141684 2006-07-25 03:06 0000 media-gfx/fbida: typo prevents filtering (CVE-2006-3119) 2006-08-23 13:02:08 0000 1 1 1 Unclassified Gentoo Security Vulnerabilities unspecified All Linux RESOLVED FIXED http://www.us.debian.org/security/2006/dsa-1124 B2 [glsa] P2 normal --- 1 dercorny@gentoo.org security@gentoo.org spock@gentoo.org dercorny@gentoo.org 2006-07-25 03:06:35 0000 gs is not called with -dSAFER because of a typo, which might allow pdf files to do evil stuff. This is fixed in version 2.05. Either dump or apply this simple patch (gained from a diff 2.04->2.05): --- fbida-2.04/fbgs 2006-04-10 09:43:01.000000000 +0200 +++ fbida-2.05/fbgs 2006-07-25 09:26:16.000000000 +0200 @@ -51,7 +51,7 @@ echo echo "### rendering pages, please wait ... ###" echo -gs -dSAVER -dNOPAUSE -dBATCH \ +gs -dSAFER -dNOPAUSE -dBATCH \ -sPDFPassword="$password" \ -sDEVICE=${device} -sOutputFile=$DIR/ps%03d.tiff \ $gsopts \ koon@gentoo.org 2006-07-29 05:37:50 0000 spock please bump with patch. spock@gentoo.org 2006-08-07 17:59:38 0000 Fixed in CVS, thanks. koon@gentoo.org 2006-08-12 08:17:34 0000 Fixed in 2.03-r4, already stable, thanks Michal. The "?" in B2? calls for a vote, I'd say this warrants a GLSA falco@gentoo.org 2006-08-16 01:54:12 0000 yes does "pdf files to do evif stuff" means code execution ? (==> B2 sure) jaervosz@gentoo.org 2006-08-19 09:25:26 0000 Let's have a GLSA on this one as well. falco@gentoo.org 2006-08-23 13:02:08 0000 GLSA 200608-22 thanks everybody