Gentoo Archives: gentoo-announce

From: Alex Legler <a3li@g.o>
To: gentoo-announce@l.g.o
Cc: bugtraq@×××××××××××××.com, full-disclosure@××××××××××××××.uk, security-alerts@×××××××××××××.com
Subject: [gentoo-announce] [ GLSA 201006-15 ] XEmacs: User-assisted execution of arbitrary code
Date: Thu, 03 Jun 2010 14:12:09
Message-Id: 20100603150104.6faf0c56@mail.a3li.li
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 201006-15
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 http://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: Normal
8 Title: XEmacs: User-assisted execution of arbitrary code
9 Date: June 03, 2010
10 Bugs: #275397
11 ID: 201006-15
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 Multiple integer overflow errors in XEmacs might allow remote,
19 user-assisted attackers to execute arbitrary code.
20
21 Background
22 ==========
23
24 XEmacs is a highly extensible and customizable text editor.
25
26 Affected packages
27 =================
28
29 -------------------------------------------------------------------
30 Package / Vulnerable / Unaffected
31 -------------------------------------------------------------------
32 1 app-editors/xemacs < 21.4.22-r1 >= 21.4.22-r1
33
34 Description
35 ===========
36
37 Tielei Wang reported multiple integer overflow vulnerabilities in the
38 tiff_instantiate(), png_instantiate() and jpeg_instantiate() functions
39 in glyphs-eimage.c, all possibly leading to heap-based buffer
40 overflows.
41
42 Impact
43 ======
44
45 A remote attacker could entice a user to open a specially crafted TIFF,
46 JPEG or PNG file using XEmacs, possibly resulting in the remote
47 execution of arbitrary code with the privileges of the user running the
48 application, or a Denial of Service condition.
49
50 Workaround
51 ==========
52
53 There is no known workaround at this time.
54
55 Resolution
56 ==========
57
58 All XEmacs users should upgrade to the latest version:
59
60 # emerge --sync
61 # emerge --ask --oneshot --verbose ">=app-editors/xemacs-21.4.22-r1"
62
63 NOTE: This is a legacy GLSA. Updates for all affected architectures are
64 available since July 26, 2009. It is likely that your system is already
65 no longer affected by this issue.
66
67 References
68 ==========
69
70 [ 1 ] CVE-2009-2688
71 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2688
72
73 Availability
74 ============
75
76 This GLSA and any updates to it are available for viewing at
77 the Gentoo Security Website:
78
79 http://security.gentoo.org/glsa/glsa-201006-15.xml
80
81 Concerns?
82 =========
83
84 Security is a primary focus of Gentoo Linux and ensuring the
85 confidentiality and security of our users machines is of utmost
86 importance to us. Any security concerns should be addressed to
87 security@g.o or alternatively, you may file a bug at
88 https://bugs.gentoo.org.
89
90 License
91 =======
92
93 Copyright 2010 Gentoo Foundation, Inc; referenced text
94 belongs to its owner(s).
95
96 The contents of this document are licensed under the
97 Creative Commons - Attribution / Share Alike license.
98
99 http://creativecommons.org/licenses/by-sa/2.5

Attachments

File name MIME type
signature.asc application/pgp-signature