Dia: Format string vulnerabilities — GLSA 200606-03

Format string vulnerabilities in Dia may lead to the execution of arbitrary code.

Affected packages

Background

Dia is a GTK+ based diagram creation program.

Description

KaDaL-X discovered a format string error within the handling of filenames. Hans de Goede also discovered several other format string errors in the processing of dia files.

Impact

By enticing a user to open a specially crafted file, a remote attacker could exploit these vulnerabilities to execute arbitrary code with the rights of the user running the application.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-office/dia-0.95.1"

References

• CVE-2006-2453
• CVE-2006-2480

Release date
June 07, 2006

Latest revision
June 07, 2006: 01

Severity
normal

Exploitable
remote

Bugzilla entries

• 133699