[ GLSA 201710-21 ] Kodi

[GLSA]

Gentoo Linux Security Advisory

Title: Kodi: Arbitrary code execution (GLSA 201710-21)
Severity: normal
Exploitable: remote
Date: 2017-10-22
Bug(s): #622384
ID: 201710-21

Synopsis

An integer overflow vulnerability in Kodi could result in remote
execution of arbitrary code.


Background

Kodi is a free and open source media-center and entertainment hub
previously known as XBMC.


Affected Packages

Package: media-tv/kodi
Vulnerable: < 17.3-r1
Unaffected: >= 17.3-r1
Architectures: All supported architectures


Description

Kodi is vulnerable due to shipping with an embedded version of UnRAR.
Please review the referenced CVE identifier for details.


Impact

A remote attacker, by enticing a user to process a specifically crafted
RAR file, could execute arbitrary code.


Workaround

There is no known workaround at this time.

Resolution

All Kodi users should upgrade to the latest version: