CVE-2017-20147

In the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript uses a PID file that is writable by the smokeping user. By writing arbitrary PIDs to that file, the smokeping user can cause a denial of service to arbitrary PIDs when the service is stopped...

CVE-2017-20147

CVE-2017-20147 affects Smokeping on Gentoo (smokeping-2.7.3-r1). The initscript uses a PID file writable by the smokeping user, allowing an attacker to write arbitrary PIDs to that file and cause a denial of service to arbitrary PIDs when the service is stopped. The provided connected documents c...

CVE-2017-20148: Incorrect Permission Assignment for Critical Resource

In the ebuild package through logcheck-1.3.23.ebuild for Logcheck on Gentoo, it is possible to achieve root privilege escalation from the logcheck user because of insecure recursive chown calls...

CVE-2016-20015: Concurrent Execution using Shared Resource with Improper Synchronization

In the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript allows the smokeping user to gain ownership of any file, allowing for the smokeping user to gain root privileges. There is a race condition involving /var/lib/smokeping and chown...

Github Account of Gentoo Linux Hacked, Code Replaced With Malware

Downloaded anything from Gentoo's GitHub account yesterday? Consider those files compromised and dump them now—as an unknown group of hackers or an individual managed to gain access to the GitHub account of the Gentoo Linux distribution on Thursday and replaced the original source code with a...

GLSA-201803-07 : JabberD 2.x: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201803-07 JabberD 2.x: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Gentoos JabberD 2.x ebuild. Please review the referenced CVE identifiers for details. Impact : An attacker could possibly escalate...

JabberD 2.x: Multiple vulnerabilities

Background JabberD 2.x is an open source Jabber server written in C. Description Multiple vulnerabilities have been discovered in Gentoo’s JabberD 2.x ebuild. Please review the referenced CVE identifiers for details. Impact An attacker could possibly escalate privileges by owning system binaries ...

Gentoo Local Privilege Vulnerability

Gentoo is an open source Linux system from the Gentoo Foundation. Ebuild in Gentoo may change directory and file permissions based on the order of installed packages, which can be exploited by a local attacker to read or write to a restricted directory, execute restricted commands via the affecte...

CVE-2004-2778

Ebuild in Gentoo may change directory and file permissions depending on the order of installed packages, which allows local users to read or write to restricted directories or execute restricted commands via navigating to the affected directories, or executing the affected commands...

CVE-2004-2778

Ebuild in Gentoo may change directory and file permissions depending on the order of installed packages, which allows local users to read or write to restricted directories or execute restricted commands via navigating to the affected directories, or executing the affected commands...

CVE-2004-2778

CVE-2004-2778 affects Gentoo’s ebuild handling: the order of installed packages can alter directory and file permissions, enabling a local attacker to read/write restricted dirs or run restricted commands by navigating affected paths. Connected sources corroborate Gentoo local privilege vulnerabi...

CVE-2004-2778: Undefined Security Weakness

Ebuild in Gentoo may change directory and file permissions depending on the order of installed packages, which allows local users to read or write to restricted directories or execute restricted commands via navigating to the affected directories, or executing the affected commands...

PT-2017-4428

Name of the Vulnerable Software and Affected Versions: Gentoo affected versions not specified Description: The issue in Gentoo allows local users to access restricted directories or execute commands they should not be able to, due to how the Ebuild handles directory and file permissions based on...

NGINX: Privilege escalation

Background nginx is a robust, small, and high performance HTTP and reverse proxy server. Description It was discovered that Gentoo’s default NGINX installation applied similar problematic permissions on “/var/log/nginx” as Debian DSA-3701 and is therefore vulnerable to the same attack described i...

Gentoo Security Advisory GLSA 201210-04 (ebuild)

The remote host is missing updates announced in advisory GLSA 201210-04. SPDX-FileCopyrightText: 2012 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

Gentoo Security Advisory GLSA 201202-08 (ebuild stunnel)

The remote host is missing updates announced in advisory GLSA 201202-08. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200710-25 (mldonkey)

The remote host is missing updates announced in advisory GLSA 200710-25. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2007-5714: Improper Authentication

The Gentoo ebuild of MLDonkey before 2.9.0-r3 has a p2p user account with an empty default password and valid login shell, which might allow remote attackers to obtain login access and execute arbitrary code...

MLDonkey: Privilege escalation

Background MLDonkey is a peer-to-peer filesharing client that connects to several different peer-to-peer networks, including Overnet and BitTorrent. Description The Gentoo MLDonkey ebuild adds a user to the system named "p2p" so that the MLDonkey service can run under a user with low privileges...

GLSA-200701-19 : OpenLDAP: Insecure usage of /tmp during installation

The remote host is affected by the vulnerability described in GLSA-200701-19 OpenLDAP: Insecure usage of /tmp during installation Tavis Ormandy of the Gentoo Linux Security Team has discovered that the file gencert.sh distributed with the Gentoo ebuild for OpenLDAP does not exit upon the existenc...