[ GLSA 201412-08 ] Multiple packages, Multiple vulnerabilities fixed in 2010

[GLSA]

Gentoo Linux Security Advisory

Title: Multiple packages, Multiple vulnerabilities fixed in 2010 (GLSA 201412-08)
Severity: high
Exploitable: local, remote
Date: December 11, 2014
Bug(s): #159556, #208464, #253822, #259968, #298067, #300375, #300943, #302478, #307525, #307633, #315235, #316697, #319719, #320961, #322457, #325507, #326759, #326953, #329125, #329939, #331421, #332527, #333661
ID: 201412-08

Synopsis

This GLSA contains notification of vulnerabilities found in several
Gentoo packages which have been fixed prior to January 1, 2011. The worst
of these vulnerabilities could lead to local privilege escalation and
remote code execution. Please see the package list and CVE identifiers
below for more information.


Background

For more information on the packages listed in this GLSA, please see
their homepage referenced in the ebuild.


Affected Packages

Package: dev-util/insight
Vulnerable: < 6.7.1-r1
Unaffected: >= 6.7.1-r1
Architectures: All supported architectures

Package: dev-perl/perl-tk
Vulnerable: < 804.028-r2
Unaffected: >= 804.028-r2
Architectures: All supported architectures

Package: dev-util/sourcenav
Vulnerable: < 5.1.4
Unaffected: >= 5.1.4
Architectures: All supported architectures

Package: dev-lang/tk
Vulnerable: < 8.4.18-r1
Unaffected: >= 8.4.18-r1
Architectures: All supported architectures

Package: sys-block/partimage
Vulnerable: < 0.6.8
Unaffected: >= 0.6.8
Architectures: All supported architectures

Package: app-antivirus/bitdefender-console
Vulnerable: <= 7.1
Architectures: All supported architectures

Package: net-mail/mlmmj
Vulnerable: < 1.2.17.1
Unaffected: >= 1.2.17.1
Architectures: All supported architectures

Package: sys-apps/acl
Vulnerable: < 2.2.49
Unaffected: >= 2.2.49
Architectures: All supported architectures

Package: x11-apps/xinit
Vulnerable: < 1.2.0-r4
Unaffected: >= 1.2.0-r4
Architectures: All supported architectures

Package: app-arch/gzip
Vulnerable: < 1.4
Unaffected: >= 1.4
Architectures: All supported architectures

Package: app-arch/ncompress
Vulnerable: < 4.2.4.3
Unaffected: >= 4.2.4.3
Architectures: All supported architectures

Package: dev-libs/liblzw
Vulnerable: < 0.2
Unaffected: >= 0.2
Architectures: All supported architectures

Package: media-gfx/splashutils
Vulnerable: < 1.5.4.3-r3
Unaffected: >= 1.5.4.3-r3
Architectures: All supported architectures

Package: sys-devel/m4
Vulnerable: < 1.4.14-r1
Unaffected: >= 1.4.14-r1
Architectures: All supported architectures

Package: kde-base/kdm
Vulnerable: < 4.3.5-r1
Unaffected: >= 4.3.5-r1
Architectures: All supported architectures

Package: x11-libs/gtk+
Vulnerable: < 2.18.7
Unaffected: >= 2.18.7
Architectures: All supported architectures

Package: kde-base/kget
Vulnerable: < 4.3.5-r1
Unaffected: >= 4.3.5-r1
Architectures: All supported architectures

Package: app-text/dvipng
Vulnerable: < 1.13
Unaffected: >= 1.13
Architectures: All supported architectures

Package: app-misc/beanstalkd
Vulnerable: < 1.4.6
Unaffected: >= 1.4.6
Architectures: All supported architectures

Package: sys-apps/pmount
Vulnerable: < 0.9.23
Unaffected: >= 0.9.23
Architectures: All supported architectures

Package: sys-auth/pam_krb5
Vulnerable: < 4.3
Unaffected: >= 4.3
Architectures: All supported architectures

Package: app-text/gv
Vulnerable: < 3.7.1
Unaffected: >= 3.7.1
Architectures: All supported architectures

Package: net-ftp/lftp
Vulnerable: < 4.0.6
Unaffected: >= 4.0.6
Architectures: All supported architectures

Package: www-client/uzbl
Vulnerable: < 2010.08.05
Unaffected: >= 2010.08.05
Architectures: All supported architectures

Package: x11-misc/slim
Vulnerable: < 1.3.2
Unaffected: >= 1.3.2
Architectures: All supported architectures

Package: net-misc/iputils
Vulnerable: < 20100418
Unaffected: >= 20100418
Architectures: All supported architectures

Package: media-tv/dvbstreamer
Vulnerable: < 1.1-r1
Unaffected: >= 1.1-r1
Architectures: All supported architectures


Description

Vulnerabilities have been discovered in the packages listed below.
Please review the CVE identifiers in the Reference section for details.

• Insight
• Perl Tk Module
• Source-Navigator
• Tk
• Partimage
• Mlmmj
• acl
• Xinit
• gzip
• ncompress
• liblzw
• splashutils
• GNU M4
• KDE Display Manager
• GTK+
• KGet
• dvipng
• Beanstalk
• Policy Mount
• pam_krb5
• GNU gv
• LFTP
• Uzbl
• Slim
• Bitdefender Console
• iputils
• DVBStreamer

Impact

A context-dependent attacker may be able to gain escalated privileges,
execute arbitrary code, cause Denial of Service, obtain sensitive
information, or otherwise bypass security restrictions.


Workaround

There are no known workarounds at this time.

Resolution

All Insight users should upgrade to the latest version: