TunePimp: Buffer overflow
Gentoo Linux Security Advisory
||GLSA 200607-11 / Tunepimp
||July 28, 2006
||June 01, 2007: 02
All supported architectures
A vulnerability in TunePimp has been reported which could lead to the
execution of arbitrary code.
The TunePimp library (also referred to as libtunepimp) is a development
library geared towards developers who wish to create MusicBrainz
enabled tagging applications.
Kevin Kofler has reported a vulnerability where three stack variables
are allocated with 255, 255 and 100 bytes respectively, yet 256 bytes
are read into each. This could lead to buffer overflows.
Running an affected version of TunePimp could lead to the execution of
arbitrary code by a remote attacker.
There is no known workaround at this time.
All tunepimp users should upgrade to the latest version:
Code Listing 3.1: Resolution
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/tunepimp-0.5."