blob: bb1874a3c90f2a2b6b764d8264f81a21aec5b9c3 [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200611-16">
<title>Texinfo: Buffer overflow</title>
Texinfo is vulnerable to a buffer overflow that could lead to the execution
of arbitrary code.
<product type="ebuild">texinfo</product>
<announced>November 21, 2006</announced>
<revised>November 21, 2006: 01</revised>
<package name="sys-apps/texinfo" auto="yes" arch="*">
<unaffected range="ge">4.8-r5</unaffected>
<vulnerable range="lt">4.8-r5</vulnerable>
Texinfo is the official documentation system of the GNU project.
Miloslav Trmac from Red Hat discovered a buffer overflow in the
"readline()" function of texindex.c. The "readline()" function is
called by the texi2dvi and texindex commands.
<impact type="normal">
By enticing a user to open a specially crafted Texinfo file, an
attacker could execute arbitrary code with the rights of the user
running Texinfo.
There is no known workaround at this time.
All Texinfo users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/texinfo-4.8-r5&quot;</code>
<uri link="">CVE-2006-4810</uri>
<metadata tag="requester" timestamp="Wed, 15 Nov 2006 21:23:53 +0000">
<metadata tag="bugReady" timestamp="Wed, 15 Nov 2006 21:39:27 +0000">
<metadata tag="submitter" timestamp="Thu, 16 Nov 2006 14:40:00 +0000">