PO
Product
Portage
7
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 1Medium 2Low 0
Watch
Add Portage to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-20021 | 9.8 | Jan 12 | In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature… Affected: before 3.0.47 |
| CVE-2004-2778 | 7.1 | Jun 27 | Ebuild in Gentoo may change directory and file permissions depending on the order of installed packages, which allows local users to read or write to restricted directories or… Affected: All versions, or not specified |
| CVE-2019-20384 | 5.5 | Jan 21 | Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios user account, because… Affected: through 2.3.84 |
| CVE-2004-1901 | 5.5 | Dec 31 | Portage before 2.0.50-r3 allows local users to overwrite arbitrary files via a hard link attack on the lockfiles Affected: before 2.0.50; 2.0.50 |
| CVE-2013-2100 | – | Sep 29 | The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows… Affected: 2.1.12 |
| CVE-2008-4394 | – | Oct 10 | Multiple untrusted search path vulnerabilities in Portage before 2.1.4.5 include the current working directory in the Python search path, which allows local users to execute… Affected: through 2.1.4.4; 2.0.51.22; 2.1.1; 2.1.3.10; 2.1.3.11 |
| CVE-2007-6249 | – | Dec 15 | etc-update in Portage before 2.1.3.11 on Gentoo Linux relies on the umask to set permissions for the merge file, often resulting in permissions weaker than those of the original… Affected: through 2.1.3.10 |
Showing 7