sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

[SM-Security] gxine: format string vulnerability

From: Thomas Houssin <Thomas.Houssin AT gmail.com>
To: sm-security AT lists.ibiblio.org
Subject: [SM-Security] gxine: format string vulnerability
Date: Tue, 31 May 2005 20:54:49 +0200

Synopsis
========
A format string vulnerability in gxine could allow a remote attacker to
execute arbitrary code.

Background
==========
gxine is a gtk+2 frontend for xine-lib.

Description
===========
CAN-2005-1692 :
Format string vulnerability in gxine allows remote attackers to execute
arbitrary code via a ram file with a URL whose hostname contains format
string specifiers.

Affected packages
=================
gxine in all grimoires is affected.
This is now fixed in devel, test, stable-rc and stable grimoires (gxine
updated to 0.4.5).

Resolution
==========
All gxine users should upgrade to the latest available version:
#scribe update
#cast -c gxine

--
Thomas Houssin

Security Team Lead : Source Mage GNU/Linux http://www.sourcemage.org
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature

[SM-Security] gxine: format string vulnerability, Thomas Houssin, 05/31/2005