Is this vuln considered a virus On 3/10/08, Pierre-Yves Rofes <[EMAIL PROTECTED]> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - > Gentoo Linux Security Advisory GLSA 200803-17 > - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - > http://security.gentoo.org/ > - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - > > Severity: Normal > Title: PDFlib: Multiple buffer overflows > Date: March 10, 2008 > Bugs: #203287 > ID: 200803-17 > > - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - > > Synopsis > ======== > > Multiple stack-based buffer overflows have been reported in PDFlib. > > Background > ========== > > PDFlib is a library for generating PDF on the fly. > > Affected packages > ================= > > ------------------------------------------------------------------- > Package / Vulnerable / Unaffected > ------------------------------------------------------------------- > 1 media-libs/pdflib < 7.0.2_p8 >= 7.0.2_p8 > > Description > =========== > > poplix reported multiple boundary errors in the pdc_fsearch_fopen() > function when processing overly long filenames. > > Impact > ====== > > A remote attacker could send specially crafted content to a vulnerable > application using PDFlib, possibly resulting in the remote execution of > arbitrary code with the privileges of the user running the application. > > Workaround > ========== > > There is no known workaround at this time. > > Resolution > ========== > > All PDFlib users should upgrade to the latest version: > > # emerge --sync > # emerge --ask --oneshot --verbose ">=media-libs/pdflib-7.0.2_p8" > > References > ========== > > [ 1 ] CVE-2007-6561 > http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6561 > > Availability > ============ > > This GLSA and any updates to it are available for viewing at > the Gentoo Security Website: > > http://security.gentoo.org/glsa/glsa-200803-17.xml > > Concerns? > ========= > > Security is a primary focus of Gentoo Linux and ensuring the > confidentiality and security of our users machines is of utmost > importance to us. Any security concerns should be addressed to > [EMAIL PROTECTED] or alternatively, you may file a bug at > http://bugs.gentoo.org. > > License > ======= > > Copyright 2008 Gentoo Foundation, Inc; referenced text > belongs to its owner(s). > > The contents of this document are licensed under the > Creative Commons - Attribution / Share Alike license. > > http://creativecommons.org/licenses/by-sa/2.5 > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2.0.7 (GNU/Linux) > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org > > iD8DBQFH1bcyuhJ+ozIKI5gRAqWDAJ9nAoYSMiv8M4BizsKK16yDrFo3HQCgno+N > 1w7uxj8ylAaRgyI2ckCJhj4= > =09TR > -----END PGP SIGNATURE----- >
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
