summaryrefslogtreecommitdiff
path: root/metadata/glsa/glsa-200711-12.xml
diff options
context:
space:
mode:
authorV3n3RiX <venerix@redcorelinux.org>2017-10-09 18:53:29 +0100
committerV3n3RiX <venerix@redcorelinux.org>2017-10-09 18:53:29 +0100
commit4f2d7949f03e1c198bc888f2d05f421d35c57e21 (patch)
treeba5f07bf3f9d22d82e54a462313f5d244036c768 /metadata/glsa/glsa-200711-12.xml
reinit the tree, so we can have metadata
Diffstat (limited to 'metadata/glsa/glsa-200711-12.xml')
-rw-r--r--metadata/glsa/glsa-200711-12.xml66
1 files changed, 66 insertions, 0 deletions
diff --git a/metadata/glsa/glsa-200711-12.xml b/metadata/glsa/glsa-200711-12.xml
new file mode 100644
index 000000000000..b59d548e5fc3
--- /dev/null
+++ b/metadata/glsa/glsa-200711-12.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="200711-12">
+ <title>Tomboy: User-assisted execution of arbitrary code</title>
+ <synopsis>
+ Tomboy doesn't properly handle environment variables, potentially allowing
+ a local attacker to execute arbitrary code.
+ </synopsis>
+ <product type="ebuild">tomboy</product>
+ <announced>2007-11-08</announced>
+ <revised>2007-11-08: 01</revised>
+ <bug>189249</bug>
+ <access>local</access>
+ <affected>
+ <package name="app-misc/tomboy" auto="yes" arch="*">
+ <unaffected range="ge">0.8.1-r1</unaffected>
+ <vulnerable range="lt">0.8.1-r1</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>
+ Tomboy is a GTK-based desktop note-taking application written in C# and
+ the Mono C#.
+ </p>
+ </background>
+ <description>
+ <p>
+ Jan Oravec reported that the "/usr/bin/tomboy" script sets the
+ "LD_LIBRARY_PATH" environment variable incorrectly, which might result
+ in the current working directory (.) to be included when searching for
+ dynamically linked libraries of the Mono Runtime application.
+ </p>
+ </description>
+ <impact type="normal">
+ <p>
+ A local attacker could entice a user into running Tomboy in a directory
+ containing a specially crafted library file to execute arbitrary code
+ with the privileges of the user running Tomboy.
+ </p>
+ </impact>
+ <workaround>
+ <p>
+ Do not run Tomboy from an untrusted working directory.
+ </p>
+ </workaround>
+ <resolution>
+ <p>
+ All Tomboy users should upgrade to the latest version:
+ </p>
+ <code>
+ # emerge --sync
+ # emerge --ask --oneshot --verbose "&gt;=app-misc/tomboy-0.8.1-r1"</code>
+ </resolution>
+ <references>
+ <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4790">CVE-2005-4790</uri>
+ </references>
+ <metadata tag="requester" timestamp="2007-11-06T01:11:29Z">
+ rbu
+ </metadata>
+ <metadata tag="submitter" timestamp="2007-11-06T04:11:22Z">
+ rbu
+ </metadata>
+ <metadata tag="bugReady" timestamp="2007-11-06T04:11:35Z">
+ rbu
+ </metadata>
+</glsa>