STLport: Possible remote execution of arbitrary code

1. Gentoo Linux Security Advisory

Advisory Reference	GLSA 200703-07 / STLport
Release Date	March 06, 2007
Latest Revision	March 06, 2007: 01
Impact	normal
Exploitable	remote

Package	Vulnerable versions	Unaffected versions	Architecture(s)
dev-libs/STLport	< 5.0.3	>= 5.0.3	All supported architectures

Related bugreports: #165837

Synopsis

Two buffer overflows have been discovered in STLport possibly leading to the remote execution of arbitrary code.

2. Impact Information

Background

STLport is a multi-platform C++ Standard Library implementation.

Description

Two buffer overflows have been discovered, one in "print floats" and one in the rope constructor.

Impact

Both of the buffer overflows could result in the remote execution of arbitrary code. Please note that the exploitability of the vulnerabilities depends on how the library is used by other software programs.

3. Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All STLport users should upgrade to the latest version.

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-libs/STLport-5.0.3"

4. References

CVE-2007-0803

Updated March 06, 2007

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.