Bug 107916 – app-office/dia: arbitary python code execution through SVG files

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Thierry Carrez (RETIRED) 2005-10-02 11:04:38 UTC]

Joxean Koret discovered that the SVG import plugin in dia, a
 vector-oriented diagram editor, does not properly sanitise data read
 from an SVG file and is hence vulnerable to execute arbitrary Python
 code.

This is CAN-2005-2966.

[Comment 1 Thierry Carrez (RETIRED) 2005-10-02 11:05:22 UTC]

Created attachment 69738 [details, diff]
dia.patch

Patch from Steve Kemp / Debian Security

[Comment 2 Thierry Carrez (RETIRED) 2005-10-03 00:32:35 UTC]

Gnome herd, please bump with patch and/or advise.

[Comment 3 Daniel Gryniewicz (RETIRED) 2005-10-03 09:10:32 UTC]

Patched and bumped.  rev is dia-0.94-r3, target stable flags are:
alpha amd64 ia64 ppc ppc64 sparc x86

[Comment 4 Thierry Carrez (RETIRED) 2005-10-03 09:14:09 UTC]

Thx Daniel
Arches, please test and mark stable...

[Comment 5 Daniel Gryniewicz (RETIRED) 2005-10-03 09:42:33 UTC]

amd64 done

[Comment 6 Marcin Kryczek (RETIRED) 2005-10-03 10:22:14 UTC]

marked stable on x86

[Comment 7 Gustavo Zacarias (RETIRED) 2005-10-03 10:55:40 UTC]

sparc stable.

[Comment 8 Fernando J. Pereda (RETIRED) 2005-10-03 11:37:34 UTC]

alpha stable

[Comment 9 Markus Rothe (RETIRED) 2005-10-03 12:35:49 UTC]

stable on ppc64

[Comment 10 Michael Hanselmann (hansmi) (RETIRED) 2005-10-04 11:45:47 UTC]

Stable on ppc.

[Comment 11 Sune Kloppenborg Jeppesen (RETIRED) 2005-10-06 08:06:19 UTC]

GLSA 200510-06