3831 matches found
tqdm: Arbitrary code execution
Background tqdm is a smart progress meter. Description A vulnerablility was discovered in tqdm.version that could allow a malicious git log within the current working directory. Impact A remote attacker could execute arbitrary commands by enticing a user to clone a crafted repo. Workaround There ...
PNP4Nagios: Root privilege escalation
Background PNP4Nagios is an addon for the Nagios Network Monitoring System. Description It was found that PHP4Nagios creates files owned by an unprivileged user that are used by root. Impact A local attacker could escalate privileges to root. Workaround There is no known workaround at this time...
file: Denial of service
Background file is a utility that guesses a file format by scanning binary data for patterns. Description File does not properly utilize the docorenote function in readelf.c in libmagic.a. Impact A remote attacker could send a specially crafted ELF file possibly resulting in a Denial of Service...
Chromium, Google Chrome: User-assisted execution of arbitrary code
Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Description An out of bounds flaw has discovered in Chromium and Chrome’s ...
Transmission: Remote code execution
Background Transmission is a cross-platform BitTorrent client. Description A vulnerability was discovered in how Transmission handles access control through the X-Transmission-Session-Id. Impact A remote attacker could execute arbitrary RFC commands or consequently conduct a DNS rebinding attack...
cURL: Multiple vulnerabilities
Background A command line tool and library for transferring data with URLs. Description Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details. Impact Remote attackers could cause a Denial of Service condition, obtain sensitive...
Quassel: Multiple vulnerabilities
Background Quassel is a Qt4/KDE4 IRC client suppporting a remote daemon for 24/7 connectivity. Description Multiple vulnerabilities have been discovered in Quassel. Please review the CVE identifiers referenced below for details. Impact A remote attacker could cause arbitrary code execution or a...
BURP: Multiple vulnerabilities
Background A network backup and restore program. Description It was discovered that Gentoo’s BURP ebuild does not properly set permissions or place the pid file in a safe directory. Impact A local attacker could escalate privileges. Workaround Users should ensure the proper permissions are set as...
Adobe Flash Player: Multiple vulnerabilities
Background The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Description Multiple vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers referenced below for details. Impact A remote attacke...
GNU Wget: Cookie injection
Background GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols. Description A vulnerability was discovered in GNU Wget’s respnew function which does not validate \r\n sequences in continuation lines. Impact A remote attacker...
procps: Multiple vulnerabilities
Background A bunch of small useful utilities that give information about processes using the /proc filesystem. Description Multiple vulnerabilities have been discovered in procps. Please review the CVE identifiers referenced below for details. Impact A local attacker could execute arbitrary code,...
beep: Local privilege escalation
Background The advanced PC speaker beeper. Description A race condition, if setuid, was discovered in beep. Impact A local attacker could escalate privileges. Workaround There is no known workaround at this time. Resolution All beep users should upgrade to the latest version: emerge --sync emerge...
Git: Multiple vulnerabilities
Background Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency. Description Multiple vulnerabilities have been discovered in Git. Please review the CVE identifiers referenced below for details...
NTP: Multiple vulnerabilities
Background NTP contains software for the Network Time Protocol. Description Multiple vulnerabilities have been discovered in NTP. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code or cause a Denial of Service condition...
Zsh: Multiple vulnerabilities
Background A shell designed for interactive use, although it is also a powerful scripting language. Description Multiple vulnerabilities have been discovered in Zsh. Please review the CVE identifiers referenced below for details. Impact A local attacker could execute arbitrary code, escalate...
Rootkit Hunter: User-assisted execution of arbitrary code
Background Scans for known and unknown rootkits, backdoors, and sniffers. Description A vulnerability was discovered in Rootkit Hunter that allows the downloading of mirror updates over insecure channels HTTP. Furthermore, the mirror update is then executed in Bash. Impact A remote attacker, by...
VirtualBox: Multiple vulnerabilities
Background VirtualBox is a powerful virtualization product from Oracle. Description Multiple vulnerabilities have been discovered in VirtualBox. Please review the CVE identifiers referenced below for details. Impact An attacker could take control of VirtualBox resulting in the execution of...
Shadow: security bypass
Background Shadow is a set of tools to deal with user accounts. Description A local attacker could possibly bypass security restrictions if an administrator used “group blacklisting” to restrict access to file system paths. Impact A local attacker could possibly bypass security restrictions...
Samba: Multiple vulnerabilities
Background Samba is a suite of SMB and CIFS client/server programs. Description Multiple vulnerabilities have been discovered in Samba. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code, cause a Denial of Service...
Chromium, Google Chrome: Multiple vulnerabilities
Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Description Multiple vulnerabilities have been discovered in Chromium and...
mpv: Remote code execution
Background Video player based on MPlayer/mplayer2 Description A vulnerability was discovered in mpv with the handling of HTML documents containing VIDEO elements. Additionally, mpv accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdlhook.lua. Impact A remote...
rsync: Arbitrary command execution
Background File transfer program to keep remote files into sync. Description A vulnerability was discovered in rsync’s parsearguments function in options.c. Impact Remote attackers could possibly execute arbitrary commands with the privilege of the process. Workaround There is no known workaround...
hesiod: Root privilege escalation
Background DNS functionality to access to DB of information that changes infrequently. Description Multiple vulnerabilities have been discovered in hesiod that have remained unaddressed. Please review the referenced CVE identifiers for details. Impact A remote or local attacker may be able to...
Chromium, Google Chrome: Multiple vulnerabilities
Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Description Multiple vulnerabilities have been discovered in Chromium and...
Python: Buffer overflow
Background Python is an interpreted, interactive, object-oriented programming language. Description A buffer overflow was discovered in Python’s PyStringDecodeEscape function in stringobject.c. Impact Remote attackers, by enticing a user to process a specially crafted file, could execute arbitrar...
Chromium, Google Chrome: Multiple vulnerabilities
Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Description Multiple vulnerabilities have been discovered in Chromium and...
unADF: Remote code execution
Background An unzip like for .ADF files. Description Multiple vulnerabilities were discovered in unADF that can lead to remote code execution. Please review the CVE identifiers referenced below for details. Impact A remote attacker, by enticing a user to process a specially crafted file, could...
tenshi: Privilege escalation
Background A log monitoring program, designed to watch one or more log files for lines matching user defined regular expressions and report on the matches. Description It was discovered that the tenshi ebuild creates a tenshi.pid file after dropping privileges to a non-root account. Impact A loca...
ClamAV: Multiple vulnerabilities
Background ClamAV is a GPL virus scanner. Description Multiple vulnerabilities have been discovered in ClamAV. Please review the CVE identifiers referenced below for details. Impact A remote attacker, through multiple vectors, could execute arbitrary code, cause a Denial of Service condition, or...
Quagga: Multiple vulnerabilities
Background Quagga is a free routing daemon replacing Zebra supporting RIP, OSPF and BGP. Description Multiple vulnerabilities have been discovered in Quagga. Please review the CVE identifiers referenced below for details. Impact A remote attacker, by sending specially crafted packets, could execu...
mbed TLS: Multiple vulnerabilites
Background mbed TLS previously PolarSSL is an “easy to understand, use, integrate and expand” implementation of the TLS and SSL protocols and the respective cryptographic algorithms and support code required. Description Multiple vulnerabilities have been discovered in mbed TLS. Please review the...
librelp: Remote code execution
Background A reliable logging program. Description A buffer overflow was discovered in librelp with the handling of x509 certificates. Impact A remote attacker, by sending a specially crafted x509 certificate, could execute arbitrary code. Workaround There is no known workaround at this time...
GDK-PixBuf: Remote code execution
Background GDK-PixBuf is an image loading library for GTK+. Description Several integer overflows were discovered in GDK-PixBuf’s gifgetlzw function. Impact A remote attacker, by enticing a user to process a specially crafted image file, could execute arbitrary code or cause a Denial of Service...
ncurses: Multiple vulnerabilities
Background Free software emulation of curses in System V. Description Multiple vulnerabilities have been discovered in ncurses. Please review the CVE identifiers referenced below for details. Impact A remote attacker, by enticing the user to process untrusted terminfo or other data, could execute...
Evince: Command injection
Background Evince is a document viewer for multiple document formats, including PostScript. Description A vulnerability was discovered in Evince’s handling of filenames while printing PDF files. Impact A remote attacker, by enticing the user to process a specially crafted file, could execute...
Go: Arbitrary code execution
Background Go is an open source programming language that makes it easy to build simple, reliable, and efficient software. Description A vulnerability in Go was discovered which does not validate the import path of remote repositories. Impact Remote attackers, by enticing a user to import from a...
Adobe Flash Player: Multiple vulnerabilities
Background The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Description Multiple vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers referenced below for details. Impact A remote attacke...
Zend Framework: Multiple vulnerabilities
Background Zend Framework is a high quality and open source framework for developing Web Applications. Description Multiple vulnerabilities have been discovered in Zend Framework that have remain unaddressed. Please review the referenced CVE identifiers for details. Impact Remote attackers could...
ISC DHCP: Multiple vulnerabilities
Background ISC DHCP is a Dynamic Host Configuration Protocol DHCP client/server. Description Multiple vulnerabilities have been discovered in ISC DHCP. Please review the CVE identifiers referenced below for details. Impact Remote attackers could execute arbitrary code, cause a Denial of Service...
mailx: Multiple vulnerabilities
Background A utility program for sending and receiving mail, also known as a Mail User Agent program. Description Multiple vulnerabilities have been discovered in mailx. Please review the CVE identifiers referenced below for details. Impact A remote attacker could execute arbitrary commands...
cURL: Multiple vulnerabilities
Background A command line tool and library for transferring data with URLs. Description Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details. Impact Remote attackers could cause a Denial of Service condition, obtain sensitive...
libvirt: Multiple vulnerabilities
Background libvirt is a C toolkit for manipulating virtual machines. Description Multiple vulnerabilities have been discovered in libvirt. Please review the CVE identifiers referenced below for details. Impact A local privileged attacker could execute arbitrary commands or cause a Denial of Servi...
QEMU: Multiple vulnerabilities
Background QEMU is a generic and open source machine emulator and virtualizer. Description Multiple vulnerabilities have been discovered in QEMU. Please review the CVE identifiers referenced below for details. Impact An attacker could execute arbitrary code, cause a Denial of Service condition, o...
Poppler: Multiple vulnerabilities
Background Poppler is a PDF rendering library based on the xpdf-3.0 code base. Description Multiple vulnerabilities have been discovered in Poppler. Please review the CVE identifiers referenced below for details. Impact A remote attacker, by enticing a user to open a specially crafted PDF, could...
SPICE VDAgent: Arbitrary command injection
Background Provides a complete open source solution for remote access to virtual machines in a seamless way so you can play videos, record audio, share USB devices and share folders without complications. Description SPICE VDAgent does not properly escape save directory before passing to shell...
libxslt: Multiple vulnerabilities
Background libxslt is the XSLT C library developed for the GNOME project. XSLT is an XML language to define transformations for XML. Description Multiple vulnerabilities have been discovered in libxslt. Please review the CVE identifiers referenced below for details. Impact A remote attacker, via ...
glibc: Multiple vulnerabilities
Background glibc is a package that contains the GNU C library. Description Multiple vulnerabilities have been discovered in glibc. Please review the CVE identifiers referenced below for details. Impact An attacker could possibly execute arbitrary code, escalate privileges, cause a Denial of Servi...
Mozilla Thunderbird: Multiple vulnerabilities
Background Mozilla Thunderbird is a popular open-source email client from the Mozilla project. Description Multiple vulnerabilities have been discovered in Mozilla Thunderbird. Please review the referenced Mozilla Foundation Security Advisories and CVE identifiers below for details. Impact A remo...
BusyBox: Multiple vulnerabilities
Background BusyBox is a set of tools for embedded systems and is a replacement for GNU Coreutils. Description Multiple vulnerabilities have been discovered in BusyBox. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code wi...
PLIB: User-assisted execution of arbitrary code
Background PLIB includes sound effects, music, a complete 3D engine, font rendering, a simple Windowing library, a game scripting language, a GUI, networking, 3D math library and a collection of handy utility functions. Description A stack-based buffer overflow within the error function of...