GLSA 200507-23: Kopete: Vulnerability in included Gadu library

http://security.gentoo.org/

Severity:	high
Title:	Kopete: Vulnerability in included Gadu library
Date:	07/25/2005
Bugs:	#99754
ID:	200507-23

Synopsis

Kopete is vulnerable to several input validation vulnerabilities which may lead to execution of arbitrary code.

Background

KDE is a feature-rich graphical desktop environment for Linux and Unix-like Operating Systems. Kopete (also part of kdenetwork) is the KDE Instant Messenger.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
kde-base/kdenetwork	< 3.4.1-r1	>= 3.4.1-r1	All supported architectures
kde-base/kopete	< 3.4.1-r1	>= 3.4.1-r1	All supported architectures

Description

Kopete contains an internal copy of libgadu and is therefore subject to several input validation vulnerabilities in libgadu.

Impact

A remote attacker could exploit this vulnerability to execute arbitrary code or crash Kopete.

Workaround

Delete all Gadu Gadu contacts.

Resolution

All Kopete users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose kde-base/kdenetwork

All KDE Split Ebuild Kopete users should upgrade to the latest version:


    # emerge --sync
    # emerge --ask --oneshot --verbose ">=kde-base/kopete-3.4.1-r1"

References

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200507-23.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.