gedit security update

2005-06-13T15:05:00
ID CESA-2005:499
Type centos
Reporter CentOS Project
Modified 2005-06-13T18:39:19

Description

CentOS Errata and Security Advisory CESA-2005:499

gEdit is a small text editor designed specifically for the GNOME GUI desktop.

A file name format string vulnerability has been discovered in gEdit. It is possible for an attacker to create a file with a carefully crafted name which, when the file is opened, executes arbitrary instructions on a victim's machine. Although it is unlikely that a user would manually open a file with such a carefully crafted file name, a user could, for example, be tricked into opening such a file from within an email client. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-1686 to this issue.

Users of gEdit should upgrade to this updated package, which contains a backported patch to correct this issue.

Merged security bulletin from advisories: http://lists.centos.org/pipermail/centos-announce/2005-June/023857.html http://lists.centos.org/pipermail/centos-announce/2005-June/023858.html http://lists.centos.org/pipermail/centos-announce/2005-June/023867.html http://lists.centos.org/pipermail/centos-announce/2005-June/023868.html http://lists.centos.org/pipermail/centos-announce/2005-June/023875.html http://lists.centos.org/pipermail/centos-announce/2005-June/023881.html http://lists.centos.org/pipermail/centos-announce/2005-June/023886.html

Affected packages: gedit gedit-devel

Upstream details at: https://rhn.redhat.com/errata/RHSA-2005-499.html