sys-apps

Security Bug Reports

• sys-apps/systemd: TOCTOU race condition when updating file permissions and SELinux security contexts

  600624 - Assigned to Gentoo Security
• sys-apps/portage: order of installed packages may result in vary directories permissions, leading to crontab not requiring acct-group/cron group membership as example

  607430 - Assigned to Gentoo Security
• <sys-apps/usbredir-0.12.0: use-after-free

  834010 - Assigned to Gentoo Security
• sys-apps/busybox: multiple vulnerabilities

  836920 - Assigned to Gentoo Security
• sys-apps/portage uses /var/tmp insecurely

  853283 - Assigned to Gentoo Security
• sys-apps/man2html: multiple vulnerabilities

  869413 - Assigned to Gentoo Security
• <sys-apps/shadow-4.13-r3: passwd file manipulation via chfn

  904518 - Assigned to Gentoo Security
• <sys-apps/shadow-4.13-r4: possible password leak during passwd(1) change

  908613 - Assigned to Gentoo Security
• <sys-apps/hwloc-2.9.3: Denial of service

  914155 - Assigned to Gentoo Security
• sys-apps/busybox: multiple vulnerabilities

  918699 - Assigned to Gentoo Security
• <sys-apps/util-linux-2.39.3-r6[tty-helpers]: wall escape sequence issues

  927980 - Assigned to Gentoo Security
• <sys-apps/coreutils-9.5: chmod -R TOCTOU vulnerability

  928062 - Assigned to Gentoo Security
• <sys-apps/less-643-r2: LESSOPEN handling is unsafe on untrusted names, arbitrary code execution

  929210 - Assigned to Gentoo Security
• sys-apps/busybox: multiple vulnerabilities

  954289 - Assigned to Gentoo Security
• <sys-apps/systemd-{256.16,257.6}: Local information disclosure in systemd-coredump (CVE-2025-4598)

  956816 - Assigned to Gentoo Security
• <sys-apps/util-linux-2.41.3: Buffer overflow in setpwnam

  967612 - Assigned to Gentoo Security
• <sys-apps/util-linux-2.41.4: Multiple vulnerabilities

  971935 - Assigned to Gentoo Security
• <sys-apps/xdg-desktop-portal-1.20.4: arbitrary trashing of host files

  972436 - Assigned to Gentoo Security
• <sys-apps/xdg-dbus-proxy-0.1.7: Eavesdrop filter bypass allows message interception

  972494 - Assigned to Gentoo Security
• <sys-apps/sed-4.10: TOCTOU with -i --follow-symlinks

  973318 - Assigned to Gentoo Security
• <sys-apps/less-704: Multiple vulnerabilities

  976977 - Assigned to Gentoo Security
• <sys-apps/util-linux-{2.41.5,2.42.2}: Multiple vulnerabilities

  977563 - Assigned to Gentoo Security
• <sys-apps/acl-2.4.0 <sys-apps/attr-2.6.0: Multiple vulnerabilities

  978280 - Assigned to Gentoo Security
• <sys-apps/xdg-dbus-proxy-0.1.8: broadcast message filtering bypass

  980738 - Assigned to Gentoo Security
• <sys-apps/flatpak-1.18.1: Multiple vulnerabilities

  980781 - Assigned to Gentoo Security
• sys-apps/fwupd 2.1.7 contains important security fixes

  981010 - Assigned to Gentoo Security
• sys-apps/uutils-coreutils: Multiple vulnerabilities

  981448 - Assigned to Gentoo Security