A pump security update to fix execution of arbitrary code has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Gentoo Linux Security Advisory                           GLSA 201911-02- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -                                           https://security.gentoo.org/- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal    Title: pump: User-assisted execution of arbitrary code     Date: November 07, 2019     Bugs: #694314       ID: 201911-02- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Synopsis========A buffer overflow in pump might allow remote attacker to executearbitrary code.Background==========BOOTP and DHCP client for automatic IP configuration.Affected packages=================    -------------------------------------------------------------------     Package              /     Vulnerable     /            Unaffected    -------------------------------------------------------------------  1  net-misc/pump              <= 0.8.24-r4               Vulnerable!    -------------------------------------------------------------------     NOTE: Certain packages are still vulnerable. Users should migrate           to another package if one is available or wait for the           existing packages to be marked stable by their           architecture maintainers.Description===========It was discovered that there was an arbitrary code executionvulnerability in the pump DHCP/BOOTP client.Impact======A remote attacker, by enticing a user to connect to a malicious server,could cause the execution of arbitrary code with the privileges of theuser running pump DHCP/BOOTP client.Workaround==========There is no known workaround at this time.Resolution==========Gentoo has discontinued support for pump. We recommend that usersunmerge pump:  # emerge --unmerge "net-misc/pump"References==========[ 1 ] Debian Bug Report 933674      https://bugs.debian.org/933674Availability============This GLSA and any updates to it are available for viewing atthe Gentoo Security Website: https://security.gentoo.org/glsa/201911-02Concerns?=========Security is a primary focus of Gentoo Linux and ensuring theconfidentiality and security of our users' machines is of utmostimportance to us. Any security concerns should be addressed tosecurity@gentoo.org or alternatively, you may file a bug athttps://bugs.gentoo.org.License=======Copyright 2019 Gentoo Foundation, Inc; referenced textbelongs to its owner(s).The contents of this document are licensed under theCreative Commons - Attribution / Share Alike license.https://creativecommons.org/licenses/by-sa/2.5