ELinks: User-assisted execution of arbitrary code — GLSA 200706-03

A vulnerability has been discovered in ELinks allowing for the user-assisted execution of arbitrary code.

Affected packages

Background

ELinks is a text-mode web browser.

Description

Arnaud Giersch discovered that the "add_filename_to_string()" function in file intl/gettext/loadmsgcat.c uses an untrusted relative path, allowing for a format string attack with a malicious .po file.

Impact

A local attacker could entice a user to run ELinks in a specially crafted directory environment containing a malicious ".po" file, possibly resulting in the execution of arbitrary code with the privileges of the user running ELinks.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=www-client/elinks-0.11.2-r1"

References

• CVE-2007-2027

Release date
June 06, 2007

Latest revision
June 06, 2007: 01

Severity
normal

Exploitable
local

Bugzilla entries

• 177512