[ glsa 202008-02 ] gnu global

[GLSA]

Gentoo Linux Security Advisory

Title: GNU GLOBAL: Arbitrary code execution (GLSA 202008-02)
Severity: normal
Exploitable: remote
Date: 2020-08-08
Bug(s): #646348
ID: 202008-02

Synopsis

A vulnerability in GNU GLOBAL was discovered, possibly allowing
remote attackers to execute arbitrary code.


Background

GNU GLOBAL is a source code tagging system that works the same way
across diverse environments, such as Emacs editor, Vi editor, Less
viewer, Bash shell, various web browsers, etc.


Affected Packages

Package: dev-util/global
Vulnerable: < 6.6.4
Unaffected: >= 6.6.4
Architectures: All supported architectures


Description

A vulnerability was found in an undocumented function of gozilla.

Impact

A remote attacker could entice a user to open a specially crafted URL
using GNU GLOBAL, possibly resulting in execution of arbitrary code with
the privileges of the process or a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All GNU GLOBAL users should upgrade to the latest version: