blob: 2bd659078961ca95221fb4a85ee2d2edbbe852b4 [file] [log] [blame]
<?xml version="1.0" encoding="UTF-8"?>
<glsa id="201206-08">
<title>Wicd: Multiple vulnerabilities</title>
<synopsis>Multiple vulnerabilities have been found in Wicd, the worst of
which might allow execution of arbitrary code as root.
<product type="ebuild">wicd</product>
<announced>June 21, 2012</announced>
<revised>June 21, 2012: 1</revised>
<package name="net-misc/wicd" auto="yes" arch="*">
<unaffected range="ge"></unaffected>
<vulnerable range="lt"></vulnerable>
<p>Wicd is an open source wired and wireless network manager for Linux.</p>
<p>Two vulnerabilities have been found in Wicd:</p>
<li>Passwords and passphrases are written to /var/log/wicd
<li>Input from the daemon's D-Bus interface is not properly sanitized
<impact type="high">
<p>A local attacker could gain privileges of the root user or obtain
sensitive information.
<p>There is no known workaround at this time.</p>
<p>All Wicd users should upgrade to the latest version:</p>
# emerge --sync
# emerge --ask --oneshot --verbose "&gt;=net-misc/wicd-"
<uri link="">CVE-2012-0813</uri>
<uri link="">CVE-2012-2095</uri>
<metadata timestamp="Sun, 15 Apr 2012 04:06:17 +0000" tag="requester">
<metadata timestamp="Thu, 21 Jun 2012 10:10:59 +0000" tag="submitter">ackle</metadata>