[ GLSA 201405-28 ] xmonad-contrib: Arbitrary code execution

[GLSA]

Gentoo Linux Security Advisory

Title: xmonad-contrib: Arbitrary code execution (GLSA 201405-28)
Severity: normal
Exploitable: remote
Date: May 28, 2014
Bug(s): #478288
ID: 201405-28

Synopsis

A remote command injection vulnerability has been discovered in
xmonad-contrib.


Background

xmonad-contrib is a set of third party tiling algorithms,
configurations, and scripts for xmonad.


Affected Packages

Package: x11-wm/xmonad-contrib
Vulnerable: < 0.11.2
Unaffected: >= 0.11.2
Architectures: All supported architectures


Description

A vulnerability in the Xmonad.Hooks.DynamicLog module could allow a
malicious website with a specially crafted title to inject commands into
the title bar which would be executed when the bar is clicked.


Impact

A remote attacker could possibly execute arbitrary code with the
privileges of the process or cause a Denial of
Service condition.


Workaround

There is no known workaround at this time.

Resolution

All xmonad-contrib users should upgrade to the latest version: