type = 'ebuild'
|
|
Occurrence: The access element can occur 0 or 1 time
|
|
|
|
Example: <access>Remote</access>
|
|
-->
|
|
<!ELEMENT access (#PCDATA)>
|
|
|
|
<!--
|
|
Element: affected
|
|
Description: Describe what the affected subjects are.
|
|
|
|
If product@type = 'ebuild', the child elements are 'package'
|
|
If product@type = 'portage', the child elements are 'package'
|
|
If product@type = 'infrastructure', the child elements are
|
|
'service'
|
|
|
|
-->
|
|
<!ELEMENT affected (package*|service*)>
|
|
|
|
<!--
|
|
Element: package
|
|
Description: Provide all necessary information regarded the affected
|
|
packages. It also contains information about the affected
|
|
architectures, if automatic updates can be done and the update
|
|
|
|
The "update" attribute contains the path to the non-vulnerable
|
|
version of the package
|
|
|
|
The "auto" attribute contains either "yes" or "no" and tells
|
|
Portage that the package can be updated automatically (to be
|
|
implemented) without further user interaction
|
|
|
|
The "arch" attribute contains either the architecture (as used
|
|
by ACCEPT_KEYWORDS) or the "*" value (in case all
|
|
architectures are affected)
|
|
|
|
Occurrence: The package element can occur 0, 1 or more times
|
|
Example: <package name="dev-libs/openssl" auto="yes" arch="*">
|
|
<vulnerable range="lt">0.9.6k</vulnerable>
|
|
<unaffected range="gt">0.9.6k</unaffected>
|
|
</package>
|
|
-->
|
|
<!ELEMENT package (vulnerable|unaffected)*>
|
|
<!ATTLIST package name CDATA #REQUIRED
|
|
auto (yes|no) #REQUIRED
|
|
arch CDATA #REQUIRED>
|
|
|
|
<!--
|
|
Element: vulnerable
|
|
Description: Version of the vulnerable package. Can be a range too
|
|
-->
|
|
<!ELEMENT vulnerable (#PCDATA)>
|
|
<!ATTLIST vulnerable range (le|lt|eq|gt|ge|rlt|rle|rgt|rge) #REQUIRED
|
|
slot CDATA "*">
|
|
|
|
<!--
|
|
Element: unaffected
|
|
Description: Version of the fixed (or unaffected) package. In case the
|
|
package is superseded by another package, you need to
|
|
define that package using the "name" attribute.
|
|
|
|
The r* range information is revision-specific. For instance,
|
|
rge foo-1.2.3-r4 == >=foo-1.2.3-r4 && <foo-1.2.4
|
|
|
|
Example:
|
|
<unaffected range="gt" name="foobar">2.0.0</unaffected>
|
|
-->
|
|
<!ELEMENT unaffected (#PCDATA)>
|
|
<!ATTLIST unaffected range (le|lt|eq|gt|ge|rlt|rle|rgt|rge) #REQUIRED
|
|
slot CDATA "*"
|
|
name CDATA #IMPLIED>
|
|
|
|
<!--
|
|
Element: service
|
|
Description: Provide information about the Gentoo services that are
|
|
affected by the security advisory. Portage must be able
|
|
to parse this information to make decisions (for instance,
|
|
ignore an rsync server or a certain distfiles mirror).
|
|
|
|
The type attribute can be one of "rsync", "web", "mirror".
|
|
|
|
The fixed attribute (denoting if the problem has been solved)
|
|
can be one of "yes" or "no". If not used, the default value is
|
|
"no".
|
|
|
|
Occurrence: The service element can occur 0, 1 or more times
|
|
Example: <service type="rsync">rsync://rsync.someserver.tld/gentoo-portage</service>
|
|
-->
|
|
<!ELEMENT service (#PCDATA)>
|
|
<!ATTLIST service type (rsync|web|mirror) #REQUIRED
|
|
fixed (yes|no) #IMPLIED>
|
|
|
|
<!--
|
|
Element: uri
|
|
Description: Link to the organisation involved in releasing the advisory
|
|
Occurrence: The uri element can occur 0, 1 or more times
|
|
|
|
Example: <uri link="http://www.cert.org">CERT</uri>
|
|
-->
|
|
<!ELEMENT uri (#PCDATA)>
|
|
<!ATTLIST uri link CDATA #IMPLIED>
|
|
|
|
<!--
|
|
Element: mail
|
|
Description: Mail address of the people involved in releasing the advisory
|
|
Occurrence: The mail element can occur 0, 1 or more times
|
|
|
|
Example: <mail link="some@person.com">Some Person</mail>
|
|
-->
|
|
<!ELEMENT mail (#PCDATA)>
|
|
<!ATTLIST mail link CDATA #REQUIRED>
|
|
|
|
<!--
|
|
Element: p
|
|
Description: Plain text
|
|
Occurrence: The "p" element can occur 0, 1 or more times and can contain
|
|
links or addresses
|
|
|
|
Example: <p>Please update your system</p>
|
|
-->
|
|
<!ELEMENT p (#PCDATA|mail|uri|b|i|br)*>
|
|
|
|
<!--
|
|
Element: code
|
|
Description: The code element contains text that should preserve whitespace
|
|
and is therefore useful for code listings or commands
|
|
|
|
Example: <code>emerge sync</code>
|
|
-->
|
|
<!ELEMENT code (#PCDATA)>
|
|
|
|
<!--
|
|
Element: background
|
|
Description: Provides a background of the affected package(s)/service(s)
|
|
The background element contains only "<p>"s in which the text
|
|
is placed
|
|
|
|
-->
|
|
<!ELEMENT background (p|ul|ol)*>
|
|
|
|
<!--
|
|
Element: description
|
|
Description: Provides a description about the security issue
|
|
The description element contains only "<p>"s.
|
|
-->
|
|
<!ELEMENT description (p|ul|ol|code)*>
|
|
|
|
<!--
|
|
Element: impact
|
|
Description: Provides information about the impact that the security issue
|
|
can have
|
|
|
|
The "impact" element contains only "<p>"s.
|
|
|
|
The type element gives a short term, such as
|
|
"Denial of Service", "Buffer Overflow", ...
|
|
|
|
-->
|
|
<!ELEMENT impact (p|ul|ol)*>
|
|
<!ATTLIST impact type CDATA #REQUIRED>
|
|
|
|
<!--
|
|
Element: workaround
|
|
Description: Provides information about how the security issue can be
|
|
(temporarily) resolved through a work-around
|
|
|
|
The "workaround" element contains only "<p>"s and "<code>"s.
|
|
-->
|
|
<!ELEMENT workaround (p|code|ul|ol)*>
|
|
|
|
<!--
|
|
Element: resolution
|
|
Description: Provides information about how the security issue can be
|
|
resolved.
|
|
|
|
The "resolution" element contains only "<p>"s and "<code>"s.
|
|
-->
|
|
<!ELEMENT resolution (p|code|ul|ol)*>
|
|
|
|
<!--
|
|
Element: references
|
|
Description: Provides links to resources / references available online.
|
|
|
|
The "reference" element contains only "<uri>"s.
|
|
-->
|
|
<!ELEMENT references (uri*)>
|
|
|
|
<!--
|
|
Element: ul
|
|
Description: Add an unnumbered listing; can only contain <li>'s
|
|
-->
|
|
<!ELEMENT ul (li*)>
|
|
|
|
<!--
|
|
Element: ol
|
|
Description: Add a numbered listing; can only contain <li>'s
|
|
-->
|
|
<!ELEMENT ol (li*)>
|
|
|
|
<!--
|
|
Element: li
|
|
Description: Element of a listing
|
|
|
|
Example: <ul>
|
|
<li>This is element one</li>
|
|
<li>This is a second element</li>
|
|
</ul>
|
|
-->
|
|
<!ELEMENT li (#PCDATA)>
|
|
|
|
<!--
|
|
Element: b
|
|
Description: Bold text
|
|
|
|
Example: <b>this is bold</b>
|
|
-->
|
|
<!ELEMENT b (#PCDATA)>
|
|
|
|
<!--
|
|
Element: i
|
|
Description: Input text (blue)
|
|
|
|
Example: The user has to type in <i>ls</i> to see.
|
|
-->
|
|
<!ELEMENT i (#PCDATA)>
|
|
|
|
<!--
|
|
Element: br
|
|
Description: hard line break
|
|
|
|
Example: And then: <br/>
|
|
KABLAM!
|
|
-->
|
|
<!ELEMENT br (#PCDATA)>
|
|
|
|
<!--
|
|
Element: license
|
|
Description: Add license information
|
|
|
|
Example: <license/>
|
|
-->
|
|
<!ELEMENT license (EMPTY)>
|
|
|
|
<!--
|
|
Element: metadata
|
|
Description: Metadata information for GLSAMaker
|
|
|
|
Example: <metadata tag="approved">Level 1</metadata>
|
|
|
|
On request of plasmaroo, metadata can contain all elements again.
|
|
-->
|
|
<!ELEMENT metadata (#PCDATA|metadata)*>
|
|
<!ATTLIST metadata tag CDATA #REQUIRED
|
|
revision CDATA #IMPLIED
|
|
author CDATA #IMPLIED
|
|
timestamp CDATA #IMPLIED>
|