GLSA
Advocate
Joined: 12 May 2004
Posts: 2663
|
 Posted: Sun May 18, 2014 9:26 pm Post subject: [ GLSA 201405-23 ] lib3ds: User-assisted execution of arbitr |
 |
|
Gentoo Linux Security Advisory
Title: lib3ds: User-assisted execution of arbitrary code (GLSA 201405-23)
Severity: normal
Exploitable: remote
Date: May 18, 2014
Updated: December 10, 2014
Bug(s): #308033, #519936
ID: 201405-23
Synopsis
A vulnerability in lib3ds might allow a remote attacker to execute
arbitrary code.
Background
lib3ds is a library for managing 3D-Studio Release 3 and 4 .3DS files.
Affected Packages
Package: media-libs/lib3ds
Vulnerable: < 2.0.0_rc1
Unaffected: >= 2.0.0_rc1
Unaffected: >= 1.3.0-r1 < 1.3.1
Architectures: All supported architectures
Description
An array index error has been discovered in lib3ds.
Impact
A remote attacker could entice a user to open a specially crafted 3DS
file using an application linked against lib3ds, possibly resulting in
execution of arbitrary code with the privileges of the process or a
Denial of Service condition.
Workaround
There is no known workaround at this time.
Resolution
All lib3ds 2.0 users should upgrade to the latest version: | Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/lib3ds-2.0.0_rc1"
|
All lib3ds 1.3 users should upgrade to the latest version: | Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/lib3ds-1.3.0-r1"
|
Packages which depend on this library may need to be recompiled. Tools
such as revdep-rebuild may assist in identifying some of these packages.
References
CVE-2010-0280
Last edited by GLSA on Wed Dec 10, 2014 4:32 am; edited 1 time in total |
|
News & Announcements
