CVE-2023-26033 Gentoo soko contains DoS attack based on SQL Injection

Gentoo soko is the code that powers packages.gentoo.org. Versions prior to 1.0.1 are vulnerable to SQL Injection, leading to a Denial of Service. If the user selects in user preferences the "Recently Visited Packages" view for the index page, the value of the searchhistory cookie is used as a...

CVE-2023-26033

Gentoo soko (packages.gentoo.org) is vulnerable to SQL injection in versions prior to 1.0.1, exploitable via the Recently Visited Packages search_history cookie. Attackers can alter the cookie (base64-encoded comma list of atoms) to inject SQL into atom = '%s' queries, potentially wiping or alter...

CVE-2023-26033 Gentoo soko contains DoS attack based on SQL Injection

Gentoo soko is the code that powers packages.gentoo.org. Versions prior to 1.0.1 are vulnerable to SQL Injection, leading to a Denial of Service. If the user selects in user preferences the "Recently Visited Packages" view for the index page, the value of the searchhistory cookie is used as a...

PT-2023-20436 · Gentoo · Soko

Name of the Vulnerable Software and Affected Versions: Gentoo soko versions prior to 1.0.1 Description: The issue allows for SQL Injection, leading to a Denial of Service. When the "Recently Visited Packages" view is selected, the search history cookie value is used in SQL queries without proper...

SUSE CVE-2007-1856

Vixie Cron before 4.1-r10 on Gentoo Linux is installed with insecure permissions, which allows local users to cause a denial of service cron failure by creating hard links, which results in a failed stnlink check in database.c...

SUSE CVE-2007-4074

The default configuration of Centre for Speech Technology Research CSTR Festival 1.95 beta aka 2.0 beta on Gentoo Linux, SUSE Linux, and possibly other distributions, is run locally with elevated privileges without requiring authentication, which allows local and remote attackers to execute...

SUSE CVE-2015-8556

Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1...

SUSE CVE-2022-23220

USBView 2.1 before 2.2 allows some local users e.g., ones logged in via SSH to execute arbitrary code as root because certain Polkit settings e.g., allowany=yes for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu,...

CVE-2020-36657

uptimed before 0.4.6-r1 on Gentoo allows local users with access to the uptimed user account to gain root privileges by creating a hard link within the /var/spool/uptimed directory, because there is an unsafe chown -R call...

CVE-2020-36657

uptimed before 0.4.6-r1 on Gentoo allows local users with access to the uptimed user account to gain root privileges by creating a hard link within the /var/spool/uptimed directory, because there is an unsafe chown -R call...

CVE-2018-25078

man-db before 2.8.5 on Gentoo allows local users with access to the man user account to gain root privileges because /usr/bin/mandb is executed by root but not owned by root. Also, the owner can strip the setuid and setgid bits...

CVE-2018-25078

man-db before 2.8.5 on Gentoo allows local users with access to the man user account to gain root privileges because /usr/bin/mandb is executed by root but not owned by root. Also, the owner can strip the setuid and setgid bits...

Hardcoded credentials

uptimed before 0.4.6-r1 on Gentoo allows local users with access to the uptimed user account to gain root privileges by creating a hard link within the /var/spool/uptimed directory, because there is an unsafe chown -R call...

Code injection

man-db before 2.8.5 on Gentoo allows local users with access to the man user account to gain root privileges because /usr/bin/mandb is executed by root but not owned by root. Also, the owner can strip the setuid and setgid bits...

Gentoo 安全漏洞

Gentoo is an open source Linux system from the Gentoo Foundation. A security vulnerability exists in versions prior to Gentoo uptimed 0.4.6-r1, which stems from...

Gentoo 安全漏洞

Gentoo is an open source Linux system from the Gentoo Foundation. A security vulnerability exists in Gentoo man-db versions prior to 2.8.5. An attacker exploited the vulnerability to gain root privileges...

CVE-2020-36657

uptimed before 0.4.6-r1 on Gentoo allows local users with access to the uptimed user account to gain root privileges by creating a hard link within the /var/spool/uptimed directory, because there is an unsafe chown -R call...

CVE-2018-25078

man-db before 2.8.5 on Gentoo allows local users with access to the man user account to gain root privileges because /usr/bin/mandb is executed by root but not owned by root. Also, the owner can strip the setuid and setgid bits...

CVE-2020-36657

uptimed before 0.4.6-r1 on Gentoo allows local users with access to the uptimed user account to gain root privileges by creating a hard link within the /var/spool/uptimed directory, because there is an unsafe chown -R call...

CVE-2018-25078

The CVE-2018-25078 issue affects man-db prior to 2.8.5 on Gentoo. Root privileges can be gained because /usr/bin/mandb is executed by root but not owned by root, and ownership can allow stripping of setuid/setgid bits. The vulnerability is described across multiple sources (e.g., Gentoo GLSA 2023...