Security advisories

Gentoo Linux Security Advisories, from the ::gentoo tree. Full texts at security.gentoo.org.

• 202604-04 normal DTrace: Arbitrary file creation via dtprobed 2026-04-17 dev-debug/dtrace
• 202604-03 normal FUSE: Multiple Vulnerabilities 2026-04-17 sys-fs/fuse
• 202603-01 low Exiv2: Multiple Vulnerabilities 2026-03-09 media-gfx/exiv2
• 202601-05 high Commons-BeanUtils: Arbitary Code Execution 2026-01-26 dev-java/commons-beanutils
• 202601-04 high Asterisk: Multiple Vulnerabilities 2026-01-26 net-misc/asterisk
• 202601-03 high GIMP: Arbitrary Code Execution 2026-01-26 media-gfx/gimp
• 202601-02 high Vim, gVim: Multiple Vulnerabilities 2026-01-26 app-editors/gvim app-editors/vim app-editors/vim-core
• 202601-01 high inetutils: Remote Code Execution 2026-01-26 net-misc/inetutils
• 202512-01 high GnuPG: Arbitrary Code Execution 2025-12-27 app-crypt/gnupg
• 202511-07 high librnp: Weak random number generation 2025-11-26 dev-util/librnp
• 202511-06 high libpng: Multiple vulnerabilities 2025-11-26 media-libs/libpng
• 202511-05 high redict, redis: Multiple Vulnerabilities 2025-11-24 dev-db/redict dev-db/redis
• 202511-04 high Chromium, Google Chrome, Microsoft Edge. Opera: Multiple Vulnerabilities 2025-11-24 www-client/chromium www-client/google-chrome www-client/microsoft-edge www-client/opera
• 202511-03 high qtsvg: Multiple Vulnerabilities 2025-11-24 dev-qt/qtsvg
• 202511-02 high WebKitGTK+: Multiple Vulnerabilities 2025-11-24 net-libs/webkit-gtk
• 202511-01 high UDisks: Multiple Vulnerabilities 2025-11-24 sys-fs/udisks
• 202509-08 high GnuTLS: Multiple Vulnerabilities 2025-09-17 net-libs/gnutls
• 202509-07 high libvpx: Use after free 2025-09-17 media-libs/libvpx
• 202509-06 normal ProFTPd: SSH Terrapin vulnerability 2025-09-17 net-ftp/proftpd
• 202509-05 high Plex Media Server: Incorrect resource transfer 2025-09-17 media-tv/plex-media-server
• 202509-04 high glibc: Multiple Vulnerabilities 2025-09-17 sys-libs/glibc
• 202509-03 normal Django: Multiple Vulnerabilities 2025-09-17 dev-python/django
• 202509-02 high Spidermonkey: Multiple Vulnerabilities 2025-09-17 dev-lang/spidermonkey
• 202509-01 high Poppler: Multiple Vulnerabilities 2025-09-17 app-text/poppler
• 202508-06 normal Composer: Multiple Vulnerabilities 2025-08-06 dev-php/composer
• 202508-05 normal Spreadsheet-ParseExcel: Arbitrary Code Execution 2025-08-06 dev-perl/Spreadsheet-ParseExcel
• 202508-04 normal Mozilla Network Security Service (NSS): TLS RSA decryption timing attack 2025-08-06 dev-libs/nss
• 202508-03 normal FontForge: Arbitrary Code Execution 2025-08-06 media-gfx/fontforge
• 202508-02 high GPL Ghostscript: Multiple Vulnerabilities 2025-08-06 app-text/ghostscript-gpl
• 202508-01 high PAM: Multiple Vulnerabilities 2025-08-06 sys-libs/pam
• 202507-10 high Roundcube: Multiple Vulnerabilities 2025-07-22 mail-client/roundcube
• 202507-09 high Git: Multiple Vulnerabilities 2025-07-08 dev-vcs/git
• 202507-08 normal REXML: Multiple Vulnerabilities 2025-07-08 dev-ruby/rexml
• 202507-07 high Chromium, Google Chrome, Microsoft Edge. Opera: Multiple Vulnerabilities 2025-07-08 www-client/chromium www-client/google-chrome www-client/microsoft-edge www-client/opera
• 202507-06 high openh264: Heap Overflow 2025-07-08 media-libs/openh264
• 202507-05 normal NTP: Multiple Vulnerabilities 2025-07-08 net-misc/ntp
• 202507-04 normal strongSwan: Buffer Overflow 2025-07-08 net-vpn/strongswan
• 202507-03 normal ClamAV: Multiple Vulnerabilities 2025-07-08 app-antivirus/clamav
• 202507-02 high UDisks, libblockdev: Privilege escalation 2025-07-01 sys-fs/udisks sys-libs/libblockdev
• 202507-01 high sudo: Privilege escalation 2025-07-01 app-admin/sudo
• 202506-13 high Konsole: Code execution 2025-06-15 kde-apps/konsole
• 202506-12 normal sysstat: Arbitrary Code Execution 2025-06-15 app-admin/sysstat
• 202506-11 normal YAML-LibYAML: Shell injection 2025-06-12 dev-perl/YAML-LibYAML
• 202506-10 normal File-Find-Rule: Shell Injection 2025-06-12 dev-perl/File-Find-Rule
• 202506-09 normal OpenImageIO: Multiple Vulnerabilities 2025-06-12 media-libs/openimageio
• 202506-08 high Node.js: Multiple Vulnerabilities 2025-06-12 net-libs/nodejs
• 202506-07 high Python, PyPy: Multiple Vulnerabilities 2025-06-12 dev-lang/pypy dev-lang/python
• 202506-06 high Qt: Multiple Vulnerabilities 2025-06-12 dev-qt/qtbase dev-qt/qtgui dev-qt/qtnetwork
• 202506-05 high GTK+ 3: Search path vulnerability 2025-06-12 x11-libs/gtk+
• 202506-04 high X.Org X server, XWayland: Multiple Vulnerabilities 2025-06-12 x11-base/xorg-server x11-base/xwayland
• 202506-03 high LibreOffice: Multiple Vulnerabilities 2025-06-12 app-office/libreoffice app-office/libreoffice-bin
• 202506-02 high GStreamer, GStreamer Plugins: Multiple Vulnerabilities 2025-06-12 media-libs/gst-plugins-base media-libs/gstreamer
• 202506-01 high Emacs: Multiple Vulnerabilities 2025-06-12 app-editors/emacs
• 202505-11 high Node.js: Multiple Vulnerabilities 2025-05-14 net-libs/nodejs
• 202505-10 normal Tracker miners: Sandbox weakness 2025-05-14 app-misc/tracker-miners
• 202505-09 high Atop: Heap Corruption 2025-05-14 sys-process/atop
• 202505-08 high Spidermonkey: Multiple Vulnerabilities 2025-05-14 dev-lang/spidermonkey
• 202505-07 high FreeType: Remote Code Execution 2025-05-14 media-libs/freetype
• 202505-06 high glibc: Buffer Overflow 2025-05-12 sys-libs/glibc
• 202505-05 high Orc: Arbitrary Code Execution 2025-05-12 dev-lang/orc
• 202505-04 high NVIDIA Drivers: Multiple Vulnerabilities 2025-05-12 x11-drivers/nvidia-drivers
• 202505-03 high Mozilla Thunderbird: Multiple Vulnerabilities 2025-05-12 mail-client/thunderbird mail-client/thunderbird-bin
• 202505-02 high Mozilla Firefox: Multiple Vulnerabilities 2025-05-12 www-client/firefox www-client/firefox-bin
• 202505-01 high PAM: Multiple Vulnerabilities 2025-05-12 sys-libs/pam
• 202504-01 normal XZ Utils: Use after free 2025-04-05 app-arch/xz-utils
• 202502-01 normal OpenSSH: Multiple Vulnerabilities 2025-02-18 net-misc/openssh
• 202501-11 high PHP: Multiple Vulnerabilities 2025-01-23 dev-lang/php
• 202501-10 high Mozilla Firefox: Multiple Vulnerabilities 2025-01-23 www-client/firefox www-client/firefox-bin
• 202501-09 high QtWebEngine: Multiple Vulnerabilities 2025-01-23 dev-qt/qtwebengine
• 202501-08 normal Qt: Buffer Overflow 2025-01-23 dev-qt/qtbase dev-qt/qtcore
• 202501-07 high libgsf: Multiple Vulnerabilities 2025-01-23 gnome-extra/libgsf
• 202501-06 high GPL Ghostscript: Multiple Vulnerabilities 2025-01-23 app-text/ghostscript-gpl
• 202501-05 normal libuv: Hostname Truncation 2025-01-23 dev-libs/libuv
• 202501-04 high Yubico pam-u2f: Partial Authentication Bypass 2025-01-23 sys-auth/pam_u2f
• 202501-03 normal pip: arbitrary configuration injection 2025-01-17 dev-python/pip
• 202501-02 high GIMP: Multiple Vulnerabilities 2025-01-17 media-gfx/gimp
• 202501-01 high rsync: Multiple Vulnerabilities 2025-01-15 net-misc/rsync
• 202412-20 high NVIDIA Drivers: Privilege Escalation 2024-12-14 x11-drivers/nvidia-drivers
• 202412-19 normal eza: Arbitrary Code Execution 2024-12-11 sys-apps/eza
• 202412-18 normal Distrobox: Arbitrary Code Execution 2024-12-11 app-containers/distrobox
• 202412-17 normal idna: Denial of Service 2024-12-11 dev-python/idna
• 202412-16 normal libvirt: Multiple Vulnerabilities 2024-12-11 app-emulation/libvirt
• 202412-15 normal OpenSC: Multiple Vulnerabilities 2024-12-11 dev-libs/opensc
• 202412-14 low HashiCorp Consul: Multiple Vulnerabilities 2024-12-08 app-admin/consul
• 202412-13 high Spidermonkey: Multiple Vulnerabilities 2024-12-08 dev-lang/spidermonkey
• 202412-12 high PostgreSQL: Multiple Vulnerabilities 2024-12-08 dev-db/postgresql
• 202412-11 high OATH Toolkit: Privilege Escalation 2024-12-07 sys-auth/oath-toolkit
• 202412-10 normal Dnsmasq: Multiple Vulnerabilities 2024-12-07 net-dns/dnsmasq
• 202412-09 normal Salt: Multiple Vulnerabilities 2024-12-07 app-admin/salt
• 202412-08 low icinga2: Multiple Vulnerabilities 2024-12-07 net-analyzer/icinga2
• 202412-07 high OpenJDK: Multiple Vulnerabilities 2024-12-07 dev-java/openjdk dev-java/openjdk-bin dev-java/openjdk-jre-bin
• 202412-06 high Mozilla Thunderbird: Multiple Vulnerabilities 2024-12-07 mail-client/thunderbird mail-client/thunderbird-bin
• 202412-05 high Chromium, Google Chrome, Microsoft Edge. Opera: Multiple Vulnerabilities 2024-12-07 www-client/chromium www-client/google-chrome www-client/microsoft-edge www-client/opera
• 202412-04 high Mozilla Firefox: Multiple Vulnerabilities 2024-12-07 www-client/firefox www-client/firefox-bin
• 202412-03 high Asterisk: Multiple Vulnerabilities 2024-12-07 net-misc/asterisk
• 202412-02 high Cacti: Multiple Vulnerabilities 2024-12-07 net-analyzer/cacti
• 202412-01 high R: Arbitrary Code Execution 2024-12-07 dev-lang/R
• 202411-09 normal Perl: Multiple Vulnerabilities 2024-11-17 dev-lang/perl
• 202411-08 high X.Org X server, XWayland: Multiple Vulnerabilities 2024-11-17 x11-base/xorg-server x11-base/xwayland
• 202411-07 high Pillow: Arbitrary code execution 2024-11-17 dev-python/pillow
• 202411-06 normal GnuTLS: Multiple Vulnerabilities 2024-11-17 net-libs/gnutls
• 202411-05 high libgit2: Multiple Vulnerabilities 2024-11-06 dev-libs/libgit2
• 202411-04 normal EditorConfig core C library: arbitrary stack write 2024-11-06 app-text/editorconfig-core-c
• 202411-03 high Ubiquiti UniFi: Privilege Escalation 2024-11-06 net-wireless/unifi
• 202411-02 high Flatpak: Sandbox Escape 2024-11-06 sys-apps/flatpak
• 202411-01 high Neat VNC: Authentication Bypass 2024-11-06 gui-libs/neatvnc
• 202409-32 low nginx: Multiple Vulnerabilities 2024-09-28 www-servers/nginx
• 202409-31 low Apache HTTPD: Multiple Vulnerabilities 2024-09-28 www-servers/apache
• 202409-30 normal yt-dlp: Multiple Vulnerabilities 2024-09-28 net-misc/yt-dlp
• 202409-29 low Docker: Multiple Vulnerabilities 2024-09-28 app-containers/docker
• 202409-28 low HashiCorp Consul: Multiple Vulnerabilities 2024-09-28 app-admin/consul
• 202409-27 normal tmux: Null Pointer Dereference 2024-09-28 app-misc/tmux
• 202409-26 normal IcedTea: Multiple Vulnerabilities 2024-09-28 dev-java/icedtea dev-java/icedtea-bin
• 202409-25 normal Xpdf: Multiple Vulnerabilities 2024-09-25 app-text/xpdf
• 202409-24 low Tor: Multiple Vulnerabilities 2024-09-24 net-vpn/tor
• 202409-23 normal ZNC: Remote Code Execution 2024-09-24 net-irc/znc
• 202409-22 normal GCC: Flawed Code Generation 2024-09-24 sys-devel/gcc
• 202409-21 normal Hunspell: Multiple Vulnerabilities 2024-09-24 app-text/hunspell
• 202409-20 normal curl: Multiple Vulnerabilities 2024-09-23 net-misc/curl
• 202409-19 high Emacs, org-mode: Command Execution Vulnerability 2024-09-22 app-editors/emacs app-emacs/org-mode
• 202409-18 low liblouis: Multiple Vulnerabilities 2024-09-22 dev-libs/liblouis
• 202409-17 normal VLC: Multiple Vulnerabilities 2024-09-22 media-video/vlc
• 202409-16 high Slurm: Multiple Vulnerabilities 2024-09-22 sys-cluster/slurm
• 202409-15 normal stb: Multiple Vulnerabilities 2024-09-22 dev-libs/stb
• 202409-14 normal Mbed TLS: Multiple Vulnerabilities 2024-09-22 net-libs/mbedtls
• 202409-13 normal gst-plugins-good: Multiple Vulnerabilities 2024-09-22 media-libs/gst-plugins-good
• 202409-12 normal pypy, pypy3: Multiple Vulnerabilities 2024-09-22 dev-python/pypy dev-python/pypy-exe dev-python/pypy-exe-bin dev-python/pypy3
• 202409-11 normal Oracle VirtualBox: Multiple Vulnerabilities 2024-09-22 app-emulation/virtualbox
• 202409-10 normal Xen: Multiple Vulnerabilities 2024-09-22 app-emulation/xen
• 202409-09 normal Exo: Arbitrary Code Execution 2024-09-22 xfce-base/exo
• 202409-08 normal OpenVPN: Multiple Vulnerabilities 2024-09-22 net-vpn/openvpn
• 202409-07 normal Rust: Multiple Vulnerabilities 2024-09-22 dev-lang/rust dev-lang/rust-bin
• 202409-06 normal file: Stack Buffer Overread 2024-09-22 sys-apps/file
• 202409-05 normal PJSIP: Heap Buffer Overflow 2024-09-22 net-libs/pjproject
• 202409-04 high calibre: Multiple Vulnerabilities 2024-09-22 app-text/calibre
• 202409-03 high GPL Ghostscript: Multiple Vulnerabilities 2024-09-22 app-text/ghostscript-gpl
• 202409-02 high PostgreSQL: Privilege Escalation 2024-09-22 dev-db/postgresql
• 202409-01 normal Portage: Unverified PGP Signatures 2024-09-22 sys-apps/portage
• 202408-33 low protobuf-c: Multiple Vulnerabilities 2024-08-12 dev-libs/protobuf-c
• 202408-32 high PHP: Multiple Vulnerabilities 2024-08-12 dev-lang/php
• 202408-31 normal protobuf, protobuf-python: Denial of Service 2024-08-12 dev-libs/protobuf dev-python/protobuf-python
• 202408-30 normal dpkg: Directory Traversal 2024-08-12 app-arch/dpkg
• 202408-29 normal MuPDF: Multiple Vulnerabilities 2024-08-12 app-text/mupdf
• 202408-28 normal rsyslog: Heap Buffer Overflow 2024-08-11 app-admin/rsyslog
• 202408-27 normal AFLplusplus: Arbitrary Code Execution 2024-08-11 app-forensics/aflplusplus
• 202408-26 normal matio: Multiple Vulnerabilities 2024-08-11 sci-libs/matio
• 202408-25 normal runc: Multiple Vulnerabilities 2024-08-11 app-containers/runc
• 202408-24 normal Ruby on Rails: Remote Code Execution 2024-08-11 dev-ruby/rails
• 202408-23 normal GnuPG: Multiple Vulnerabilities 2024-08-10 app-crypt/gnupg
• 202408-22 normal Bundler: Multiple Vulnerabilities 2024-08-10 dev-ruby/bundler
• 202408-21 normal GPAC: Multiple Vulnerabilities 2024-08-10 media-video/gpac
• 202408-20 normal libde265: Multiple Vulnerabilities 2024-08-10 media-libs/libde265
• 202408-19 normal ncurses: Multiple Vulnerabilities 2024-08-09 sys-libs/ncurses sys-libs/ncurses-compat
• 202408-18 normal QEMU: Multiple Vulnerabilities 2024-08-09 app-emulation/qemu
• 202408-17 normal Nautilus: Denial of Service 2024-08-09 gnome-base/nautilus
• 202408-16 normal re2c: Denial of Service 2024-08-09 dev-util/re2c
• 202408-15 normal Percona XtraBackup: Multiple Vulnerabilities 2024-08-09 dev-db/percona-xtrabackup dev-db/percona-xtrabackup-bin
• 202408-14 normal Librsvg: Arbitrary File Read 2024-08-09 gnome-base/librsvg
• 202408-13 normal Nokogiri: Denial of Service 2024-08-07 dev-ruby/nokogiri
• 202408-12 normal Bitcoin: Denial of Service 2024-08-07 net-p2p/bitcoind
• 202408-11 normal aiohttp: Multiple Vulnerabilities 2024-08-07 dev-python/aiohttp
• 202408-10 normal nghttp2: Multiple Vulnerabilities 2024-08-07 net-libs/nghttp2
• 202408-09 normal Cairo: Multiple Vulnerabilities 2024-08-07 x11-libs/cairo
• 202408-08 normal json-c: Buffer Overflow 2024-08-07 dev-libs/json-c
• 202408-07 normal Go: Multiple Vulnerabilities 2024-08-07 dev-lang/go
• 202408-06 normal PostgreSQL: Multiple Vulnerabilities 2024-08-07 dev-db/postgresql
• 202408-05 normal Redis: Multiple Vulnerabilities 2024-08-07 dev-db/redis
• 202408-04 normal Levenshtein: Remote Code Execution 2024-08-07 dev-python/Levenshtein
• 202408-03 normal libXpm: Multiple Vulnerabilities 2024-08-07 x11-libs/libXpm
• 202408-02 high Mozilla Firefox: Multiple Vulnerabilities 2024-08-06 www-client/firefox www-client/firefox-bin
• 202408-01 high containerd: Multiple Vulnerabilities 2024-08-06 app-containers/containerd
• 202407-28 normal Freenet: Deanonymization Vulnerability 2024-07-24 net-p2p/freenet
• 202407-27 normal ExifTool: Multiple vulnerabilities 2024-07-24 media-libs/exiftool
• 202407-26 normal Dmidecode: Privilege Escalation 2024-07-24 sys-apps/dmidecode
• 202407-25 high Buildah: Multiple Vulnerabilities 2024-07-10 app-containers/buildah
• 202407-24 normal HarfBuzz: Denial of Service 2024-07-10 media-libs/harfbuzz
• 202407-23 normal LIVE555 Media Server: Multiple Vulnerabilities 2024-07-09 media-plugins/live
• 202407-22 high Mozilla Firefox: Multiple Vulnerabilities 2024-07-06 www-client/firefox www-client/firefox-bin
• 202407-21 normal X.Org X11 library: Multiple Vulnerabilities 2024-07-06 x11-libs/libX11
• 202407-20 high KDE Plasma Workspaces: Privilege Escalation 2024-07-06 kde-plasma/plasma-workspace
• 202407-19 high Mozilla Thunderbird: Multiple Vulnerabilities 2024-07-06 mail-client/thunderbird mail-client/thunderbird-bin
• 202407-18 normal Stellarium: Arbitrary File Write 2024-07-05 sci-astronomy/stellarium
• 202407-17 normal BusyBox: Multiple Vulnerabilities 2024-07-05 sys-apps/busybox
• 202407-16 high GNU Coreutils: Buffer Overflow Vulnerability 2024-07-05 sys-apps/coreutils
• 202407-15 normal GraphicsMagick: Multiple Vulnerabilities 2024-07-05 media-gfx/graphicsmagick
• 202407-14 normal TigerVNC: Multiple Vulnerabilities 2024-07-05 net-misc/tigervnc
• 202407-13 high WebKitGTK+: Multiple Vulnerabilities 2024-07-05 net-libs/webkit-gtk
• 202407-12 high podman: Multiple Vulnerabilities 2024-07-05 app-containers/podman
• 202407-11 high PuTTY: Multiple Vulnerabilities 2024-07-05 net-misc/putty
• 202407-10 high Sofia-SIP: Multiple Vulnerabilities 2024-07-05 net-libs/sofia-sip
• 202407-09 high OpenSSH: Remote Code Execution 2024-07-01 net-misc/openssh
• 202407-08 high GNU Emacs, Org Mode: Multiple Vulnerabilities 2024-07-01 app-editors/emacs app-emacs/org-mode
• 202407-07 normal cpio: Arbitrary Code Execution 2024-07-01 app-arch/cpio
• 202407-06 normal cryptography: Multiple Vulnerabilities 2024-07-01 dev-python/cryptography
• 202407-05 normal SSSD: Command Injection 2024-07-01 sys-auth/sssd
• 202407-04 normal Pixman: Heap Buffer Overflow 2024-07-01 x11-libs/pixman
• 202407-03 normal Liferea: Remote Code Execution 2024-07-01 net-news/liferea
• 202407-02 normal SDL_ttf: Arbitrary Memory Write 2024-07-01 media-libs/sdl2-ttf
• 202407-01 normal Zsh: Prompt Expansion Vulnerability 2024-07-01 app-shells/zsh
• 202406-06 high GStreamer, GStreamer Plugins: Multiple Vulnerabilities 2024-06-28 media-libs/gst-plugins-bad media-libs/gstreamer