CVE-2007-6249

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-12-15 · updated 2026-06-16
Weakness: CWE-200

Description

etc-update in Portage before 2.1.3.11 on Gentoo Linux relies on the umask to set permissions for the merge file, often resulting in permissions weaker than those of the original files, which might allow local users to obtain sensitive information by reading the merge file.

Affected products

gentoo Portage: through 2.1.3.10

References

http://bugs.gentoo.org/show_bug.cgi?id=193589
http://osvdb.org/42636
http://secunia.com/advisories/28094
http://sources.gentoo.org/viewcvs.py/portage?rev=7799&view=rev
http://www.gentoo.org/security/en/glsa/glsa-200712-11.xml
http://www.securityfocus.com/bid/26864
http://www.securitytracker.com/id?1019097
https://exchange.xforce.ibmcloud.com/vulnerabilities/39035
http://bugs.gentoo.org/show_bug.cgi?id=193589
http://osvdb.org/42636
http://secunia.com/advisories/28094
http://sources.gentoo.org/viewcvs.py/portage?rev=7799&view=rev

Get alerted when CVE-2007-6249 or the next vulnerability affects your stack