Gentoo: GLSA-201408-04: Catfish: Multiple Vulnerabilities
Summary
Multiple vulnerabilities have been discovered in Catfish. Please review the CVE identifiers referenced below for details.
Resolution
All Catfish users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-util/catfish-1.0.2"
References
[ 1 ] CVE-2014-2093 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2093 [ 2 ] CVE-2014-2094 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2094 [ 3 ] CVE-2014-2095 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2095 [ 4 ] CVE-2014-2096 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2096
Availability
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201408-04
Concerns
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
Synopsis
Multiple vulnerabilities have been found in Catfish, allowing local attackers to escalate their privileges.
Background
Catfish is a versatile file searching tool.
Affected Packages
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-util/catfish < 1.0.2 >= 1.0.2
Impact
===== A local attacker could gain escalated privileges via a specially crafted shared library.
Workaround
There is no known workaround at this time.