Gentoo vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2020-36770 pkg_postinst in the Gentoo ebuild for Slurm through 22.05.3 unnecessarily calls chown to assign root's ownership on files in the live root filesystem.Critical 9.8 · Jan 15, 2024
• CVE-2016-20021 In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform Critical 9.8 · Jan 11, 2024
• CVE-2023-28424 Soko if the code that powers packages.gentoo.org.Critical 9.1 · Mar 20, 2023
• CVE-2023-26033 Gentoo soko is the code that powers packages.gentoo.org.High 7.5 · Feb 24, 2023
• CVE-2017-14484 The Gentoo sci-mathematics/gimps package before 28.10-r1 for Great Internet Mersenne Prime Search (GIMPS) allows local users to gain privileges by creating a haHigh 7.3 · Sep 15, 2017
• CVE-2004-2778 Ebuild in Gentoo may change directory and file permissions depending on the order of installed packages, which allows local users to read or write to restrictedHigh 7.1 · Jun 27, 2017
• CVE-2013-2100 The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which alloHigh 9.3 · Sep 29, 2014
• CVE-2008-4580 fence_manual, as used in fence 2.02.00-r1 and possibly cman, allows local users to modify arbitrary files via a symlink attack on the fence_manual.fifo temporarHigh 7.2 · Oct 15, 2008
• CVE-2008-1078 expn in the am-utils and net-fs packages for Gentoo, rPath Linux, and other distributions, allows local users to overwrite arbitrary files via a symlink attack High 7.2 · Feb 28, 2008
• CVE-2007-3508 Integer overflow in the process_envvars function in elf/rtld.c in glibc before 2.5-rc4 might allow local users to execute arbitrary code via a large LD_HWCAP_MAHigh 7.2 · Jul 3, 2007
• CVE-2007-2194 Stack-based buffer overflow in XnView 1.90.3 allows user-assisted remote attackers to execute arbitrary code via a crafted XPM file with a long section string.High 10 · Apr 24, 2007
• CVE-2005-4595 Untrusted search path vulnerability (RPATH) in XnView 1.70 and NView 4.51 on Gentoo Linux allows local users to execute arbitrary code via a malicious library iHigh 7.2 · Dec 31, 2005
• CVE-2005-4279 Untrusted search path vulnerability in Qt-UnixODBC before 3.3.4-r1 on Gentoo Linux allows local users in the portage group to gain privileges via a malicious shHigh 7.2 · Dec 16, 2005
• CVE-2005-0002 poppassd_pam 1.0 and earlier, when changing a user password, does not verify that the user entered the old password correctly, which allows remote attackers to High 10 · May 2, 2005
• CVE-2004-1115 The init scripts in Search for Extraterrestrial Intelligence (SETI) project 3.08-r3 and earlier execute user-owned programs with root privileges, which allows lHigh 7.2 · Jan 10, 2005
• CVE-2004-1116 The init scripts in Great Internet Mersenne Prime Search (GIMPS) 23.9 and earlier execute user-owned programs with root privileges, which allows local users to High 7.2 · Jan 10, 2005
• CVE-2004-1117 The init scripts in ChessBrain 20407 and earlier execute user-owned programs with root privileges, which allows local users to gain privileges by modifying the High 7.2 · Jan 10, 2005
• CVE-2004-1452 Tomcat before 5.0.27-r3 in Gentoo Linux sets the default permissions on the init scripts as tomcat:tomcat, but executes the scripts with root privileges, which High 7.2 · Dec 31, 2004
• CVE-2003-1422 Multiple unspecified vulnerabilities in the installer for SYSLINUX 2.01, when running setuid root, allow local users to gain privileges via unknown vectors.High 10 · Dec 31, 2003