[ GLSA 201708-07 ] evilvte

[GLSA]

Gentoo Linux Security Advisory

Title: evilvte: User-assisted execution of arbitrary code (GLSA 201708-07)
Severity: normal
Exploitable: remote
Date: 2017-08-21
Updated: 2017-08-26
Bug(s): #611290
ID: 201708-07

Synopsis

Improper hypertext validation might allow remote attackers to
execute arbitrary code.


Background

VTE based, highly customizable terminal emulator

Affected Packages

Package: x11-terms/evilvte
Vulnerable: <= 0.5.1
Architectures: All supported architectures


Description

Steve Kemp of Debian identified a flaw in evilvte which does not
properly validate hypertext links. Please review the Debian bug report
referenced below.


Impact

Remote attackers could execute arbitrary code by enticing a user to
click a hyperlink in their terminal.


Workaround

There is no known workaround at this time.

Resolution

Gentoo Security recommends that users unmerge evilvte: