[ GLSA 200712-09 ] Ruby-GNOME2: Format string error

[GLSA]

Gentoo Linux Security Advisory

Title: Ruby-GNOME2: Format string error (GLSA 200712-09)
Severity: normal
Exploitable: remote
Date: December 09, 2007
Bug(s): #200623
ID: 200712-09

Synopsis


A format string error has been discovered in Ruby-GNOME2, possibly leading
to the execution of arbitrary code.


Background


Ruby-GNOME2 is a set of bindings for using GTK+ within the Ruby
programming language.


Affected Packages

Package: dev-ruby/ruby-gtk2
Vulnerable: < 0.16.0-r2
Unaffected: >= 0.16.0-r2
Architectures: All supported architectures


Description


Chris Rohlf discovered that the "Gtk::MessageDialog.new()" method in
the file gtk/src/rbgtkmessagedialog.c does not properly sanitize the
"message" parameter before passing it to the gtk_message_dialog_new()
function.


Impact


A remote attacker could send a specially crafted string to an
application using Ruby-GNOME2, possibly leading to the execution of
arbitrary code with the privileges of the user running the application.


Workaround


There is no known workaround at this time.


Resolution


All Ruby-GNOME2 users should upgrade to the latest version: