AutoTrace converts bitmap to vector graphics.
+Heap-based buffer overflows have been discovered in the + pstoedit_suffix_table_init and pnm_load_rawpbm functions of AutoTrace. +
+Remote attackers, by enticing a user to process a crafted bmp image + file, could cause a Denial of Service condition. +
+There is no known workaround at this time.
+Gentoo has discontinued support for AutoTrace. We recommend that users + unmerge AutoTrace: +
+ +
+ # emerge --unmerge "media-gfx/autotrace"
+
+ jbig2dec is a decoder implementation of the JBIG2 image compression + format. +
+Integer overflow errors have been discovered in the + jbig2_decode_symbol_dict, jbig2_build_huffman_table, and + jbig2_image_compose functions of jbig2dec. +
+A remote attacker, by enticing a user to open a specially crafted JBIG2 + file using an application linked against jbig2dec, could possibly execute + arbitrary code with the privileges of the process or cause a Denial of + Service condition. +
+There is no known workaround at this time.
+All jbig2dec users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=media-libs/jbig2dec-0.13-r4"
+
+ MCollective is a framework to build server orchestration or parallel job + execution systems. +
+A vulnerability was discovered in MCollective which allowed for + deserialized YAML from agents without calling safe_load. This allows the + potential for arbitrary code execution on the server. +
+A remote attacker could possibly execute arbitrary code with the + privileges of the process or cause a Denial of Service condition. +
+There is no known workaround at this time.
+All MCollective users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=app-admin/mcollective-2.11.0"
+
+ The GNU Binutils are a collection of tools to create, modify and analyse + binary files. Many of the files use BFD, the Binary File Descriptor + library, to do low-level manipulation. +
+Multiple vulnerabilities have been discovered in Binutils. Please review + References for additional information. +
+A remote attacker, by enticing a user to compile/execute a specially + crafted ELF file, PE File, or binary file, could possibly cause a Denial + of Service condition. +
+There is no known workaround at this time.
+All Binutils users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=sys-devel/binutils-2.28.1"
+
+ WebKitGTK+ is a full-featured port of the WebKit rendering engine, + suitable for projects requiring any kind of web integration, offers + Webkit’s full functionality and is used on a wide range of systems. +
+Multiple vulnerabilities have been discovered in WebkitGTK+. Please + review the references below for details. +
+A remote attacker could execute arbitrary code via crafted web content.
+There is no known workaround at this time.
+All WebkitGTK+ users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.16.5"
+
+
+ Packages which depend on this library may need to be recompiled. Tools + such as revdep-rebuild may assist in identifying some of these packages. +
+mod_gnutls is an extension for Apache’s httpd. It uses the + GnuTLS library to provide HTTPS. It supports some protocols and + features that mod_ssl does not. +
+ +It was discovered that the authentication hook in mod_gnutls does not + validate client’s certificates even when option + “GnuTLSClientVerify” is set to “require”. +
+A remote attacker could present a crafted certificate and spoof clients + data. +
+There is no known workaround at this time.
+All mod_gnutls users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=www-apache/mod_gnutls-0.7.3"
+
+ chkrootkit is a tool to locally check for signs of a rootkit.
+When /tmp is mounted without the noexec option chkrootkit will execute + files in /tmp with root privileges. +
+A local attacker could possibly execute arbitrary code with root + privileges. +
+Users should mount /tmp with noexec option.
+All chkrootkit users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=app-forensics/chkrootkit-0.50"
+
+ Supervisor is a client/server system that allows its users to monitor + and control a number of processes on UNIX-like operating systems. +
+A vulnerability in Supervisor was discovered in which an authenticated + client could send malicious XML-RPC requests and supervidord will run + them as shell commands with process privileges. In some cases, + supervisord is configured with root permissions. +
+A remote attacker could execute arbitrary code with the privileges of + the process. +
+There is no known workaround at this time.
+All Supervisor users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose "=app-admin/supervisor-3.1.4"
+
+
+ Kpathsea is a library to do path searching. It is used by TeX Live and + others TeX related software. +
+It was discovered that the mpost program from the shell_escape_commands + list is capable of executing arbitrary external programs during the + conversion of .tex files. The responsible function is runpopen() + (texmfmp.c). +
+A remote attacker, by enticing a user to open a specially crafted .tex + file, could possibly execute arbitrary code with the privileges of the + process. +
+There is no known workaround at this time.
+All Kpathsea users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose
+ ">=dev-libs/kpathsea-6.2.2_p20160523"
+
+
+ Packages which depend on this library may need to be recompiled. Tools + such as revdep-rebuild may assist in identifying some of these packages. +
+GDK-PixBuf is an image loading library for GTK+.
+Multiple vulnerabilities have been discovered in GDK-PixBuf. Please + review the referenced CVE identifiers for details. +
+A remote attacker, by sending a specially crafted TIFF, JPEG, or URL, + could execute arbitrary code with the privileges of the process or cause + a Denial of Service condition. +
+There is no known workaround at this time.
+All GDK-PixBuf users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=x11-libs/gdk-pixbuf-2.36.9"
+
+
+ Packages which depend on this library may need to be recompiled. Tools + such as revdep-rebuild may assist in identifying some of these packages. +
+Subversion is a version control system intended to eventually replace + CVS. Like CVS, it has an optional client-server architecture (where the + server can be an Apache server running mod_svn, or an ssh program as in + CVS’s :ext: method). In addition to supporting the features found in + CVS, Subversion also provides support for moving and copying files and + directories. +
+Specially crafted ‘ssh://...’ URLs may allow the owner of the + repository to execute arbitrary commands on client’s machine if those + commands are already installed on the client’s system. This is + especially dangerous when the third-party repository has one or more + submodules with specially crafted ‘ssh://...’ URLs. Each time the + repository is recursively cloned or submodules are updated the payload + will be triggered. +
+A remote attacker, by enticing a user to clone a specially crafted + repository, could possibly execute arbitrary code with the privileges of + the process. +
+There are several alternative ways to fix this vulnerability. Please + refer to Subversion Team Announce for more details. +
+All Subversion 1.9.x users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=dev-vcs/subversion-1.9.7"
+
+
+ All Subversion 1.8.x users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=dev-vcs/subversion-1.8.18"
+
+ Git is a small and fast distributed version control system designed to + handle small and large projects. +
+Specially crafted ‘ssh://...’ URLs may allow the owner of the + repository to execute arbitrary commands on client’s machine if those + commands are already installed on the client’s system. This is + especially dangerous when the third-party repository has one or more + submodules with specially crafted ‘ssh://...’ URLs. Each time the + repository is recursively cloned or submodules are updated the payload + will be triggered. +
+A remote attacker, by enticing a user to clone a specially crafted + repository, could possibly execute arbitrary code with the privileges of + the process. +
+There is no known workaround at this time.
+All Git users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.13.5"
+
+ GIMPS, the Great Internet Mersenne Prime Search, is a software capable + of find Mersenne Primes, which are used in cryptography. GIMPS is also + used for hardware testing. +
+It was discovered that Gentoo’s default GIMPS installation suffered + from a privilege escalation vulnerability in the init script. This script + calls an unsafe “chown -R” command in checkconfig() function. +
+A local attacker who does not belong to the root group, but has the + ability to modify the /var/lib/gimps directory can escalate privileges to + the root group. +
+There is no known workaround at this time.
+All GIMPS users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=sci-mathematics/gimps-28.10-r1"
+
+
+ File::Path module provides a convenient way to create directories of + arbitrary depth and to delete an entire directory subtree from the + filesystem. +
+A race condition occurs within concurrent environments. This condition + was discovered by The cPanel Security Team in the rmtree and remove_tree + functions in the File-Path module before 2.13 for Perl. This is due to + the time-of-check-to-time-of-use (TOCTOU) race condition between the + stat() that decides the inode is a directory and the chmod() that tries + to make it user-rwx. +
+A local attacker could exploit this condition to set arbitrary mode + values on arbitrary files and hence bypass security restrictions. +
+There is no known workaround at this time.
+All Perl users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=dev-lang/perl-5.24.1-r2"
+
+
+ All File-Path users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=perl-core/File-Path-2.130.0"
+
+
+ All Perl-File-Path users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=virtual/perl-File-Path-2.130.0"
+
+ SquirrelMail is a webmail package written in PHP. It supports IMAP and + SMTP and can optionally be installed with SQL support. +
+It was discovered that the sendmail.cf file is mishandled in a popen + call. +
+A remote attacker, by enticing a user to open an e-mail attachment, + could execute arbitrary shell commands. +
+There is no known workaround at this time.
+Gentoo has discontinued support for SquirrelMail and recommends that + users unmerge the package: +
+ +
+ # emerge --unmerge "mail-client/squirrelmail"
+
+ cURL is a tool and libcurl is a library for transferring data with URL + syntax. +
+Multiple vulnerabilities have been discovered in cURL. Please review the + CVE identifiers referenced below for details. +
+Remote attackers could cause a Denial of Service condition, obtain + sensitive information, or bypass intended restrictions for TLS sessions. +
+There is no known workaround at this time.
+All cURL users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=net-misc/curl-7.55.1"
+
+