[ GLSA 200801-02 ] R: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: R: Multiple vulnerabilities (GLSA 200801-02)
Severity: normal
Exploitable: remote
Date: January 09, 2008
Bug(s): #198976
ID: 200801-02

Synopsis


Multiple vulnerabilities in R could result in the execution of arbitrary
code.


Background


R is a GPL licensed implementation of S, a language and environment for
statistical computing and graphics. PCRE is a library providing
functions for Perl-compatible regular expressions.


Affected Packages

Package: dev-lang/R
Vulnerable: < 2.2.1-r1
Unaffected: >= 2.2.1-r1
Architectures: All supported architectures


Description


R includes a copy of PCRE which is vulnerable to multiple buffer
overflows and memory corruptions vulnerabilities (GLSA 200711-30).


Impact


An attacker could entice a user to process specially crafted regular
expressions with R, which could possibly lead to the execution of
arbitrary code, a Denial of Service or the disclosure of sensitive
information.


Workaround


There is no known workaround at this time.


Resolution


All R users should upgrade to the latest version: