Ruby-GNOME2: Format string error — GLSA 200712-09

A format string error has been discovered in Ruby-GNOME2, possibly leading to the execution of arbitrary code.

Affected Packages

dev-ruby/ruby-gtk2 on all architectures
Affected versions < 0.16.0-r2
Unaffected versions >= 0.16.0-r2

Background

Ruby-GNOME2 is a set of bindings for using GTK+ within the Ruby programming language.

Description

Chris Rohlf discovered that the "Gtk::MessageDialog.new()" method in the file gtk/src/rbgtkmessagedialog.c does not properly sanitize the "message" parameter before passing it to the gtk_message_dialog_new() function.

Impact

A remote attacker could send a specially crafted string to an application using Ruby-GNOME2, possibly leading to the execution of arbitrary code with the privileges of the user running the application.

Workaround

There is no known workaround at this time.

Resolution

All Ruby-GNOME2 users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=dev-ruby/ruby-gtk2-0.16.0-r2"

References

Release Date
December 09, 2007

Latest Revision
December 09, 2007: 01

Severity
normal

Exploitable
remote

Bugzilla entries