Info-ZIP’s UnZip is a tool to list and extract files inside PKZIP compressed files.
+Multiple vulnerabilities have been discovered in UnZip. Please review the CVE identifiers referenced below for details.
+Please review the referenced CVE identifiers for details.
+There is no known workaround at this time.
+All UnZip users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=app-arch/unzip-6.0_p27"
+
+ Rack is a modular Ruby web server interface.
+Multiple vulnerabilities have been discovered in Rack. Please review the CVE identifiers referenced below for details.
+A possible denial of service vulnerability was found in the multipart parsing component of Rack. + +A sequence injection vulnerability was found which could allow a possible shell escape in the Lint and CommonLogger components of Rack.
+There is no known workaround at this time.
+All Rack users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=dev-ruby/rack-2.2.3.1"
+
+ Dovecot is an open source IMAP and POP3 email server.
+A vulnerability has been discovered in Dovecot. Please review the CVE identifier referenced below for details.
+When two passdb configuration entries exist in Dovecot configuration, which have the same driver and args settings, the incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation with certain configurations involving master user authentication. + +Dovecot documentation does not advise against the use of passdb definitions which have the same driver and args settings. One such configuration would be where an administrator wishes to use the same pam configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
+There is no known workaround at this time.
+All Dovecot users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=net-mail/dovecot-2.3.19.1-r1"
+
+ rxvt-unicode is a clone of the well known terminal emulator rxvt.
+A vulnerability has been discovered in rxvt-unicode. Please review the CVE identifiers referenced below for details.
+in the Perl background extension, when an attacker can +control the data written to the user's terminal and certain options are set. + +The "background" extension is automatically loaded if certain X resources are set such as 'transparent' (see the full list at the top of src/perl/background[1]). So it is possible to be using this extension without realising it.
+There is no known workaround at this time.
+All rxvt-unicode users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=x11-terms/rxvt-unicode-9.30"
+
+ ConnMan provides a daemon for managing Internet connections.
+Multiple vulnerabilities have been discovered in ConnMan. Please review the CVE identifiers referenced below for details.
+Please review the referenced CVE identifiers for details.
+There is no known workaround at this time.
+All ConnMan users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=net-misc/connman-1.42_pre20220801"
+
+ Salt is a fast, intelligent and scalable automation engine.
+Multiple vulnerabilities have been discovered in Salt. Please review the CVE identifiers referenced below for details.
+Please review the referenced CVE identifiers for details.
+There is no known workaround at this time.
+All Salt users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=app-admin/salt-3004.2"
+
+ libxslt is the XSLT C library developed for the GNOME project. XSLT itself is an XML language to define transformations for XML.
+Multiple vulnerabilities have been discovered in libxslt. Please review the CVE identifiers referenced below for details.
+Please review the referenced CVE identifiers for details.
+There is no known workaround at this time.
+All libxslt users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=dev-libs/libxslt-1.1.35"
+
+ GitPython is a Python library used to interact with Git repositories.
+Please review the CVE identifier referenced below for details.
+An attacker may be able to trigger Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.
+There is no known workaround at this time.
+All GitPython users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=dev-python/GitPython-3.1.30"
+
+ Netatalk is a kernel level implementation of the AppleTalk Protocol Suite, which allows Unix hosts to act as file, print, and time servers for Apple computers. It includes several script utilities, including etc2ps.sh.
+Multiple vulnerabilities have been discovered in Netatalk. Please review the CVE identifiers referenced below for details.
+Please review the referenced CVE identifiers for details.
+There is no known workaround at this time.
+All Netatalk users should upgrade to the latest version:
+ +
+ # emerge --sync
+ # emerge --ask --oneshot --verbose ">=net-fs/netatalk-3.1.18"
+
+