Multiple vulnerabilities have been discovered in UDisks, the worst of which can lead to execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-fs/udisks | * | < 2.10.2 | >= 2.10.2 |
UDisks provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies.
Multiple vulnerabilities have been discovered in UDisks. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All UDisks users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-fs/udisks-2.10.2"
Multiple vulnerabilities have been discovered in UDisks, libblockdev, the worst of which could result in privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-fs/udisks | * | < 2.10.1-r4 | >= 2.10.1-r4 |
| sys-libs/libblockdev | * | < 3.3.0 | >= 3.3.0 |
UDisks provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies. libblockdev is a library for manipulating block devices.
Multiple vulnerabilities have been discovered in UDisks and libblockdev. Please review the CVE identifiers referenced below for details.
A physical attacker with a local, unprivileged session can escalate privileges to root. Please review the referenced CVE identifier for details.
There is no known workaround at this time.
All UDisks users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-fs/udisks-2.10.1-r4"
All libblockdev users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/libblockdev-3.3.0"
A stack-based buffer overflow vulnerability has been found in udisks, allowing a local attacker to possibly execute arbitrary code or cause Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-fs/udisks | * | < 2.1.3 | >= 1.0.5 (revision), >= 2.1.3 |
udisks is an abstraction for enumerating block devices and performing operations on them.
A stack-based buffer overflow can be triggered when udisks is given a long path name as a mount point.
A local attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition.
There is no known workaround at this time.
All udisks 1.0 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-fs/udisks-1.0.5:0"
All udisks 2.0 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-fs/udisks-2.1.3"