Joined: 12 May 2004
|Posted: Fri Oct 20, 2006 10:26 am Post subject: [ GLSA 200610-08 ] Cscope: Multiple buffer overflows
|Gentoo Linux Security Advisory
Title: Cscope: Multiple buffer overflows (GLSA 200610-08)
Date: October 20, 2006
Cscope is vulnerable to multiple buffer overflows that could lead to the execution of arbitrary code.
Cscope is a developer's tool for browsing source code.
Vulnerable: < 15.5.20060927
Unaffected: >= 15.5.20060927
Architectures: All supported architectures
Unchecked use of strcpy() and *scanf() leads to several buffer overflows.
A user could be enticed to open a carefully crafted file which would allow the attacker to execute arbitrary code with the permissions of the user running Cscope.
There is no known workaround at this time.
All Cscope users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-util/cscope-15.5.20060927"