Bug#417789: fixed in elinks 0.11.1-1.4

2007-05-05 Thread Arnaud Giersch
Vendredi 04 mai 2007, vers 09:57:07 (+0200), Kalle Olavi Niemitalo a écrit : * Don't look for gettext message catalogs in ../po/ (closes: #417789). Thanks, Arnaud Giersch! Reference: CVE-2007-2027. A less paranoid fix has been checked in to elinks-0.11 and elinks-0.12 in Git. If you

Bug#417789: fixed in elinks 0.11.1-1.4

2007-05-05 Thread Arnaud Giersch
Samedi 05 mai 2007, vers 22:14:33 (+0200), Kalle Olavi Niemitalo a écrit : Thank you for your concern. The patched ELinks 0.12.GIT (d1fa336f7f390d9b51456498fac5dda8f54c18a4) appears to open the correct gettext catalog in this case, regardless of what the current working directory is. Please

Bug#417789: this doesn't seem like a security issue

2007-04-05 Thread Arnaud Giersch
On Wed, Apr 04, 2007 at 08:04:52PM +0300, Eddy Petri\u0219or wrote: I tagged this bug as grave+security because it can be used to make elinks load any corrupted file, and possibly execute arbitrary code. How? Those are only strings. Nothing is executed from po/mo/gmo files. Beside the

Bug#417789: elinks: elinks uses untrusted gettext catalog

2007-04-04 Thread Arnaud Giersch
of file elinks-0.11.1/src/intl/gettext/loadmsgcat.c. IMHO, changing this function to return NULL unconditionally should fix the problem (I did not want to download all the build dependencies to verify). Regards, Arnaud Giersch $ gdb -q /usr/bin/elinks -c core (no debugging symbols found