blob: 3b46e4fa29418de854a2ded4773ef443ba63f56e [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200711-12">
<title>Tomboy: User-assisted execution of arbitrary code</title>
Tomboy doesn't properly handle environment variables, potentially allowing
a local attacker to execute arbitrary code.
<product type="ebuild">tomboy</product>
<announced>November 08, 2007</announced>
<revised>November 08, 2007: 01</revised>
<package name="app-misc/tomboy" auto="yes" arch="*">
<unaffected range="ge">0.8.1-r1</unaffected>
<vulnerable range="lt">0.8.1-r1</vulnerable>
Tomboy is a GTK-based desktop note-taking application written in C# and
the Mono C#.
Jan Oravec reported that the "/usr/bin/tomboy" script sets the
"LD_LIBRARY_PATH" environment variable incorrectly, which might result
in the current working directory (.) to be included when searching for
dynamically linked libraries of the Mono Runtime application.
<impact type="normal">
A local attacker could entice a user into running Tomboy in a directory
containing a specially crafted library file to execute arbitrary code
with the privileges of the user running Tomboy.
Do not run Tomboy from an untrusted working directory.
All Tomboy users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=app-misc/tomboy-0.8.1-r1&quot;</code>
<uri link="">CVE-2005-4790</uri>
<metadata tag="requester" timestamp="Tue, 06 Nov 2007 01:11:29 +0000">
<metadata tag="submitter" timestamp="Tue, 06 Nov 2007 04:11:22 +0000">
<metadata tag="bugReady" timestamp="Tue, 06 Nov 2007 04:11:35 +0000">