[ GLSA 200801-19 ] GOffice: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: GOffice: Multiple vulnerabilities (GLSA 200801-19)
Severity: normal
Exploitable: remote
Date: January 30, 2008
Bug(s): #198385
ID: 200801-19

Synopsis


Multiple vulnerabilities in GOffice could result in the execution of
arbitrary code.


Background


GOffice is a library of document-centric objects and utilities based on
GTK.


Affected Packages

Package: x11-libs/goffice
Vulnerable: < 0.6.1
Unaffected: >= 0.6.1
Unaffected: >= 0.4.3 < 0.4.4
Architectures: All supported architectures


Description


GOffice includes a copy of PCRE which is vulnerable to multiple buffer
overflows and memory corruptions vulnerabilities (GLSA 200711-30).


Impact


An attacker could entice a user to open specially crafted documents
with GOffice, which could possibly lead to the execution of arbitrary
code, a Denial of Service or the disclosure of sensitive information.


Workaround


There is no known workaround at this time.


Resolution


All GOffice 0.4.x users should upgrade to the latest version: