CVE-2007-6249 Information disclosure in n/a

What is CVE-2007-6249?

CVE-2007-6249 is a low-severity vulnerability in n/a, published on 15 Dec 2007. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

etc-update in Portage before 2.1.3.11 on Gentoo Linux relies on the umask to set permissions for the merge file, often resulting in permissions weaker than those of the original files, which might allow local users to obtain sensitive information by reading the merge file.

Weakness: CWE-200

Which versions are affected by CVE-2007-6249?

It affects 1 product.

Products include Gentoo Portage.

How do I fix CVE-2007-6249?

No fix has been published for CVE-2007-6249 yet. Limit exposure of the affected software until one is available.

Is CVE-2007-6249 being exploited?

There is no known exploitation of CVE-2007-6249 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2016-20021 Gentoo Portage missing PGP validation of executed code Critical 9.8
• CVE-2013-2100 Gentoo Portage does not verify X.509 certificates from SSL servers Critical 9.3
• CVE-2004-2778 Privilege escalation in n/a High 7.1
• CVE-2008-4394 Path traversal in n/a Medium 6.9
• CVE-2019-20384 Race condition in n/a Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vfqg-qqv4-ghx2.