1. Gentoo Linux Security Advisory
| Advisory Reference | GLSA 200712-09 / ruby-gtk2 |
| Release Date | December 09, 2007 |
| Latest Revision | December 09, 2007: 01 |
| Impact | normal |
| Exploitable | remote |
| Package | Vulnerable versions | Unaffected versions | Architecture(s) |
| dev-ruby/ruby-gtk2 | < 0.16.0-r2 | >= 0.16.0-r2 | All supported architectures |
Related bugreports: #200623
A format string error has been discovered in Ruby-GNOME2, possibly leading to the execution of arbitrary code.
Ruby-GNOME2 is a set of bindings for using GTK+ within the Ruby programming language.
Chris Rohlf discovered that the "Gtk::MessageDialog.new()" method in the file gtk/src/rbgtkmessagedialog.c does not properly sanitize the "message" parameter before passing it to the gtk_message_dialog_new() function.
A remote attacker could send a specially crafted string to an application using Ruby-GNOME2, possibly leading to the execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All Ruby-GNOME2 users should upgrade to the latest version:
Code Listing 3.1: Resolution |
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/ruby-gtk2-0.16.0-r2" |