gentoo vulnerabilities

Products

• linux 136
• portage 7
• logrotate 6
• webmin 6
• cman 2
• fence 2
• soko 2
• xdg-utils 2
• xnview 2
• app-crypt pinentry 1
• dev-python-flower 1
• ebuild for slurm 1
• file 1
• linux eix 1
• linux webapp-config 1
• media-libs jpeg 1
• mirrorselect 1
• mldonkey ebuild 1
• nullmailer 1
• nvclock 1
• nview 1
• php toolkit 1
• poppassd pam 1
• qt-unixodbc 1
• rootkit hunter 1
• sci-mathematics-gimps 1
• security 1
• syslinux 1

Latest gentoo CVEs

Newest publication first · page 1 of 8

1. CVE-2024-12084 Rsync: heap buffer overflow in rsync due to improper checksum length handling

   Published 2025-01-15

   Critical·CVSS 9.8 EPSS 72.5%

   A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buf...

2. CVE-2024-12087 Rsync: path traversal vulnerability in rsync

   Published 2025-01-14

   High·CVSS 7.5 EPSS 2.3%

   A path traversal vulnerability exists in rsync. It stems from behavior enabled by the --inc-recursive option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive option, a l...

3. CVE-2024-12088 Rsync: --safe-links option bypass leads to path traversal

   Published 2025-01-14

   High·CVSS 7.5 EPSS 4.6%

   A flaw was found in rsync. When using the --safe-links option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file...

4. CVE-2024-12086 Rsync: rsync server leaks arbitrary client files

   Published 2025-01-14

   Medium·CVSS 6.8 EPSS 1.8%

   A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the cli...

5. CVE-2024-12085 Rsync: info leak via uninitialized stack contents

   Published 2025-01-14

   High·CVSS 7.5 EPSS 8.6%

   A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a ti...

6. CVE-2024-36451 Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. If this vulnerability is exploited, a console session may be hijacked by a...

   Published 2024-07-10

   High·CVSS 8.8 EPSS 0.57%

   Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. If this vulnerability is exploited, a console session may be hijacked by an unauthorized user. As a result, data within a system may be referred, a webpag...

7. CVE-2020-36770 pkg_postinst in the Gentoo ebuild for Slurm through 22.05.3 unnecessarily calls chown to assign root's ownership on files in the live root filesystem. This could be exploited by the slurm user to beco...

   Published 2024-01-15

   Critical·CVSS 9.8 EPSS 0.37%

   pkg_postinst in the Gentoo ebuild for Slurm through 22.05.3 unnecessarily calls chown to assign root's ownership on files in the live root filesystem. This could be exploited by the slurm user to become the owner of root-owned files.

8. CVE-2016-20021 Gentoo Portage missing PGP validation of executed code

   Published 2024-01-12

   Critical·CVSS 9.8 EPSS 0.46%

   In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.

9. CVE-2023-48795 Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

   Published 2023-12-18

   Medium·CVSS 5.9 EPSS 93.5% Public exploit

   The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end...

10. CVE-2023-28424 Soko SQL Injection vulnerability

    Published 2023-03-20

    Critical·CVSS 9.8 EPSS 1.2%

    Soko if the code that powers packages.gentoo.org. Prior to version 1.0.2, the two package search handlers, Search and SearchFeed, implemented in pkg/app/handler/packages/search.go, are affected by a SQL injection via the q parameter. As a result, unauthenticated attackers can exe...

11. CVE-2023-26033 Gentoo soko contains DoS attack based on SQL Injection

    Published 2023-02-24

    Critical·CVSS 9.1 EPSS 0.62%

    Gentoo soko is the code that powers packages.gentoo.org. Versions prior to 1.0.1 are vulnerable to SQL Injection, leading to a Denial of Service. If the user selects (in user preferences) the "Recently Visited Packages" view for the index page, the value of the search_history coo...

12. CVE-2019-20384 Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios user account, because this directory is wr...

    Published 2020-01-20

    Medium·CVSS 5.5 EPSS 0.27%

    Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios user account, because this directory is writable in between a call to emake and a call to fowners.

13. CVE-2017-14484 The Gentoo sci-mathematics/gimps package before 28.10-r1 for Great Internet Mersenne Prime Search (GIMPS) allows local users to gain privileges by creating a hard link under /var/lib/gimps, because an...

    Published 2017-09-15

    High·CVSS 7.3 EPSS 0.27%

    The Gentoo sci-mathematics/gimps package before 28.10-r1 for Great Internet Mersenne Prime Search (GIMPS) allows local users to gain privileges by creating a hard link under /var/lib/gimps, because an unsafe "chown -R" command is executed.

14. CVE-2017-14483 flower.initd in the Gentoo dev-python/flower package before 0.9.1-r1 for Celery Flower sets PID file ownership to a non-root account, which might allow local users to kill arbitrary processes by lever...

    Published 2017-09-15

    Medium·CVSS 5.5 EPSS 0.21%

    flower.initd in the Gentoo dev-python/flower package before 0.9.1-r1 for Celery Flower sets PID file ownership to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root sc...

15. CVE-2004-2778 Ebuild in Gentoo may change directory and file permissions depending on the order of installed packages, which allows local users to read or write to restricted directories or execute restricted comma...

    Published 2017-06-27

    High·CVSS 7.1 EPSS 0.33%

    Ebuild in Gentoo may change directory and file permissions depending on the order of installed packages, which allows local users to read or write to restricted directories or execute restricted commands via navigating to the affected directories, or executing the affected comman...

16. CVE-2014-9622 Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.

    Published 2015-01-21

    Medium·CVSS 6.8 EPSS 3.3%

    Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.

17. CVE-2013-2100 Gentoo Portage does not verify X.509 certificates from SSL servers

    Published 2014-09-29

    High·CVSS 9.3 EPSS 1.6%

    The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.

18. CVE-2014-4909 Integer overflow in the tr_bitfieldEnsureNthBitAlloced function in bitfield.c in Transmission before 2.84 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a...

    Published 2014-07-29

    Medium·CVSS 6.8 EPSS 5.4%

    Integer overflow in the tr_bitfieldEnsureNthBitAlloced function in bitfield.c in Transmission before 2.84 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted peer message, which triggers an out-of-bounds write.

19. CVE-2013-4223 The Gentoo Nullmailer package before 1.11-r2 uses world-readable permissions for /etc/nullmailer/remotes, which allows local users to obtain SMTP authentication credentials by reading the file.

    Published 2014-05-23

    Medium·CVSS 5.0 EPSS 1.3%

    The Gentoo Nullmailer package before 1.11-r2 uses world-readable permissions for /etc/nullmailer/remotes, which allows local users to obtain SMTP authentication credentials by reading the file.

20. CVE-2013-0348 thttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log/thttpd.log, which allows local users to obtain sensitive information by reading the file.

    Published 2013-12-13

    Low·CVSS 2.1 EPSS 0.52%

    thttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log/thttpd.log, which allows local users to obtain sensitive information by reading the file.

21. CVE-2013-2032 MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attacker...

    Published 2013-11-15

    Medium·CVSS 5.0 EPSS 2.5%

    MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one o...

22. CVE-2013-2031 MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a...

    Published 2013-11-15

    Medium·CVSS 4.3 EPSS 2.5%

    MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox.

23. CVE-2010-1159 Multiple heap-based buffer overflows in Aircrack-ng before 1.1 allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) large length value in an EAPOL packet or...

    Published 2013-10-28

    Medium·CVSS 6.8 EPSS 7.3%

    Multiple heap-based buffer overflows in Aircrack-ng before 1.1 allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) large length value in an EAPOL packet or (2) long EAPOL packet.

24. CVE-2012-4893 Multiple cross-site request forgery (CSRF) vulnerabilities in file/show.cgi in Webmin 1.590 and earlier allow remote attackers to hijack the authentication of privileged users for requests that (1) re...

    Published 2012-09-11

    Medium·CVSS 6.8 EPSS 0.85%

    Multiple cross-site request forgery (CSRF) vulnerabilities in file/show.cgi in Webmin 1.590 and earlier allow remote attackers to hijack the authentication of privileged users for requests that (1) read files or execute (2) tar, (3) zip, or (4) gzip commands, a different issue th...

25. CVE-2012-2981 Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary Perl code via a crafted file associated with the type (aka monitor type name) parameter.

    Published 2012-09-11

    Medium·CVSS 6.0 EPSS 2.1%

    Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary Perl code via a crafted file associated with the type (aka monitor type name) parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.