VDE is an ethernet compliant virtual network that can be spawned over a + set of physical computer over the Internet. +
+It was discovered that Gentoo’s default VDE installation suffered from + a privilege escalation vulnerability in the init script. This script + calls an unsafe ‘chown’ command which gives members from “qemu” + group root privileges. +
+A local attacker could escalate privileges to root.
+There is no known workaround at this time.
+All VDE users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=net-misc/vde-2.3.2-r4"
+
+ eGroupWare is a suite of web-based group applications including + calendar, address book, messenger and email. +
+It was found that eGroupWare contains multiple code injection + vulnerabilities in multiple parameters and routes because of improper + input sanitization. +
+A remote attacker could execute arbitrary code, delete arbitrary files + or inject arbitrary PHP objects via multiple routes. +
+There is no known workaround at this time.
+Gentoo has discontinued support for eGroupWare and recommends that users + unmerge the package: +
+ +
+ # emerge --unmerge "www-apps/egroupware"
+
+ The Adobe Flash Player is a renderer for the SWF file format, which is + commonly used to provide interactive websites. +
+ +Multiple vulnerabilities have been discovered in Adobe Flash Player. + Please review the referenced CVE identifiers and Adobe Security Bulletin + for details. +
+A remote attacker could possibly execute arbitrary code with the + privileges of the process. +
+There is no known workaround at this time.
+All Adobe Flash Player users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose
+ ">=www-plugins/adobe-flash-27.0.0.187"
+
+ IcedTea’s aim is to provide OpenJDK in a form suitable for easy + configuration, compilation and distribution with the primary goal of + allowing inclusion in GNU/Linux distributions. +
+Multiple vulnerabilities have been discovered in IcedTea. Please review + the referenced CVE identifiers for details. +
+A remote attacker could possibly execute arbitrary code with the + privileges of the process, cause a Denial of Service condition, or gain + access to information. +
+There is no known workaround at this time.
+All IcedTea binary users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=dev-java/icedtea-bin-3.6.0"
+
+ PHPUnit is a programmer-oriented testing framework for PHP. It is an + instance of the xUnit architecture for unit testing frameworks. +
+When PHPUnit is installed in a production environment via composer and + these modules are in a web accessible directory, the eval-stdin.php file + in PHPUnit contains vulnerable statements that trigger the vulnerability. +
+A remote attacker could possibly execute arbitrary PHP code or cause a + Denial of Service condition. +
+There are several ways to fix or mitigate this vulnerability:
+ +Remove PHPUnit from the production environment.
+ +Update PHPUnit.
+ +Manually apply the patch.
+ +Disable direct access to the composer packages by placing .htaccess file + to /vendor folder. +
+All PHPUnit users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=dev-php/phpunit-5.7.15-r1"
+
+ Apache CouchDB is a distributed, fault-tolerant and schema-free + document-oriented database. +
+Multiple vulnerabilities have been discovered in CouchDB. Please review + the CVE identifiers referenced below for details. +
+A remote attacker could execute arbitrary shell commands or escalate + privileges. +
+There is no known workaround at this time.
+All CouchDB users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=dev-db/couchdb-1.7.1"
+
+ WebKitGTK+ is a full-featured port of the WebKit rendering engine, + suitable for projects requiring any kind of web integration, from hybrid + HTML/CSS applications to full-fledged web browsers. +
+Multiple vulnerabilities have been discovered in WebKitGTK+. Please + review the referenced CVE identifiers for details. +
+By enticing a victim to visit maliciously crafted web content, a remote + attacker could execute arbitrary code or cause a denial of service + condition. +
+There are no known workarounds at this time.
+All WebKitGTK+ users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.18.3"
+
+ OpenCV (Open Source Computer Vision Library) is an open source computer + vision and machine learning software library. +
+Multiple vulnerabilities have been discovered in OpenCV. Please review + the referenced CVE identifiers for details. +
+An attacker can cause a denial of service condition or conduct other + memory corruption attacks. +
+There are no known workarounds at this time.
+All OpenCV users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=media-libs/opencv-2.4.13-r3"
+
+ OpenSSL is a robust, commercial-grade, and full-featured toolkit for the + Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. +
+Multiple vulnerabilities have been discovered in OpenSSL. Please review + the referenced CVE identifiers for details. +
+A remote attacker could cause a Denial of Service condition, recover a + private key in unlikely circumstances, circumvent security restrictions + to perform unauthorized actions, or gain access to sensitive information. +
+There are no known workarounds at this time.
+All OpenSSL users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.2n"
+
+
+ A command line tool and library for transferring data with URLs.
+Multiple vulnerabilities have been discovered in cURL. Please review the + CVE identifiers referenced below for details. +
+Remote attackers could cause a Denial of Service condition, disclose + sensitive information or other unspecified impacts. +
+There is no known workaround at this time.
+All cURL users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=net-misc/curl-7.57.0"
+
+
+