Joined: 12 May 2004
|Posted: Tue Jul 10, 2012 6:26 am Post subject: [ GLSA 201207-08 ] Gnash: Multiple vulnerabilities
|Gentoo Linux Security Advisory
Title: Gnash: Multiple vulnerabilities (GLSA 201207-08)
Exploitable: local, remote
Date: July 09, 2012
Bug(s): #391283, #408209
Multiple vulnerabilities have been found in Gnash which could
result in execution of arbitrary code, Denial of Service, or information
Gnash is a GNU flash movie player that supports many SWF features.
Vulnerable: < 0.8.10-r2
Unaffected: >= 0.8.10-r2
Architectures: All supported architectures
Multiple vulnerabilities have been found in Gnash:
- The "nsPluginInstance::setupCookies()" function in plugin.cpp creates
world-readable cookies with predictable file names (CVE-2011-4328).
- The "GnashImage::size()" function in GnashImage.h contains an integer
overflow error which could cause a heap-based buffer overflow
A remote attacker could entice a user to open a specially crafted SWF
file, possibly resulting in execution of arbitrary code or a Denial of
Service condition. Furthermore, a local attacker may be able to obtain
There is no known workaround at this time.
All Gnash users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=www-plugins/gnash-0.8.10-r2"