ClamAV is a GPL virus scanner.
+Multiple vulnerabilities have been discovered in ClamAV. Please review + the CVE identifiers referenced below for details. +
+A remote attacker could cause ClamAV to scan a specially crafted file, + possibly resulting in execution of arbitrary code with the privileges of + the process or cause a Denial of Service condition. +
+There is no known workaround at this time.
+All ClamAV users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.99.3"
+
+
+ Fossil is a simple, high-reliability, distributed software configuration + management system. +
+Fossil does not properly validate SSH sync protocol URLs.
+A remote attacker, by enticing a user to open a specially crafted URL, + could possibly execute arbitrary commands with the privileges of the user + running the application. +
+There is no known workaround at this time.
+All Fossil users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=dev-vcs/fossil-2.4"
+
+ VirtualBox is a powerful virtualization product from Oracle.
+Multiple vulnerabilities have been discovered in VirtualBox. Please + review the CVE identifiers referenced below for details. +
+An attacker could take control of VirtualBox resulting in the execution + of arbitrary code with the privileges of the process, a Denial of Service + condition, or other unspecified impacts. +
+There is no known workaround at this time.
+All VirtualBox users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=app-emulation/virtualbox-5.1.32"
+
+
+ All VirtualBox Binary users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose
+ ">=app-emulation/virtualbox-bin-5.1.32.120294"
+
+
+ All VirtualBox Guest Additions users should upgrade to the latest + version: +
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose
+ ">=app-emulation/virtualbox-guest-additions-5.1.32"
+
+
+ Chromium is an open-source browser project that aims to build a safer, + faster, and more stable way for all users to experience the web. +
+ +Google Chrome is one fast, simple, and secure browser for all your + devices. +
+Multiple vulnerabilities have been discovered in Chromium and Google + Chrome. Please review the referenced CVE identifiers and Google Chrome + Releases for details. +
+A remote attacker could possibly execute arbitrary code with the + privileges of the process, cause a Denial of Service condition, bypass + content security controls, or conduct URL spoofing. +
+There is no known workaround at this time.
+All Chromium users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose
+ ">=www-client/chromium-64.0.3282.167"
+
+
+ All Google Chrome users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose
+ ">=www-client/google-chrome-64.0.3282.167"
+
+
+ Mozilla Firefox is a popular open-source web browser from the Mozilla + Project. +
+ +Multiple vulnerabilities have been discovered in Mozilla Firefox. Please + review the referenced CVE identifiers for details. +
+ +A remote attacker could entice a user to view a specially crafted web + page, possibly resulting in the execution of arbitrary code with the + privileges of the process or a Denial of Service condition. Furthermore, + a remote attacker may be able to perform Man-in-the-Middle attacks, + obtain sensitive information, spoof the address bar, conduct clickjacking + attacks, bypass security restrictions and protection mechanisms, or have + other unspecified impact. +
+There is no known workaround at this time.
+All Mozilla Firefox users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=www-client/firefox-52.6.0"
+
+
+ All Mozilla Firefox binary users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-52.6.0"
+
+
+ A fast, multi-threaded, multi-user SQL database server.
+Multiple vulnerabilities have been discovered in MySQL. Please review + the referenced CVE identifiers for details. +
+A remote attacker could execute arbitrary code without authentication or + cause a partial denial of service condition. +
+There are no known workarounds at this time.
+All MySQL users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=dev-db/mysql-5.6.39"
+
+
+ Ruby is an interpreted object-oriented programming language. The + elaborate standard library includes an HTTP server (“WEBRick”) and a + class for XML parsing (“REXML”). +
+A command injection flaw was discovered in Net::FTP which impacts Ruby.
+A remote attacker, by enticing a user to download and open a crafted + file from a malicious FTP server, could execute arbitrary commands with + the privileges of the process. +
+There is no known workaround at this time.
+All Ruby users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=dev-lang/ruby-2.2.9:2.2"
+
+ LibreOffice is a powerful office suite; its clean interface and powerful + tools let you unleash your creativity and grow your productivity. +
+It was discovered that missing restrictions in the implementation of the + WEBSERVICE function in LibreOffice could result in the disclosure of + arbitrary files. +
+A remote attacker could entice a user to open a specially crafted + document using LibreOffice, possibly resulting in the disclosure of + arbitrary files readable by the victim. +
+There is no known workaround at this time.
+All LibreOffice users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=app-office/libreoffice-5.4.5.1"
+
+
+ All LibreOffice binary users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose
+ ">=app-office/libreoffice-bin-5.4.5.1"
+
+
+ Exim is a message transfer agent (MTA) designed to be a a highly + configurable, drop-in replacement for sendmail. +
+Multiple vulnerabilities have been discovered in Exim. Please review the + CVE identifiers referenced below for details. +
+A remote attacker, by connecting to the SMTP listener daemon, could + possibly execute arbitrary code with the privileges of the process or + cause a Denial of Service condition. +
+There is no known workaround at this time.
+All Exim users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=mail-mta/exim-4.90.1"
+
+ util-linux is a suite of Linux programs including mount and umount, + programs used to mount and unmount filesystems. +
+It was discovered that the umount bash-completion as provided by + util-linux does not escap mount point paths. +
+An attacker controlling a volume label could entice a user with + privileges to mount/umount filesystems to use umount command with auto + completion, possibly resulting in execution of arbitrary code with root + privileges. +
+Disable Bash-completion or remove + “/usr/share/bash-completion/completions/umount”. +
+All util-linux users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=sys-apps/util-linux-2.30.2-r1"
+
+
+ Go is an open source programming language that makes it easy to build + simple, reliable, and efficient software. +
+ +A command injection flaw was discovered in the source code build phase + because of the “go get” command, which does not block -fplugin= and + -plugin arguments. +
+A remote attacker could entice a user to process a repository containing + maliciously-crafted build instructions using “go get”, resulting in + the execution of arbitrary code with the privileges of the process. +
+There is no known workaround at this time.
+All Go users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=dev-lang/go-1.9.4"
+
+
+