[ GLSA 201402-05 ] Banshee: Arbitrary code execution

[GLSA]

Gentoo Linux Security Advisory

Title: Banshee: Arbitrary code execution (GLSA 201402-05)
Severity: low
Exploitable: local
Date: February 05, 2014
Bug(s): #345567
ID: 201402-05

Synopsis

An environment variable processing error has been reported in
Banshee, possibly allowing local attacker to load a specially crafted
shared library.


Background

Banshee is a multimedia management and playback application for GNOME.

Affected Packages

Package: media-sound/banshee
Vulnerable: < 1.8.0-r1
Unaffected: >= 1.8.0-r1
Architectures: All supported architectures


Description

Banshee places a zero-length directory name in PATH, which allows
libraries to be loaded from the working directory.


Impact

A local attacker could put specially crafted library into working
directory of Banshee, possibly resulting in execution of arbitrary code
with the privileges of the process, or a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All Banshee users should upgrade to the latest version: