Bugzilla Bug 96991

libaudit noticed a format string vulnerability in abiword:

Jun 24 23:47:00 insomniac abiword-2.2: warn: non-literal format string contains no specifiers: vsprintf(0x88ed868, "Save changes to document Statement.abw before closing?");

Of questionable security impact, a user would have to open, modify and then attempt to exit abiword with a very dodgy looking filename, but it should be fixed nonetheless.

suggested fix, around line 761 of abi/src/af/xap/xp/xap_Frame.cpp

-       pDialog->setMessage(szNewMessage);
+       pDialog->setMessage("%s", szNewMessage);

testcase would be saving a file called foo%.500x%n%n%n%n%nbar.abw or something, 
modifying the file, then attempting to exit without saving.

Thx Tavis, has upstream been notified? 

They have now :) http://bugzilla.abisource.com/show_bug.cgi?id=9201

upstream report the issue has now been fixed in their cvs repository

Gnome team: feel like patching ? Or wait for a new release ?

patching would be fine by me, but i have zero time this week so won't get
around
to it anytime soon. If any of the security folk care to do it ?

Tavis, feel like pushing the patch in ? Anyone else in Gnome herd ?

All 3 builds have been revbumped and patched.  old ( non rev bumped ) ebuilds
w/o the patch were removed.

Ready for GLSA

Hmm, let's rather vote... It's a quite complicated path to social engineer
(especially the "quit without saving" part).

I would vote a weak NO.

I vote NO. 

Voting no too -> closing