Portage: Man-in-the-middle

Background Portage is the package management and distribution system for Gentoo. Description A vulnerability was discovered in emerge-delta-webrsync and Portage that did not properly validate the revocation status of GPG keys. Impact A remote attacker could conduct a man-in-the-middle attack...

Github Account of Gentoo Linux Hacked, Code Replaced With Malware

Downloaded anything from Gentoo's GitHub account yesterday? Consider those files compromised and dump them now—as an unknown group of hackers or an individual managed to gain access to the GitHub account of the Gentoo Linux distribution on Thursday and replaced the original source code with a...

Github Account of Gentoo Linux Hacked, Code Replaced With Malware

Downloaded anything from Gentoo's GitHub account yesterday? Consider those files compromised and dump them now—as an unknown group of hackers or an individual managed to gain access to the GitHub account of the Gentoo Linux distribution on Thursday and replaced the original source code with a...

CVE-2005-3582

ImageMagick before 6.2.4.2-r1 allows local users in the portage group to increase privileges via a shared object in the Portage temporary build directory, which is added to the search path allowing objects in it to be loaded at runtime...

Gentoo Security Advisory GLSA 201507-16

Gentoo Linux Local Security Checks GLSA 201507-16 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

GLSA-201507-16 : Portage: Man-in-the-middle attack

The remote host is affected by the vulnerability described in GLSA-201507-16 Portage: Man-in-the-middle attack Portage does not verify X.509 SSL certificates properly if HTTPS is used. Impact : A remote attacker can spoof servers and modify binary package lists via specially crafted certificates...

Portage: Man-in-the-middle attack

Background Portage is the package management and distribution system for Gentoo. Description Portage does not verify X.509 SSL certificates properly if HTTPS is used. Impact A remote attacker can spoof servers and modify binary package lists via specially crafted certificates. Workaround There is...

The vulnerability of the Gentoo Linux operating system allows a malicious individual to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability in the portage package of the Gentoo Linux operating system up to version 2.1.4.5 can lead to a violation of confidentiality, integrity, and accessibility of protected information. This vulnerability can be exploited locally...

The vulnerability of the Gentoo Linux operating system allows a malicious individual to compromise the integrity of protected information.

The vulnerability in the portage package of the Gentoo Linux operating system up to version 2.1.3.11 can lead to the compromise of protected information. This vulnerability can be exploited locally...

Vulnerabilities of the Gentoo Linux operating system, which allow a malicious individual to compromise the integrity of protected information

The multiple vulnerabilities in the portage package up to version 2.0.51-r2 inclusive of the Gentoo Linux operating system can lead to the compromise of protected information. These vulnerabilities can be exploited locally...

CVE-2013-2100

The urlopen function in pym/portage/util/urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate...

Design/Logic Flaw

The urlopen function in pym/portage/util/urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate...

PYSEC-2014-115

The urlopen function in pym/portage/util/urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate...

PYSEC-2014-115

The urlopen function in pym/portage/util/urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate...

CVE-2013-2100

The urlopen function in pym/portage/util/urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate...

CVE-2013-2100

The CVE-2013-2100 issue affects Gentoo Portage (version 2.1.12) where the urlopen helper does not verify X.509 SSL certificates when using HTTPS. This allows a remote attacker to perform a man-in-the-middle attack to spoof the Gentoo repository and modify binary package lists via a crafted certif...

Gentoo Security Advisory GLSA 200909-10 (lmbench)

The remote host is missing updates announced in advisory GLSA 200909-10. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

LMBench: Insecure temporary file usage

Background LMBench is a suite of simple, portable benchmarks for UNIX platforms. Description Dmitry E. Oboukhov reported that the rccs and STUFF scripts do not handle "/tmp/sdiff." temporary files securely. NOTE: There might be further occurances of insecure temporary file usage. Impact A local...

Tremulous: User-assisted execution of arbitrary code

Background Tremulous is a team-based First Person Shooter game. Description It has been reported that Tremulous includes a vulnerable version of the ioQuake3 engine GLSA 200605-12, CVE-2006-2236. Impact A remote attacker could entice a user to connect to a malicious games server, possibly resulti...

Gentoo Security Advisory GLSA 200812-20 (phpcollab)

The remote host is missing updates announced in advisory GLSA 200812-20. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...