CVE-2005-4280: Untrusted search path vulnerability in CMake before 2.2.0-r1 on Gentoo Linux allows local users in the port...

Security readout for executives and security teams

This is an old Gentoo Linux packaging issue affecting CMake before 2.2.0-r1. A local user in the portage group could potentially gain higher privileges by abusing how a build-time library path was trusted. It is not a remote internet-facing flaw, but it matters on legacy systems where untrusted users can participate in package builds. Exposure is likely limited to legacy Gentoo Linux systems running CMake before 2.2.0-r1 where local users have portage group membership. Modern systems are unlikely to be affected unless they preserve old package states or vulnerable build environments. Treat this as a legacy local privilege risk, not an emergency remote-exploitation event. Prioritize remediation where old Gentoo systems have multiple administrators, shared shell access, CI build users, or weak separation around package building. Mitigation focus: Check Gentoo GLSA-200510-14 and apply the vendor-recommended CMake update.; Upgrade Gentoo CMake to 2.2.0-r1 or later where applicable.; Remove unnecessary users from the portage group..

Prepared

Jun 29, 2026, 15:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.