Gentoo Project

Base System

Security Bug Reports

• <sys-libs/db-{4.8.30-r10,5.3.28-r12,6.0.35-r6}: Berkeley DB reads DB_CONFIG from the current working directory

  638434 - Assigned to Gentoo Security
• sys-devel/flex: Stack exhaustion in mark_beginning_as_normal causing denial of service (CVE-2019-6293)

  717714 - Assigned to Gentoo Security
• net-misc/wget: Authorisation header disclosure on redirect (CVE-2021-31879)

  786957 - Assigned to Gentoo Security
• sys-devel/patch: invalid free vulnerability

  829835 - Assigned to Gentoo Security
• dev-db/sqlite: record leakage

  833451 - Assigned to Gentoo Security
• <sys-apps/usbredir-0.12.0: use-after-free

  834010 - Assigned to Gentoo Security
• <sys-fs/fuse-exfat-1.4.0: deleted file information leak

  842213 - Assigned to Gentoo Security
• <dev-libs/libpcre2-10.40: multiple vulnerabilities

  845195 - Assigned to Gentoo Security
• <app-admin/logrotate-3.20.0: Unprivileged DoS via state file

  847382 - Assigned to Gentoo Security
• <app-crypt/gnupg-{2.4.9,2.5.10}: denial of service issue (resource consumption) using compressed packets

  861446 - Assigned to Gentoo Security
• dev-lang/yasm: multiple vulnerabilities

  862112 - Assigned to Gentoo Security
• app-arch/unzip: null pointer dereference

  866386 - Assigned to Gentoo Security
• sys-apps/man2html: multiple vulnerabilities

  869413 - Assigned to Gentoo Security
• <app-misc/ca-certificates-20211016.3.86: TrustCor removal

  884805 - Assigned to Gentoo Security
• <app-shells/bash-5.2_p15-r2: heap buffer overflow yielding "memory problems"

  889878 - Assigned to Gentoo Security
• <dev-util/pkgconf-1.8.1: Billion Laughs vulnerability

  891647 - Assigned to Gentoo Security
• <sys-apps/shadow-4.13-r3: passwd file manipulation via chfn

  904518 - Assigned to Gentoo Security
• <sys-libs/libcap-2.69: Multiple vulnerabilities

  906461 - Assigned to Gentoo Security
• <sys-apps/shadow-4.13-r4: possible password leak during passwd(1) change

  908613 - Assigned to Gentoo Security
• <sys-process/procps-4.0.4: ps buffer overflow

  913408 - Assigned to Gentoo Security
• <sys-boot/grub-2.06-r9: Multiple vulnerabilities

  915131 - Assigned to Gentoo Security
• <net-libs/libtirpc-1.3.4: Multiple vulnerabilities

  915404 - Assigned to Gentoo Security
• <sys-fs/exfatprogs-1.2.2: OOB read

  916507 - Assigned to Gentoo Security
• <sys-boot/shim-15.8: multiple vulnerabilities

  922931 - Assigned to Gentoo Security
• <sys-apps/util-linux-2.39.3-r6[tty-helpers]: wall escape sequence issues

  927980 - Assigned to Gentoo Security
• <sys-apps/coreutils-9.5: chmod -R TOCTOU vulnerability

  928062 - Assigned to Gentoo Security
• <sys-apps/less-643-r2: LESSOPEN handling is unsafe on untrusted names, arbitrary code execution

  929210 - Assigned to Gentoo Security
• <net-misc/wget-1.24.5: cookie leakage with HSTS and subdomains

  930041 - Assigned to Gentoo Security
• <net-misc/curl-8.9.1: ASN.1 date parser overread

  937125 - Assigned to Gentoo Security
• <net-misc/curl-8.11.0: HSTS subdomain overwrites parent cache entry

  942952 - Assigned to Gentoo Security
• <net-misc/wget-1.25.0: Vulnerability with shorthand FTP URLs

  943275 - Assigned to Gentoo Security
• <net-misc/curl-8.11.1: netrc and redirect credential leak

  946291 - Assigned to Gentoo Security
• <net-misc/curl-8.12.0: multiple vulnerabilities

  949330 - Assigned to Gentoo Security
• <net-misc/curl-8.13.0: Lack of validation with missing known_hosts for SCP and SFTP

  949342 - Assigned to Gentoo Security
• <dev-libs/libtasn1-4.20.0: Denial of service

  949497 - Assigned to Gentoo Security
• <net-misc/openssh-9.9_p2: Multiple vulnerabilities

  949904 - Assigned to Gentoo Security
• sys-boot/grub: Multiple vulnerabilities

  950250 - Assigned to Gentoo Security
• <dev-libs/libxslt-1.1.43: Multiple vulnerabilities

  951265 - Assigned to Gentoo Security
• <sys-libs/libcap-2.76: Possible privilege escalation with "@"-prefixed groups

  951333 - Assigned to Gentoo Security
• <net-misc/openssh-10.0_p1: DisableForwarding doesn't have documented effect

  953746 - Assigned to Gentoo Security
• <net-dns/c-ares-1.34.5: Use after free in read_answers()

  953870 - Assigned to Gentoo Security
• <dev-db/sqlite-3.49.2: Crash via malicious CREATE TABLE statements

  955819 - Assigned to Gentoo Security
• <net-misc/iputils-20250605: Multiple vulnerabilities

  957594 - Assigned to Gentoo Security
• <sys-process/procps-4.0.5-r1: Vulnerability with legacy configuration files in top

  958286 - Assigned to Gentoo Security
• <dev-db/sqlite-3.50.3: Possible memory safety issue

  960691 - Assigned to Gentoo Security
• <net-misc/curl-8.16.0: multiple vulnerabilities

  962682 - Assigned to Gentoo Security
• <dev-libs/libxml2-2.13.9: Multiple vulnerabilities

  962684 - Assigned to Gentoo Security
• <dev-libs/libpcre2-10.46: Out-of-bounds read with attacker-controlled regex pattern

  962686 - Assigned to Gentoo Security
• <net-misc/openssh-10.1_p1: Control characters allowed on command line / via configuration

  963869 - Assigned to Gentoo Security
• <dev-libs/libxslt-1.1.43-r2: Type confusion in exsltFuncResultComp

  964753 - Assigned to Gentoo Security
• <net-misc/curl-8.17.0-r1: wcurl path traversal with percent-encoded slashes

  966140 - Assigned to Gentoo Security
• <sys-boot/grub-2.14: multiple vulnerabilities

  966254 - Assigned to Gentoo Security
• <net-libs/gnutls-3.8.11: Stack overwrite in gnutls_pkcs11_token_init

  966282 - Assigned to Gentoo Security
• <dev-libs/libxslt-1.1.45: Multiple vulnerabilities

  966901 - Assigned to Gentoo Security
• <media-libs/libpng-1.6.52: out-of-bounds read in `png_image_read_composite`

  967052 - Assigned to Gentoo Security
• <net-dns/c-ares-1.34.6: Use-after-free bug in read_answers()

  967359 - Assigned to Gentoo Security
• <sys-apps/util-linux-2.41.3: Buffer overflow in setpwnam

  967612 - Assigned to Gentoo Security
• <net-misc/rsync-3.4.1-r2: Out-of-bounds read

  967677 - Assigned to Gentoo Security
• <app-crypt/gnupg-2.5.16, <app-crypt/freepg-2.5.16: Cleartext Signature Forgery in the NotDashEscaped header

  968171 - Assigned to Gentoo Security
• <dev-libs/libtasn1-4.21.0: stack-based buffer overflow

  968531 - Assigned to Gentoo Security
• <media-libs/libpng-1.6.54: multiple vulnerabilities

  968671 - Assigned to Gentoo Security
• <app-crypt/gnupg-2.5.17, <app-crypt/freepg-2.5.17: Multiple vulnerabilities

  969320 - Assigned to Gentoo Security
• <net-misc/curl-8.18.0: Multiple vulnerabilities

  969430 - Assigned to Gentoo Security
• <media-libs/libpng-1.6.55: Buffer overflow in png_set_quantize

  969844 - Assigned to Gentoo Security
• <net-libs/gnutls-3.8.12: Multiple vulnerabilities

  969845 - Assigned to Gentoo Security
• <sys-libs/zlib-1.3.2: Multiple vulnerabilities

  970211 - Assigned to Gentoo Security
• <dev-libs/libxml2-2.15.2: Multiple vulnerabilities

  970915 - Assigned to Gentoo Security
• <net-misc/curl-8.19.0: multiple vulnerabilities

  971090 - Assigned to Gentoo Security
• <dev-libs/openssl-{3.5.6,3.6.2}: TLS 1.3 server may choose unexpected key agreement group

  971145 - Assigned to Gentoo Security
• <media-libs/libpng-1.6.56: multiple vulnerabilities

  971570 - Assigned to Gentoo Security
• <net-misc/openssh-10.3_p1: Multiple vulnerabilities (shell injection)

  971889 - Assigned to Gentoo Security
• <sys-apps/util-linux-2.41.4: Multiple vulnerabilities

  971935 - Assigned to Gentoo Security
• <sys-libs/libcap-2.78: TOCTOU vulnerability

  972440 - Assigned to Gentoo Security
• <media-libs/libpng-1.6.57: use-after-free vulnerability

  972442 - Assigned to Gentoo Security
• app-arch/tar: multiple vulnerabilities

  972553 - Assigned to Gentoo Security
• <dev-libs/libxml2-2.15.3: Multiple vulnerabilities

  972765 - Assigned to Gentoo Security
• <app-shells/dash-0.5.13.3: Denial of service

  972904 - Assigned to Gentoo Security
• <dev-libs/libgcrypt-1.12.2: Multiple vulnerabilities

  973044 - Assigned to Gentoo Security
• <sys-auth/sssd-{2.9.8-r1,2.13.0}: Out-of-bounds read in PAM passkey responder

  973316 - Assigned to Gentoo Security
• <sys-apps/sed-4.10: TOCTOU with -i --follow-symlinks

  973318 - Assigned to Gentoo Security
• <net-libs/gnutls-3.8.13: Multiple vulnerabilities

  973386 - Assigned to Gentoo Security
• <dev-libs/libksba-1.8.0: Multiple vulnerabilities

  974854 - Assigned to Gentoo Security
• <dev-libs/libksba-1.6.8: Multiple vulnerabilities

  974855 - Assigned to Gentoo Security
• <app-crypt/gnupg-2.5.20: Multiple vulnerabilities

  974896 - Assigned to Gentoo Security
• <sys-apps/less-704: Multiple vulnerabilities

  976977 - Assigned to Gentoo Security
• <dev-libs/openssl-{3.0.21,3.4.6,3.5.7,3.6.3,4.0.1}: multiple vulnerabilities

  977128 - Assigned to Gentoo Security
• <sys-apps/util-linux-{2.41.5,2.42.2}: Multiple vulnerabilities

  977563 - Assigned to Gentoo Security
• <net-misc/curl-8.21.0: Multiple vulnerabilities

  978006 - Assigned to Gentoo Security
• <app-arch/unrar-7.2.7: multiple vulnerabilities

  978307 - Assigned to Gentoo Security
• <net-misc/openssh-10.4_p1: multiple vulnerabilities

  978845 - Assigned to Gentoo Security
• <net-dns/c-ares-1.34.8: multiple vulnerabilities

  978847 - Assigned to Gentoo Security
• <sys-libs/libseccomp-2.6.1: Multiple vulnerabilities

  979003 - Assigned to Gentoo Security
• <sys-fs/ntfs3g-2026.7.7: Multiple vulnerabilities

  979306 - Assigned to Gentoo Security
• dev-libs/openssl: Client-Side Memory Leak in OCSP Response Checking

  980397 - Assigned to Gentoo Security
• <net-misc/openssh-10.5_p1: multiple vulnerabilities

  980721 - Assigned to Gentoo Security
• <net-misc/rsync-3.5.0: Multiple vulnerabilities

  980780 - Assigned to Gentoo Security
• <app-arch/zip-3.0_p16: Command injection

  980838 - Assigned to Gentoo Security
• <app-arch/unzip-6.0_p31: Multiple vulnerabilities

  980955 - Assigned to Gentoo Security
• <app-arch/gzip-1.14-r1: out-of-bounds memory access

  981308 - Assigned to Gentoo Security
• <dev-libs/openssl-{3.0.22,3.4.7,3.5.8,3.6.4,4.0.2}: Multiple vulnerabilities

  981389 - Assigned to Gentoo Security
• <dev-libs/libgcrypt-1.12.3: Multiple vulnerabilities

  981731 - Assigned to Gentoo Security
• <dev-libs/libksba-1.8.1: Possible infinite loop in CMS parser

  981739 - Assigned to Gentoo Security
• <dev-libs/libxml2-2.15.4: Multiple vulnerabilities

  981935 - Assigned to Gentoo Security
• <sys-apps/util-linux-2.42.3: Multiple vulnerabilities

  981937 - Assigned to Gentoo Security
• <dev-libs/libpcre2-10.48: Multiple vulnerabilities

  982082 - Assigned to Gentoo Security
• <net-misc/curl-8.22.0: Multiple vulnerabilities

  982083 - Assigned to Gentoo Security
• <sys-fs/fuse-3.18.3: Multiple vulnerabilities

  982164 - Assigned to Gentoo Security
• <app-arch/xz-utils-5.8.4: Multiple vulnerabilities

  982202 - Assigned to Gentoo Security
• <net-dialup/ppp-2.5.4: security release

  982553 - Assigned to Gentoo Security
• <sys-fs/ntfs3g-2026.9.18: multiple vulnerabilities

  983157 - Assigned to Gentoo Security
• <app-crypt/gnupg-2.5.23: Format string vulnerability in gpgsm --debug

  983193 - Assigned to Gentoo Security
• <dev-libs/libpcre2-10.49: Out-of-bounds write in JIT with attacker-controlled regex

  983449 - Assigned to Gentoo Security
• <media-libs/libpng-1.6.59: Use-after-free

  983481 - Assigned to Gentoo Security
• <sys-apps/groff-1.24.2: Multiple vulnerabilities

  983497 - Assigned to Gentoo Security
• <dev-libs/openssl-{3.4.8,3.5.9,3.6.5,4.0.3}: multiple vulnerabilities

  983498 - Assigned to Gentoo Security
• <net-misc/openssh-10.6_p1: multiple vulnerabilities

  983816 - Assigned to Gentoo Security
• <app-admin/sudo-1.9.17_p2-r1: time based authentication bypass

  983967 - Assigned to Gentoo Security
• <net-misc/curl-8.23.0: Multiple vulnerabilities

  984218 - Assigned to Gentoo Security
• <app-misc/ca-certificates-20260816.3.125: compromise of intermediates issued by emSign_ECC_Root_CA_-_G3.pem

  984601 - Assigned to Gentoo Security
• <net-dns/c-ares-1.34.9: Multiple vulnerabilities

  984698 - Assigned to Gentoo Security
• sys-devel/patch: creation of out-of-tree files when reversing a patch deletion

  985008 - Assigned to Gentoo Security