Gnash: Multiple vulnerabilities
Gentoo Linux Security Advisory
||GLSA 201207-08 / Gnash
||July 09, 2012
||July 09, 2012: 1
All supported architectures
Multiple vulnerabilities have been found in Gnash which could
result in execution of arbitrary code, Denial of Service, or information
Gnash is a GNU flash movie player that supports many SWF features.
Multiple vulnerabilities have been found in Gnash:
- The "nsPluginInstance::setupCookies()" function in plugin.cpp creates
world-readable cookies with predictable file names (CVE-2011-4328).
- The "GnashImage::size()" function in GnashImage.h contains an integer
overflow error which could cause a heap-based buffer overflow
A remote attacker could entice a user to open a specially crafted SWF
file, possibly resulting in execution of arbitrary code or a Denial of
Service condition. Furthermore, a local attacker may be able to obtain
There is no known workaround at this time.
All Gnash users should upgrade to the latest version:
Code Listing 3.1: Resolution
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-plugins/gnash-0.8.10-r2"