171799 2007-03-22 14:02 0000 media-gfx/inkscape < 0.45.1 format string vulnerability (CVE-2007-146{3|4}) 2007-04-16 16:35:14 0000 1 1 1 Unclassified Gentoo Security Vulnerabilities unspecified All Linux RESOLVED FIXED http://secunia.com/advisories/24615/ B2 [glsa] p-y P2 normal --- 154898 160013 162237 1 py@gentoo.org security@gentoo.org amne@gentoo.org betelgeuse@gentoo.org graphics@gentoo.org lars@chaotika.org rockoo@gmail.com zypher@gentoo.org py@gentoo.org 2007-03-22 14:02:23 0000 Some vulnerabilities have been reported in Inkscape, which potentially can be exploited by malicious people to compromise a user's system. 1) A format string error exists in certain dialogs. This can be exploited to execute arbitrary code by tricking the user into opening a specially crafted URI containing format string specifiers. 2) A format string error exists in the Whiteboard Jabber client, which potentially can be exploited to execute arbitrary code. Successful exploitation requires that the user is logged in to a Jabber server. The vulnerabilities are reported in versions prior to 0.45.1. SOLUTION: Update to version 0.45.1. PROVIDED AND/OR DISCOVERED BY: Kees Cook jaervosz@gentoo.org 2007-03-25 06:27:21 0000 graphics please advise and patch as necessary. betelgeuse@gentoo.org 2007-04-07 13:53:49 0000 *** Bug 165715 has been marked as a duplicate of this bug. *** betelgeuse@gentoo.org 2007-04-07 14:06:41 0000 (In reply to comment #1) > graphics please advise and patch as necessary. > 0.45.1 added to the tree. Arches please test and mark stable. Requires a newer pstoedit stable too as users weren't able to import postscript files with earlier versions: betelgeuse@pena /usr/portage/media-gfx/inkscape $ adjutrix -w x86 =media-gfx/inkscape-0.45.1 Package Version Current Keywords Masks ============================= =================== ================= ========= media-gfx/pstoedit 3.44 ~x86 media-gfx/inkscape 0.45.1 ~x86 fauli@gentoo.org 2007-04-07 16:56:33 0000 x86 stable corsair@gentoo.org 2007-04-08 10:46:39 0000 ppc64 stable dertobi123@gentoo.org 2007-04-08 12:04:21 0000 ppc stable jer@gentoo.org 2007-04-09 04:05:11 0000 Stable for HPPA. py@gentoo.org 2007-04-09 11:56:01 0000 updating status. gustavoz@gentoo.org 2007-04-09 12:26:23 0000 sparc stable. cryos@gentoo.org 2007-04-09 19:38:58 0000 Stable on amd64. py@gentoo.org 2007-04-09 19:57:52 0000 thanks arches, GLSA in progress... vorlon@gentoo.org 2007-04-16 14:48:10 0000 GLSA 200704-10 thanks everyone jaervosz@gentoo.org 2007-04-16 16:35:14 0000 *** Bug 174815 has been marked as a duplicate of this bug. ***