GNU GLOBAL: Arbitrary code execution

Background

GNU GLOBAL is a source code tagging system that works the same way across diverse environments, such as Emacs editor, Vi editor, Less viewer, Bash shell, various web browsers, etc.

Description

A vulnerability was found in an undocumented function of gozilla.

Impact

A remote attacker could entice a user to open a specially crafted URL using GNU GLOBAL, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All GNU GLOBAL users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=dev-util/global-6.6.4"