[ GLSA 200611-16 ] Texinfo: Buffer overflow

[GLSA]

Gentoo Linux Security Advisory

Title: Texinfo: Buffer overflow (GLSA 200611-16)
Severity: normal
Exploitable: remote
Date: November 21, 2006
Bug(s): #154316
ID: 200611-16

Synopsis

Texinfo is vulnerable to a buffer overflow that could lead to the execution of arbitrary code.

Background

Texinfo is the official documentation system of the GNU project.

Affected Packages

Package: sys-apps/texinfo
Vulnerable: < 4.8-r5
Unaffected: >= 4.8-r5
Architectures: All supported architectures


Description

Miloslav Trmac from Red Hat discovered a buffer overflow in the "readline()" function of texindex.c. The "readline()" function is called by the texi2dvi and texindex commands.

Impact

By enticing a user to open a specially crafted Texinfo file, an attacker could execute arbitrary code with the rights of the user running Texinfo.

Workaround

There is no known workaround at this time.

Resolution

All Texinfo users should upgrade to the latest version: