A vulnerability has been discovered in R, which can lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/R | * | < 4.4.1 | >= 4.4.1 |
R is a language and environment for statistical computing and graphics.
Deserialization of untrusted data can occur in the R statistical programming language, enabling a maliciously crafted RDS (R Data Serialization) formatted file or R package to run arbitrary code on an end user’s system when interacted with.
Arbitrary code may be run when deserializing untrusted data.
There is no known workaround at this time.
All R users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/R-4.4.1"
A vulnerability was found in R which could allow for remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/R | * | < 4.0.4 | >= 4.0.4 |
R is a language and environment for statistical computing and graphics.
The native R package installation mechanisms do not sufficiently validate installed source packages for path traversal.
Installation of a malicious R package could result in an arbitrary file overwrite which could result in arbitrary code execution, as might be seen with the overwrite of an authorized_keys file.
There is no known workaround at this time.
All R users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/R-4.0.4"
R is vulnerable to symlink attacks due to an insecure usage of temporary files.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/R | * | < 2.7.1 | >= 2.7.1 |
R is a GPL licensed implementation of S, a language and environment for statistical computing and graphics.
Dmitry E. Oboukhov reported that the "javareconf" script uses temporary files in an insecure manner.
A local attacker could exploit this vulnerability to overwrite arbitrary files with the privileges of the user running the application.
There is no known workaround at this time.
All R users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/R-2.7.1"
Multiple vulnerabilities in R could result in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/R | * | < 2.2.1-r1 | >= 2.2.1-r1 |
R is a GPL licensed implementation of S, a language and environment for statistical computing and graphics. PCRE is a library providing functions for Perl-compatible regular expressions.
R includes a copy of PCRE which is vulnerable to multiple buffer overflows and memory corruptions vulnerabilities (GLSA 200711-30).
An attacker could entice a user to process specially crafted regular expressions with R, which could possibly lead to the execution of arbitrary code, a Denial of Service or the disclosure of sensitive information.
There is no known workaround at this time.
All R users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/R-2.2.1-r1"