The following 5 Gentoo security updates are available:

[ GLSA 201406-11 ] libXfont: Multiple vulnerabilities
[ GLSA 201406-12 ] FreeRADIUS: Arbitrary code execution
[ GLSA 201406-13 ] memcached: Multiple vulnerabilities
[ GLSA 201406-14 ] Opera: Multiple vulnerabilities
[ GLSA 201406-15 ] KDirStat: Arbitrary command execution

[ GLSA 201406-11 ] libXfont: Multiple vulnerabilities

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201406-11
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: libXfont: Multiple vulnerabilities
Date: June 14, 2014
Bugs: #510250
ID: 201406-11

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been found in libXfont, the worst of
which allow for local privilege escalation.

Background
==========

libXfont is an X11 font rasterisation library.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 x11-libs/libXfont < 1.4.8 >= 1.4.8

Description
===========

Multiple vulnerabilities have been discovered in libXfont. Please
review the CVE identifiers referenced below for details.

Impact
======

A context-dependent attacker could use a specially crafted file to gain
privileges, cause a Denial of Service condition or possibly execute
arbitrary code with the privileges of the process.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All libXfont users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-libs/libXfont-1.4.8"

References
==========

[ 1 ] CVE-2014-0209
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0209
[ 2 ] CVE-2014-0210
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0210
[ 3 ] CVE-2014-0211
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0211

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201406-11.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

[ GLSA 201406-12 ] FreeRADIUS: Arbitrary code execution

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201406-12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: FreeRADIUS: Arbitrary code execution
Date: June 15, 2014
Bugs: #501754
ID: 201406-12

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

A vulnerability in FreeRADIUS can lead to arbitrary code execution or
Denial of Service by authenticated users.

Background
==========

FreeRADIUS is an open source RADIUS authentication server.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-dialup/freeradius < 2.2.5 >= 2.2.5

Description
===========

Large passwords can trigger a stack-based buffer overflow in
FreeRADIUS's rlm_pap module when authenticating against an LDAP server.

Impact
======

An authenticated user could set a specially crafted long password,
possibly leading to arbitrary code execution or a Denial of Service
condition.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All FreeRADIUS users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-dialup/freeradius-2.2.5"

References
==========

[ 1 ] CVE-2014-2015
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2015

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201406-12.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

[ GLSA 201406-13 ] memcached: Multiple vulnerabilities

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201406-13
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: memcached: Multiple vulnerabilities
Date: June 15, 2014
Bugs: #279386, #452098, #467962, #496506, #498078
ID: 201406-13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been found in memcached, allowing remote
attackers to execute arbitrary code or cause Denial of Service.

Background
==========

memcached is a high-performance, distributed memory object caching
system

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-misc/memcached < 1.4.17 >= 1.4.17

Description
===========

memcached authentication could be bypassed when using SASL due to a
flaw related to SASL authentication state. Also several heap-based
buffer overflows due to integer conversions when parsing certain length
attributes were discovered.

Impact
======

A remote attacker could possibly execute
arbitrary code with the privileges of the process, cause a Denial of
Service condition or authenticate with invalid SASL credentials,
bypassing memcached authentication completely.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All memcached users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/memcached-1.4.17"

References
==========

[ 1 ] CVE-2009-2415
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2415
[ 2 ] CVE-2013-7239
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-7239
[ 3 ] CVE-2011-4971
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4971
[ 4 ] CVE-2013-0179
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0179
[ 5 ] CVE-2013-7290
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-7290
[ 6 ] CVE-2013-7291
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-7291

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201406-13.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

[ GLSA 201406-14 ] Opera: Multiple vulnerabilities

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201406-14
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Opera: Multiple vulnerabilities
Date: June 15, 2014
Bugs: #442044, #444040, #446096, #454654
ID: 201406-14

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been found in Opera, the worst of which
may allow remote execution of arbitrary code.

Background
==========

Opera is a fast web browser that is available free of charge.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-client/opera < 12.13_p1734 >= 12.13_p1734

Description
===========

Multiple vulnerabilities have been discovered in Opera. Please review
the CVE identifiers referenced below for details.

Impact
======

A remote attacker could entice a user to open a specially crafted web
page using Opera, possibly resulting in execution of arbitrary code
with the privileges of the process or a Denial of Service condition.
Furthermore, a remote attacker may be able to obtain sensitive
information, conduct Cross-Site Scripting (XSS) attacks, or bypass
security restrictions.

A local attacker may be able to obtain sensitive information.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Opera users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=www-client/opera-12.13_p1734"

References
==========

[ 1 ] CVE-2012-6461
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6461
[ 2 ] CVE-2012-6462
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6462
[ 3 ] CVE-2012-6463
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6463
[ 4 ] CVE-2012-6464
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6464
[ 5 ] CVE-2012-6465
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6465
[ 6 ] CVE-2012-6466
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6466
[ 7 ] CVE-2012-6467
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6467
[ 8 ] CVE-2012-6468
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6468
[ 9 ] CVE-2012-6469
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6469
[ 10 ] CVE-2012-6470
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6470
[ 11 ] CVE-2012-6471
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6471
[ 12 ] CVE-2012-6472
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6472
[ 13 ] CVE-2013-1618
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1618
[ 14 ] CVE-2013-1637
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1637
[ 15 ] CVE-2013-1638
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1638
[ 16 ] CVE-2013-1639
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1639

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201406-14.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

[ GLSA 201406-15 ] KDirStat: Arbitrary command execution

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201406-15
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: KDirStat: Arbitrary command execution
Date: June 15, 2014
Bugs: #504994
ID: 201406-15

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

A vulnerability in KDirStat could allow local attackers to execute
arbitrary shell commands.

Background
==========

KDirStat is a graphical disk usage utility for KDE.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 kde-misc/kdirstat < 2.7.5 >= 2.7.5

Description
===========

Missing escape of executable shell command in KDirStat can be used to
insert malicious shell commands.

Impact
======

A local attacker could possibly execute arbitrary shell command with
the privileges of the process.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All KDirStat users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=kde-misc/kdirstat-2.7.5"

References
==========

[ 1 ] CVE-2014-2527
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2527

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201406-15.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5