GNU GLOBAL: Arbitrary code execution — GLSA 202008-02

A vulnerability in GNU GLOBAL was discovered, possibly allowing remote attackers to execute arbitrary code.

Affected packages

Background

GNU GLOBAL is a source code tagging system that works the same way across diverse environments, such as Emacs editor, Vi editor, Less viewer, Bash shell, various web browsers, etc.

Description

A vulnerability was found in an undocumented function of gozilla.

Impact

A remote attacker could entice a user to open a specially crafted URL using GNU GLOBAL, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=dev-util/global-6.6.4"
 

References

• CVE-2017-17531

Release date
August 08, 2020

Latest revision
August 08, 2020: 1

Severity
normal

Exploitable
remote

Bugzilla entries

• 646348