https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=207286 https://issues.rpath.com/browse/RPL-680 The Red Hat bug is x86_64, but the rpath bug doesn't report platform and the CVE links to several advisories that update all platforms (Mandriva, for instance). This is an old bug that just popped up again on fulldiclosure, I searched up and down in bugzilla but didn't see it. We still have vulnerable versions in portage (see bug #140490, security cleanup needed). Current stable is 249, which fixes this particular problem.
Thanks for the report. Since the stable version is not affected and has been stable for months, this does not appear to be worth a GLSA anymore. The older versions are also vulnerable to a different issue, so they really should be removed when possible, but this is handled in bug #140490.
